1

Last time I successfully added a nice checksum-maven-plugin in maven. I generate the checksum for one of my file. I am using for that this special configuration:

<execution>
      <phase>package</phase>
  <goals>
    <goal>files</goal>
  </goals>
</execution>
    ...
<fileSets>
<fileSet>
  <directory>${basedir}/myfiles</directory>
  <includes>
    <include>file-name</include>
  </includes>
</fileSet>
</fileSets>

It works perfect and generates a file-name.md5 file with checksum inside /target.

I build my JAR with maven-assembly-plugin with this execution.

<execution>
  <phase>package</phase>
  <goals>
    <goal>single</goal>
  </goals>
</execution>

Inside Java I have already access to my src/main/resources/my.properties properties file with:

InputStream inputStream = RunJetty.class.getClassLoader()
        .getResourceAsStream("my.properties");

(this works OK).

I need the checksum generated by checksum-maven-plugin pass to Java code. How to do that?

After some comments I see two options:

  • One is to add the checksum file to JAR.
  • 2'nd is to add the checksum value to my.properties file (or create separate properties file).
Knight of Ni
  • 1,780
  • 3
  • 20
  • 47
  • 1
    Any particular reason why it's better to have this in the property file than as a separate resource? You'd probably have to do something like write your own plugin to generate `my.properties`, or use resource filtering and uh... somehow have the filtering pass have this as a system property. – millimoose Sep 06 '13 at 17:55
  • 1
    This question is lacking **a lot** of important context. But why don't you just exclude the file in the plugin that builds your jar? – Daniel Kaplan Sep 06 '13 at 17:56
  • @millimoose. I have already use the properties file and filter some setting from POM, so this was my first choice. I though maybe some command execution for OS like appending this to new my.properties file would be nice. But this would be non portable. – Knight of Ni Sep 06 '13 at 18:14
  • @tieTYT. I am new to Maven. What context do you mean? You mean I can add this file with checksum file to my JAR? Not sure haw to do that. It would be perfect. – Knight of Ni Sep 06 '13 at 18:16
  • 1
    @flyer maybe there's a language barrier here, but I don't understand what you're currently generating vs what you want to generate. Show us your jar structure and the way you want it to look. Also, show us more of your pom. – Daniel Kaplan Sep 06 '13 at 18:22
  • edited. More POM stuff. JAR structure? nothing fancy I think. Just my app + dependencies. – Knight of Ni Sep 06 '13 at 19:07
  • @flyer It just seems to me like the less abstruse option would be just to add a utility method that reads the contents of the `file-name.md5` file instead of heavily modifying the build to put everything into a single property file for no reason besides consistency. (Encapsulating reading your configuration files is a good idea one way or the other.) Also, the preferrable way of loading `.properties` files is `ResourceBundle.getBundle()` - less exception handling if nothing else. – millimoose Sep 06 '13 at 20:44

1 Answers1

1

Perhaps, the JAR manifest is an appropriate location for storing hashes, as long as you don't want to store hashes of the jar itself, of course. If hashes are used for more than consistency checks, e.g. licensing, one could use salts and encryption to increase security.

  • The maven-jar-plugin is able to
    • sign the jar
    • customize the manifest
    • package custom files

      I think, this is the way to go, as the maven artefacts ought to remain consistent this way, whereas altering the jars afterwards could get you into trouble. Look here for how to add custom files, e.g. your property file. However, take care to configure the checksum-maven-plugin before this plugin, alternatively, you could also bring its execution forward by mapping it to the prepare-package phase.

  • For how to read manifests, look here: Reading my own Jar's Manifest

  • For consistency among Java classes, one could also 'seal' a jar.

The oracle manifest tutorial: http://docs.oracle.com/javase/tutorial/deployment/jar/manifestindex.html

The checksum-maven-plugin is indeed not capable to emit the hashes as a property.

Solutions I can currently think of are:

  1. Add the relative path of that hash list file within the jar to the manifest. I don't think it's that bad to separate the hashes from the manifest as you've done it so far, especially if the hash list is large.
  2. Add another plugin execution to read the file generated with the cheksum plugin; See: https://stackoverflow.com/a/9339405/1175253. But this alone is probably insufficient, as one cannot add the hashes iteratively without further work. One would possibly end up with dumping the hash file contents into a manifest entry or writing a custom plugin. If I'd be up to develop such a plugin, I'd start with the mojo-executor-maven-plugin, which allows integration of existing plugins.
Community
  • 1
  • 1
Sam
  • 7,778
  • 1
  • 23
  • 49
  • This would be another nice option (with one less file in JAR). I am already adding a main class to manifest with Maven. How can I receive the checksum from `checksum-maven-plugin`? Seems `checksum-maven-plugin` just creates a file. Can I 'bind' like this: ${something.from.checksum.plugin} – Knight of Ni Sep 06 '13 at 20:09
  • Thanks for confirmation. That is bad the `checksum-maven-plugin` doesn't do that. It would be great feature (it this is possible in Maven). – Knight of Ni Sep 06 '13 at 20:54