SpringBoot Starter jars not excluded from repackaged jars using spring-boot-maven-plugin.

JarTypeFilter is not handling dependency jars with missing manifest files. This results in all starter jars being included in the repackaged jar.

A NullPointerException is thrown from JarTypeFilter.filter on this line:

    String jarType = jarFile.getManifest().getMainAttributes().getValue("Spring-Boot-Jar-Type");

When this occurs, the NPE is caught in FilterArtifacts.filter which skips the results of the executing filter, resulting in the starter jars being retained in the repackaged jar file.

If the manifest file is missing, the jar should still be included by this filter (returning false). Either of these fix the issue...

    return Optional.ofNullable(jarFile.getManifest())
            .map(Manifest::getMainAttributes)
            .map(attributes -> attributes.getValue("Spring-Boot-Jar-Type"))
            .map(EXCLUDED_JAR_TYPES::contains)
            .orElse(Boolean.FALSE);

    final Manifest manifest = jarFile.getManifest();
    if (manifest != null) {
        String jarType = manifest.getMainAttributes().getValue("Spring-Boot-Jar-Type");
        return jarType != null && EXCLUDED_JAR_TYPES.contains(jarType);
    }
    return false;

This jar was the culprit in our project. net.sourceforge.streamsupport:streamsupport:1.2.1.

Comment From: dreis2211

Nice find @edwardsre. If I remember correctly, my original PR for this included a catch on every Exception - not just IOException - which the Gradle part still does for example: see JarTypeFileSpec. I guess the third alternative is to harmonize this on the Maven side of things. I'd be happy to open a PR if you don't mind to fix this, but I don't want to steal your chance to provide a PR yourself. Just let me know.

Comment From: edwardsre

Nice find @edwardsre. If I remember correctly, my original PR for this included a catch on every Exception - not just IOException - which the Gradle part still does for example: see JarTypeFileSpec. I guess the third alternative is to harmonize this on the Maven side of things. I'd be happy to open a PR if you don't mind to fix this, but I don't want to steal your chance to provide a PR yourself. Just let me know.