From 7d874c8ab1c39eea77c74587f393fccbe95224a1 Mon Sep 17 00:00:00 2001 From: Andreas Stefl Date: Sat, 10 Oct 2026 13:33:04 +0200 Subject: [PATCH 1/2] ci(maven): pin Maven 3.9 and skip an existing GitHub Packages upload The ubuntu-24.04 image 20261004 updates Maven from 3.9.16 to 3.10.0. Maven 3.10 stages a maven-metadata-local.xml next to the version directory. central-publishing-maven-plugin 0.11.0 deletes only maven-metadata-central-staging.xml, so the file stays in the bundle. Central then rejects the bundle with "Bundle has content that does NOT have a .pom file", and the v7.5.0 and v7.5.1 releases of odr-core-java did not get to Maven Central. A Maven Wrapper in jni/ pins Maven 3.9.16 with a checksum, and the workflow uses it for all three builds. The upload to GitHub Packages succeeds before the Central step runs. A rerun then gets 409 from GitHub Packages and stops before Central. The publish step now skips the upload if the pom of that version is already on GitHub Packages. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01LkhPXqd9UFL99dDDkMDKQN --- .github/workflows/maven.yml | 17 +- jni/.mvn/wrapper/maven-wrapper.properties | 4 + jni/README.md | 4 +- jni/mvnw | 295 ++++++++++++++++++++++ 4 files changed, 315 insertions(+), 5 deletions(-) create mode 100644 jni/.mvn/wrapper/maven-wrapper.properties create mode 100755 jni/mvnw diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index eb3d00d86..1f031f3da 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -32,8 +32,11 @@ jobs: java-version: 21 cache: maven + # jni/mvnw pins Maven 3.9. Maven 3.10 stages a maven-metadata-local.xml + # that central-publishing-maven-plugin 0.11.0 does not remove, and Central + # rejects the bundle: "Bundle has content that does NOT have a .pom file". - name: build - run: mvn --batch-mode --no-transfer-progress --file jni/pom.xml verify + run: jni/mvnw --batch-mode --no-transfer-progress --file jni/pom.xml verify # Split out so the secrets sit behind an environment and are never in reach of # a plain push build. @@ -66,8 +69,16 @@ jobs: echo "REVISION=${INPUT_VERSION}" >> "$GITHUB_ENV" fi + # GitHub Packages refuses a second upload of a version with 409, so a rerun + # after a failed Maven Central step must not upload again. - name: publish to github packages - run: mvn --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Drevision="${REVISION}" + run: | + if curl --silent --fail --output /dev/null --user "x:${GITHUB_TOKEN}" \ + "https://maven.pkg.github.com/${GITHUB_REPOSITORY}/app/opendocument/odr-core-java/${REVISION}/odr-core-java-${REVISION}.pom"; then + echo "odr-core-java ${REVISION} is already on GitHub Packages" + exit 0 + fi + jni/mvnw --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Drevision="${REVISION}" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -87,7 +98,7 @@ jobs: gpg-passphrase: MAVEN_GPG_PASSPHRASE - name: publish to maven central - run: mvn --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Pcentral -Drevision="${REVISION}" + run: jni/mvnw --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Pcentral -Drevision="${REVISION}" env: MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }} MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} diff --git a/jni/.mvn/wrapper/maven-wrapper.properties b/jni/.mvn/wrapper/maven-wrapper.properties new file mode 100644 index 000000000..a3c407ffc --- /dev/null +++ b/jni/.mvn/wrapper/maven-wrapper.properties @@ -0,0 +1,4 @@ +wrapperVersion=3.3.4 +distributionType=only-script +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip +distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce diff --git a/jni/README.md b/jni/README.md index 61694594e..0c86591cd 100644 --- a/jni/README.md +++ b/jni/README.md @@ -48,8 +48,8 @@ dependencies { Prefer Central. GitHub Packages needs a token with `read:packages` even for a public package. -Local build: `mvn --file jni/pom.xml