elharo opened a new pull request, #147:
URL: https://github.com/apache/maven-shared-jar/pull/147
Fixes #133
## Problem
`JarBytecodeHashAnalyzer.computeHash()` overwrote `result` on each loop
iteration, so the computed bytecode hash only covered the **last** class entry
in the JAR:
```java
for (JarEntry entry : entries) {
try (InputStream is = jarAnalyzer.getEntryInputStream(entry)) {
result = DigestUtils.sha1Hex(is); // overwrites previous result
}
}
```
As a result, two JARs with completely different class sets could produce the
same `bytecodeHash` whenever their last-sorted class entry was identical,
contradicting the analyzer's contract of detecting an exact copy of the file's
class data.
## Fix
The SHA-1 digest is now updated incrementally across every class entry (in
the stable, name-sorted order produced by `JarAnalyzer`), and the final digest
is hex-encoded once after the loop.
## Tests
Added `JarBytecodeHashAnalyzerTest` with two tests, both verified to **fail
before the fix** and pass after:
- `computeHashCoversAllClassEntries`: the hash of `codec.jar` (14 classes)
equals the SHA-1 of the concatenated class bytes.
- `distinctClassSetsProduceDistinctHashes`: two JARs sharing only the
last-sorted class entry produce different hashes (they previously hashed
identically).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
