pkozelka / contentcheck-maven-plugin Goto Github PK
View Code? Open in Web Editor NEWChecks contents of an archive against plaintext list of expected files
Home Page: https://mvnrepository.com/artifact/net.kozelka.maven/contentcheck-maven-plugin
Checks contents of an archive against plaintext list of expected files
Home Page: https://mvnrepository.com/artifact/net.kozelka.maven/contentcheck-maven-plugin
It could be also useful to have an option to check that an archive contains duplicated files on different locations, i mean especially JARs on different locations.
stacktrace:
java.lang.NullPointerException
at net.kozelka.contentcheck.mojo.ContentCheckMojo.doExecute(ContentCheckMojo.java:58)
at net.kozelka.contentcheck.mojo.AbstractArchiveContentMojo.execute(AbstractArchiveContentMojo.java:75)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:133)
... 20 more
useful for
expected features:
implementation considerations:
such a functionality can be generally useful.
Right now my use-case is to skip checking when used in clover-enabled build; that causes clover.jar to be included in the war.
The dirty workarround is to add clover.jar as approved, but the skip would allow keeping the approval list clean.
Another solution to my case could be to maintain a "devel-ignore" list; it would allow to ignore some files when building snapshot, but for release build, they will cause failure.
Use either MD5
or SHA1
hash to check integrity of the included files.
This can discover differences caused by improper modifications in nexus caches (or others).
this might be useful for use in projects consisting of microservices, where teams with independent codebase wish to keep their thirdparty dependencies as similar as possible.
One of motivations behind this can be a lengthy corporate procedure for approving thirdparty software.
it is ok to work with maven model classes outside, but using log or other pieces of plugin api prevents good structuring of the code in minimalistic dependencies in mind.
Think about targeting ant, cli, and other hosting platforms.
Currently, the conflict checker ignores the fact that the war file itself can contain classes that may potentially conflict with those in jar files.
On implementation side, this will require storing more information about a resource:
WEB-INF/classes/
)currently the only way how to tolerate some files with conflict is to specify number of allowed conflicts.
This is insufficient, and in teams with weaker code review habits it does not work in a way allowing step-by-step conflict reduction.
Adding a way to explicitly list which conflicts to allow might slightly help in such situation.
just to make the results easier to share and/or further process
how it should work:
In result, this will:
it should be based on existing output artifact and plugin configuration already present in pom.xml
... which could be a dedicated github repo for easier collaboration and sharing
Stacktrace:
Caused by: java.lang.NullPointerException
at net.kozelka.contentcheck.introspection.AbstractIntrospector.checkArchiveManifest(AbstractIntrospector.java:163)
at net.kozelka.contentcheck.introspection.AbstractIntrospector.isVendorArchive(AbstractIntrospector.java:143)
at net.kozelka.contentcheck.introspection.AbstractIntrospector.readEntries(AbstractIntrospector.java:72)
at net.kozelka.contentcheck.mojo.ContentListingGeneratorMojo.doExecute(ContentListingGeneratorMojo.java:36)
at net.kozelka.contentcheck.mojo.AbstractArchiveContentMojo.execute(AbstractArchiveContentMojo.java:75)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:133)
... 20 more
In such case, it would be useful to leave a copy in file target/contentcheck-maven-plugin/approved-content.txt
The command
mvn contentcheck:generate -DignoreVendorArchives=true
still adds SNAPSHOTs of the same projects
A conflict is just a duplicate when conflicting classes are exactly the same. This indicates that a component (somewhere in the dependency graph) has unclean design or build, but is quite harmless in runtime.
A conflict is serious when conflicting classes (or resources in general) are different. Then the order within classloader decides which one will be effective, and that order is frequently not reliable.
Serious conflicts - as defined here - increase risk of non-reproducible behavior.
Now it is not possible to properly control which project modules get into the webapp.
This is because their filename typically contains the "-SNAPSHOT" suffix, which changes during release.
This could be solved by inventing a special syntax, perhaps like
.module groupId:artifactId:classifier:type
which does not need changing with version changes.
This of course relies on availability of matching data in container JAR's manifest, or maven property files.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.