apache / apache/maven-jar-plugin

maven-jar-plugin can create invalid Multi-Release jars

Open
#484 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
92
Forks
84
Avg merge
19h 45m
Merged PRs (30d)
6

Description

### Affected version

3.4.2

### Bug description

When maven-jar-plugin is used to create a Multi-Release jar, it doesn't check that the jars are valid.

The `jar` tool will validate that the APIs of all versioned classes are the same, and report an error like the following if they are not

```
entry: META-INF/versions/.../Foo.class, contains a class with different api from earlier version
invalid multi-release jar file ... deleted
```

Since JDK 17 ([JDK-8266835](https://bugs.openjdk.org/browse/JDK-8266835)), the `jar` tool supports a `--validate` flag that can be used to validate archives created by other tools. So one option would be to re-use that, or have a recommended way to run `jar --validate` on the outputs of maven-jar-plugin.

Here are two examples where this came up with jars created by maven-jar-plugin

* https://github.com/unitsofmeasurement/indriya/issues/348
* https://github.com/raphw/asm-jdk-bridge/issues/11

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the invalid Multi-Release jar with maven-jar-plugin 3.4.2, then run the JDK 17+ `jar --validate` command against the output. Inspect how the plugin creates Multi-Release jars and determine whether validation belongs in the plugin or should be documented as a recommended step; done means invalid versioned APIs are detected or the supported validation workflow is clearly established.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.