Opening the JAR: The Hitchhiker's Guide to JAR File Dependencies
summary
Maps how dependencies actually end up inside a JAR: POM.xml entries, maven shade plugin renaming versus assembly/uber-JAR unpacking, and OSGi’s import-package manifest entries. Notes that Maven’s nearest-wins resolution can substitute 1.0 for a transitively required 2.0 and cause runtime failures, and that many real-world JARs violate old docs, producing surprising classloader behavior. Covers the three pre-Java9 loaders, the Java 9 module path conversion rules, common incorrect implementations, and why focusing on what actually loads reduces alert fatigue.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:48JAR dependency analysis matters
- 2:53Java and its ecosystem
- 5:02JAR files structure
- 6:05Maven and POM basics
- 7:54Maven plugins for deps
- 10:21POM inheritance
- 11:02Maven dependency rules
- 12:24OSGi and Manifest files
- 14:11Java class loading
- 16:19Class loading pre-Java 9
- 19:30Java 9 modularity
- 21:55JAR deps and class loading recap
- 22:38Supply chain security risks
- 24:24Reducing security alerts
- 25:49Further reading
- 26:11Q&A
related talks
28mOpening the JAR: The Hitchhiker's Guide to JAR File Dependencies
42mProject Jigsaw in JDK 9: Modularity Comes To Java
48mHidden Security Features of the JVM - Everything You Didn’t Know and More
39mTrust but Verify: Uncovering the Hidden Risks of Inaccurate SBOMs With J...
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
49mWargames - Java vulnerabilities and why you should care
46mNavigating the Dependency Management Maze
49mThe Anatomy of Java Vulnerabilities