Bug#654899: libarchive-zip-perl: jh_manifest from javahelper creates corrupt archives (jars)

[Wookey]

+++ Niko Tyni [2012-01-08 19:58 +0200]:
> On Sun, Jan 08, 2012 at 02:15:31PM +0000, Wookey wrote:
> > +++ Niko Tyni [2012-01-06 21:33 +0200]:
> > > On Fri, Jan 06, 2012 at 04:59:35PM +0000, Wookey wrote:
> > > > Package: libarchive-zip-perl
> > > > Version: 1.30-3
> > > > Severity: important
> > > > Tags: upstream
> > > > 
> > > > jh_manifest generates corrupt jars using this code:
> > > 
> > > I'm having trouble reproducing this on sid/amd64 with a self made trivial
> > > jar file. Could you please provide a test case? (I suppose that's a
> > > jar file that breaks, the necessary bits in debian/ and a jh_manifest
> > > invocation that goes wrong.)
> > 
> > I can upload my actual case later, but I made me test case by using terraintool
> > from debian, and adding a dh_override_jh_manifest: to the rules files
> > so that jh_manifest didn't get run.
> > 
> > That made me a vaid jar (test with unzip -t). Then running
> > 'jh_manifest' in the terraintool source dir corrupted it reliably.
> 
> Still no luck on amd64 (javahelper 0.37). 'unzip -t' reports no errors
> before or after I run jh_manifest.
> 
> Are you on i386? I guess I'll have to test that next.

Nope - I'm on amd64.

> BTW, I had to comment out "export JAVA_HOME=/usr/lib/jvm/java-6-openjdk"
> from the terraintool debian/rules file because I only have
> java-6-openjdk-amd64 and java-6-openjdk-common here (but the build-deps
> are obviously satisfied.)

Yeah - sorry - that's this bug
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640583 , and it was fixing that that got me
into investigating all this :-)

> Cc'ing the bug, hope that's OK with you. I tried to remove any remotely
> private information in case you left the bug out intentionally.

Nope - that was just incompetence too.

OK. So - I've uploaded a tar of the terraintool package dir I'm using:
http://wookware.org/files/terraintool-1.09a.tar.gz

So I can reproduce the problem like this:
wget http://wookware.org/files/terraintool-1.09a.tar.gz
tar -xzvf terraintool-1.09a.tar.gz
cd terraintool-1.09a
debuild

then try to unzip -t the /usr/share/terraintool.jar produced in
terraintool_1.09a-3_all.deb  - and get:
Archive:  terraintool.jar.bust
META-INF/:  ucsize 0 <> csize 2 for STORED entry


adding the line: 
override_jh_manifest:
to debian/rules and re-running debuild gives you a
/usr/share/terraintool.jar that is not corrupted.

If you can't reproduce that in a current wheezy machines/chroot then
there is something very odd going on. 

Here are the two jars I just produced by doing this:
http://wookware.org/files/terraintool.jar
http://wookware.org/files/terraintool.jar.bust


Wookey
-- 
Principal hats:  Linaro, Emdebian, Wookware, Balloonboard, ARM
http://wookware.org/