verify` produces the jar plus the sources -and javadoc jars in `jni/target/`. The `central` profile (`mvn deploy +Local build: `jni/mvnw --file jni/pom.xml verify` produces the jar plus the sources +and javadoc jars in `jni/target/`. The `central` profile (`jni/mvnw deploy -Pcentral`) adds the PGP signatures and the `developers` POM entry that Central requires. It is off the default build, so neither a signing key nor a portal token is needed to build or to deploy to GitHub Packages. diff --git a/jni/mvnw b/jni/mvnw new file mode 100755 index 000000000..bd8896bf2 --- /dev/null +++ b/jni/mvnw @@ -0,0 +1,295 @@ +#!/bin/sh +# ---------------------------------------------------------------------------- +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# ---------------------------------------------------------------------------- + +# ---------------------------------------------------------------------------- +# Apache Maven Wrapper startup batch script, version 3.3.4 +# +# Optional ENV vars +# ----------------- +# JAVA_HOME - location of a JDK home dir, required when download maven via java source +# MVNW_REPOURL - repo url base for downloading maven distribution +# MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven +# MVNW_VERBOSE - true: enable verbose log; debug: trace the mvnw script; others: silence the output +# ---------------------------------------------------------------------------- + +set -euf +[ "${MVNW_VERBOSE-}" != debug ] || set -x + +# OS specific support. +native_path() { printf %s\\n "$1"; } +case "$(uname)" in +CYGWIN* | MINGW*) + [ -z "${JAVA_HOME-}" ] || JAVA_HOME="$(cygpath --unix "$JAVA_HOME")" + native_path() { cygpath --path --windows "$1"; } + ;; +esac + +# set JAVACMD and JAVACCMD +set_java_home() { + # For Cygwin and MinGW, ensure paths are in Unix format before anything is touched + if [ -n "${JAVA_HOME-}" ]; then + if [ -x "$JAVA_HOME/jre/sh/java" ]; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD="$JAVA_HOME/jre/sh/java" + JAVACCMD="$JAVA_HOME/jre/sh/javac" + else + JAVACMD="$JAVA_HOME/bin/java" + JAVACCMD="$JAVA_HOME/bin/javac" + + if [ ! -x "$JAVACMD" ] || [ ! -x "$JAVACCMD" ]; then + echo "The JAVA_HOME environment variable is not defined correctly, so mvnw cannot run." >&2 + echo "JAVA_HOME is set to \"$JAVA_HOME\", but \"\$JAVA_HOME/bin/java\" or \"\$JAVA_HOME/bin/javac\" does not exist." >&2 + return 1 + fi + fi + else + JAVACMD="$( + 'set' +e + 'unset' -f command 2>/dev/null + 'command' -v java + )" || : + JAVACCMD="$( + 'set' +e + 'unset' -f command 2>/dev/null + 'command' -v javac + )" || : + + if [ ! -x "${JAVACMD-}" ] || [ ! -x "${JAVACCMD-}" ]; then + echo "The java/javac command does not exist in PATH nor is JAVA_HOME set, so mvnw cannot run." >&2 + return 1 + fi + fi +} + +# hash string like Java String::hashCode +hash_string() { + str="${1:-}" h=0 + while [ -n "$str" ]; do + char="${str%"${str#?}"}" + h=$(((h * 31 + $(LC_CTYPE=C printf %d "'$char")) % 4294967296)) + str="${str#?}" + done + printf %x\\n $h +} + +verbose() { :; } +[ "${MVNW_VERBOSE-}" != true ] || verbose() { printf %s\\n "${1-}"; } + +die() { + printf %s\\n "$1" >&2 + exit 1 +} + +trim() { + # MWRAPPER-139: + # Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds. + # Needed for removing poorly interpreted newline sequences when running in more + # exotic environments such as mingw bash on Windows. + printf "%s" "${1}" | tr -d '[:space:]' +} + +scriptDir="$(dirname "$0")" +scriptName="$(basename "$0")" + +# parse distributionUrl and optional distributionSha256Sum, requires .mvn/wrapper/maven-wrapper.properties +while IFS="=" read -r key value; do + case "${key-}" in + distributionUrl) distributionUrl=$(trim "${value-}") ;; + distributionSha256Sum) distributionSha256Sum=$(trim "${value-}") ;; + esac +done <"$scriptDir/.mvn/wrapper/maven-wrapper.properties" +[ -n "${distributionUrl-}" ] || die "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties" + +case "${distributionUrl##*/}" in +maven-mvnd-*bin.*) + MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/ + case "${PROCESSOR_ARCHITECTURE-}${PROCESSOR_ARCHITEW6432-}:$(uname -a)" in + *AMD64:CYGWIN* | *AMD64:MINGW*) distributionPlatform=windows-amd64 ;; + :Darwin*x86_64) distributionPlatform=darwin-amd64 ;; + :Darwin*arm64) distributionPlatform=darwin-aarch64 ;; + :Linux*x86_64*) distributionPlatform=linux-amd64 ;; + *) + echo "Cannot detect native platform for mvnd on $(uname)-$(uname -m), use pure java version" >&2 + distributionPlatform=linux-amd64 + ;; + esac + distributionUrl="${distributionUrl%-bin.*}-$distributionPlatform.zip" + ;; +maven-mvnd-*) MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/ ;; +*) MVN_CMD="mvn${scriptName#mvnw}" _MVNW_REPO_PATTERN=/org/apache/maven/ ;; +esac + +# apply MVNW_REPOURL and calculate MAVEN_HOME +# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-,maven-mvnd--}/ +[ -z "${MVNW_REPOURL-}" ] || distributionUrl="$MVNW_REPOURL$_MVNW_REPO_PATTERN${distributionUrl#*"$_MVNW_REPO_PATTERN"}" +distributionUrlName="${distributionUrl##*/}" +distributionUrlNameMain="${distributionUrlName%.*}" +distributionUrlNameMain="${distributionUrlNameMain%-bin}" +MAVEN_USER_HOME="${MAVEN_USER_HOME:-${HOME}/.m2}" +MAVEN_HOME="${MAVEN_USER_HOME}/wrapper/dists/${distributionUrlNameMain-}/$(hash_string "$distributionUrl")" + +exec_maven() { + unset MVNW_VERBOSE MVNW_USERNAME MVNW_PASSWORD MVNW_REPOURL || : + exec "$MAVEN_HOME/bin/$MVN_CMD" "$@" || die "cannot exec $MAVEN_HOME/bin/$MVN_CMD" +} + +if [ -d "$MAVEN_HOME" ]; then + verbose "found existing MAVEN_HOME at $MAVEN_HOME" + exec_maven "$@" +fi + +case "${distributionUrl-}" in +*?-bin.zip | *?maven-mvnd-?*-?*.zip) ;; +*) die "distributionUrl is not valid, must match *-bin.zip or maven-mvnd-*.zip, but found '${distributionUrl-}'" ;; +esac + +# prepare tmp dir +if TMP_DOWNLOAD_DIR="$(mktemp -d)" && [ -d "$TMP_DOWNLOAD_DIR" ]; then + clean() { rm -rf -- "$TMP_DOWNLOAD_DIR"; } + trap clean HUP INT TERM EXIT +else + die "cannot create temp dir" +fi + +mkdir -p -- "${MAVEN_HOME%/*}" + +# Download and Install Apache Maven +verbose "Couldn't find MAVEN_HOME, downloading and installing it ..." +verbose "Downloading from: $distributionUrl" +verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName" + +# select .zip or .tar.gz +if ! command -v unzip >/dev/null; then + distributionUrl="${distributionUrl%.zip}.tar.gz" + distributionUrlName="${distributionUrl##*/}" +fi + +# verbose opt +__MVNW_QUIET_WGET=--quiet __MVNW_QUIET_CURL=--silent __MVNW_QUIET_UNZIP=-q __MVNW_QUIET_TAR='' +[ "${MVNW_VERBOSE-}" != true ] || __MVNW_QUIET_WGET='' __MVNW_QUIET_CURL='' __MVNW_QUIET_UNZIP='' __MVNW_QUIET_TAR=v + +# normalize http auth +case "${MVNW_PASSWORD:+has-password}" in +'') MVNW_USERNAME='' MVNW_PASSWORD='' ;; +has-password) [ -n "${MVNW_USERNAME-}" ] || MVNW_USERNAME='' MVNW_PASSWORD='' ;; +esac + +if [ -z "${MVNW_USERNAME-}" ] && command -v wget >/dev/null; then + verbose "Found wget ... using wget" + wget ${__MVNW_QUIET_WGET:+"$__MVNW_QUIET_WGET"} "$distributionUrl" -O "$TMP_DOWNLOAD_DIR/$distributionUrlName" || die "wget: Failed to fetch $distributionUrl" +elif [ -z "${MVNW_USERNAME-}" ] && command -v curl >/dev/null; then + verbose "Found curl ... using curl" + curl ${__MVNW_QUIET_CURL:+"$__MVNW_QUIET_CURL"} -f -L -o "$TMP_DOWNLOAD_DIR/$distributionUrlName" "$distributionUrl" || die "curl: Failed to fetch $distributionUrl" +elif set_java_home; then + verbose "Falling back to use Java to download" + javaSource="$TMP_DOWNLOAD_DIR/Downloader.java" + targetZip="$TMP_DOWNLOAD_DIR/$distributionUrlName" + cat >"$javaSource" <<-END + public class Downloader extends java.net.Authenticator + { + protected java.net.PasswordAuthentication getPasswordAuthentication() + { + return new