3.5.0 fails to create modular JARs on Windows with JDK < 14 (NPE in plexus-archiver)

[ascheman]

Summary

maven-jar-plugin 3.5.0 fails to create modular JARs (projects with a module-info.java) on Windows when running on JDK 8–13 and a Reproducible-Builds timestamp (project.build.outputTimestamp) is set:

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-jar-plugin:3.5.0:jar (default-jar) on project ...: Error assembling JAR: NullPointerException

Stack (condensed):

MavenArchiver.createArchive
  → AbstractArchiver.createArchive
  → JarToolModularJarArchiver.postCreateArchive
  → JarToolModularJarArchiver.fixLastModifiedTimeZipEntries (JarToolModularJarArchiver.java:158)
  → java.lang.NullPointerException

This is a regression versus 3.4.2.

Root cause

3.5.0 ships plexus-archiver 4.10.4, whose fixLastModifiedTimeZipEntries() calls

Files.getFileAttributeView(destFile, PosixFileAttributeView.class, LinkOption.NOFOLLOW_LINKS)
        .readAttributes();

without a null guard — on Windows there is no POSIX attribute view, so getFileAttributeView returns null. The method is only reached when the JDK jar tool does not support --date (JDK < 14), which is why JDK 17/21 builds are fine.

plexus-archiver 4.12.0 already contains the fix (if (view != null) …), and both master and maven-jar-plugin-3.x already depend on 4.12.0 — no code change is needed. This issue asks for a 3.5.1 release from maven-jar-plugin-3.x.

Impact

Maven 3.10.0-rc-1's super-POM makes jar-plugin 3.5.0 the default, so every modular JAR build on Windows + JDK 8–13 breaks out of the box. First seen on apache/maven-surefire CI, where the windows-latest jdk-11 × 3.10.0-rc-1 matrix cell fails 4 modular IT fixtures with exactly this NPE (e.g. https://github.com/apache/maven-surefire/actions/runs/29647349025/job/88088170720, PRs #3392/#3394 — failure is unrelated to those PRs' content).

Reproduction / verification

Minimal reproducer + verification on a windows-latest / Zulu 11 GitHub runner:
https://github.com/aschemaven/maven-surefire/actions/runs/29678927319
(job builds a minimal modular project with jar-plugin 3.5.0 → NPE reproduced; second step overrides plexus-archiver to 4.12.0 as a plugin dependency → build succeeds.)

Workaround for consumers until 3.5.1

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-jar-plugin</artifactId>
  <version>3.5.0</version>
  <dependencies>
    <dependency>
      <groupId>org.codehaus.plexus</groupId>
      <artifactId>plexus-archiver</artifactId>
      <version>4.12.0</version>
    </dependency>
  </dependencies>
</plugin>

(or pin jar-plugin 3.4.2)

Happy to help with the 3.5.1 release if useful.

[elharo]

The fix is already in the current development version. pom.xml line 85 sets plexusArchiverVersion to 4.12.0, and plexus-archiver 4.12.0 includes the null guard for Files.getFileAttributeView() returning null on Windows (no POSIX attribute view). No code change is needed in this repository — a 3.5.1 release from the maven-jar-plugin-3.x branch would pick up the dependency bump.

[ascheman]

I intentionally opened this issue, though it was clear (and documented) that the problem itself was already solved - I just wanted to track the problem as it blocks further processing of apache/maven-surefire#3392 and apache/maven-surefire#3394.

plexus-archiver 4.12.0 already contains the fix (if (view != null) …), and both master and maven-jar-plugin-3.x already depend on 4.12.0 — no code change is needed. This issue asks for a 3.5.1 release from maven-jar-plugin-3.x.

I will also intentionally close the issue when the time has come.

If this violates any ASF/Maven policy or good practice, I am happy to learn.

[elharo]

If it's fixed, it's fixed. This bug is not for release tracking.