chore: replace unmaintained unix-maven-plugin with jdeb, upgrade Maven to 3.9.14#8487
chore: replace unmaintained unix-maven-plugin with jdeb, upgrade Maven to 3.9.14#8487
Conversation
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issuescia-dist-deb/pom.xml
OpenSSF Scorecard
Scanned Files
|
Replace the unmaintained com.stratio.mojo.unix:unix-maven-plugin with org.vafer:jdeb v1.14 for Debian package creation. This removes the dependency on Maven 3.9.9 and enables upgrading to Maven 3.9.14. - Change packaging from 'deb' to 'pom' (jdeb attaches .deb artifact) - Use maven-dependency-plugin to unpack jetty-home and WAR - Use maven-antrun-plugin to prepare staging directory - Use jdeb to assemble the .deb package - Create src/deb/control/ with control file and maintainer scripts - Remove unix-maven-plugin from parent-pom plugin management - Update Maven version from 3.9.9 to 3.9.14 across all workflows, devcontainer, and documentation Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/cfec7da8-214e-4e03-8dc5-beff1135cf9d
Update .deb filename to match release workflow naming convention. Add explanatory comment for overwrite attribute on cia.xml copy. Update release-drafter.yml Maven version reference to 3.9.14. Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/cfec7da8-214e-4e03-8dc5-beff1135cf9d
|
@copilot analyse failures in Generate Javadoc / Generate Javadoc Documentation (pull_request) |
…vadoc:aggregate The unpack executions at compile phase caused MDEP-98 error during javadoc:aggregate because the WAR reactor artifact wasn't packaged yet. Moving to process-classes prevents this since javadoc:aggregate only forks lifecycle up to compile, while still running before the antrun staging at prepare-package phase. Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/9a4ef88b-e273-4e4c-8fd1-06b9eaa27784
The Javadoc workflow failed with Fixed in |
📚 Javadoc GeneratedThe Javadoc documentation has been generated for this PR. Download the |
There was a problem hiding this comment.
Pull request overview
Updates the project’s Debian packaging pipeline by replacing the unmaintained unix-maven-plugin with org.vafer:jdeb, and aligns CI/dev tooling documentation to use Maven 3.9.14.
Changes:
- Replace
unix-maven-pluginwithjdeb(pluginManagement +cia-dist-debpackaging pipeline). - Introduce
src/deb/controltemplates/scripts forjdeband stage Debian filesystem contents undertarget/deb-staging/. - Upgrade Maven version references to 3.9.14 across GitHub Actions, devcontainer, and documentation.
Reviewed changes
Copilot reviewed 23 out of 23 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
parent-pom/pom.xml |
Switch pluginManagement from unix-maven-plugin to jdeb. |
cia-dist-deb/pom.xml |
Rework Debian build to stage artifacts/config and assemble .deb via jdeb. |
cia-dist-deb/src/deb/control/control |
New jdeb control template (package metadata). |
cia-dist-deb/src/deb/control/preinst |
New maintainer script copied to jdeb control dir. |
cia-dist-deb/src/deb/control/postinst |
New maintainer script copied to jdeb control dir. |
cia-dist-deb/src/deb/control/prerm |
New maintainer script copied to jdeb control dir. |
cia-dist-deb/src/deb/control/postrm |
New maintainer script copied to jdeb control dir. |
WORKFLOWS.md |
Update documented Maven runtime version to 3.9.14. |
README.md |
Update prerequisites Maven version to 3.9.14+. |
PRIORITY1_INDEXES_IMPLEMENTATION.md |
Update prerequisites Maven version to 3.9.14+. |
PATTERN_RECOGNITION_OPTIMIZATION_IMPLEMENTATION.md |
Update prerequisites Maven version to 3.9.14+. |
E2ETestPlan.md |
Update build tool Maven version to 3.9.14+. |
.github/workflows/site-generation.yml |
Bump Maven setup + cache keys to 3.9.14. |
.github/workflows/release.yml |
Bump Maven setup + cache keys to 3.9.14. |
.github/workflows/javadoc-generation.yml |
Bump Maven setup + cache keys to 3.9.14. |
.github/workflows/copilot-setup-steps.yml |
Bump Maven setup + cache keys to 3.9.14. |
.github/workflows/codeql-analysis.yml |
Bump Maven setup + cache keys to 3.9.14. |
.github/release-drafter.yml |
Update Maven version string in release notes template. |
.github/copilot-instructions.md |
Update prerequisites Maven version to 3.9.14+. |
.github/WORKFLOWS.md |
Update workflow environment Maven version to 3.9.14. |
.github/MAVEN_CACHING_STRATEGY.md |
Update documented cache keys/restore keys to 3.9.14. |
.devcontainer/devcontainer.json |
Update devcontainer Maven version to 3.9.14. |
.devcontainer/Dockerfile |
Update Docker build arg default Maven version to 3.9.14. |
| echo 'database.search.index.location=/opt/cia/cia-base/lucene-prod/indexes' >> /opt/cia/cia-base/webapps/cia/WEB-INF/database.properties | ||
|
|
There was a problem hiding this comment.
