elharo commented on issue #92:
URL:
https://github.com/apache/maven-jarsigner-plugin/issues/92#issuecomment-5372375672
ZipInputStream reads from byte 0 and expects the ZIP magic number
(PK\x03\x04) at
the start. When it encounters the shell script header of a Spring Boot
executable
jar, it either throws or finds no entries, so isZipFile() returns
false. The
plugin then skips the artifact with "Unsupported artifact ignored".
The fix should go in maven-jarsigner's JarSignerUtil.
isZipFile(). The plugin itself just delegates to that utility at
AbstractJarsignerMojo.java:395. A corrected isZipFile() could search
for the ZIP
End of Central Directory (EOCD) signature (PK\x05\x06) from the end of
the file —
which is what Java's java.util.jar.JarFile and java.util.zip.ZipFile do
— rather
than reading from byte 0.
Workaround (no code change): Configure the maven-jarsigner-plugin to
run before
spring-boot-maven-plugin's repackage goal, so jarsigner signs the
regular jar
before it gets wrapped into an executable jar.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
