[paulrutter]

https://issues.apache.org/jira/browse/FELIX-6857

Problem

When a bundle uses Embed-Dependency and one of the selected dependencies is a
type=pom artifact (a BOM/aggregator declared as a compile dependency),
DependencyEmbedder adds that artifact's .pom file to the bundle classpath
(Bundle-ClassPath / -includeresource). bnd's CDI-annotations analyzer then tries
to open the .pom as a JAR/ZIP and fails:

• maven-bundle-plugin 6.0.2 (embeds bnd 7.0.0): emits [WARNING] Invalid bundle classpath entry and builds successfully.
• maven-bundle-plugin 6.1.0 (embeds bnd 7.3.0): the same condition is now a fatal
  [ERROR] Error(s) found in bundle configuration and fails the build.

So upgrading the plugin breaks any bundle that embeds a pom-type dependency.

[ERROR] Bundle ... : Analyzer Plugin CDIAnnotations failed The JAR/ZIP file
(.../org/junit/junit-bom/5.11.3/junit-bom-5.11.3.pom) seems corrupted,
error: zip END header not found -> zip END header not found for AnalyzerPlugin
[ERROR] Error(s) found in bundle configuration

The .pom is valid XML, not corrupt — bnd is simply being handed a pom to open as an
archive.

Root cause

DependencyEmbedder embeds any selected artifact whose file exists, without checking
its type, so a type=pom dependency's .pom file ends up on the classpath. A pom
contains no classes and must never be on the bundle classpath.

The underlying hard-fail is a bnd 7.0.0 → 7.3.0 behaviour change in
aQute.bnd.cdi.CDIAnnotations#analyzeJar (a warning promoted to a fatal error), but the
plugin should never have placed the .pom there in the first place.

Fix

Skip type=pom artifacts in DependencyEmbedder, covering both the embed and inline
paths, logging a warning so it is not silent. The non-embed classpath path in
BundlePlugin.getClasspath() already excludes poms via
ArtifactHandler.isAddedToClasspath(), so only the embed path needed the guard.

Reproducer

<packaging>bundle</packaging>
<dependencies>
  <dependency>
    <groupId>org.junit</groupId>
    <artifactId>junit-bom</artifactId>
    <version>5.11.3</version>
    <type>pom</type>
  </dependency>
</dependencies>

<Embed-Dependency>*;scope=compile</Embed-Dependency>

mvn clean package fails on 6.1.0, succeeds on 6.0.2 (and with this fix).

Testing

Added BundlePluginTest#testEmbedDependencyExcludesPomArtifacts, asserting a pom
dependency is excluded from Bundle-ClassPath and Embedded-Artifacts while a
regular jar is still embedded. Fails without the fix, passes with it.
Added an embed-pom-dependency integration test (a type=pom dependency alongside a
jar dependency). The build fails without the fix (the CDIAnnotations error above) and
passes with it.