This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-release-plugin.git
The following commit(s) were added to refs/heads/master by this push:
new 1044916 Include the main project artifact and POM in release checksums
1044916 is described below
commit 10449165df30415458850f4cbd8deb9c91309b5f
Author: Gary Gregory <[email protected]>
AuthorDate: Sun Nov 8 11:19:26 2026 -0500
Include the main project artifact and POM in release checksums
Hash the main artifact and project POM when generating
sha512.properties,
using artifactId-version.pom for the POM entry. This includes both in
the checksum list consumed by vote-txt.
Correct the test stub to keep the main JAR and POM separate from
attached
artifacts, and verify their hashes and inclusion in VOTE.txt.
Assisted-By: OpenAI Codex
---
src/changes/changes.xml | 1 +
.../mojos/CommonsDistributionDetachmentMojo.java | 39 ++++++++++++----------
.../CommonsDistributionDetachmentMojoTest.java | 4 ++-
.../stubs/DistributionDetachmentProjectStub.java | 30 +++++++----------
4 files changed, 38 insertions(+), 36 deletions(-)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 316bfe9..592ba12 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -27,6 +27,7 @@
<release version="1.9.3" date="YYYY-MM-DD" description="This is a feature
and maintenance release. Java 8 or later is required.">
<!-- FIX -->
<action type="fix" dev="ggregory" due-to="Gary Gregory">Precompile
Pattern in ReadmeHtmlVelocityDelegate.render(Writer).</action>
+ <action type="fix" dev="ggregory" due-to="Gary Gregory">Include the main
project artifact and POM in sha512.properties for vote-txt.</action>
<!-- ADD -->
<!-- UPDATE -->
<action type="update" dev="ggregory" due-to="Gary Gregory">Bump
org.apache.commons:commons-parent from 96 to 107.</action>
diff --git
a/src/main/java/org/apache/commons/release/plugin/mojos/CommonsDistributionDetachmentMojo.java
b/src/main/java/org/apache/commons/release/plugin/mojos/CommonsDistributionDetachmentMojo.java
index ff38449..1d576d0 100644
---
a/src/main/java/org/apache/commons/release/plugin/mojos/CommonsDistributionDetachmentMojo.java
+++
b/src/main/java/org/apache/commons/release/plugin/mojos/CommonsDistributionDetachmentMojo.java
@@ -179,6 +179,11 @@ public final class CommonsDistributionDetachmentMojo
extends AbstractMojo {
if (!workingDirectory.exists()) {
SharedFunctions.initDirectory(getLog(), workingDirectory);
}
+ final Artifact mainArtifact = project.getArtifact();
+ if (mainArtifact != null && mainArtifact.getFile() != null &&
!"pom".equals(mainArtifact.getType())) {
+ putFileInSha512Map(mainArtifact.getFile().getName(),
mainArtifact.getFile());
+ }
+ putFileInSha512Map(project.getArtifactId() + "-" +
project.getVersion() + ".pom", project.getFile());
writeAllArtifactsInSha512PropertiesFile();
copyRemovedArtifactsToWorkingDirectory();
getLog().info("");
@@ -245,24 +250,24 @@ public final class CommonsDistributionDetachmentMojo
extends AbstractMojo {
* artifact.
*/
private void putAttachedArtifactInSha512Map(final Artifact artifact)
throws MojoExecutionException {
- try {
- final String artifactKey = getArtifactKey(artifact);
- if (!artifactKey.endsWith(".asc")) { // .asc files don't need
hashes
- try (InputStream fis =
Files.newInputStream(artifact.getFile().toPath())) {
- artifactSha512s.put(artifactKey,
DigestUtils.sha512Hex(fis));
- }
- }
+ final String artifactKey = getArtifactKey(artifact);
+ if (!artifactKey.endsWith(".asc")) { // .asc files don't need hashes
+ putFileInSha512Map(artifactKey, artifact.getFile());
+ }
+ }
+
+ /**
+ * Computes a file's SHA-512 hash and stores it under its release artifact
name.
+ *
+ * @param artifactKey the release artifact name.
+ * @param file the file to hash.
+ * @throws MojoExecutionException if the file cannot be read.
