Opening the JAR: The Hitchhiker's Guide to JAR File Dependencies
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 12:20· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Walks through exactly where dependencies hide inside JARs: pom.xml entries, the Maven assembly plugin that creates Uber-jars and the Maven Shade plugin that renames packages to avoid collisions, parent POM inheritance and Maven’s nearest-wins resolution that silently drops older transitive versions, OSGi’s Manifest import-package syntax, Manifest Class-Path/Main-Class fields, pre‑9 classloader hierarchy vs Java 9+ module-path and automatic modules, and concrete edge cases where dependencies appear in the JAR but never get loaded at runtime.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:48JAR dependency analysis matters
- 2:53Java and its ecosystem
- 5:02JAR files structure
- 6:05Maven and POM basics
- 7:54Maven plugins for deps
- 10:21POM inheritance
- 11:02Maven dependency rules
- 12:24OSGi and Manifest files
- 14:11Java class loading
- 16:19Class loading pre-Java 9
- 19:30Java 9 modularity
- 21:55JAR deps and class loading recap
- 22:38Supply chain security risks
- 24:24Reducing security alerts
- 25:49Further reading
- 26:11Q&A
related talks
28mOpening the JAR: The Hitchhiker's Guide to JAR File Dependencies
48mHidden Security Features of the JVM - Everything You Didn’t Know and More
42mProject Jigsaw in JDK 9: Modularity Comes To Java
46mNavigating the Dependency Management Maze
39mTrust but Verify: Uncovering the Hidden Risks of Inaccurate SBOMs With J...
20mDetect and track the aliens hiding in your dependencies
37mThe Death Star and the Ultimate Vulnerability
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers