[PR] FELIX-6857 maven-bundle-plugin: do not embed type=pom dependencies [felix-dev]

["paulrutter (via GitHub)" <gi...@apache.org>]

paulrutter opened a new pull request, #549:
URL: https://github.com/apache/felix-dev/pull/549

   https://issues.apache.org/jira/browse/FELIX-6857
   
   ## Problem
   
   When a bundle uses `Embed-Dependency` and one of the selected dependencies is a
   `type=pom` artifact (a BOM/aggregator declared as a compile dependency),
   `DependencyEmbedder` adds that artifact's `.pom` file to the bundle classpath
   (`Bundle-ClassPath` / `-includeresource`). bnd's CDI-annotations analyzer then tries
   to open the `.pom` as a JAR/ZIP and fails:
   
   - **maven-bundle-plugin 6.0.2** (embeds bnd 7.0.0): emits `[WARNING] Invalid bundle
     classpath entry` and **builds successfully**.
   - **maven-bundle-plugin 6.1.0** (embeds bnd 7.3.0): the same condition is now a fatal
     `[ERROR] Error(s) found in bundle configuration` and **fails the build**.
   
   So upgrading the plugin breaks any bundle that embeds a pom-type dependency.
   
   ```
   [ERROR] Bundle ... : Analyzer Plugin CDIAnnotations failed The JAR/ZIP file
   (.../org/junit/junit-bom/5.11.3/junit-bom-5.11.3.pom) seems corrupted,
   error: zip END header not found -> zip END header not found for AnalyzerPlugin
   [ERROR] Error(s) found in bundle configuration
   ```
   
   
   The `.pom` is valid XML, not corrupt — bnd is simply being handed a pom to open as an
   archive.
   
   ## Root cause
   
   `DependencyEmbedder` embeds any selected artifact whose file exists, without checking
   its type, so a `type=pom` dependency's `.pom` file ends up on the classpath. A pom
   contains no classes and must never be on the bundle classpath.
   
   The underlying hard-fail is a bnd 7.0.0 → 7.3.0 behaviour change in
   `aQute.bnd.cdi.CDIAnnotations#analyzeJar` (a warning promoted to a fatal error), but the
   plugin should never have placed the `.pom` there in the first place.
   
   ## Fix
   
   Skip `type=pom` artifacts in `DependencyEmbedder`, covering both the embed and inline
   paths, logging a warning so it is not silent. The non-embed classpath path in
   `BundlePlugin.getClasspath()` already excludes poms via
   `ArtifactHandler.isAddedToClasspath()`, so only the embed path needed the guard.
   
   ## Reproducer
   
   ```xml
   <packaging>bundle</packaging>
   <dependencies>
     <dependency>
       <groupId>org.junit</groupId>
       <artifactId>junit-bom</artifactId>
       <version>5.11.3</version>
       <type>pom</type>
     </dependency>
   </dependencies>
   ```
   `<Embed-Dependency>*;scope=compile</Embed-Dependency>`
   
   mvn clean package fails on 6.1.0, succeeds on 6.0.2 (and with this fix).
   
   ## Testing
   
   Added BundlePluginTest#testEmbedDependencyExcludesPomArtifacts, asserting a pom
   dependency is excluded from Bundle-ClassPath and Embedded-Artifacts while a
   regular jar is still embedded. Fails without the fix, passes with it.
   Added an embed-pom-dependency integration test (a type=pom dependency alongside a
   jar dependency). The build fails without the fix (the CDIAnnotations error above) and
   passes with it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@felix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] FELIX-6857 maven-bundle-plugin: do not embed type=pom dependencies [felix-dev]

["paulrutter (via GitHub)" <gi...@apache.org>]

paulrutter merged PR #549:
URL: https://github.com/apache/felix-dev/pull/549


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@felix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org