8352480: Don't follow symlinks in additional content for app images #24974

sashamatveev · 2025-04-30T20:17:57Z

Symbolic links will not be followed for --app-content on all platforms.
Added test to cover this case.
MacHelper updated to use "cp -R" instead of "cp -r" when unpacking DMG, since "cp -r" on macOS is not documented option and when used cp will follow symbolic links which breaks test. "cp -R" does not follow symbolic links.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8352480: Don't follow symlinks in additional content for app images (Bug - P4)

Reviewers

Alexey Semenyuk (@alexeysemenyukoracle - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/24974/head:pull/24974
$ git checkout pull/24974

Update a local copy of the PR:
$ git checkout pull/24974
$ git pull https://git.openjdk.org/jdk.git pull/24974/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 24974

View PR using the GUI difftool:
$ git pr show -t 24974

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/24974.diff

Using Webrev

Link to Webrev Comment

…images

bridgekeeper · 2025-04-30T20:18:20Z

👋 Welcome back almatvee! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-04-30T20:18:41Z

@sashamatveev This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8352480: Don't follow symlinks in additional content for app images

Reviewed-by: asemenyuk

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 56 new commits pushed to the master branch:

cc3a366: 8333568: Test that jpackage doesn't modify R/O files/directories
8a8893e: 8356562: SigningAppImageTwoStepsTest test fails
c2a4fa1: 8355573: Remove kludge_c++11.h from jpackage code
... and 53 more: https://git.openjdk.org/jdk/compare/bed5114e3a061d13bbc2031334d73f4527309f90...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2025-04-30T20:19:17Z

@sashamatveev The following label will be automatically applied to this pull request:

core-libs

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2025-04-30T20:21:55Z

Webrevs

alexeysemenyukoracle · 2025-04-30T20:56:19Z

I don't like the idea of changing behavior on only one platform. It should be consistent across all platforms. Let's not follow symlinks on other platforms, either.

…images [v2]

…images [v3]

myankelev · 2025-05-01T21:23:38Z

test/jdk/tools/jpackage/share/AppContentTest.java

 *  --jpt-run=AppContentTest
 */
 public class AppContentTest {



Nitpick: do you think it might be worth it to add a bug id to the @test?

No. I do not see a need. This is a generic test and not something specific to particular JBS issue.

…images [v4]

sashamatveev · 2025-05-07T01:30:05Z

I don't like the idea of changing behavior on only one platform. It should be consistent across all platforms. Let's not follow symlinks on other platforms, either.

Fix is updated not to follow links on all platforms. Test is updated as well.

test/jdk/tools/jpackage/share/AppContentTest.java

…images [v5]

alexeysemenyukoracle · 2025-05-07T12:26:54Z

test/jdk/tools/jpackage/share/AppContentTest.java

        Path contentDir = cmd.appLayout().contentDirectory();
-        if (copyInResources) {
-            return contentDir.resolve("Resources");
+        // Links are always created in "Resources"


Links are always created in "Resources"

All additional content on macOS is created in the "Resources" directory. On Linux there is no such requirement.

The return value of getAppContentPath() is not supposed to depend on the additional content type; the new "name" parameter doesn't make sense to me.

For links we creating link and corresponding text file, so for it we should put both files into folder and add it to --app-content app-content-0/Resources. Note app-content-0 is temp folder with random name and if we using it directly we end up copying app-content-0 into application bundle. In such case it will not be possible to figure out location of link without putting it under known folder name such as "Resources".

"name" is to figure out if it link and if link it should be under "Resources".

I can see you reverted the getAppContentPath() back. I guess it happened after your comment :)

alexeysemenyukoracle · 2025-05-07T12:27:56Z

test/jdk/tools/jpackage/share/AppContentTest.java

+            Path appContentArg = TKit.createTempDirectory("app-content").resolve("Resources");
            var srcPath = TKit.TEST_SRC_ROOT.resolve(appContentPath);
-            var dstPath = appContentArg.resolve(srcPath.getFileName());
+            Path dstPath = appContentArg.resolve(srcPath.getFileName());


This is a redundant change

alexeysemenyukoracle · 2025-05-07T12:28:08Z

test/jdk/tools/jpackage/share/AppContentTest.java


        private static Path copyAppContentPath(Path appContentPath) throws IOException {
-            var appContentArg = TKit.createTempDirectory("app-content").resolve("Resources");
+            Path appContentArg = TKit.createTempDirectory("app-content").resolve("Resources");


