gnodet opened a new pull request, #12874:
URL: https://github.com/apache/maven/pull/12874
## Summary
- Strips `executable()` conditions from profile activations during consumer
POM building, preventing environment-dependent PATH checks from polluting
published artifacts
- Applies to all three transform paths: `transformNonPom`, `transformBom`
(via `prune()`), and `transformPom` (directly)
- When no other activation triggers remain after stripping the condition,
the activation is removed entirely
## Details
The `executable()` function (added in #12332 / MNG-8768) evaluates against
the local system `PATH`. When such conditions survive into published consumer
POMs, downstream consumers silently evaluate them against *their own* `PATH`,
producing non-reproducible builds.
This PR removes the entire `condition` string when it contains an
`executable(` call during `DefaultConsumerPomBuilder` processing, rather than
attempting partial expression surgery which could change boolean semantics in
unexpected ways.
## Test plan
- [x] 8 new unit tests in `ConsumerPomBuilderTest` covering:
- Profile with only `executable()` activation → activation removed
- Profile with `executable()` + other triggers (OS, property) → condition
stripped, other triggers preserved
- Profile without `executable()` → unchanged
- Profile with null activation → unchanged
- Negated `executable()` (`not(executable(...))`) → stripped
- `transformNonPom` path strips executable conditions
- `transformPom` path strips executable conditions
- [x] All 17 `ConsumerPomBuilderTest` tests pass (9 existing + 8 new)
Closes #12570
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