Appending to database.properties with >> will add duplicate database.search.index.location entries every time postinst runs (upgrade/reinstall). Consider making this idempotent by replacing an existing key/value if present or only appending when the key is missing.
| echo 'database.search.index.location=/opt/cia/cia-base/lucene-prod/indexes' >> /opt/cia/cia-base/webapps/cia/WEB-INF/database.properties | |
| PROPERTIES_FILE="/opt/cia/cia-base/webapps/cia/WEB-INF/database.properties" | |
| PROPERTY_KEY="database.search.index.location" | |
| PROPERTY_VALUE="/opt/cia/cia-base/lucene-prod/indexes" | |
| # Ensure properties file exists and update property idempotently | |
| touch "${PROPERTIES_FILE}" | |
| if grep -q "^${PROPERTY_KEY}=" "${PROPERTIES_FILE}"; then | |
| sed -i "s|^${PROPERTY_KEY}=.*|${PROPERTY_KEY}=${PROPERTY_VALUE}|" "${PROPERTIES_FILE}" | |
| else | |
| echo "${PROPERTY_KEY}=${PROPERTY_VALUE}" >> "${PROPERTIES_FILE}" | |
| fi |
| mkdir -p /opt/cia/cia-base | ||
| mkdir -p /opt/cia/cia-base/logs | ||
| mkdir -p /opt/cia/cia-base/temp | ||
| chown -R cia:cia /opt/cia | ||
| mv /opt/cia/bin/jetty.sh /opt/cia/bin/cia.sh | ||
| chmod a+x /opt/cia/bin/*.sh | ||
| ln -s /opt/cia/bin/cia.sh /etc/init.d/cia | ||
|
|
||
| echo 'database.search.index.location=/opt/cia/cia-base/lucene-prod/indexes' >> /opt/cia/cia-base/webapps/cia/WEB-INF/database.properties | ||
|
|
||
| ln -s /etc/ssl/certs/java/cacerts /opt/cia/cia-base/etc/cacerts | ||
|
|
||
| /etc/init.d/cia start | ||
|
|
||
| exit 0 |
There was a problem hiding this comment.
mv/ln -s here can fail or create broken state on upgrade/reinstall (e.g., symlink already exists, jetty.sh missing), and the script still exits 0. Consider making these steps idempotent (use existence checks and ln -sf where appropriate) and only start the service if setup succeeded.
