2.2.0 Jar seems to include an incoherent version number in its pom

[nhumblot]

Expected Behavior

The <version> and <tag> XML tags have the 2.2.0 value

Actual Behavior

The <version> and <tag> XML tags have the 2.2.0\n value, not matching the actual version https://mvnrepository.com/artifact/com.google.summit/summit-ast/2.2.0

Steps to Reproduce the Problem

1. Download the jar of the 2.2.0 version on Maven central
2. unzip summit-ast-2.2.0.jar
3. cat META-INF/maven/com.google.summit/summit-ast/pom.xml

This got identified during an investigation of an error faced during the execution of OWASP DependencyCheck: jeremylong/DependencyCheck#6688 (comment)

Specifications

• Version: 2.2.0
• Platform: Linux

[aaronhurst-google]

I’ve caught this a few times, but this one escaped.

The https://github.com/vaticle/bazel-distribution that generates pom.xml includes the exact contents of VERSION… including the trailing newline that most text editors will add by default.

I would prefer to move away from this dependency.

[nhumblot]

Hi @aaronhurst-google 👋

Thank you for your answer. Do you have an idea of what you would like to have as a replacement of this dependency? Would a PR, opened by a first time contributor, following these guidelines be considered if open?

[nhumblot]

Root cause in Bazel distribution has been identified: typedb/bazel-distribution#380

[farost]

Thank you for mentioning our issue!

As I understand, your problem comes from the assemble_maven rule, and its behavior has been fixed. You can try updating your dependency to this commit and check if the issue is still relevant.