Copilot commented on code in PR #2205:
URL: https://github.com/apache/maven-resolver/pull/2205#discussion_r4251525800


##########
maven-resolver-spi/src/main/java/org/eclipse/aether/spi/io/PathProcessorSupport.java:
##########
@@ -71,6 +76,18 @@ public class PathProcessorSupport implements PathProcessor {
     protected static final long WINDOWS_MOVE_RETRY_DELAY =
             Long.getLong(PathProcessor.class.getName() + 
"WINDOWS_MOVE_RETRY_DELAY", 50L);
 
+    /**
+     * Whether to fall back to a direct (non-atomic) stream copy when all 
rename attempts on Windows are exhausted
+     * with {@link AccessDeniedException} due to a persistent file lock (for 
example an IDE holding the target
+     * {@code .jar} open). When {@code true} (the default), the installer 
degrades gracefully to the pre-2.0.24
+     * behavior — the target is overwritten in-place via a stream, which on 
Windows succeeds even if another
+     * process holds a shared read handle. The atomicity guarantee is lost for 
this last-resort path, but the

Review Comment:
   Making the truncating fallback default-on globally reinstates the f007 
integrity failure for more than installation: `PathProcessorSupport` also 
publishes downloaded artifacts and `writeFile` output. If the process dies 
during `classicCopy`, a partially written artifact remains at its trusted final 
path and later builds do not revalidate local-repository contents. Preserve 
atomic publication for resolution/write paths by making this fallback opt-in or 
scoping it to the install-specific compatibility path.



##########
maven-resolver-spi/src/main/java/org/eclipse/aether/spi/io/PathProcessorSupport.java:
##########
@@ -71,6 +76,18 @@ public class PathProcessorSupport implements PathProcessor {
     protected static final long WINDOWS_MOVE_RETRY_DELAY =
             Long.getLong(PathProcessor.class.getName() + 
"WINDOWS_MOVE_RETRY_DELAY", 50L);
 
+    /**
+     * Whether to fall back to a direct (non-atomic) stream copy when all 
rename attempts on Windows are exhausted
+     * with {@link AccessDeniedException} due to a persistent file lock (for 
example an IDE holding the target
+     * {@code .jar} open). When {@code true} (the default), the installer 
degrades gracefully to the pre-2.0.24
+     * behavior — the target is overwritten in-place via a stream, which on 
Windows succeeds even if another
+     * process holds a shared read handle. The atomicity guarantee is lost for 
this last-resort path, but the
+     * build succeeds. Set to {@code false} to keep the strict never-truncate 
contract and let the build fail
+     * with the original {@link AccessDeniedException} instead.
+     */
+    protected static final boolean WINDOWS_CLASSIC_COPY_FALLBACK = 
Boolean.parseBoolean(
+            System.getProperty(PathProcessor.class.getName() + 
"WINDOWS_CLASSIC_COPY_FALLBACK", "true"));

Review Comment:
   The documented opt-out cannot take effect: `PathProcessor.class.getName()` 
does not include a trailing dot, so this reads 
`org.eclipse.aether.spi.io.PathProcessorWINDOWS_CLASSIC_COPY_FALLBACK` rather 
than the documented `...PathProcessor.WINDOWS_CLASSIC_COPY_FALLBACK`. Add the 
separator so 
`-Dorg.eclipse.aether.spi.io.PathProcessor.WINDOWS_CLASSIC_COPY_FALLBACK=false` 
actually disables the fallback.
   
   This issue also appears on line 329 of the same file.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to