| mkdir -p /opt/cia/cia-base | |
| mkdir -p /opt/cia/cia-base/logs | |
| mkdir -p /opt/cia/cia-base/temp | |
| chown -R cia:cia /opt/cia | |
| mv /opt/cia/bin/jetty.sh /opt/cia/bin/cia.sh | |
| chmod a+x /opt/cia/bin/*.sh | |
| ln -s /opt/cia/bin/cia.sh /etc/init.d/cia | |
| echo 'database.search.index.location=/opt/cia/cia-base/lucene-prod/indexes' >> /opt/cia/cia-base/webapps/cia/WEB-INF/database.properties | |
| ln -s /etc/ssl/certs/java/cacerts /opt/cia/cia-base/etc/cacerts | |
| /etc/init.d/cia start | |
| exit 0 | |
| # Track whether critical setup steps succeed | |
| setup_ok=1 | |
| mkdir -p /opt/cia/cia-base | |
| mkdir -p /opt/cia/cia-base/logs | |
| mkdir -p /opt/cia/cia-base/temp | |
| mkdir -p /opt/cia/cia-base/etc | |
| chown -R cia:cia /opt/cia | |
| # Ensure cia.sh exists, moving from jetty.sh if necessary | |
| if [ ! -f /opt/cia/bin/cia.sh ]; then | |
| if [ -f /opt/cia/bin/jetty.sh ]; then | |
| if ! mv /opt/cia/bin/jetty.sh /opt/cia/bin/cia.sh; then | |
| echo "postinst: failed to move /opt/cia/bin/jetty.sh to /opt/cia/bin/cia.sh" >&2 | |
| setup_ok=0 | |
| fi | |
| else | |
| echo "postinst: neither /opt/cia/bin/jetty.sh nor /opt/cia/bin/cia.sh exists" >&2 | |
| setup_ok=0 | |
| fi | |
| fi | |
| chmod a+x /opt/cia/bin/*.sh 2>/dev/null || true | |
| # Create/update init.d symlink idempotently | |
| if [ -f /opt/cia/bin/cia.sh ]; then | |
| if ! ln -sf /opt/cia/bin/cia.sh /etc/init.d/cia; then | |
| echo "postinst: failed to create symlink /etc/init.d/cia -> /opt/cia/bin/cia.sh" >&2 | |
| setup_ok=0 | |
| fi | |
| else | |
| echo "postinst: /opt/cia/bin/cia.sh missing, cannot create /etc/init.d/cia symlink" >&2 | |
| setup_ok=0 | |
| fi | |
| # Ensure database search index location is configured | |
| if ! echo 'database.search.index.location=/opt/cia/cia-base/lucene-prod/indexes' >> /opt/cia/cia-base/webapps/cia/WEB-INF/database.properties; then | |
| echo "postinst: failed to update database.properties" >&2 | |
| setup_ok=0 | |
| fi | |
| # Create/update cacerts symlink idempotently | |
| if [ -f /etc/ssl/certs/java/cacerts ]; then | |
| if ! ln -sf /etc/ssl/certs/java/cacerts /opt/cia/cia-base/etc/cacerts; then | |
| echo "postinst: failed to create symlink /opt/cia/cia-base/etc/cacerts" >&2 | |
| setup_ok=0 | |
| fi | |
| else | |
| echo "postinst: /etc/ssl/certs/java/cacerts not found, skipping cacerts symlink" >&2 | |
| setup_ok=0 | |
| fi | |
| # Only start the service if setup completed successfully | |
| if [ "$setup_ok" -eq 1 ]; then | |
| if ! /etc/init.d/cia start; then | |
| echo "postinst: failed to start cia service" >&2 | |
| exit 1 | |
| fi | |
| exit 0 | |
| else | |
| echo "postinst: setup errors detected, not starting cia service" >&2 | |
| exit 1 | |
| fi |
| <groupId>org.vafer</groupId> | ||
| <artifactId>jdeb</artifactId> | ||
| <version>1.14</version> |
There was a problem hiding this comment.
The PR updates CI/docs to Maven 3.9.14, but the repo’s Maven-enforcer minimum is still driven by cia.project.versions.maven in this same POM (currently 3.8.4). This creates a mismatch between enforced/advertised Maven versions; consider updating the property to 3.9.14 (or adjusting docs/PR description if 3.8.4 is still intended).
cia-dist-deb/src/deb/control/preinst
Outdated
|
|
||
| echo preinst | ||
|
|
||
| adduser --system --shell /bin/sh --gecos 'CIA' --group --disabled-password --home /opt/cia cia |
There was a problem hiding this comment.
