title: Maven dependency exclusions in pom.xml are not excluded by assembly
body: <p>So I have a project in which I've excluded all of the transitive dependencies from one of my dependencies (oracle jdbc stubbornly pulls in all of the jars someone <em>might</em> need, which causes issues for me by replacing my xml parser).</p>
  
  <p>My project's assembly uses a dependencySet to pull in the jars that I need, but this doesn't respect these exclusions at all: the jars that should be excluded are showing up in the final package.</p>
  
  <p>I know that I can explicitly exclude these dependencies in the assembly descriptor itself but its undesirable to have to maintain exclusions in two places and this grows unwieldy if you have lots of exclusions in the pom.xml</p>
  
  <p>Minimal reproducing example:</p>
  
  <h2>all files</h2>
  
  <pre><code>$ find
  .
  ./src
  ./src/assembly
  ./src/assembly/tar.gz.xml
  ./pom.xml
  </code></pre>
  
  <h2>pom.xml</h2>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"&gt;
    &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
    &lt;groupId&gt;bug.maven&lt;/groupId&gt;
    &lt;artifactId&gt;maven-bug&lt;/artifactId&gt;
    &lt;version&gt;1-SNAPSHOT&lt;/version&gt;
    &lt;packaging&gt;jar&lt;/packaging&gt;
    &lt;build&gt;
      &lt;plugins&gt;
        &lt;plugin&gt;
          &lt;groupId&gt;org.apache.maven.plugins&lt;/groupId&gt;
          &lt;artifactId&gt;maven-assembly-plugin&lt;/artifactId&gt;
          &lt;version&gt;2.6&lt;/version&gt;
          &lt;configuration&gt;
            &lt;descriptors&gt;
              &lt;descriptor&gt;src/assembly/tar.gz.xml&lt;/descriptor&gt;
            &lt;/descriptors&gt;
            &lt;finalName&gt;maven-bug-${project.version}&lt;/finalName&gt;
          &lt;/configuration&gt;
          &lt;executions&gt;
            &lt;execution&gt;
              &lt;phase&gt;package&lt;/phase&gt;
              &lt;goals&gt;
                &lt;goal&gt;attached&lt;/goal&gt;
              &lt;/goals&gt;
            &lt;/execution&gt;
          &lt;/executions&gt;
        &lt;/plugin&gt;
      &lt;/plugins&gt;
    &lt;/build&gt;
    &lt;dependencies&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;commons-validator&lt;/groupId&gt;
        &lt;artifactId&gt;commons-validator&lt;/artifactId&gt;
        &lt;version&gt;1.4.1&lt;/version&gt;
        &lt;exclusions&gt;
          &lt;exclusion&gt;
            &lt;groupId&gt;*&lt;/groupId&gt;
            &lt;artifactId&gt;*&lt;/artifactId&gt;
          &lt;/exclusion&gt;
        &lt;/exclusions&gt;
      &lt;/dependency&gt;
    &lt;/dependencies&gt;
  &lt;/project&gt;
  </code></pre>
  
  <h2>src/assembly/tar.gz.xml</h2>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;assembly&gt;
    &lt;id&gt;pkg&lt;/id&gt;
    &lt;formats&gt;
      &lt;format&gt;tar.gz&lt;/format&gt;
    &lt;/formats&gt;
    &lt;includeBaseDirectory&gt;false&lt;/includeBaseDirectory&gt;
    &lt;dependencySets&gt;
      &lt;dependencySet&gt;
        &lt;outputDirectory&gt;/lib&lt;/outputDirectory&gt;
        &lt;useProjectArtifact&gt;false&lt;/useProjectArtifact&gt;
      &lt;/dependencySet&gt;
    &lt;/dependencySets&gt;
  &lt;/assembly&gt;
  </code></pre>
  
  <h2>To reproduce</h2>
  
  <pre><code>$ mvn clean package
  $ tar tzf target/maven-bug-1-SNAPSHOT-pkg.tar.gz
  lib/commons-validator-1.4.1.jar
  lib/commons-beanutils-1.8.3.jar
  lib/commons-logging-1.2.jar
  lib/commons-digester-1.8.1.jar
  lib/commons-collections-3.2.1.jar
  </code></pre>
  
  <h3>Expected Results</h3>
  
  <pre><code>$ mvn clean package
  $ tar tzf target/maven-bug-1-SNAPSHOT-pkg.tar.gz
  lib/commons-validator-1.4.1.jar
  </code></pre>
  
  <p>From what I can tell this is just a bug without documentation in maven. Does anyone have an idea that I'm missing or solution?</p>