elharo commented on issue #539: URL: https://github.com/apache/maven-war-plugin/issues/539#issuecomment-5070706162
The root cause is that the Windows Subsystem for Linux (WSL) mounts Windows NTFS file systems with synthetic POSIX permissions. Unless explicitly configured via `wsl.conf` to map permissions accurately, WSL often defaults to setting the executable bit (e.g., `755` or `777`) on all files. When the `maven-war-plugin` copies dependency JARs from the local Maven repository into the `WEB-INF/lib` directory, it preserves these synthetic permissions. However, JAR files in a web application are strictly data archives and should not have executable permissions. Retaining the executable bit can break reproducible builds and may trigger false positives in security scanners or strict deployment environments. Normalizing file permissions (such as forcing standard `644` permissions for copied libraries) during the assembly process is a robust solution. It decouples the final build artifact from the quirks of the developer's local file system mount, ensuring consistent and correct WAR generation across different operating systems. This issue should be accepted and implemented. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