+ */
+ private void putFileInSha512Map(final String artifactKey, final File file)
throws MojoExecutionException {
+ try (InputStream input = Files.newInputStream(file.toPath())) {
+ artifactSha512s.put(artifactKey, DigestUtils.sha512Hex(input));
} catch (final IOException e) {
- throw new MojoExecutionException(
- "Could not find artifact signature for: "
- + artifact.getArtifactId()
- + "-"
- + artifact.getClassifier()
- + "-"
- + artifact.getVersion()
- + " type: "
- + artifact.getType(),
- e);
+ throw new MojoExecutionException("Could not compute SHA-512 for: "
+ file, e);
}
}
diff --git
a/src/test/java/org/apache/commons/release/plugin/mojos/CommonsDistributionDetachmentMojoTest.java
b/src/test/java/org/apache/commons/release/plugin/mojos/CommonsDistributionDetachmentMojoTest.java
index 4f9a181..19a9bbf 100644
---
a/src/test/java/org/apache/commons/release/plugin/mojos/CommonsDistributionDetachmentMojoTest.java
+++
b/src/test/java/org/apache/commons/release/plugin/mojos/CommonsDistributionDetachmentMojoTest.java
@@ -87,7 +87,9 @@ public class CommonsDistributionDetachmentMojoTest {
final String[] suffixes = {"-bin.tar.gz", "-bin.zip", "-src.tar.gz",
"-src.zip", ".jar", ".pom", "-javadoc.jar", "-sources.jar"};
for (final String suffix : suffixes) {
final String name = "commons-text-1.4" + suffix;
- final Path artifact = new
File("src/test/resources/mojos/detach-distributions/target", name).toPath();
+ final Path artifact = ".pom".equals(suffix)
+ ? new
File("src/test/resources/mojos/detach-distributions/detach-distributions.xml").toPath()
+ : new
File("src/test/resources/mojos/detach-distributions/target", name).toPath();
expected.setProperty(name,
Hex.encodeHexString(MessageDigest.getInstance("SHA-512").digest(Files.readAllBytes(artifact))));
}
// Exact equality also excludes signatures and unexpected artifacts.
diff --git
a/src/test/java/org/apache/commons/release/plugin/stubs/DistributionDetachmentProjectStub.java
b/src/test/java/org/apache/commons/release/plugin/stubs/DistributionDetachmentProjectStub.java
index 53cc301..166eda4 100644
---
a/src/test/java/org/apache/commons/release/plugin/stubs/DistributionDetachmentProjectStub.java
+++
b/src/test/java/org/apache/commons/release/plugin/stubs/DistributionDetachmentProjectStub.java
@@ -82,6 +82,13 @@ public final class DistributionDetachmentProjectStub extends
MavenProjectStub {
private List<Artifact> attachedArtifacts;
+ @Override
+ public Artifact getArtifact() {
+ return new DistributionDetachmentArtifactStub(
+ new
File("src/test/resources/mojos/detach-distributions/target/commons-text-1.4.jar"),
+ "jar", "org.apache.commons", "commons-text", null, "1.4");
+ }
+
@Override
public String getArtifactId() {
return "commons-text";
@@ -162,15 +169,6 @@ public final class DistributionDetachmentProjectStub
extends MavenProjectStub {
"src", "1.4"
)
);
- attachedArtifacts.add(
- new DistributionDetachmentArtifactStub(
- new
File("src/test/resources/mojos/detach-distributions/target/commons-text-1.4.jar"),
- "jar",
- "org.apache.commons",
- "commons-text",
- "jar", "1.4"
- )
- );
attachedArtifacts.add(
new DistributionDetachmentArtifactStub(
new
File("src/test/resources/mojos/detach-distributions/target/commons-text-1.4.jar.asc"),
@@ -180,15 +178,6 @@ public final class DistributionDetachmentProjectStub
extends MavenProjectStub {
"jar", "1.4"
)
);
- attachedArtifacts.add(
- new DistributionDetachmentArtifactStub(
- new
File("src/test/resources/mojos/detach-distributions/target/commons-text-1.4.pom"),
- "pom",
- "org.apache.commons",
- "commons-text",
- "pom", "1.4"
- )
- );
attachedArtifacts.add(
new DistributionDetachmentArtifactStub(
new
File("src/test/resources/mojos/detach-distributions/target/commons-text-1.4.pom.asc"),
@@ -237,6 +226,11 @@ public final class DistributionDetachmentProjectStub
extends MavenProjectStub {
return attachedArtifacts;
}
+ @Override
+ public File getFile() {
+ return new
File("src/test/resources/mojos/detach-distributions/detach-distributions.xml");
+ }
+
@Override
public String getGroupId() {
return "org.apache.commons";
