DiscoveryServer packaging changed in latest release

[habelson]

Describe the bug
We have been using the 2024.0.x train, and up until now the DiscoveryServer was packaged such that the jar could be used as a library jar, to allow for extension and embedding. This was a change at some point from 2023 and prior which packaged the main jar as a spring boot executable jar (I know there was an issue related to this at the time, but I can't find it in searches now)

This change was a huge benefit for us and we were excited to see it introduced in the release of 3.2.1. Where the jar was packaged as a basic jar, and a classifier for exec was used to still make the spring boot executable jar available.

It appears that as of 3.2.2 (and also 3.3.0 and 5.0.0-M1) this behavior has regressed, and the main jar has been returned to only published as the executable jar.

I understand that customization may be a more niche use-case, and I would be fine if the special classifier was used for the lib rather than the executable, but I would like to request a return to making the library version of discoveryserver available.

It appears was added, after some discussion for issue #1456 and then apparently removed with no explanation in PR #1921

Sample

file	size
spring-cloud-kubernetes-discoveryserver-3.2.1-exec.jar	67212079
spring-cloud-kubernetes-discoveryserver-3.2.1.jar	9433
spring-cloud-kubernetes-discoveryserver-3.2.2.jar	67364887

[ryanjbaxter]

Thanks for opening this issue!

You are correct that these jars are no longer executable. The primary reason for this (and this was a Spring wide decision not specific to Spring Cloud Kubernetes) has to do with the potential of providing executable jars that contain CVEs. We (the Spring team) do not want to incur the responsibility of someone taking an executable we produce which could contain a vulnerability and just running it and being responsible for any potential negative consequences from the vulnerability.

I understand the extra overhead this causes and do apologize for that.