From 84249dcd17b9f38e90c9d7762f7a241f85c2fdd0 Mon Sep 17 00:00:00 2001
From: Bertrand Martin <bertrand@sentrysoftware.com>
Date: Wed, 22 Jul 2026 13:20:01 +0200
Subject: [PATCH 1/2] Add shaded artifact with relocated dependencies

Attach a second artifact (classifier "shaded") in which every dependency
is relocated under org.metricshub.winrm.shaded.* so that embedding
winrm-java cannot clash with, or leak ServiceLoader/JAXP registrations
into, the host application's classpath:

- All CXF/HttpClient/JAXB/SAAJ/smbj/etc. packages relocated; the
  ServicesResourceTransformer renames and rewrites META-INF/services
  entries to the relocated names.
- CXF discovers its features from META-INF/cxf/bus-extensions.txt whose
  class names are plain text (not rewritten by relocation), so the jar
  ships a pre-relocated merged copy of all cxf-* entries
  (src/main/shade/bus-extensions.txt) and the originals are filtered out.
- javax.xml.stream.* service files are dropped: the shaded jar must not
  claim the JVM-wide default StAX implementation in host applications
  (CXF falls back to the JDK StAX implementation).
- org.slf4j:slf4j-api stays external so the host controls logging;
  jcl-over-slf4j is embedded (relocated) to back the shaded HttpClient's
  commons-logging. org.bouncycastle stays external: it is a signed JCE
  provider and must not be repackaged.

Verified by running WinRMService.createInstance + executeWql with ONLY
the shaded jar, slf4j and bcprov on the classpath: the full stack (WSDL
parse, JAX-WS catalog, JAXB, SAAJ, NTLM encryption interceptors, async
HTTP conduit) works up to the network layer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 README.md                         |  39 ++++++
 pom.xml                           | 194 ++++++++++++++++++++++++++++++
 src/main/shade/bus-extensions.txt |  52 ++++++++
 3 files changed, 285 insertions(+)
 create mode 100644 src/main/shade/bus-extensions.txt

diff --git a/README.md b/README.md
index dbbdb42..fda92eb 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,45 @@ This is a simple Maven project. Build with:
 mvn verify
 ```
 
+## Shaded artifact
+
+Besides the regular thin JAR, the build attaches a **shaded** artifact (classifier `shaded`) in which all
+dependencies (Apache CXF, HttpClient, JAXB, SAAJ, smbj, etc.) are relocated under
+`org.metricshub.winrm.shaded.*` and their `META-INF/services` registrations are renamed accordingly.
+Use it to embed winrm-java in applications where its dependency tree could otherwise clash with — or leak
+`ServiceLoader`/JAXP registrations into — the host classpath (e.g., the shaded JAR deliberately does *not*
+register Woodstox as the JVM-wide StAX implementation).
+
+Only two dependencies are intentionally left unshaded and must be provided by the consumer:
+`org.slf4j:slf4j-api` (so the host controls logging) and `org.bouncycastle:bcprov-jdk18on`
+(a signed JCE provider that must not be repackaged).
+
+```xml
+<dependency>
+	<groupId>org.metricshub</groupId>
+	<artifactId>winrm-java</artifactId>
+	<version>${winrm-java.version}</version>
+	<classifier>shaded</classifier>
+	<exclusions>
+		<!-- The shaded JAR embeds everything except slf4j-api and BouncyCastle -->
+		<exclusion>
+			<groupId>*</groupId>
+			<artifactId>*</artifactId>
+		</exclusion>
+	</exclusions>
+</dependency>
+<dependency>
+	<groupId>org.slf4j</groupId>
+	<artifactId>slf4j-api</artifactId>
+	<version>2.0.17</version>
+</dependency>
+<dependency>
+	<groupId>org.bouncycastle</groupId>
+	<artifactId>bcprov-jdk18on</artifactId>
+	<version>1.79</version>
+</dependency>
+```
+
 ## Release instructions
 
 The artifact is deployed to Sonatype's [Maven Central](https://central.sonatype.com/).
diff --git a/pom.xml b/pom.xml
index 36510ec..06f3179 100644
--- a/pom.xml
+++ b/pom.xml
@@ -204,6 +204,200 @@
 				</executions>
 			</plugin>
 
+			<!-- Shaded artifact (classifier "shaded"): all dependencies relocated under
+			     org.metricshub.winrm.shaded.* so embedding winrm-java cannot clash with, or leak
+			     ServiceLoader/JAXP registrations into, the host application's classpath.
+			     Exceptions kept as regular external dependencies:
+			     - org.slf4j (logging binding belongs to the host)
+			     - org.bouncycastle (signed JCE provider; relocation would break it) -->
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-shade-plugin</artifactId>
+				<version>3.6.0</version>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>shade</goal>
+						</goals>
+						<configuration>
+							<shadedArtifactAttached>true</shadedArtifactAttached>
+							<shadedClassifierName>shaded</shadedClassifierName>
+							<createDependencyReducedPom>false</createDependencyReducedPom>
+							<artifactSet>
+								<excludes>
+									<!-- jcl-over-slf4j (same groupId) stays IN: it backs the relocated
+									     org.apache.commons.logging used by the shaded Apache HttpClient -->
+									<exclude>org.slf4j:slf4j-api</exclude>
+									<exclude>org.bouncycastle:*</exclude>
+									<exclude>org.jspecify:*</exclude>
+									<exclude>org.apiguardian:*</exclude>
+								</excludes>
+							</artifactSet>
+							<relocations>
+								<relocation>
+									<pattern>org.apache.cxf</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.apache.cxf</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.apache.neethi</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.apache.neethi</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.apache.ws.commons.schema</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.apache.ws.commons.schema</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.apache.commons.logging</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.apache.commons.logging</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.apache.commons.codec</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.apache.commons.codec</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.apache.http</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.apache.http</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.apache.xml.resolver</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.apache.xml.resolver</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>javax.wsdl</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.javax.wsdl</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>com.ibm.wsdl</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.com.ibm.wsdl</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>com.ctc.wstx</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.com.ctc.wstx</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.codehaus.stax2</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.codehaus.stax2</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>com.sun.xml</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.com.sun.xml</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>com.sun.istack</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.com.sun.istack</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>com.oracle.webservices</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.com.oracle.webservices</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.glassfish</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.glassfish</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.jvnet</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.jvnet</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>jakarta.activation</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.jakarta.activation</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>jakarta.annotation</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.jakarta.annotation</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>jakarta.mail</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.jakarta.mail</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>jakarta.jws</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.jakarta.jws</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>jakarta.xml.bind</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.jakarta.xml.bind</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>jakarta.xml.soap</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.jakarta.xml.soap</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>jakarta.xml.ws</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.jakarta.xml.ws</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.eclipse.angus</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.eclipse.angus</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>com.hierynomus</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.com.hierynomus</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>net.engio</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.net.engio</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.objectweb.asm</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.objectweb.asm</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>com.oracle.xmlns.webservices</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.com.oracle.xmlns.webservices</shadedPattern>
+								</relocation>
+								<relocation>
+									<pattern>org.xmlsoap.schemas</pattern>
+									<shadedPattern>org.metricshub.winrm.shaded.org.xmlsoap.schemas</shadedPattern>
+								</relocation>
+							</relocations>
+							<filters>
+								<filter>
+									<artifact>*:*</artifact>
+									<excludes>
+										<exclude>module-info.class</exclude>
+										<exclude>META-INF/versions/*/module-info.class</exclude>
+										<exclude>META-INF/*.SF</exclude>
+										<exclude>META-INF/*.DSA</exclude>
+										<exclude>META-INF/*.RSA</exclude>
+										<exclude>META-INF/DEPENDENCIES</exclude>
+										<!-- Do not claim the JVM-wide default StAX implementation in host applications -->
+										<exclude>META-INF/services/javax.xml.stream.*</exclude>
+										<!-- Do not register into host servlet containers (jaxws-rt leftover) -->
+										<exclude>META-INF/services/jakarta.servlet.*</exclude>
+										<!-- Spring/Blueprint integration is not used -->
+										<exclude>META-INF/spring.*</exclude>
+										<exclude>OSGI-INF/**</exclude>
+										<!-- Replaced by the pre-relocated merged copy (IncludeResourceTransformer below) -->
+										<exclude>META-INF/cxf/bus-extensions.txt</exclude>
+									</excludes>
+								</filter>
+							</filters>
+							<transformers>
+								<!-- Renames and rewrites META-INF/services files to the relocated names -->
+								<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
+								<!-- CXF discovers its features from this file; class names inside are plain
+								     text so relocation does not rewrite them. This is the merged content of
+								     all cxf-* jars with the relocation applied (see src/main/shade). -->
+								<transformer implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
+									<resource>META-INF/cxf/bus-extensions.txt</resource>
+									<file>src/main/shade/bus-extensions.txt</file>
+								</transformer>
+								<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+									<manifestEntries>
+										<Multi-Release>true</Multi-Release>
+									</manifestEntries>
+								</transformer>
+								<transformer implementation="org.apache.maven.plugins.shade.resource.ApacheNoticeResourceTransformer">
+									<addHeader>false</addHeader>
+								</transformer>
+							</transformers>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+
 		</plugins>
 	</build>
 
diff --git a/src/main/shade/bus-extensions.txt b/src/main/shade/bus-extensions.txt
new file mode 100644
index 0000000..2dbf461
--- /dev/null
+++ b/src/main/shade/bus-extensions.txt
@@ -0,0 +1,52 @@
+org.metricshub.winrm.shaded.org.apache.cxf.bus.managers.PhaseManagerImpl:org.metricshub.winrm.shaded.org.apache.cxf.phase.PhaseManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.bus.managers.WorkQueueManagerImpl:org.metricshub.winrm.shaded.org.apache.cxf.workqueue.WorkQueueManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.bus.managers.CXFBusLifeCycleManager:org.metricshub.winrm.shaded.org.apache.cxf.buslifecycle.BusLifeCycleManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.bus.managers.ServerRegistryImpl:org.metricshub.winrm.shaded.org.apache.cxf.endpoint.ServerRegistry:true
+org.metricshub.winrm.shaded.org.apache.cxf.bus.managers.EndpointResolverRegistryImpl:org.metricshub.winrm.shaded.org.apache.cxf.endpoint.EndpointResolverRegistry:true
