@@ -1345,6 +1345,8 @@ under the License.
1345
1345
<version >2.4</version ><!-- $NO-MVN-MAN-VER$-->
1346
1346
<configuration >
1347
1347
<archive >
1348
+ <!-- Globally exclude maven metadata, because it may accidentally bundle files we don't intend to -->
1349
+ <addMavenDescriptor >false</addMavenDescriptor >
1348
1350
<manifest >
1349
1351
<addDefaultImplementationEntries >true</addDefaultImplementationEntries >
1350
1352
<addDefaultSpecificationEntries >true</addDefaultSpecificationEntries >
@@ -1713,6 +1715,21 @@ under the License.
1713
1715
<exclude >META-INF/*.SF</exclude >
1714
1716
<exclude >META-INF/*.DSA</exclude >
1715
1717
<exclude >META-INF/*.RSA</exclude >
1718
+ <!-- META-INF/maven can contain 2 things:
1719
+ - For archetypes, it contains an archetype-metadata.xml.
1720
+ - For other jars, it contains the pom for all dependencies under the respective <groupId>/<artifactId>/ directory.
1721
+
1722
+ We want to exclude the poms because they may be under an incompatible license,
1723
+ however the archetype metadata is required and we need to keep that around.
1724
+
1725
+ This pattern excludes directories under META-INF/maven.
1726
+ ('?*/**' does not work because '**' also matches zero directories;
1727
+ everything that matches '?*' also matches '?*/**')
1728
+
1729
+ The initial '**' allows the pattern to also work for multi-release jars that may contain such entries under
1730
+ 'META-INF/versions/11/META-INF/maven/'.
1731
+ -->
1732
+ <exclude >**/META-INF/maven/?*/?*/**</exclude >
1716
1733
</excludes >
1717
1734
</filter >
1718
1735
</filters >
0 commit comments