Add hdf5-native Maven JARs and SciJava native-lib-loader integration#6356
Add hdf5-native Maven JARs and SciJava native-lib-loader integration#6356matteodg wants to merge 16 commits into
Conversation
|
Must Fix: The FFM [H5.java:314] calls Hdf5NativeLoader.loadBundledNativesIfPresent(false) with no try-catch in the static block. If native-lib-loader-2.5.0.jar is missing from the classpath, loading Hdf5NativeLoader will throw NoClassDefFoundError (because it imports org.scijava.nativelib.NativeLoader), which will cause an ExceptionInInitializerError that permanently prevents H5 from being used in that JVM. The JNI [H5.java:366-374] correctly wraps the call in catch (Throwable err), which handles this. The FFM version does not. The FFM path should have the same protection. Nice to have:
Moderate:
Low Severity
Consider using a simpler pattern like hdf5-(java|native|jni-native) or an array-based check.
Verify:
|
brtnfld
left a comment
There was a problem hiding this comment.
"Must Fix" needs to be addressed.
4779e1e to
f7e31e1
Compare
2a04368 to
cbf65fa
Compare
In both java/hdf/hdf5lib/H5.java (FFM) and java/src-jni/hdf/hdf5lib/H5.java (JNI), replace: with:
In java/cmake/HDF5JavaNativeBundles.cmake: Nice to have:
java/cmake/pom-native.xml.in and java/cmake/pom-jni-native.xml.in both end without a newline (\ No newline at end of file). Add a newline at the end of each.
The problem: isHdf5LibraryLoaded is set in two unrelated places with different meanings: In the bundled loader block — means "bundled hdf5 loaded" — split the flag's responsibilities): Replace the two flags with three, each with a single clear meaning: Change the early-exit guard from: to: Change the H5.H5dont_atexit() block from: to: This way isHdf5LibraryLoaded tracks only the bundled load result, isHdf5JavaLibraryLoaded tracks only the JNI bridge load result, and isInitialized guards against redundant re-entry. |
Add zizmor_config.yml to ignore template-injection findings in the setup-jextract action and maven/ctest workflow files introduced in PR HDFGroup#6356, where inputs are caller-controlled but not user-controlled.
b2b553f to
6031e92
Compare
…t display (#6439) * review-checklist: show all requested owners per area in checklist buildBody was using area.owners.find() — picking the first CODEOWNERS-listed owner in the requested set. This broke reviewer swaps (removing @A and adding @b would show @C, the next CODEOWNERS entry, not @b) and also failed to reflect GitHub's CODEOWNERS auto-assignment, which requests all owners. Switch to area.owners.filter() so every requested owner for an area is mentioned in that row. Approval logic is unchanged: any owner approval still checks the box. * review-checklist: enforce one load-balanced reviewer per area GitHub's CODEOWNERS auto-assignment requests all owners of touched files when a PR opens, before the workflow runs. The script was then seeing them already assigned and skipping its own selection entirely. On opened/reopened: select one load-balanced reviewer per area (ignoring GitHub's pre-assigned set), remove any auto-assigned CODEOWNERS not in the selection, then add the chosen reviewer. Only code owners are removed — manually-added non-owner reviewers are left untouched. On synchronize: keep existing assignments (reviewer may have already started). confirmedRequested now starts empty and is populated only with the script's selection, so the checklist only mentions owners that were explicitly chosen. * review-checklist: retry reviewer cleanup to handle GitHub auto-assign race GitHub's CODEOWNERS auto-assignment can fire after the workflow starts, re-adding extra reviewers after we remove them. Add a 15-second wait followed by a second cleanup pass on opened/reopened events. Extract the removal loop into enforceSelection() so both passes share the same logic. * zizmor: suppress template-injection for PR #6356 workflow files Add zizmor_config.yml to ignore template-injection findings in the setup-jextract action and maven/ctest workflow files introduced in PR #6356, where inputs are caller-controlled but not user-controlled. * review-checklist: don't re-assign reviewers on synchronize On synchronize, chooseReviewers saw no owner assigned (because the reviewer was manually removed) and re-added one via requestReviewers, overriding the manual removal. Reviewer assignment now only happens on opened/reopened. Synchronize only updates the checklist display based on whoever is currently assigned — manual removals are respected. * zizmor: skip upload-sarif failure on fork PRs * zizmor: move config out of workflows dir to fix GitHub Actions parse error GitHub Actions parses all .yml files in .github/workflows/ as workflow files; zizmor_config.yml there caused "unexpected value 'rules'" because rules: is not valid workflow syntax. Moved to .github/zizmor.yml and updated the --config path in zizmor.yml accordingly. * review-checklist: retry on transient 401 from GitHub API GitHub's API intermittently returns 401 on write operations (issues.addAssignees, issues.createComment) even when the token has Issues: write and PullRequests: write — read-only calls succeed in the same run. The github-script action excludes 401 from retries by default. Removing 401 from retry-exempt-status-codes and setting retries: 3 handles these transient failures with exponential backoff. * review-checklist: fix checklist mention when non-requested owner approves The mention in each checklist row was derived from the approver (if any), so when a different area owner happened to approve first, the mention changed from the assigned reviewer to the approver. Fix by decoupling sign-off detection from display: signedOff now uses .some() so any owner's approval checks the box, while the mention always shows the confirmed-requested reviewer(s) via .filter(). Also shows multiple reviewers when one is manually added alongside the load-balanced selection. * review-checklist: show approver name when signed off, requested reviewer(s) when pending When an area is signed off, replace the mention with the approver so the checklist shows who actually reviewed it (which may differ from whoever was load-balanced as the requested reviewer). When pending, show all confirmed-requested reviewers — the one load-balanced pick normally, but two if a reviewer was manually added alongside it. * zizmor: remove config file and --config flag The ignored files (ctest.yml, maven-deploy.yml, maven-staging.yml, setup-jextract/action.yml) had template-injection findings on inputs.* references, which are not attacker-controllable. Rather than suppressing them via a config file, let all findings surface in the Security tab and address them individually if needed.
7148db4 to
70290bf
Compare
Download only the jextract 25 Unix binaries with correct platform detection and verify the installed version for consistent FFM CI output. Co-authored-by: Cursor <cursoragent@cursor.com>
Download only the jextract 25 Windows binary, verify the installed version, and use a forward-slash PATH entry on GitHub Windows runners. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Extract shared helpers for SciJava native JAR staging, manifest generation, and OS-activated Maven profile snippets. Wire HDF5JavaNativeBundles.cmake from FFM and JNI Java binding CMakeLists and move add_subdirectory(java) before the Maven deploy status message. Co-authored-by: Cursor <cursoragent@cursor.com>
Bundle libhdf5 under natives/<platform>/ with SciJava-mapped aliases and
install hdf5-native-*-{classifier}.jar plus pom-hdf5-native.xml.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add optional Maven bundles for shared zlib and libaec/szip with platform aliases and optional OS-activated binding-POM profile snippets. Co-authored-by: Cursor <cursoragent@cursor.com>
Add JNI bridge native bundle when HDF5JAVA_MAVEN_NATIVE_JNI is enabled. The standalone pom-jni-native template carries no Maven deps on libhdf5. Co-authored-by: Cursor <cursoragent@cursor.com>
e869881 to
16ee5a1
Compare
Consolidate bundled zlib/szip/libhdf5 loading in loadBundledDependenciesBeforeHdf5(), use it from FFM/JNI H5.loadH5Lib and the slimmed hdf5_h_2 jextract patch, and layer binding POM dependencies (required hdf5-jni-native on java-jni; optional libhdf5 stack). Co-authored-by: Cursor <cursoragent@cursor.com>
Add artifact validation, Maven consumer smoke test with explicit native deps, FFM deflate smoke test, and CI workflow updates for native bundle artifacts. Co-authored-by: Cursor <cursoragent@cursor.com>
Describe optional libhdf5-stack artifacts, required hdf5-jni-native on java-jni, classpath-only vs system-native consumer paths, and runtime init contract. Co-authored-by: Cursor <cursoragent@cursor.com>
fd1c7ab to
776fccd
Compare
|
I'm trying to fix the failing builds due to this branch. |
Centralize SciJava -link URL, native-lib-loader classpath handling, and hdf5_java_doc target creation for FFM and JNI binding trees. Co-authored-by: Cursor <cursoragent@cursor.com>
Wire HDF5JavaJavadoc.cmake with the FFM compile classpath so javadoc can
resolve SciJava {@link} references in Hdf5NativeLoader.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire HDF5JavaJavadoc.cmake with the JNI classpath so javadoc resolves SciJava cross-references when building the JNI binding tree. Co-authored-by: Cursor <cursoragent@cursor.com>
Ensure doc builds with HDF5_BUILD_JAVA and HDF5_BUILD_DOC also generate hdf5_java_doc before the Doxygen hdf5lib_doc stamp target. Co-authored-by: Cursor <cursoragent@cursor.com>
39b6411 to
7815c86
Compare
Fixes #6355
I created this with Cursor, as my knowledge of CMake is basically zero: I tried to do it myself, but I was not able. I tested this in Linux x86_64 and Windows x86_64 and it is creating the proper jar and pom.xml file, that I can install in my local Maven repository and depend on them from an example application. This was there is not need of installing HDF5 library or setting up
LD_LIBRARY_PATHanymore.This will be useful for the future of HDFView as well.