-
Bug
-
Resolution: Won't Fix
-
Medium
-
4.0.2
-
None
-
Severity 2 - Major
I'm not sure if this has been reintroduced or something else is wrong, since the CLOVKB claims it is not the case: https://confluence.atlassian.com/display/CLOVERKB/Maven+is+deploying+instrumented+jars
(I am using the instrument goal - followed by log and check)
In the below, you can see that, e.g., target/clover/magnolia-module-diff-1.7-SNAPSHOT-clover-tests.jar gets copied to .../magnolia-module-diff-1.7-SNAPSHOT-tests.jar (without -clover qualifier!)
This seems to happen for ~all artifacts except the "main" jar. (test jar, assemblies, etc..).
In this case, the situation is saved by the "real" install plugin that gets executed later and overwrites those wrong artifacts. However, if we use the (newish) installAtEnd feature of the maven-install-plugin, then this doesn't happen, and we end up with instrumented jars in place of the non-instrumented ones, which has tons of ugly consequences. See for yourself with the snippet:
<build> <pluginManagement> <plugins> <plugin> <groupId>org.apache.maven.plugins</groupId> <artifactId>maven-install-plugin</artifactId> <configuration> <installAtEnd>false</installAtEnd> </configuration> </plugin> </plugins> </pluginManagement> </build>
Why is Clover installing anything, anyway ? Shouldn't it just attach the instrumented jars (and only those) to the build, and let Maven do the rest ?
[INFO] --- maven-clover2-plugin:4.0.2:check (instrument-and-check) @ magnolia-module-diff --- [INFO] [INFO] --- maven-install-plugin:2.5.2:install (default-install) @ magnolia-module-diff --- [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/clover/magnolia-module-diff-1.7-SNAPSHOT-clover.jar to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-clover.jar [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/pom.xml to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT.pom [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/magnolia-module-diff-1.7-SNAPSHOT-bundle.zip to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-bundle.zip [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/magnolia-module-diff-1.7-SNAPSHOT-bundle.tar.gz to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-bundle.tar.gz [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/magnolia-module-diff-1.7-SNAPSHOT-tests.jar to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-tests.jar [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/clover/magnolia-module-diff-1.7-SNAPSHOT-clover-bundle.zip to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-bundle.zip [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/clover/magnolia-module-diff-1.7-SNAPSHOT-clover-bundle.tar.gz to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-bundle.tar.gz [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/clover/magnolia-module-diff-1.7-SNAPSHOT-clover-tests.jar to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-tests.jar [INFO] [INFO] <<< maven-clover2-plugin:4.0.2:instrument (instrument-and-check) < [clover]install @ magnolia-module-diff <<< [INFO] [INFO] --- maven-clover2-plugin:4.0.2:instrument (instrument-and-check) @ magnolia-module-diff --- [INFO] [INFO] --- maven-clover2-plugin:4.0.2:log (instrument-and-check) @ magnolia-module-diff --- [INFO] Clover Version 4.0.2, built on October 13 2014 (build-943) [...] [INFO] Coverage check PASSED [INFO] [INFO] --- maven-install-plugin:2.5.2:install (default-install) @ magnolia-module-diff --- [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/magnolia-module-diff-1.7-SNAPSHOT.jar to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT.jar [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/pom.xml to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT.pom [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/magnolia-module-diff-1.7-SNAPSHOT-bundle.zip to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-bundle.zip [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/magnolia-module-diff-1.7-SNAPSHOT-bundle.tar.gz to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-bundle.tar.gz [INFO] Installing /Users/gjoseph/Dev/magnolia/git/enterprise/diff/target/magnolia-module-diff-1.7-SNAPSHOT-tests.jar to /Users/gjoseph/.m2/repository/info/magnolia/magnolia-module-diff/1.7-SNAPSHOT/magnolia-module-diff-1.7-SNAPSHOT-tests.jar [INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESS [INFO] ------------------------------------------------------------------------
- relates to
-
CLOV-1632 Protect against deployment of instrumented code
- Closed
[CLOV-1668] Clover installs instrumented-jars in local Maven repo, in place of non-instrument ones
Update: the CLOV-1632 will not check for all possible cases in which a custom classifier could be used - it will check only if the main artifact has a custom classifier defined (which can happen if, for example, some plugin forks a build cycle and renames an artifact); it will not check if some plugin adds an additional artifact with a classifier (e.g. build-helper-maven-plugin attach-artifact, maven-antrun-plugin attachArtifact).
It means that this CLOV-1632 may not cover your specific case in full extent - it will fail a build with 'install/deploy' is called, but not if maven-jar-plugin:test-jar is called.
Gregory Joseph
added a comment - Cool - good news and thanks for the update ! I'll be watching the other issue 
Gregory Joseph
added a comment - Cool - good news and thanks for the update ! I'll be watching the other issue Update: I'm working on a CLOV-1632 issue, which will protect against installation / deployment of instrumented code. This issue will also check whether any artifact uses a custom classifier. This could be useful for you.
Indeed, installation happens for every forked build. And in my opinion this is a correct behaviour. In my opinion installAtEnd means "install at the end of every build life cycle executed" and not "install at the end of the main build life cycle only".
On a side note, do you have any clue why this doesn't work with installAtEnd (i.e the install happens during clover's forked process rather than at the end).
I will analyze it and let you know.
Indeed. This would require fixes/hacks in other plugins. Probably not only in the maven-jar-plugin only. Not every plugin has proper configuration options.
For instance, jar:jar has the 'classifier' property:
- JarMojo.java (line 52)
while the jar:test-jar has this hard-coded:
- TestJarMojo.java (line 56)
Gregory Joseph
added a comment - Ha, I naively thought this could be fixed in com.atlassian.maven.plugin.clover.CloverInstrumentInternalMojo#redirectArtifact, but now I get what you were saying earlier.. other classifiers created by other plugins are not taken care of by this method (it even looks like we could blame it on those other plugins since they override Clover's classifier)
On a side note, do you have any clue why this doesn't work with installAtEnd (i.e the install happens during clover's forked process rather than at the end)
Gregory Joseph
added a comment - Ha, I naively thought this could be fixed in com.atlassian.maven.plugin.clover.CloverInstrumentInternalMojo#redirectArtifact , but now I get what you were saying earlier.. other classifiers created by other plugins are not taken care of by this method (it even looks like we could blame it on those other plugins since they override Clover's classifier)
On a side note, do you have any clue why this doesn't work with installAtEnd (i.e the install happens during clover's forked process rather than at the end) Gregory Joseph
added a comment - Sure, thanks. I'd like to lower priority of this bug from Critical to Major. Do you agree?
Thanks - adding <repositoryPollutionProtection>true</repositoryPollutionProtection> right now, although I'm not sure it'll change anything for us, since we switched back from <goal>instrument</goal> to <goal>instrument-test</goal>