✨ feat: Add Maven build extensions support to lockfile by tkubas-rh · Pull Request #1529 · chains-project/maven-lockfile

tkubas-rh · 2026-03-15T18:07:40Z

Summary

Adds support for tracking Maven build extensions in lockfiles. Build extensions modify Maven's core behavior and are loaded before the build starts, making them critical for supply chain security and build reproducibility.

Implementation

The algorithm resolves build extensions through the following process:

Use project.getBuildExtensions() (non-deprecated API) to get extension model objects
Resolve extensions using Eclipse Aether's RepositorySystem with batch resolution via CollectRequest/DependencyRequest
Reuse resolveComponentDependencies() (renamed from resolvePluginDependencies) for transitive dependency resolution
Filter to compile+runtime scopes only (exclude TEST scope dependencies)
Add extensions to the mavenExtensions key in the lockfile

Changes

Extracts common plugin/extension logic into AbstractMavenComponent base class
Adds MavenExtension data class with dependencies support
Updates LockFile to include mavenExtensions field
Updates LockFileDifference to diff extensions
Implements extension resolution in LockFileFacade
Adds extension validation to ValidateChecksumMojo
Includes 3 integration tests covering simple, multiple, and validation failure scenarios

Bug Fixes

Fixes ValidateChecksumMojo to respect includeEnvironment config flag

Closes #1513

maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/data/LockFile.java

...lugin/src/main/java/io/github/chains_project/maven_lockfile/data/AbstractMavenComponent.java

maven_plugin/src/test/java/it/IntegrationTestsIT.java

...lugin/src/main/java/io/github/chains_project/maven_lockfile/data/AbstractMavenComponent.java

- Create AbstractMavenComponent base class for plugins and extensions - Add MavenExtension data class with dependencies support - Update LockFile to include mavenExtensions field - Update LockFileDifference to diff extensions

- Include extension diffing in lockfile validation - Show missing extensions in validation error output

- Add RepositorySystem injection to AbstractLockfileMojo - Implement getAllExtensions() using project.getBuildExtensions() - Use batch resolution with Aether's CollectRequest/DependencyRequest - Rename resolvePluginDependencies to resolveComponentDependencies - Resolve extension dependencies using compile+runtime scopes - Pass repositorySystem to generateLockFileFromProject() Assisted-by: Claude Code

- buildExtensionsSimple: single extension with dependencies - buildExtensionsMultiple: multiple extensions - buildExtensionsValidationFail: tampered checksum detection 🐛 fix: Respect includeEnvironment config in ValidateChecksumMojo - Only generate environment metadata when config.isIncludeEnvironment() is true - Read lockfile config before generating environment metadata - Fixes false validation failures when lockfile has includeEnvironment=false 🐛 fix: Add checksum tiebreakers in AbstractMavenComponent.compareTo() - Add checksumAlgorithm and checksum comparison after version - Ensures consistent ordering and equals()/compareTo() contract - Fixes MavenPluginTest comparison test failures Assisted-by: Claude Code

- Verify extension dependencies are not empty - Verify all dependencies have valid scopes - Ensure TEST scope dependencies are excluded - Match thoroughness of plugin tests Assisted-by: Claude Code

- Update buildExtensionsValidationFail lockfile POM checksum - Allows test to reach extension validation instead of failing on POM

Signed-off-by: Timotej Kubas <tkubas@redhat.com>

Replace CRTP pattern with simple runtime typechecks. This simplifies the code while maintaining type isolation between MavenPlugin and MavenExtension. Changes: - Remove <T extends AbstractMavenComponent<T>> type parameter - Fix equals() to check exact type (this.getClass() != obj.getClass()) - Add type-first ordering in compareTo() - Add cross-type comparison tests to MavenPluginTest - Add MavenExtensionTest with comprehensive test coverage Signed-off-by: Timotej Kubas <tkubas@redhat.com>

Remove redundant buildExtensionsSimple test as buildExtensionsMultiple provides sufficient coverage for build extensions functionality. Changes: - Remove buildExtensionsSimple test directory - Remove buildExtensionsSimple test method from IntegrationTestsIT Signed-off-by: Timotej Kubas <tkubas@redhat.com>

Signed-off-by: Timotej Kubas <tkubas@redhat.com>

brunoapimentel · 2026-03-26T21:20:56Z

@algomaster99 Can we also get a review on this one?

