gnodet opened a new pull request, #599: URL: https://github.com/apache/maven-jar-plugin/pull/599
## Summary `SOURCE_DATE_EPOCH=0` (Unix epoch, 1970) is a widely-used reproducible-build convention (Debian, many Apache projects). Since 4.0.0-beta-2 the plugin delegates directly to the JDK `jar` tool, which rejects dates before 1980 with: ``` date 1970-01-01T00:00:00Z is not within the valid range 1980-01-01T00:00:02Z to 2099-12-31T23:59:59Z ``` This was silently accepted by maven-jar-plugin 3.3.x and is a regression. ## Root cause The ZIP format does not support entry timestamps before 1980-01-01. The `jar` tool enforces this strictly. `getOutputTimestamp()` did not validate or clamp the value before forwarding it to `--date`. ## Fix In `getOutputTimestamp()`, after resolving the timestamp (POM property, `SOURCE_DATE_EPOCH` env variable, or seconds-since-epoch conversion), the value is now parsed as an `Instant` and clamped to `DATE_MIN` (`1980-01-01T00:00:02Z`) when it falls below that value, with a `WARN`-level log message. Values already within range are unchanged. Values that cannot be parsed as a date-time (opaque strings passed verbatim to the tool) are also unchanged. ## Tests `AbstractJarMojoTest` with 10 cases covering: - `SOURCE_DATE_EPOCH=0` (seconds) → clamped - Negative seconds → clamped - ISO 8601 `1970-01-01T00:00:00Z` → clamped - ISO 8601 offset before 1980 → clamped - ISO 8601 offset within range → unchanged - `315532802` (exactly `DATE_MIN`) → not clamped - Valid modern timestamp → unchanged - Unparseable string → unchanged - `null` → returns `null` Fixes #595. _Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
