HV-2032 Test strict JAXP configuration in a nightly build

Author: marko-bekhta

jenkins/nightly/Jenkinsfile

@@ -8,7 +8,11 @@
 @Library('[email protected]') _
 
 def withMavenWorkspace(Closure body) {
-	withMaven(jdk: 'OpenJDK 17 Latest', maven: 'Apache Maven 3.9',
+	withMavenWorkspace('OpenJDK 17 Latest', body)
+}
+
+def withMavenWorkspace(jdk, Closure body) {
+	withMaven(jdk: jdk, maven: 'Apache Maven 3.9',
 			mavenLocalRepo: env.WORKSPACE_TMP + '/.m2repository',
 			options: [
 					// Artifacts are not needed and take up disk space
@@ -33,24 +37,57 @@ pipeline {
 		overrideIndexTriggers(false)
 	}
 	stages {
-		stage('Build reproducibility check') {
-			agent {
-				label 'Worker&&Containers'
-			}
-			steps {
-				// The timeout cannot be in stage options, because that would
-				// include the time needed to provision a node.
-				timeout(time: 15, unit: 'MINUTES') {
-					withMavenWorkspace {
-						echo "Generate the artifacts."
-						sh "mvn clean install -Preproducibility-check"
+		stage ('Run checks') {
+			parallel {
+				stage('Build reproducibility check') {
+					agent {
+						label 'Worker&&Containers'
+					}
+					steps {
+						// The timeout cannot be in stage options, because that would
+						// include the time needed to provision a node.
+						timeout(time: 15, unit: 'MINUTES') {
+							withMavenWorkspace {
+								echo "Generate the artifacts."
+								sh "mvn clean install -Preproducibility-check"
+
+								echo "Running the reproducibility check."
+								sh """mvn clean verify \
+									artifact:compare -Dreference.repo=hibernate-maven-central \
+									-Preproducibility-check \
+									--fail-at-end
+								"""
+							}
+						}
+					}
+				}
+				stage('Build with strict JAXP security settings') {
+					agent {
+						label 'Worker&&Containers'
+					}
+					steps {
+						script {
+							jdkVersion = 'OpenJDK 23 Latest'
+						}
+						// The timeout cannot be in stage options, because that would
+						// include the time needed to provision a node.
+						timeout(time: 15, unit: 'MINUTES') {
+							withMavenWorkspace(jdkVersion, {
+								script {
+									compilerToolPath = tool(name: jdkVersion, type: 'jdk')
+									jaxpStrictProperties = pwd(tmp: true) + '/jaxp-strict.properties'
+								}
+
+								echo "Copy strict JAXP configuration properties."
+								sh "cp $compilerToolPath/conf/jaxp-strict.properties.template $jaxpStrictProperties"
 
-						echo "Running the reproducibility check."
-						sh """mvn clean verify \
-							artifact:compare -Dreference.repo=hibernate-maven-central \
-							-Preproducibility-check \
-							--fail-at-end
-						"""
+								echo "Run a build with strict JAXP configuration."
+								sh """mvn clean install \
+									 -Dsurefire.jvm.args.jaxp.strict-args="-Djava.xml.config.file=$jaxpStrictProperties" \
+									 -Djava-version.test.release=23
+								"""
+							})
+						}
 					}
 				}
 			}

pom.xml

@@ -361,6 +361,7 @@
         <surefire.jvm.args.illegal-access></surefire.jvm.args.illegal-access>
         <surefire.jvm.args.add-opens></surefire.jvm.args.add-opens>
         <surefire.jvm.args.java-version></surefire.jvm.args.java-version>
+        <surefire.jvm.args.jaxp.strict-args></surefire.jvm.args.jaxp.strict-args>
         <!--
           The arguments below are Shrinkwrap settings taken from
           https://github.com/shrinkwrap/resolver/blob/788a3c1148af3a7ebdfdaf817393273f5f5ee17b/impl-maven/src/main/java/org/jboss/shrinkwrap/resolver/impl/maven/bootstrap/MavenSettingsBuilder.java#L80
@@ -369,8 +370,8 @@
         <surefire.jvm.args.shrinkwrap>
             -Dmaven.repo.local=${settings.localRepository}
         </surefire.jvm.args.shrinkwrap>
-        <surefire.jvm.args>${surefire.jvm.args.additional} ${surefire.jvm.args.add-opens} ${surefire.jvm.args.illegal-access} ${surefire.jvm.args.shrinkwrap} ${surefire.jvm.args.java-version} ${surefire.jvm.args.commandline}</surefire.jvm.args>
-        <failsafe.jvm.args>${surefire.jvm.args.additional} ${surefire.jvm.args.add-opens} ${surefire.jvm.args.illegal-access} ${surefire.jvm.args.shrinkwrap} ${surefire.jvm.args.java-version} ${surefire.jvm.args.commandline}</failsafe.jvm.args>
+        <surefire.jvm.args>${surefire.jvm.args.additional} ${surefire.jvm.args.add-opens} ${surefire.jvm.args.illegal-access} ${surefire.jvm.args.shrinkwrap} ${surefire.jvm.args.java-version} ${surefire.jvm.args.commandline} ${surefire.jvm.args.jaxp.strict-args}</surefire.jvm.args>
+        <failsafe.jvm.args>${surefire.jvm.args.additional} ${surefire.jvm.args.add-opens} ${surefire.jvm.args.illegal-access} ${surefire.jvm.args.shrinkwrap} ${surefire.jvm.args.java-version} ${surefire.jvm.args.commandline} ${surefire.jvm.args.jaxp.strict-args}</failsafe.jvm.args>
 
         <!--
             Should be set from the command line.