ascheman opened a new issue, #555:
URL: https://github.com/apache/maven-jar-plugin/issues/555
### Summary
`maven-jar-plugin 3.5.0` fails to create **modular JARs** (projects with a
`module-info.java`) on **Windows** when running on **JDK 8–13** and a
Reproducible-Builds timestamp (`project.build.outputTimestamp`) is set:
```
[ERROR] Failed to execute goal
org.apache.maven.plugins:maven-jar-plugin:3.5.0:jar (default-jar) on project
...: Error assembling JAR: NullPointerException
```
Stack (condensed):
```
MavenArchiver.createArchive
→ AbstractArchiver.createArchive
→ JarToolModularJarArchiver.postCreateArchive
→ JarToolModularJarArchiver.fixLastModifiedTimeZipEntries
(JarToolModularJarArchiver.java:158)
→ java.lang.NullPointerException
```
This is a regression versus 3.4.2.
### Root cause
3.5.0 ships **plexus-archiver 4.10.4**, whose
`fixLastModifiedTimeZipEntries()` calls
```java
Files.getFileAttributeView(destFile, PosixFileAttributeView.class,
LinkOption.NOFOLLOW_LINKS)
.readAttributes();
```
without a null guard — on Windows there is no POSIX attribute view, so
`getFileAttributeView` returns null. The method is only reached when the JDK
`jar` tool does not support `--date` (JDK < 14), which is why JDK 17/21 builds
are fine.
plexus-archiver **4.12.0** already contains the fix (`if (view != null) …`),
and **both `master` and `maven-jar-plugin-3.x` already depend on 4.12.0** — no
code change is needed. This issue asks for a **3.5.1 release** from
`maven-jar-plugin-3.x`.
### Impact
Maven **3.10.0-rc-1**'s super-POM makes jar-plugin 3.5.0 the default, so
every modular JAR build on Windows + JDK 8–13 breaks out of the box. First seen
on apache/maven-surefire CI, where the `windows-latest jdk-11 × 3.10.0-rc-1`
matrix cell fails 4 modular IT fixtures with exactly this NPE (e.g.
https://github.com/apache/maven-surefire/actions/runs/29647349025/job/88088170720,
PRs #3392/#3394 — failure is unrelated to those PRs' content).
### Reproduction / verification
Minimal reproducer + verification on a windows-latest / Zulu 11 GitHub
runner:
https://github.com/aschemaven/maven-surefire/actions/runs/29678927319
(job builds a minimal modular project with jar-plugin 3.5.0 → NPE
reproduced; second step overrides `plexus-archiver` to 4.12.0 as a plugin
dependency → build succeeds.)
### Workaround for consumers until 3.5.1
```xml
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>3.5.0</version>
<dependencies>
<dependency>
<groupId>org.codehaus.plexus</groupId>
<artifactId>plexus-archiver</artifactId>
<version>4.12.0</version>
</dependency>
</dependencies>
</plugin>
```
(or pin jar-plugin 3.4.2)
Happy to help with the 3.5.1 release if useful.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