java.net.PasswordAuthentication( System.getenv( "MVNW_USERNAME" ), System.getenv( "MVNW_PASSWORD" ).toCharArray() ); + } + public static void main( String[] args ) throws Exception + { + setDefault( new Downloader() ); + java.nio.file.Files.copy( java.net.URI.create( args[0] ).toURL().openStream(), java.nio.file.Paths.get( args[1] ).toAbsolutePath().normalize() ); + } + } + END + # For Cygwin/MinGW, switch paths to Windows format before running javac and java + verbose " - Compiling Downloader.java ..." + "$(native_path "$JAVACCMD")" "$(native_path "$javaSource")" || die "Failed to compile Downloader.java" + verbose " - Running Downloader.java ..." + "$(native_path "$JAVACMD")" -cp "$(native_path "$TMP_DOWNLOAD_DIR")" Downloader "$distributionUrl" "$(native_path "$targetZip")" +fi + +# If specified, validate the SHA-256 sum of the Maven distribution zip file +if [ -n "${distributionSha256Sum-}" ]; then + distributionSha256Result=false + if [ "$MVN_CMD" = mvnd.sh ]; then + echo "Checksum validation is not supported for maven-mvnd." >&2 + echo "Please disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2 + exit 1 + elif command -v sha256sum >/dev/null; then + if echo "$distributionSha256Sum $TMP_DOWNLOAD_DIR/$distributionUrlName" | sha256sum -c - >/dev/null 2>&1; then + distributionSha256Result=true + fi + elif command -v shasum >/dev/null; then + if echo "$distributionSha256Sum $TMP_DOWNLOAD_DIR/$distributionUrlName" | shasum -a 256 -c >/dev/null 2>&1; then + distributionSha256Result=true + fi + else + echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available." >&2 + echo "Please install either command, or disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2 + exit 1 + fi + if [ $distributionSha256Result = false ]; then + echo "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised." >&2 + echo "If you updated your Maven version, you need to update the specified distributionSha256Sum property." >&2 + exit 1 + fi +fi + +# unzip and move +if command -v unzip >/dev/null; then + unzip ${__MVNW_QUIET_UNZIP:+"$__MVNW_QUIET_UNZIP"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -d "$TMP_DOWNLOAD_DIR" || die "failed to unzip" +else + tar xzf${__MVNW_QUIET_TAR:+"$__MVNW_QUIET_TAR"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -C "$TMP_DOWNLOAD_DIR" || die "failed to untar" +fi + +# Find the actual extracted directory name (handles snapshots where filename != directory name) +actualDistributionDir="" + +# First try the expected directory name (for regular distributions) +if [ -d "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain" ]; then + if [ -f "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain/bin/$MVN_CMD" ]; then + actualDistributionDir="$distributionUrlNameMain" + fi +fi + +# If not found, search for any directory with the Maven executable (for snapshots) +if [ -z "$actualDistributionDir" ]; then + # enable globbing to iterate over items + set +f + for dir in "$TMP_DOWNLOAD_DIR"/*; do + if [ -d "$dir" ]; then + if [ -f "$dir/bin/$MVN_CMD" ]; then + actualDistributionDir="$(basename "$dir")" + break + fi + fi + done + set -f +fi + +if [ -z "$actualDistributionDir" ]; then + verbose "Contents of $TMP_DOWNLOAD_DIR:" + verbose "$(ls -la "$TMP_DOWNLOAD_DIR")" + die "Could not find Maven distribution directory in extracted archive" +fi + +verbose "Found extracted Maven distribution directory: $actualDistributionDir" +printf %s\\n "$distributionUrl" >"$TMP_DOWNLOAD_DIR/$actualDistributionDir/mvnw.url" +mv -- "$TMP_DOWNLOAD_DIR/$actualDistributionDir" "$MAVEN_HOME" || [ -d "$MAVEN_HOME" ] || die "fail to move MAVEN_HOME" + +clean || : +exec_maven "$@" From f8c08e10fdea34cf11e5ec93d163241398868ec5 Mon Sep 17 00:00:00 2001 From: Andreas Stefl Date: Sat, 10 Oct 2026 13:37:38 +0200 Subject: [PATCH 2/2] ci(maven): check for the jar, not the pom, before the upload The deploy uploads the pom before the jar. If an upload stops after the pom, a check for the pom skips the jar on every rerun. A check for the jar skips only an upload that completed. Also tell jni/AGENTS.md to build through mvnw, and reflow the README paragraph. