maven-core fails to build

Hi,

I currently cannot get maven, because maven-core fails to build. To reproduce:

guix shell maven

Log:

[mkdir] Created dir: /tmp/guix-build-maven-core-3.8.5.drv-0/apache-maven-3.8.5/maven-core/build/jar

[jar] Building jar: /tmp/guix-build-maven-core-3.8.5.drv-0/apache-maven-3.8.5/maven-core/build/jar/maven-core.jar

BUILD SUCCESSFUL

Total time: 1 second

phase `build' succeeded after 2.3 seconds

starting phase `generate-metadata'

SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".

SLF4J: Defaulting to no-operation (NOP) logger implementation

SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinderfor further details.

[INFO] Discovered 58 component descriptors(s)

Problem executing command line.

Error stacktrace:

java.io.IOException: Invalid input descriptor for merge: /tmp/plexus-metadata3957336728290309540xml --> http://xml.org/sax/features/external-general-entitiesfeature http://xml.org/sax/features/external-general-entities not supported for SAX driver org.codehaus.plexus.metadata.merge.Driver

at org.codehaus.plexus.metadata.merge.AbstractMerger.mergeDescriptors(Unknown Source)

at org.codehaus.plexus.metadata.DefaultMetadataGenerator.generateDescriptor(Unknown Source)

at org.codehaus.plexus.metadata.PlexusMetadataGeneratorCli.invokePlexusComponent(Unknown Source)

at org.codehaus.plexus.tools.cli.AbstractCli.execute(Unknown Source)

at org.codehaus.plexus.tools.cli.AbstractCli.execute(Unknown Source)

at org.codehaus.plexus.metadata.PlexusMetadataGeneratorCli.main(Unknown Source)

error: in phase 'generate-metadata': uncaught exception:

system-error "open-file" "~A: ~S" ("No such file or directory" "build/classes/META-INF/plexus/components.t.xml") (2)

phase `generate-metadata' failed after 0.8 seconds

Backtrace:

12 (primitive-load "/gnu/store/ndhm39px4lh3jrcqpkaa3ykwgji…")

In guix/build/gnu-build-system.scm:

906:2 11 (gnu-build #:source _ #:outputs _ #:inputs _ #:phases . #)

In ice-9/boot-9.scm:

1752:10 10 (with-exception-handler _ _ #:unwind? _ # _)

In srfi/srfi-1.scm:

634:9 9 (for-each #<procedure 7ffff034be20 at guix/build/gnu-b…> …)

In ice-9/boot-9.scm:

1752:10 8 (with-exception-handler _ _ #:unwind? _ # _)

In guix/build/gnu-build-system.scm:

927:23 7 (_)

In ice-9/eval.scm:

619:8 6 (_ #(#(#(#<directory (guile-user) 7ffff1fd3c80>) (…)) #))

311:34 5 (_ #(#(#(#<directory (guile-user) 7ffff1fd3c80>) (…)) #))

293:34 4 (_ #(#(#<directory (guile-user) 7ffff1fd3c80>) "build…"))

In ice-9/ports.scm:

450:11 3 (call-with-input-file "build/classes/META-INF/plexus/c…" …)

In unknown file:

2 (open-file "build/classes/META-INF/plexus/components.t…" …)

In ice-9/boot-9.scm:

1685:16 1 (raise-exception _ #:continuable? _)

1685:16 0 (raise-exception _ #:continuable? _)

ice-9/boot-9.scm:1685:16: In procedure raise-exception:

In procedure open-file: No such file or directory: "build/classes/META-INF/plexus/components.t.xml"

Best wishes,

Arne

--

Unpolitisch sein

heißt politisch sein,

ohne es zu merken.

draketo.de

I did some digging and found this regression is caused by commit:

6068b83b82475566acd4162467bcf54270f338f9

"gnu: java-jdom: Update to 2.0.6.1 [fixes CVE-2021-33813]."

Apparently the fix for this issue causes jdom to be very strict;

Which sound familiar when looking at that CVE

(https://github.com/advisories/GHSA-2363-cqg2-863c):

I dunno how to fix this though, I'm just a curious guixer. Easiest path

seems to be to make a new java-jdom-2.0.6 var and use that as a

native-input for maven. Would that be an acceptable solution?

Cheers,

Remco

Le Sat, 04 Jun 2022 12:25:21 +0200,

Remco van 't Veer <remco@remworks.net> a écrit :

Like you say, the issue is with the new jdom. Believe it or not, but

between 2.0.6 and 2.0.6.1 there's some breakage (and > 1 year of

changes, too)!

So I figured I could fix java-plexus-component-metadata that we use to

generate some xml files during the build of maven. jdom is one of its

inputs. Adding another jdom to the native inputs would probably not fix

the issue.

What I did instead is, since jdom wants to set more features than

supported in the driver, to add dummy support for all these additional

features by just not throwing the exception. It's not very satisfying,

but it works and we don't keep a vulnerable jdom around. With the

attached patch, I built up to maven.

2022/06/04 15:47, Julien Lepiller:

Reverting the jdom upgrade patch, I did get mave-core to build. I admit

I did not try running it. My interest in maven is as a dependency to

clojure-tools, I don't really know how to test maven is actually working

by itself.

Smart! I look forward to seeing your patch land in the main branch.

Cheers,

Remco

Julien Lepiller <julien@lepiller.eu> writes:

Thank you!

The patch looks clear enough — will you push it?

Best wishes,

Arne

--

Unpolitisch sein

heißt politisch sein,

ohne es zu merken.

draketo.de

Hi,

I was able to build java-plexus-component-metadata using this patch, and

from there maven to clojure-tools.

Cheers,

Futurile

On 2022-06-04 15:47, Julien Lepiller wrote:

Work for me as well. Probably can be merged to master?

--

Best regards,

Andrew Tropin

Le Sat, 04 Jun 2022 17:00:15 +0200,

"Dr. Arne Babenhauserheide" <arne_bab@web.de> a écrit :

Pushed to master as f0d9248267dabd2feb5c004d6e4610cbdf3e5b87, thanks

for testing it :)