This is a redundant change

alexeysemenyukoracle · 2025-05-07T12:43:53Z

test/jdk/tools/jpackage/share/AppContentTest.java

        private static List<Path> initAppContentPaths(List<Path> appContentPaths) {
-            if (copyInResources) {
+            boolean copy = (copyInResources || appContentPaths.stream()
+                            .anyMatch(s -> s.toString().contains("Link")));


s.toString().contains("Link") is a lousy way to detect if the path is a symlink. "s" can be an absolute path (to the local OpenJDK repo) that may have a "Link" substring in one of path components, like "/home/BLink/my-projects/open/test/jdk/tools/jpackage/non-existant". The test will fail, and we will have a very hard time figuring out the cause. I'd fix it by narrowing the scope from the full path to the filename; create a dedicated function for detecting if the given path is supposed to be a symlink instead of repeating .toString().contains("Link"):

private static boolean isSymlinkPath(Path v) { return v.getFileName().toString().contains("Link"); }

…images [v6]

sashamatveev · 2025-05-09T01:38:14Z

8352480: [macos] Don't follow symlinks in additional content for app images [v6]

Fixed latest comments.
Link will be created under "Links" folder to avoid confusion with reusing "Resources"
Link creation moved under separate function createAppContentLink from copyAppContentPath to avoid confusion.

sashamatveev · 2025-05-09T16:46:26Z

/integrate

openjdk · 2025-05-09T16:47:10Z

Going to push as commit 601f05e.
Since your change was applied there have been 71 commits pushed to the master branch:

2661f62: 8356036: (fs) FileKey.hashCode and UnixFileStore.hashCode implementations can use Long.hashCode
bed29a0: 8356555: Incorrect use of {@link} in BigDecimal
dd25799: 8356212: runtime/cds/appcds/LotsOfSyntheticClasses.java timed out with -XX:+AOTClassLinking
... and 68 more: https://git.openjdk.org/jdk/compare/bed5114e3a061d13bbc2031334d73f4527309f90...master

Your commit was automatically rebased without conflicts.

openjdk · 2025-05-09T16:47:20Z

@sashamatveev Pushed as commit 601f05e.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8352480: [macos] Don't follow symlinks in additional content for app …

004304e

…images

openjdk bot added the rfr Pull request is ready for review label Apr 30, 2025

openjdk bot added the core-libs core-libs-dev@openjdk.org label Apr 30, 2025

sashamatveev changed the title ~~8352480: [macos] Don't follow symlinks in additional content for app images~~ 8352480: Don't follow symlinks in additional content for app images Apr 30, 2025

sashamatveev added 2 commits April 30, 2025 15:27

8352480: [macos] Don't follow symlinks in additional content for app …

c2d97df

…images [v2]

8352480: [macos] Don't follow symlinks in additional content for app …

e876867

…images [v3]

myankelev reviewed May 1, 2025

View reviewed changes

8352480: [macos] Don't follow symlinks in additional content for app …

b5f365a

…images [v4]

sashamatveev marked this pull request as draft May 6, 2025 21:44

openjdk bot removed the rfr Pull request is ready for review label May 6, 2025

Merge remote-tracking branch 'upstream/master' into JDK-8352480

519be97

sashamatveev marked this pull request as ready for review May 7, 2025 01:28

openjdk bot added the rfr Pull request is ready for review label May 7, 2025

wenshao reviewed May 7, 2025

View reviewed changes

test/jdk/tools/jpackage/share/AppContentTest.java Outdated Show resolved Hide resolved

8352480: [macos] Don't follow symlinks in additional content for app …

166c3ff

…images [v5]

alexeysemenyukoracle reviewed May 7, 2025

View reviewed changes

8352480: [macos] Don't follow symlinks in additional content for app …

5c8dc6d

…images [v6]

alexeysemenyukoracle approved these changes May 9, 2025

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label May 9, 2025

openjdk bot added the integrated Pull request has been integrated label May 9, 2025

openjdk bot closed this May 9, 2025

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels May 9, 2025

8352480: Don't follow symlinks in additional content for app images #24974

8352480: Don't follow symlinks in additional content for app images #24974

Uh oh!

Conversation

sashamatveev commented Apr 30, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issue

Reviewers

Reviewing

Uh oh!

bridgekeeper bot commented Apr 30, 2025

Uh oh!

openjdk bot commented Apr 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Apr 30, 2025

Uh oh!

mlbridge bot commented Apr 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

alexeysemenyukoracle commented Apr 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sashamatveev commented May 7, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sashamatveev commented May 9, 2025

Uh oh!

sashamatveev commented May 9, 2025

Uh oh!

openjdk bot commented May 9, 2025

Uh oh!

openjdk bot commented May 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

sashamatveev commented Apr 30, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Apr 30, 2025 •

edited

Loading

mlbridge bot commented Apr 30, 2025 •

edited

Loading