Maven question, code bundling in general

[Stuart Maclean [e-mail] [seajug]]

For better or worse, I bundle my Java applications (mostly cmd line
driven, on Linux) thus. Build in Maven, natch, and use the jar plugin
like this:


<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<configuration>
<archive>
<manifest>
<addClasspath>true</addClasspath>
</manifest>
<manifestEntries>
<!-- This will allow log4j config file locating -->
<Class-Path>.</Class-Path>
</manifestEntries>
</archive>
</configuration>
</plugin>

So the main jar's manifest has a classpath set to locate dependent jars
at runtime. I do not like 'uber jars' too much, so steer clear of the
'shade plugin' and assemblies.

I use log4j for logging. I do NOT want to bundle the log4.properties
file in the main jar, since then I have to unpack/repack the jar to
change a log level. Instead, I add '.' to the classpath, and then place
a log4j.properties file alongside the 'main jar' (the sole one
referenced in the java cmd line).

Looking at the manifest built by the jar plugin, I can see that the '.'
is PREPENDED to the class path. I would prefer it APPENDED. As it is,
it opens a security hole whereby trojaned classfiles in/under '.' would
get loaded ahead of classes housed in my intended jars. It's akin to
putting '.' at the start of your Unix PATH env var, a definite no-no.

Any Maven gurus out there know how to force the plugin to re-order my
manifest ?

Stu





------------------------------------
Posted by: Stuart Maclean <stuart-2Mt1T0R+FriWzc88wn+***@public.gmane.org>
------------------------------------


------------------------------------

Yahoo Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/seajug/

<*> Your email settings:
Individual Email | Traditional

<*> To change settings online go to:
http://groups.yahoo.com/group/seajug/join
(Yahoo! ID required)

<*> To change settings via email:
seajug-digest-***@public.gmane.org
seajug-fullfeatured-***@public.gmane.org

<*> To unsubscribe from this group, send an email to:
seajug-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo Groups is subject to:
https://info.yahoo.com/legal/us/yahoo/utos/terms/

[Nimret Sandhu [e-mail] [seajug]]

Hi Stu,

are you doing the following for ease in local development or on an actual
deployment to an environment?

I briefly glanced over the settings for the jar plugin and it appears that
your only other option may be to specify a MANIFEST.MF which kind of
defeats the purpose a bit of using maven to generate that. Maybe add a
feature to the plugins (they are usually open source :)?

cheers,
Nimret

Post by Stuart Maclean stuart-2Mt1T0R+FriWzc88wn+***@public.gmane.org [seajug]
I use log4j for logging. I do NOT want to bundle the log4.properties
file in the main jar, since then I have to unpack/repack the jar to
change a log level. Instead, I add '.' to the classpath, and then place
a log4j.properties file alongside the 'main jar' (the sole one
referenced in the java cmd line).
Looking at the manifest built by the jar plugin, I can see that the '.'
is PREPENDED to the class path. I would prefer it APPENDED. As it is,
it opens a security hole whereby trojaned classfiles in/under '.' would
get loaded ahead of classes housed in my intended jars. It's akin to
putting '.' at the start of your Unix PATH env var, a definite no-no.
Any Maven gurus out there know how to force the plugin to re-order my
manifest ?

[Stuart Maclean [e-mail] [seajug]]

are you doing the following for ease in local development or on an actual
deployment to an environment?

I am doing it really for local dev, or distribution within a small group
of users. However, I am always on the lookout for best practices of
larger scale distribution, and think I have asked about that on here
before. So, how DO you distribute a bunch of related jars, and say a
README. As a zip file, or via some installer?

stu


------------------------------------
Posted by: Stuart Maclean <stuart-2Mt1T0R+FriWzc88wn+***@public.gmane.org>
------------------------------------


------------------------------------

Yahoo Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/seajug/

<*> Your email settings:
Individual Email | Traditional

<*> To change settings online go to:
http://groups.yahoo.com/group/seajug/join
(Yahoo! ID required)

<*> To change settings via email:
seajug-digest-***@public.gmane.org
seajug-fullfeatured-***@public.gmane.org

<*> To unsubscribe from this group, send an email to:
seajug-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo Groups is subject to:
https://info.yahoo.com/legal/us/yahoo/utos/terms/

[Nimret Sandhu [e-mail] [seajug]]

a client or a server side distributable?

here are some distribution choices:
1. zip file as already mentioned :)

2. for client I'd recommend web start or a native installer with a bundled
jre (rpm/deb, nsis for windows, no idea for mac - maybe http://goo.gl/KXe1HY
:)

3. for server I'd recommend a docker image (newest hotness!
http://goo.gl/g81TRM) or something like http://goo.gl/2zb444 and the
equivalent for other platforms (rpm/deb + init scripts) .. zip file may be
easiest though.

cheers,
-
Nimret Sandhu
http://www.nimret.org

Post by Nimret Sandhu nimret-rf+Eeaps6PzQT0dZR+***@public.gmane.org [seajug]
are you doing the following for ease in local development or on an actual
deployment to an environment?
I am doing it really for local dev, or distribution within a small group
of users. However, I am always on the lookout for best practices of
larger scale distribution, and think I have asked about that on here
before. So, how DO you distribute a bunch of related jars, and say a
README. As a zip file, or via some installer?
stu
------------------------------------
------------------------------------
------------------------------------
Yahoo Groups Links