Detect broken MR-JAR files

[sormuras]

For example, when a MR-JAR contains a version 9 directory within its META-INF facility, it shouldn't contain classes that are compiled with --release 10 or higher.

See this broken Java module as a reference: https://repo1.maven.org/maven2/org/lwjgl/lwjgl/3.2.2/lwjgl-3.2.2.jar

In its META-INF/versions/9/ directory are classes reporting bytecode level 54.0 (Java 10):

IIRC, jar is not used to create the JAR file. Correct, @Spasi?

[Spasi]

Correct, the Ant jar task was used.

[sormuras]

Just uploaded a simple "multi-release JAR" sanity checker tool. Find it here: https://github.com/sormuras/modules/blob/master/src/MultiReleaseCheck.java

• java MultiReleaseCheck.java org.lwjgl:lwjgl:3.1.6 yields 0, as it isn't a MRJAR
• java MultiReleaseCheck.java org.lwjgl:lwjgl:3.2.0 yields 1 due to
  Expected 9, but 'META-INF/versions/9/module-info.class' reports: 10 (54)

[sormuras]

With Java 17, jar supports a --validate option -- see openjdk/jdk#3971 for details.