slachiewicz opened a new pull request, #327:
URL: https://github.com/apache/maven-source-plugin/pull/327

   A symbolic link below a source root was archived as a link, so the sources 
jar carried an entry pointing outside itself and the linked file was absent. 
Unpacked anywhere else, the link resolves to nothing. That is 
[plexus-archiver#160](https://github.com/codehaus-plexus/plexus-archiver/issues/160),
 open since 2021.
   
   `followSymlinks` (property `maven.source.followSymlinks`) defaults to false, 
so nothing changes for anyone relying on links being preserved. With it on, a 
link is archived as the file or directory it points at, and a linked 
directory's contents are included.
   
   This needs plexus-archiver 4.14.0, which is where 
`FileSet.isFollowingSymLinks()` arrives 
([#481](https://github.com/codehaus-plexus/plexus-archiver/pull/481)) — the pom 
moves from 4.12.0 to pick it up. The archiver had hardcoded the flag off with 
no way for a caller to reach it, which is why the 2021 report went nowhere.
   
   Verified: `mvn clean verify -Prun-its` → 10 unit tests and 25/25 ITs, 
against the released 4.14.0. Removing the wiring makes the new IT fail with the 
jar holding a bare `shared` entry and no `shared/Shared.java`, which is the 
reported bug exactly.
   
   The new IT is skipped on Windows — creating a symbolic link there needs 
privileges that are not granted by default.
   
   Related: MRESOURCES-237 tracks the sibling problem in 
maven-resources-plugin. Not touched here.
   
   *This change was created with AI assistance.*
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to