Signed-off-by: Timotej Kubas <tkubas@redhat.com>

algomaster99 · 2026-03-27T16:39:46Z

@brunoapimentel sure! I can go through it over the weekend. Personally, I have not directly used build extensions so I will also need to spend some time understanding its usecase :)

algomaster99

Overall, looks good. I left some minor comments below.

algomaster99 · 2026-03-29T11:28:39Z

...lugin/src/main/java/io/github/chains_project/maven_lockfile/data/AbstractMavenComponent.java

+                && Objects.equals(resolved, other.resolved)
+                && Objects.equals(repositoryId, other.repositoryId)


resolved and repositoryId were not used to compare MavenPlugin before, but now they would be. I believe that is correct behaviour. Just flagging it here in case.

algomaster99 · 2026-03-29T11:31:29Z

maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/LockFileFacade.java

+                        transitiveDeps));
+            }
+        } catch (DependencyResolutionException e) {
+            PluginLogManager.getLog().warn("Failed to resolve extension dependencies", e);


I guess a follow up PR could be to have an option to enforce failure here and I also think you would want this option in Konflux otherwise hermetic builds won't succeed.

algomaster99 · 2026-03-29T11:38:24Z

maven_plugin/src/test/resources-its/it/IntegrationTestsIT/buildExtensionsMultiple/pom.xml

+    <extensions>
+      <extension>
+        <groupId>kr.motd.maven</groupId>
+        <artifactId>os-maven-plugin</artifactId>
+        <version>1.7.1</version>
+      </extension>
+      <extension>
+        <groupId>org.apache.maven.wagon</groupId>
+        <artifactId>wagon-ssh</artifactId>
+        <version>3.5.3</version>
+      </extension>
+    </extensions>


This is a not a question related to the PR, but more to enhance my knowledge. What behaviour difference to the build one will observe where these two extensions are configured? I also don't understand how extensions are invoked. Plugins can be invoked using certain goals from example so I am trying to find an analogy.

algomaster99 · 2026-03-29T11:42:38Z

maven_plugin/src/test/java/it/IntegrationTestsIT.java

+        assertThat(lockFile.getMavenExtensions())
+                .anyMatch(ext -> ext.getGroupId().getValue().equals("kr.motd.maven")
+                        && ext.getArtifactId().getValue().equals("os-maven-plugin"));
+        assertThat(lockFile.getMavenExtensions())
+                .anyMatch(ext -> ext.getGroupId().getValue().equals("org.apache.maven.wagon")
+                        && ext.getArtifactId().getValue().equals("wagon-ssh"));


Typecasting them to list and then comparing would also assert the order implicitly although we know TreeSet is ordered.

algomaster99 · 2026-03-29T11:43:14Z

maven_plugin/src/test/java/it/IntegrationTestsIT.java

+    public void buildExtensionsValidationFail(MavenExecutionResult result) throws Exception {
+        // contract: if an extension checksum in the lockfile doesn't match the actual extension,
+        // validation should fail
+        System.out.println("Running 'buildExtensionsValidationFail' integration test.");


Suggested change

System.out.println("Running 'buildExtensionsValidationFail' integration test.");

Probably a debugging statement?

algomaster99 · 2026-03-29T11:43:39Z

maven_plugin/src/test/java/it/IntegrationTestsIT.java

+    @SuppressWarnings("null")
+    public void buildExtensionsMultiple(MavenExecutionResult result) throws Exception {
+        // contract: if a project uses multiple build extensions, all should be recorded in the lockfile
+        System.out.println("Running 'buildExtensionsMultiple' integration test.");


Suggested change

System.out.println("Running 'buildExtensionsMultiple' integration test.");

algomaster99 · 2026-03-29T12:05:56Z

@tkubas-rh can you please run spotless:apply to fix Maven test workflow? For the rest, @LogFlames do you know what is the exact issue and how to address them?