+org.metricshub.winrm.shaded.org.apache.cxf.bus.managers.HeaderManagerImpl:org.metricshub.winrm.shaded.org.apache.cxf.headers.HeaderManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.service.factory.FactoryBeanListenerManager::true
+org.metricshub.winrm.shaded.org.apache.cxf.bus.managers.ServerLifeCycleManagerImpl:org.metricshub.winrm.shaded.org.apache.cxf.endpoint.ServerLifeCycleManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.bus.managers.ClientLifeCycleManagerImpl:org.metricshub.winrm.shaded.org.apache.cxf.endpoint.ClientLifeCycleManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.bus.resource.ResourceManagerImpl:org.metricshub.winrm.shaded.org.apache.cxf.resource.ResourceManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.catalog.OASISCatalogManager:org.metricshub.winrm.shaded.org.apache.cxf.catalog.OASISCatalogManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.common.util.ASMHelperImpl:org.metricshub.winrm.shaded.org.apache.cxf.common.util.ASMHelper:true
+org.metricshub.winrm.shaded.org.apache.cxf.common.spi.ClassLoaderProxyService:org.metricshub.winrm.shaded.org.apache.cxf.common.spi.ClassLoaderService:true
+org.metricshub.winrm.shaded.org.apache.cxf.io.DelayedCachedOutputStreamCleaner:org.metricshub.winrm.shaded.org.apache.cxf.io.CachedOutputStreamCleaner:true
+org.metricshub.winrm.shaded.org.apache.cxf.binding.soap.SoapBindingFactory::true
+org.metricshub.winrm.shaded.org.apache.cxf.binding.soap.SoapTransportFactory::true
+org.metricshub.winrm.shaded.org.apache.cxf.binding.xml.XMLBindingFactory::true
+org.metricshub.winrm.shaded.org.apache.cxf.binding.xml.wsdl11.XMLWSDLExtensionLoader::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.jaxb.WrapperHelperProxyService:org.metricshub.winrm.shaded.org.apache.cxf.jaxb.WrapperHelperCreator:true
+org.metricshub.winrm.shaded.org.apache.cxf.jaxb.FactoryClassProxyService:org.metricshub.winrm.shaded.org.apache.cxf.jaxb.FactoryClassCreator:true
+org.metricshub.winrm.shaded.org.apache.cxf.jaxws.context.WebServiceContextResourceResolver::true
+org.metricshub.winrm.shaded.org.apache.cxf.jaxws.spi.WrapperClassCreatorProxyService:org.metricshub.winrm.shaded.org.apache.cxf.jaxws.spi.WrapperClassCreator:true
+org.metricshub.winrm.shaded.org.apache.cxf.jaxws.spi.WrapperClassNamingConvention$DefaultWrapperClassNamingConvention:org.metricshub.winrm.shaded.org.apache.cxf.jaxws.spi.WrapperClassNamingConvention:true
+org.metricshub.winrm.shaded.org.apache.cxf.endpoint.dynamic.ExceptionClassCreatorProxyService:org.metricshub.winrm.shaded.org.apache.cxf.endpoint.dynamic.ExceptionClassCreator:true
+org.metricshub.winrm.shaded.org.apache.cxf.transport.http.HTTPTransportFactory::true
+org.metricshub.winrm.shaded.org.apache.cxf.transport.http.HTTPWSDLExtensionLoader::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.transport.http.policy.HTTPClientAssertionBuilder::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.transport.http.policy.HTTPServerAssertionBuilder::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.transport.http.policy.NoOpPolicyInterceptorProvider::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.transport.http.asyncclient.AsyncHTTPConduitFactory:org.metricshub.winrm.shaded.org.apache.cxf.transport.http.HTTPConduitFactory:true:true
+org.metricshub.winrm.shaded.org.apache.cxf.transport.http.asyncclient.AsyncHttpTransportFactory:org.metricshub.winrm.shaded.org.apache.cxf.transport.ConduitInitiator:true:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.addressing.policy.AddressingAssertionBuilder::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.addressing.policy.UsingAddressingAssertionBuilder::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.addressing.policy.AddressingPolicyInterceptorProvider::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.addressing.impl.AddressingWSDLExtensionLoader::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.addressing.impl.AddressingFeatureApplier:org.metricshub.winrm.shaded.org.apache.cxf.ws.addressing.WSAddressingFeature$WSAddressingFeatureApplier:true:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.addressing.impl.MAPAggregatorImplLoader:org.metricshub.winrm.shaded.org.apache.cxf.ws.addressing.MAPAggregator$MAPAggregatorLoader:true:true
+org.metricshub.winrm.shaded.org.apache.cxf.wsdl11.WSDLManagerImpl:org.metricshub.winrm.shaded.org.apache.cxf.wsdl.WSDLManager:true
+org.metricshub.winrm.shaded.org.apache.cxf.wsdl.ExtensionClassCreatorProxyService:org.metricshub.winrm.shaded.org.apache.cxf.wsdl.ExtensionClassCreator:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.PolicyEngineImpl:org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.PolicyEngine:false
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.PolicyDataEngineImpl:org.metricshub.winrm.shaded.org.apache.cxf.policy.PolicyDataEngine:false
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.AssertionBuilderRegistryImpl:org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.AssertionBuilderRegistry:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.PolicyInterceptorProviderRegistryImpl:org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.PolicyInterceptorProviderRegistry:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.PolicyBuilderImpl:org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.PolicyBuilder:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.PolicyAnnotationListener::true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.attachment.ServiceModelPolicyProvider::true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.attachment.external.DomainExpressionBuilderRegistry::true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.attachment.external.EndpointReferenceDomainExpressionBuilder::true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.attachment.external.URIDomainExpressionBuilder::true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.attachment.wsdl11.Wsdl11AttachmentPolicyProvider::true:true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.mtom.MTOMAssertionBuilder::true
+org.metricshub.winrm.shaded.org.apache.cxf.ws.policy.mtom.MTOMPolicyInterceptorProvider::true

From 3061409c67bc1e198729e606803c1ce11dc1f461 Mon Sep 17 00:00:00 2001
From: Bertrand Martin <bertrand@sentrysoftware.com>
Date: Wed, 22 Jul 2026 13:35:07 +0200
Subject: [PATCH 2/2] Trim shaded artifact from 14.5 MB to 10.6 MB

Exclude artifacts that are never used at runtime:
- com.sun.xml.ws (Metro/jaxws-rt) and its satellites (gmbal, ha-api,
  management-api, streambuffer, FastInfoset) plus the duplicate
  com.sun.xml.bind JAXB flavor: CXF is the JAX-WS implementation here
  and winrm-java only uses the jakarta.xml.ws API. saaj-impl and its
  actual dependencies (stax-ex, mimepull, angus-activation) are kept.
- jakarta.mail / angus-mail: only used for MTOM/attachments, which
  WinRM never uses.

Woodstox stays in (relocated): CXF requires it for secure StAX parsing
(refuses to start without it unless org.apache.cxf.stax.allowInsecureParser
is set) and instantiates it by class name, so dropping its
javax.xml.stream service files hides it from the host JVM without
breaking CXF.

Verified with the same isolated smoke test: full stack functional down
to the network layer; no unrelocated classes or unshaded service
registrations remain in the jar.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 pom.xml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pom.xml b/pom.xml
index 06f3179..a586727 100644
--- a/pom.xml
+++ b/pom.xml
@@ -232,6 +232,24 @@
 									<exclude>org.bouncycastle:*</exclude>
 									<exclude>org.jspecify:*</exclude>
 									<exclude>org.apiguardian:*</exclude>
+									<!-- Metro (jaxws-rt) is a second, unused JAX-WS runtime: CXF is the
+									     implementation here and winrm-java only uses the jakarta.xml.ws API.
+									     Dropping it and its satellites saves ~6.5 MB. saaj-impl and its real
+									     dependencies (stax-ex, mimepull, angus-activation) are kept. -->
+									<exclude>com.sun.xml.ws:*</exclude>
+									<exclude>com.sun.xml.bind:*</exclude>
+									<exclude>com.sun.xml.fastinfoset:*</exclude>
+									<exclude>com.sun.xml.stream.buffer:*</exclude>
+									<exclude>org.glassfish.gmbal:*</exclude>
+									<exclude>org.glassfish.ha:*</exclude>
+									<exclude>org.glassfish.external:*</exclude>
+									<!-- Woodstox stays IN (relocated): CXF requires it for secure StAX parsing
+									     and instantiates it by class name, so dropping its javax.xml.stream
+									     service files (see filters) hides it from the host JVM without
+									     breaking CXF. -->
+									<!-- jakarta.mail is only used for MTOM/attachments, which WinRM never uses -->
+									<exclude>jakarta.mail:*</exclude>
+									<exclude>org.eclipse.angus:angus-mail</exclude>
 								</excludes>
 							</artifactSet>
 							<relocations>