slachiewicz opened a new issue, #13738: URL: https://github.com/apache/maven/issues/13738
Reading a resource through a `jar:` URL with `URL.openStream()` (or a cached `JarURLConnection`) opens the jar through the JVM-wide `jar:` cache, and the cached `JarFile` is never closed: closing the stream does not close it, and neither does closing the class loader the URL came from. This is the open JDK bug [JDK-8239054](https://bugs.openjdk.org/browse/JDK-8239054). Until the JVM exits, the jar is: - locked on Windows, so it cannot be overwritten or deleted; - read stale everywhere once it is rewritten in place. Our tests show `EOFException: Unexpected end of ZLIB input stream`. A plain `mvn` run usually exits before this matters. It bites under mvnd, in tests and ITs that rebuild a jar, and when a reactor module is consumed as a jar by a later module, such as a `build-tools` module with Checkstyle rules or a resource bundle. It was first found in maven-remote-resources-plugin (apache/maven-remote-resources-plugin#338). The fix is to read through `URLConnection.setUseCaches(false)`, so that closing the stream closes the jar. A JVM-wide `URLConnection.setDefaultUseCaches("jar", false)` would also change behaviour for everything else running in the Maven JVM. The fixes are tracked in these PRs: - [ ] apache/maven-remote-resources-plugin#339: bundle manifests and resources - [ ] apache/maven#13736: `InjectorImpl.discover`, which runs for every Maven 4 DI plugin realm, plus `CoreExtensionEntry` and `PluginDescriptor` (`lifecycle.xml`) - [ ] apache/maven#13737: the same for maven-3.10.x; backport to 3.9.x requested - [ ] codehaus-plexus/plexus-resources#139: `JarResourceLoader`, used for `jar:` search paths - [ ] then bump plexus-resources in maven-checkstyle-plugin (license artifacts, `DefaultCheckstyleExecutor`) and maven-remote-resources-plugin (`supplementalModelArtifacts`, apache/maven-remote-resources-plugin#341) - [ ] apache/maven-javadoc-plugin#1414: `JavadocUtil.copyResource`, which also never closed its stream - [ ] apache/maven-invoker-plugin#791: `SelectorUtils.getMavenVersion` The following uses of the same pattern are left as they are, because the jar is not rewritten while the JVM runs or the code is not ours to change: - the `Verifier` in maven-it-helper (test support); - mojohaus/siteskinner-maven-plugin `SelectorUtils` (a copy of the invoker code); - mojohaus/jaxb2-maven-plugin `MavenUriCatalogResolver`, whose `jar:` URLs are opened by XJC. Already safe: maven-resolver `UrlTransporter` and plexus-io `PlexusIoURLResource` set `setUseCaches(false)`, and the file transporter's bundle support uses zipfs. The sweep covered `src/main` on the default branch of every non-archived apache/maven-*, codehaus-plexus and mojohaus repository. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
