paulrutter opened a new pull request, #549: URL: https://github.com/apache/felix-dev/pull/549
https://issues.apache.org/jira/browse/FELIX-6857 ## Problem When a bundle uses `Embed-Dependency` and one of the selected dependencies is a `type=pom` artifact (a BOM/aggregator declared as a compile dependency), `DependencyEmbedder` adds that artifact's `.pom` file to the bundle classpath (`Bundle-ClassPath` / `-includeresource`). bnd's CDI-annotations analyzer then tries to open the `.pom` as a JAR/ZIP and fails: - **maven-bundle-plugin 6.0.2** (embeds bnd 7.0.0): emits `[WARNING] Invalid bundle classpath entry` and **builds successfully**. - **maven-bundle-plugin 6.1.0** (embeds bnd 7.3.0): the same condition is now a fatal `[ERROR] Error(s) found in bundle configuration` and **fails the build**. So upgrading the plugin breaks any bundle that embeds a pom-type dependency. ``` [ERROR] Bundle ... : Analyzer Plugin CDIAnnotations failed The JAR/ZIP file (.../org/junit/junit-bom/5.11.3/junit-bom-5.11.3.pom) seems corrupted, error: zip END header not found -> zip END header not found for AnalyzerPlugin [ERROR] Error(s) found in bundle configuration ``` The `.pom` is valid XML, not corrupt — bnd is simply being handed a pom to open as an archive. ## Root cause `DependencyEmbedder` embeds any selected artifact whose file exists, without checking its type, so a `type=pom` dependency's `.pom` file ends up on the classpath. A pom contains no classes and must never be on the bundle classpath. The underlying hard-fail is a bnd 7.0.0 → 7.3.0 behaviour change in `aQute.bnd.cdi.CDIAnnotations#analyzeJar` (a warning promoted to a fatal error), but the plugin should never have placed the `.pom` there in the first place. ## Fix Skip `type=pom` artifacts in `DependencyEmbedder`, covering both the embed and inline paths, logging a warning so it is not silent. The non-embed classpath path in `BundlePlugin.getClasspath()` already excludes poms via `ArtifactHandler.isAddedToClasspath()`, so only the embed path needed the guard. ## Reproducer ```xml <packaging>bundle</packaging> <dependencies> <dependency> <groupId>org.junit</groupId> <artifactId>junit-bom</artifactId> <version>5.11.3</version> <type>pom</type> </dependency> </dependencies> ``` `<Embed-Dependency>*;scope=compile</Embed-Dependency>` mvn clean package fails on 6.1.0, succeeds on 6.0.2 (and with this fix). ## Testing Added BundlePluginTest#testEmbedDependencyExcludesPomArtifacts, asserting a pom dependency is excluded from Bundle-ClassPath and Embedded-Artifacts while a regular jar is still embedded. Fails without the fix, passes with it. Added an embed-pom-dependency integration test (a type=pom dependency alongside a jar dependency). The build fails without the fix (the CDIAnnotations error above) and passes with it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