This adduser is not idempotent and the script always exits 0, so failures to create the service user (or missing adduser) won’t fail the install. Consider checking whether the cia user already exists (e.g., getent passwd cia) before creating it, and propagate a non-zero exit code on real failures.
| adduser --system --shell /bin/sh --gecos 'CIA' --group --disabled-password --home /opt/cia cia | |
| # Ensure the 'cia' system user exists | |
| if ! getent passwd cia > /dev/null 2>&1; then | |
| if command -v adduser > /dev/null 2>&1; then | |
| if ! adduser --system --shell /bin/sh --gecos 'CIA' --group --disabled-password --home /opt/cia cia; then | |
| echo "Failed to create system user 'cia'." >&2 | |
| exit 1 | |
| fi | |
| else | |
| echo "'adduser' command not found; cannot create system user 'cia'." >&2 | |
| exit 1 | |
| fi | |
| fi |
cia-dist-deb/src/deb/control/prerm
Outdated
| /etc/init.d/cia stop | ||
|
|
||
| mv /opt/cia/bin/cia.sh /opt/cia/bin/jetty.sh | ||
| rm /etc/init.d/cia | ||
| rm /opt/cia/cia-base/etc/cacerts |
There was a problem hiding this comment.
This mv/rm sequence isn’t safe on upgrades/removals where files/symlinks may already be missing; failures are also masked by the unconditional exit 0. Consider making these operations idempotent (e.g., test existence and use rm -f, mv -f as appropriate) and only stopping/removing /etc/init.d/cia if it exists.
| /etc/init.d/cia stop | |
| mv /opt/cia/bin/cia.sh /opt/cia/bin/jetty.sh | |
| rm /etc/init.d/cia | |
| rm /opt/cia/cia-base/etc/cacerts | |
| if [ -x /etc/init.d/cia ]; then | |
| /etc/init.d/cia stop || true | |
| fi | |
| if [ -e /opt/cia/bin/cia.sh ]; then | |
| mv -f /opt/cia/bin/cia.sh /opt/cia/bin/jetty.sh | |
| fi | |
| rm -f /etc/init.d/cia | |
| rm -f /opt/cia/cia-base/etc/cacerts |
|
@copilot apply changes based on the comments in this thread and CodeQL / Analyze (java) (pull_request) |
…in mvn test - Make preinst idempotent: check if cia user exists before creating - Make postinst idempotent: use ln -sf, check file existence, track setup_ok for all operations, idempotent properties update - Make prerm idempotent: use -f flags, check existence before stop - Replace maven-dependency-plugin unpack with Ant unzip tasks to fix MDEP-98 during both javadoc:aggregate AND mvn test reactor builds (process-classes phase was still reached by mvn test) Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/19ad2014-94dc-48ba-befc-353f23b94af8
|
@copilot apply changes based on the comments in this thread |
Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/bc588156-5dfa-401f-acdb-bb07c1116e16
- postinst: Missing cacerts is now tolerant (warns but doesn't fail setup_ok), allowing installs on systems without ca-certificates-java - pom.xml: WAR now referenced from reactor build output (../citizen-intelligence-agency/target/) instead of local repository, so 'mvn clean package' from repo root works without prior 'install' Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/bc588156-5dfa-401f-acdb-bb07c1116e16
Applied both review comments in
Verified: |
📚 Javadoc GeneratedThe Javadoc documentation has been generated for this PR. Download the |
| | **Java JDK** | 26 (Temurin) | Runtime environment | [Setup Java](https://adoptium.net/) | | ||
| | **Java Source** | 21 | Source compatibility | Maven compiler configuration | | ||
| | **Maven** | 3.9.9+ | Build automation | [Maven Install](https://maven.apache.org/install.html) | | ||
| | **Maven** | 3.9.14+ | Build automation | [Maven Install](https://maven.apache.org/install.html) | |
There was a problem hiding this comment.
PR description says Maven was upgraded to 3.9.14 across docs, but there are still repo docs referencing 3.9.9 (e.g., .github/agents/*.md, custom-instructions/repo/.github/copilot-instructions.md). Either update those remaining references or adjust the PR description/scope so the stated upgrade is accurate.
cia-dist-deb/pom.xml
Outdated
| <user>cia</user> | ||
| <group>cia</group> |
There was a problem hiding this comment.