LogFlames · 2026-03-30T23:09:41Z

Lockfile PR / check-lockfile fails due to the maven version being updated in GitHub CI runners. I have created #1535 to update, after which a rebase should fix it.

Doc Generation and Maven test / maven-quality are both caused by spotless violations. Quality fails since there are spotless violations, and doc fails since it tries to fix them and push to update (but it cannot push the update to the fork).

I'll have to investigate why Smoke Tests are failing and come back!

tkubas-rh force-pushed the build-extensions branch from 263ffc8 to 89017a9 Compare March 15, 2026 18:13

tkubas-rh changed the title ~~WIP: ✨ feat: Add Maven build extensions support to lockfile~~ ✨ feat: Add Maven build extensions support to lockfile Mar 16, 2026

brunoapimentel reviewed Mar 16, 2026

View reviewed changes

maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/data/LockFile.java Outdated Show resolved Hide resolved

brunoapimentel reviewed Mar 16, 2026

View reviewed changes

maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/data/LockFile.java Show resolved Hide resolved

...lugin/src/main/java/io/github/chains_project/maven_lockfile/data/AbstractMavenComponent.java Outdated Show resolved Hide resolved

brunoapimentel reviewed Mar 16, 2026

View reviewed changes

maven_plugin/src/test/java/it/IntegrationTestsIT.java Outdated Show resolved Hide resolved

brunoapimentel reviewed Mar 16, 2026

View reviewed changes

...lugin/src/main/java/io/github/chains_project/maven_lockfile/data/AbstractMavenComponent.java Show resolved Hide resolved

tkubas-rh force-pushed the build-extensions branch from 3154344 to e7602f2 Compare March 18, 2026 07:47

tkubas-rh requested a review from brunoapimentel March 18, 2026 08:39

tkubas-rh force-pushed the build-extensions branch from e7602f2 to 008fc34 Compare March 22, 2026 22:37

tkubas-rh added 10 commits March 26, 2026 21:19

✨ feat: Add extension validation to ValidateChecksumMojo

899e84b

- Include extension diffing in lockfile validation - Show missing extensions in validation error output

✅ test: Enhance extension tests to verify dependency scopes

c5ea532

- Verify extension dependencies are not empty - Verify all dependencies have valid scopes - Ensure TEST scope dependencies are excluded - Match thoroughness of plugin tests Assisted-by: Claude Code

🐛 fix: Update test lockfile with correct POM checksum

b03f47c

- Update buildExtensionsValidationFail lockfile POM checksum - Allows test to reach extension validation instead of failing on POM

style: Apply spotless code formatting

17b5d72

Signed-off-by: Timotej Kubas <tkubas@redhat.com>

🎨 style: Apply spotless code formatting

036758f

Signed-off-by: Timotej Kubas <tkubas@redhat.com>

🎨 style: Apply spotless code formatting

79cb8a1

Signed-off-by: Timotej Kubas <tkubas@redhat.com>

tkubas-rh force-pushed the build-extensions branch from a78b484 to 79cb8a1 Compare March 26, 2026 21:32

algomaster99 requested changes Mar 29, 2026

View reviewed changes

		&& Objects.equals(resolved, other.resolved)
		&& Objects.equals(repositoryId, other.repositoryId)

Conversation

tkubas-rh commented Mar 15, 2026

Summary

Implementation

Changes

Bug Fixes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

brunoapimentel commented Mar 26, 2026

Uh oh!

algomaster99 commented Mar 27, 2026

Uh oh!

algomaster99 left a comment

Choose a reason for hiding this comment

Uh oh!

algomaster99 Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

algomaster99 Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

algomaster99 Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

algomaster99 Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

algomaster99 Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

algomaster99 Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

algomaster99 commented Mar 29, 2026

Uh oh!

LogFlames commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants