apache / apache/maven-jar-plugin
maven-jar-plugin can create invalid Multi-Release jars
- Dominant language
- Java
- Stars
- 92
- Forks
- 84
- Avg merge
- 19h 45m
- Merged PRs (30d)
- 6
Description
### Affected version
3.4.2
### Bug description
When maven-jar-plugin is used to create a Multi-Release jar, it doesn't check that the jars are valid.
The `jar` tool will validate that the APIs of all versioned classes are the same, and report an error like the following if they are not
```
entry: META-INF/versions/.../Foo.class, contains a class with different api from earlier version
invalid multi-release jar file ... deleted
```
Since JDK 17 ([JDK-8266835](https://bugs.openjdk.org/browse/JDK-8266835)), the `jar` tool supports a `--validate` flag that can be used to validate archives created by other tools. So one option would be to re-use that, or have a recommended way to run `jar --validate` on the outputs of maven-jar-plugin.
Here are two examples where this came up with jars created by maven-jar-plugin
* https://github.com/unitsofmeasurement/indriya/issues/348
* https://github.com/raphw/asm-jdk-bridge/issues/11
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the invalid Multi-Release jar with maven-jar-plugin 3.4.2, then run the JDK 17+ `jar --validate` command against the output. Inspect how the plugin creates Multi-Release jars and determine whether validation belongs in the plugin or should be documented as a recommended step; done means invalid versioned APIs are detected or the supported validation workflow is clearly established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100