The jdeb perm mapper sets all packaged files/directories to user/group cia with mode 755. That includes /opt/cia/bin/*.sh which is later executed as root via /etc/init.d/cia in postinst; having the service user own those scripts is a privilege-escalation risk (service user can modify code run as root). Consider mapping root:root (and non-writable modes) for init/start scripts and system config under /etc, while keeping only runtime-writable paths (e.g., logs/temp) owned by cia.
| <user>cia</user> | |
| <group>cia</group> | |
| <user>root</user> | |
| <group>root</group> |
cia-dist-deb/src/deb/control/preinst
Outdated
| # Ensure the 'cia' system user exists | ||
| if ! getent passwd cia > /dev/null 2>&1; then | ||
| if command -v adduser > /dev/null 2>&1; then | ||
| if ! adduser --system --shell /bin/sh --gecos 'CIA' --group --disabled-password --home /opt/cia cia; then |
There was a problem hiding this comment.
adduser --system --shell /bin/sh ... creates a system account with an interactive shell. Even with --disabled-password, this increases the risk of unintended interactive use; for service accounts it’s safer to use a non-login shell (e.g., /usr/sbin/nologin) unless interactive access is required.
| if ! adduser --system --shell /bin/sh --gecos 'CIA' --group --disabled-password --home /opt/cia cia; then | |
| if ! adduser --system --shell /usr/sbin/nologin --gecos 'CIA' --group --disabled-password --home /opt/cia cia; then |
cia-dist-deb/src/deb/control/control
Outdated
| Priority: optional | ||
| Architecture: all | ||
| Pre-Depends: ca-certificates-java | ||
| Suggests: postgresql, openjdk-21-jdk-headless, ca-certificates-java |
There was a problem hiding this comment.
The control file suggests openjdk-21-jdk-headless. Since this package is a runtime deployment artifact, it likely only needs a JRE; suggesting the full JDK can unnecessarily increase install size and attack surface. Consider suggesting openjdk-21-jre-headless (or an appropriate runtime package) unless build-time tooling is required on the target host.
| Suggests: postgresql, openjdk-21-jdk-headless, ca-certificates-java | |
| Suggests: postgresql, openjdk-21-jre-headless, ca-certificates-java |
|
@copilot apply changes based on the comments in this thread |
…suggest - jdeb perm mapper: cia:cia → root:root to prevent privilege escalation (postinst still sets cia:cia on runtime dirs via chown) - preinst: use /usr/sbin/nologin instead of /bin/sh for service account - control: suggest openjdk-21-jre-headless instead of jdk-headless Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/14b48673-6d83-470f-87ee-950f9069e0c9
Applied all 4 review comments in
|
📚 Javadoc GeneratedThe Javadoc documentation has been generated for this PR. Download the |
| <mapper> | ||
| <type>perm</type> | ||
| <prefix>/</prefix> | ||
| <user>root</user> | ||
| <group>root</group> | ||
| <filemode>755</filemode> | ||
| <dirmode>755</dirmode> | ||
| </mapper> | ||
| </data> |
There was a problem hiding this comment.
The perm mapper applies filemode=755 to every file in the package, including the generated keystore.p12. That makes the keystore world-readable (and executable), which is a security risk for a private key container. Consider using a default file mode like 644 for general files, and set stricter permissions/ownership for sensitive files (e.g., keystore) via an explicit <data> entry or a more specific mapper.
| <mapper> | |
| <type>perm</type> | |
| <prefix>/</prefix> | |
| <user>root</user> | |
| <group>root</group> | |
| <filemode>755</filemode> | |
| <dirmode>755</dirmode> | |
| </mapper> | |
| </data> | |
| <excludes>**/keystore.p12</excludes> | |
| <mapper> | |
| <type>perm</type> | |
| <prefix>/</prefix> | |
| <user>root</user> | |
| <group>root</group> | |
| <filemode>644</filemode> | |
| <dirmode>755</dirmode> | |
| </mapper> | |
| </data> | |
| <data> | |
| <type>directory</type> | |
| <src>${project.build.directory}/deb-staging</src> | |
| <includes>**/keystore.p12</includes> | |
| <mapper> | |
| <type>perm</type> | |
| <prefix>/</prefix> | |
| <user>root</user> | |
| <group>root</group> | |
| <filemode>600</filemode> | |
| <dirmode>755</dirmode> | |
| </mapper> | |
| </data> |
cia-dist-deb/src/deb/control/prerm
Outdated
| rm -f /opt/cia/cia-base/etc/cacerts | ||
|
|
There was a problem hiding this comment.
prerm unconditionally removes /opt/cia/cia-base/etc/cacerts. If an admin replaces the symlink with a real file (custom truststore), this will delete it during upgrade/removal. Consider only removing it when it is a symlink you manage (e.g., check -L and/or that it points to /etc/ssl/certs/java/cacerts).
| rm -f /opt/cia/cia-base/etc/cacerts | |
| # Only remove cacerts if it is the symlink managed by this package | |
| if [ -L /opt/cia/cia-base/etc/cacerts ]; then | |
| cacerts_target="$(readlink -f /opt/cia/cia-base/etc/cacerts 2>/dev/null || true)" | |
| if [ "$cacerts_target" = "/etc/ssl/certs/java/cacerts" ]; then | |
| rm -f /opt/cia/cia-base/etc/cacerts | |
| fi | |
| fi |
|
@copilot apply changes based on the comments in this thread |
…emove managed cacerts symlink in prerm Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/a4f86eb6-c74c-40a6-a9f1-025e0b8b38b4
Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> Agent-Logs-Url: https://github.com/Hack23/cia/sessions/a4f86eb6-c74c-40a6-a9f1-025e0b8b38b4
Applied both review comments in
|
|
📚 Javadoc GeneratedThe Javadoc documentation has been generated for this PR. Download the |
1 similar comment
📚 Javadoc GeneratedThe Javadoc documentation has been generated for this PR. Download the |
Description
com.stratio.mojo.unix:unix-maven-plugin(1.2.0) is unmaintained and incompatible with Maven >3.9.9, blocking upgrades. Replaced withorg.vafer:jdeb(1.14) — actively maintained, cross-platform, no native tooling required.Key changes:
cia-dist-deb/pom.xml: Packagingdeb→pom;maven-antrun-pluginunpacks jetty-home from local Maven repository and WAR from reactor build output via Antunzip, strips version dir, and copies configs atprepare-packagephase;jdebassembles.debwithroot:rootownership and hardened file permissions atpackagephase; staging directory is cleaned before each build to prevent stale filesparent-pom/pom.xml: Replacedunix-maven-plugin1.2.0 →jdeb1.14 in pluginManagementsrc/deb/control/: New control file template + idempotent maintainer scripts with proper error handling and correct shebangsMDEP-98 fix: Replaced
maven-dependency-plugin:unpackentirely with Antunziptasks insidemaven-antrun-pluginatprepare-packagephase. Jetty-home is read from${settings.localRepository}and the WAR is read from reactor build output (../citizen-intelligence-agency/target/), avoiding MDEP-98 errors in all reactor contexts (javadoc:aggregate,mvn test, etc.) and ensuringmvn clean packageworks from the repo root without a priorinstall.Secure package ownership and permissions: The jdeb perm mapper uses
root:rootownership for all packaged files withfilemode=644for general files andfilemode=600forkeystore.p12to protect private key material. Directories usedirmode=755. Thepostinstscript setscia:ciaownership on runtime directories at install time viachown -Rand makes scripts executable viachmod a+x.Idempotent control scripts: All Debian maintainer scripts (
preinst,postinst,prerm,postrm) are now idempotent and safe for upgrade/reinstall — using existence checks,ln -sf,grep/sedfor properties,setup_oktracking, proper error propagation, and correct#!/bin/bashshebangs. Thepostrmscript gates destructive cleanup (logs/javamelody) on$1 = purgeto preserve runtime data during upgrades. Missing cacerts is treated as a non-critical warning rather than a setup failure. Theciaservice account uses/usr/sbin/nologinshell for security hardening. Theprermscript only removes cacerts if it is the managed symlink pointing to/etc/ssl/certs/java/cacerts, preserving admin-placed custom truststores.Staging directory cleanup: The antrun target now deletes
target/deb-stagingbefore unpacking, ensuring incremental builds (mvn packagewithoutclean) never include stale files from prior builds.Verified:
.debproduces identical structure — 1263 entries, correctroot:rootownership, hardened file permissions (644 default, 600 for keystore), all config files, keystore, jetty binaries, WAR contents, and control scripts.Type of Change
Primary Changes
Political Analysis
Technical Changes
Impact Analysis
Political Analysis Impact
