elharo opened a new issue, #133:
URL: https://github.com/apache/maven-shared-jar/issues/133
In `JarBytecodeHashAnalyzer.java:36-41`, the SHA-1 digest is overwritten on
each loop iteration:
```java
for (JarEntry entry : entries) {
try (InputStream is = jarAnalyzer.getEntryInputStream(entry)) {
result = DigestUtils.sha1Hex(is); // OVERWRITES previous result!
}
}
jarData.setBytecodeHash(result);
```
When the loop exits, `result` holds only the SHA-1 of the **last** class
file in the list. Two JARs with completely different class sets would produce
the same "bytecode hash" if their last-sorted class entry happens to be
identical. The hash is supposed to uniquely identify the full class content per
the Javadoc ("detect an exact copy of the file's class data"), but it is broken.
**Fix**: Incrementally accumulate the digest across all entries rather than
overwriting on each iteration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
