openjsse / openeddsa

JCE provider for the EdDSA crypto algorithms
GNU General Public License v2.0
3 stars 0 forks source link

POM on Maven Central (1.1.0) begins with newline character #1

Open emlun opened 3 years ago

emlun commented 3 years ago

Hi!

The 1.1.0 POM file published to Maven Central begins with a newline character:

$ curl -s https://repo.maven.apache.org/maven2/org/openjsse/openeddsa/openeddsa/1.1.0/openeddsa-1.1.0.pom | xxd | head -n3
00000000: 0a3c 3f78 6d6c 2076 6572 7369 6f6e 3d22  .<?xml version="
00000010: 312e 3022 2065 6e63 6f64 696e 673d 2255  1.0" encoding="U
00000020: 5446 2d38 223f 3e0a 3c70 726f 6a65 6374  TF-8"?>.<project

This causes both Gradle and other XML parsers to reject it:

$ gradle test
[...]
[Fatal Error] openeddsa-1.1.0.pom:3:6: The processing instruction target matching "[xX][mM][lL]" is not allowed.

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':webauthn-server-core-minimal:compileTestJava'.
> Could not resolve all files for configuration ':webauthn-server-core-minimal:testCompileClasspath'.
   > Could not resolve org.openjsse.openeddsa:openeddsa:[1.1.0,2).
     Required by:
         project :webauthn-server-core-minimal
      > Could not resolve org.openjsse.openeddsa:openeddsa:1.1.0.
         > Could not parse POM https://repo.maven.apache.org/maven2/org/openjsse/openeddsa/openeddsa/1.1.0/openeddsa-1.1.0.pom
            > The processing instruction target matching "[xX][mM][lL]" is not allowed.
[...]

It is also rejected by both Firefox:

XML Parsing Error: XML or text declaration not at start of entity Location: https://repo.maven.apache.org/maven2/org/openjsse/openeddsa/openeddsa/1.1.0/openeddsa-1.1.0.pom Line Number 2, Column 1:

<?xml version="1.0" encoding="UTF-8"?>
^

and Chrome:

This page contains the following errors: error on line 2 at column 6: XML declaration allowed only at the start of the document

The SHA1 checksum and PGP signature both check out, so this seems to be an issue with the original file rather than how Maven Central is serving it.

emlun commented 3 years ago

Oh, looks like it's even there in the original source file. :smile: