bazel-contrib / bazel-contrib/rules_jvm_external
manifest stamping prefixes all jars with "processed_"
- Dominant language
- Java
- Stars
- 373
- Forks
- 301
- Avg merge
- 6d 3h
- Merged PRs (30d)
- 5
Description
#771 enabled manifest stamping by default. This results in mutating third-party jars (which breaks SBOM verification) as well as inserting a "processed_" prefix in all file names. My deployments began failing because other non-Bazel projects cannot locate jars by name such as "commons-foo-1.2.3.jar" at runtime.
In the meantime, I can move forward by adding a `--@rules_jvm_external//settings:stamp_manifest=false` on the cmdline. However, as it involves mutating and renaming third-party artifacts, IMO manifest stamping should never be the default.
Contributor guide
Research direction
Start by locating the default for stamp_manifest in rules_jvm_external and trace how manifest stamping affects third-party JAR names. Check existing tests around stamping or artifact export if present. Done means stamping is not enabled by default, third-party JAR filenames remain unchanged, and the explicit false setting still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100