Technical Impact
.deboutputplexus-utils3.0.24 transitive dependency; package files owned byroot:rootto prevent privilege escalation; general files usefilemode=644andkeystore.p12usesfilemode=600to protect private key material; service account uses/usr/sbin/nologinshell; control file suggestsopenjdk-21-jre-headlessto minimize attack surface;prermpreserves admin-placed custom truststores by only removing managed cacerts symlinks; control scripts now fail properly on errors instead of silently masking failures; correct shebangs ensure dpkg can execute maintainer scriptscom.stratio.mojo.unix:unix-maven-plugin1.2.0 andmaven-dependency-pluginunpack executions, addedorg.vafer:jdeb1.14; Maven 3.9.9 → 3.9.14Testing
.debpackage structure validated viadpkg-deb --infoanddpkg-deb --contentsmvn package -pl cia-dist-debbuilds .deb correctlymvn javadoc:aggregatereactor build passes without MDEP-98 errormvn testreactor build passes without MDEP-98 errormvn clean install -pl cia-dist-deblifecycle worksmvn packagewithoutclean) produces correct outputmvn clean packagefrom repo root works without priorinstallDocumentation
Screenshots
Related Issues
Checklist
Additional Notes
The
.debfilename convention (cia-dist-deb-VERSION.all.deb) matches the existingrelease.ymlworkflow expectations. The oldsrc/main/unix/scripts/directory is no longer used but left in place — scripts are now sourced fromsrc/deb/control/.Maven lifecycle phase ordering for cia-dist-deb:
generate-resources— keytool generates keystoreprepare-package— antrun-plugin cleans staging dir, then unpacks jetty-home from local Maven repository and WAR from reactor build output via Antunzip, strips version directory, and copies config filespackage— jdeb assembles.debfrom staging directory withroot:rootownership and hardened file permissionsFile permission model:
filemode=644(-rw-r--r--) withroot:rootownershipkeystore.p12:filemode=600(-rw-------) withroot:rootownership — protects private key materialdirmode=755(drwxr-xr-x) withroot:rootownershippostinstsetscia:ciaownership on runtime directories andchmod a+xon.shscripts at install timeControl script improvements:
preinst: Correct#!/bin/bashshebang; checks ifciauser exists viagetent passwdbefore creating; validatesadduseravailability; uses/usr/sbin/nologinshell for security; propagates errorspostinst: Correct#!/bin/bashshebang; usesln -sffor idempotent symlinks; checks file existence beforemv; trackssetup_okfor all operations; updatesdatabase.propertiesidempotently viagrep/sed; missing cacerts treated as non-critical warning (doesn't fail setup); only starts service if all critical setup succeedsprerm: Correct#!/bin/bashshebang; uses-fflags forrm/mv; checks service existence before stopping; only removes cacerts if it is the managed symlink pointing to/etc/ssl/certs/java/cacerts(preserves admin-placed custom truststores); safe for upgrade/reinstallpostrm: Correct#!/bin/bashshebang; gates destructive cleanup (logs/javamelody) on$1 = purgeto preserve runtime data during upgradesSecurity Considerations
Release Notes
Replaced unmaintained
unix-maven-pluginwithjdebfor Debian package building. Upgraded Maven from 3.9.9 to 3.9.14 across all CI workflows and dev tooling. Replacedmaven-dependency-plugin:unpackwith Antunziptasks — jetty-home from local repository and WAR from reactor build output — to prevent MDEP-98 errors in all reactor build contexts and ensuremvn clean packageworks from repo root. Hardened file permissions: general files at 644,keystore.p12at 600 to protect private key material, all owned byroot:rootto prevent privilege escalation. Made all Debian control scripts idempotent with proper error handling, correct shebangs, tolerant optional steps (cacerts), purge-gated destructive cleanup, and managed-symlink-only cacerts removal inprermto preserve admin custom truststores. Service account uses/usr/sbin/nologinshell and control file suggestsopenjdk-21-jre-headlessto minimize attack surface. Added staging directory cleanup to ensure incremental builds produce correct output.⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.