Bug#745815: libjarjar-java: generate jars with invalid information

[Miguel Landaeta]

On Sat, May 03, 2014 at 07:30:20PM +0200, Emmanuel Bourg wrote:
> Le 03/05/2014 18:41, Miguel Landaeta a écrit :
> 
> > Well, the bug was not introduced by upstream as I thought.
> > I can only reproduce this bug when patch szzepiq_jar_resources.diff is applied.
> > When I remove that patch, jarjar works OK for me.
> 
> Interesting, the question is to know what issue this patch fixed. There
> is no mention of a bug in the changelog.
> 

However, the patch itself contains these headers:

Description: Create patch from fork at <URL:https://github.com/szczepiq/jarjar>.
 which resolve the issue with jarjar not updating the fully qualified class names
 in the jar's resources.
 For instance, with this patch jarjar is able to replace classname (based on requested
 rules) in META-INF/plexus/components.xml files.
Source: https://github.com/szczepiq/jarjar
Author: Szczepan Faber
Author: Damien Raude-Morvan <drazzib at debian.org>
Last-Update: 2013-01-08

Damien, do you remember what issue fixed this patch in jarjar package?

I think there is a serious issue with this patch. Any file not
matching .class, .java or MANIFEST.MF ends being treated like a text
file so it ends modifying .groovy, .png, .properties, anything under
META-INF, etc.

This looks broken to me and this was not accepted at upstream anyway.
Upstream is very inactive nowadays but still.

Any opinion about disabling this?

-- 
Miguel Landaeta, nomadium at debian.org
secure email with PGP 0x6E608B637D8967E9 available at
http://db.debian.org/fetchkey.cgi?fingerprint=4CB7FE1E280ECC90F29A597E6E608B637D8967E9
"Faith means not wanting to know what is true." -- Nietzsche
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20140503/455626cc/attachment-0001.sig>