Audit third-party code bundled in published JARs

Setup

Run the setup commands from the repository root with Java 17. Maven output is left visible so build progress and failures are easy to follow.

java -version
./mvnw clean package --batch-mode -DskipTests
./mvnw --batch-mode process-resources source:jar-no-fork javadoc:jar

Verification

After setup completes, run the verification separately:

bash <<'EOF'
set -euo pipefail
export LC_ALL=C

tmp_dir=$(mktemp -d)
trap 'rm -rf "$tmp_dir"' EXIT

candidate_jars="$tmp_dir/candidates"
third_party_jars="$tmp_dir/third-party"
javadoc_jars="$tmp_dir/javadocs"
clean_jars="$tmp_dir/clean"

: >"$third_party_jars"
: >"$javadoc_jars"
: >"$clean_jars"

find . -mindepth 3 -maxdepth 3 -type f \
  -path './*/target/*.jar' \
  ! -name 'original-*.jar' \
  ! -name 'parquet-benchmarks.jar' \
  -print0 >"$candidate_jars"

count_non_parquet_classes() {
  jar tf "$1" | awk '
    /\.class$/ {
      path=$0
      sub(/^META-INF\/versions\/[0-9]+\//, "", path)
      if (path !~ /^org\/apache\/parquet\//) count++
    }
    END { print count+0 }
  '
}

count_external_sources() {
  jar tf "$1" | awk '
    /\.java$/ && $0 !~ /^org\/apache\/parquet\// { count++ }
    END { print count+0 }
  '
}

count_extra_test_classes() {
  local jar_file=$1
  local module_dir=$2
  local jar_classes="$tmp_dir/jar-classes"
  local project_classes="$tmp_dir/project-classes"

  jar tf "$jar_file" | awk '/\.class$/' | sort -u >"$jar_classes"
  : >"$project_classes"

  if [[ -d "$module_dir/target/test-classes" ]]; then
    (
      cd "$module_dir/target/test-classes"
      find . -type f -name '*.class' -print |
        sed 's#^\./##' |
        sort -u
    ) >"$project_classes"
  fi

  comm -13 "$project_classes" "$jar_classes" | awk 'END { print NR+0 }'
}

printf 'Inspecting existing JARs...\n'

jar_count=0
while IFS= read -r -d '' jar_file; do
  jar_count=$((jar_count + 1))
  jar_name=$(basename "$jar_file")
  module_dir=${jar_file%/target/*}

  case "$jar_name" in
    *-javadoc.jar)
      unzip -p "$jar_file" script.js >"$tmp_dir/script.js"
      if grep -Fq 'Oracle and/or its affiliates' "$tmp_dir/script.js"; then
        printf '%s\tJDK-generated JavaScript/CSS\n' "$jar_file" >>"$javadoc_jars"
      else
        printf '%s\n' "$jar_file" >>"$clean_jars"
      fi
      continue
      ;;
    *-sources.jar)
      bundled_count=$(count_external_sources "$jar_file")
      ;;
    *-tests.jar)
      bundled_count=$(count_extra_test_classes "$jar_file" "$module_dir")
      ;;
    *)
      bundled_count=$(count_non_parquet_classes "$jar_file")
      ;;
  esac

  if [[ $bundled_count -gt 0 ]]; then
    printf '%s\t%d bundled classes or sources\n' \
      "$jar_file" "$bundled_count" >>"$third_party_jars"
  else
    printf '%s\n' "$jar_file" >>"$clean_jars"
  fi
done <"$candidate_jars"

if [[ $jar_count -eq 0 ]]; then
  printf 'No JARs found. Run the setup commands first.\n' >&2
  exit 1
fi

printf '\n=== JARs containing bundled third-party code ===\n\n'
sort "$third_party_jars"

printf '\n=== Javadoc JARs containing JDK-provided assets ===\n\n'
sort "$javadoc_jars"

printf '\n=== JARs with no bundled third-party code found ===\n\n'
sort "$clean_jars"

printf '\nInspected %d published JARs.\n' "$jar_count"
EOF