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01LkhPXqd9UFL99dDDkMDKQN --- .github/workflows/maven.yml | 5 +++-- jni/AGENTS.md | 2 +- jni/README.md | 10 +++++----- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 1f031f3da..9e05a745f 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -70,11 +70,12 @@ jobs: fi # GitHub Packages refuses a second upload of a version with 409, so a rerun - # after a failed Maven Central step must not upload again. + # after a failed Maven Central step must not upload again. The jar goes up + # after the pom, so its presence means the upload completed. - name: publish to github packages run: | if curl --silent --fail --output /dev/null --user "x:${GITHUB_TOKEN}" \ - "https://maven.pkg.github.com/${GITHUB_REPOSITORY}/app/opendocument/odr-core-java/${REVISION}/odr-core-java-${REVISION}.pom"; then + "https://maven.pkg.github.com/${GITHUB_REPOSITORY}/app/opendocument/odr-core-java/${REVISION}/odr-core-java-${REVISION}.jar"; then echo "odr-core-java ${REVISION} is already on GitHub Packages" exit 0 fi diff --git a/jni/AGENTS.md b/jni/AGENTS.md index c30e64a36..ca453b1df 100644 --- a/jni/AGENTS.md +++ b/jni/AGENTS.md @@ -9,7 +9,7 @@ bindings (`python/`). | Path | What | |------|------| | `CMakeLists.txt` | Builds `libodr_jni` and `odr-core-java.jar`. Included from the root build via `ODR_JNI`, or standalone against an installed `odrcore`. `ODR_JNI_JAR=OFF` builds the native half alone, which is what `../android` does and the only build that needs no JDK. | -| `pom.xml` | Maven distribution of the Java classes (`app.opendocument:odr-core-java`). `.github/workflows/maven.yml` publishes it to Maven Central (profile `central`) and GitHub Packages (profile `github`) on release. Keep `--release` and `-Xlint` in sync with `CMAKE_JAVA_COMPILE_FLAGS`. | +| `pom.xml` | Maven distribution of the Java classes (`app.opendocument:odr-core-java`). `.github/workflows/maven.yml` publishes it to Maven Central (profile `central`) and GitHub Packages (profile `github`) on release. Run it through `mvnw`, which pins the Maven version that Central's publishing plugin works with. Keep `--release` and `-Xlint` in sync with `CMAKE_JAVA_COMPILE_FLAGS`. | | `src/` | One `jni_*` unit per public-API area. `odr_jni.hpp` (strings, exceptions, handles) and `jni_convert.hpp` (struct and POJO marshalling) are the helpers. | | `java/app/opendocument/core/` | The Java API: enums, POJOs (styles, metas, `HtmlConfig`), and handle-backed wrappers that extend `NativeResource`. `../android` compiles the same sources into the AAR. It stays java, because `add_jar` has no kotlin toolchain. | | `tests/` | JUnit 5 suite, run through ctest (`odr_jni_junit`). Inputs come from `TestFiles`. | diff --git a/jni/README.md b/jni/README.md index 0c86591cd..3f47b43ce 100644 --- a/jni/README.md +++ b/jni/README.md @@ -48,11 +48,11 @@ dependencies { Prefer Central. GitHub Packages needs a token with `read:packages` even for a public package. -Local build: `jni/mvnw --file jni/pom.xml verify` produces the jar plus the sources -and javadoc jars in `jni/target/`. The `central` profile (`jni/mvnw deploy --Pcentral`) adds the PGP signatures and the `developers` POM entry that Central -requires. It is off the default build, so neither a signing key nor a portal -token is needed to build or to deploy to GitHub Packages. +Local build: `jni/mvnw --file jni/pom.xml verify` produces the jar plus the +sources and javadoc jars in `jni/target/`. The `central` profile (`jni/mvnw +deploy -Pcentral`) adds the PGP signatures and the `developers` POM entry that +Central requires. It is off the default build, so neither a signing key nor a +portal token is needed to build or to deploy to GitHub Packages. ## Building