How to find version of Jar if not mentioned in Manifest

Question

I have a project in which many JARS are checked in but there is no version information for them.

I have to implement dependency management using Apache Ivy, but I don't know which versions to point to in my ivy.xml . I checked the Manifests and many of them do not have the JAR versions mentioned there.

Is there another way to find version of JARS? I understand that finding checksum and comparing them is another option but for that I need to check each of my JAR against checksums of all possible JAR versions and so that is not an option.

Any other suggestions please?

Answer 1

I would say - there's no other way. If you have somewhere all the jar versions (of the library in question), you can eg md5 them and then compare with the md5 sum of that unknown jar version you have. I might be wrong but I don't see any other way.

Answer 2

To add to some previous comments, you can find details about the Maven REST API at http://search.maven.org/#api . The URL of interest to you here is http://search.maven.org/solrsearch/select?q=1 :"SHA-1 checksum".

I had a case where I needed to find the versions of hundreds of JARs as part of a Java application and did so from 2 sources. First I cracked open the JAR and checked the Manifest.MF file for the JAR version first in the field 'Implementation-Version' and if not there, then 'Bundle-Version'. The code I used for that is below (obviously you will want some better error handling):

public String getVersionFromJarManifest(File jarFile){
    try {
        Manifest manifest = new JarFile(jarFile).getManifest();
        Attributes mainAttribs = manifest.getMainAttributes();
        String version = mainAttribs.getValue("Implementation-Version");

        if(version == null || version == "" || version.isEmpty()){
            version = mainAttribs.getValue("Bundle-Version");
        }

        return version;
    } catch (Exception e) {
        LOGGER.warn("Manifest not found for {}", jarFile.getPath());
        return null;
    }
}

If I was unable to to get the version from the Manifest file then I computed a SHA-1 checksum of the JAR and searched Maven for it. That code (with again not great error checking) is below:

public String getVersionFromMavenByChecksum(File jarFile){
    String sha = null;
    try {
        MessageDigest md = MessageDigest.getInstance("SHA1");
        FileInputStream fis = new FileInputStream(jarFile);
        byte[] dataBytes = new byte[1024];

        int nread = 0;

        while ((nread = fis.read(dataBytes)) != -1) {
            md.update(dataBytes, 0, nread);
        }

        byte[] mdbytes = md.digest();

        //convert the byte to hex format
        StringBuffer sb = new StringBuffer("");
        for (int i = 0; i < mdbytes.length; i++) {
            sb.append(Integer.toString((mdbytes[i] & 0xff) + 0x100, 16).substring(1));
        }

        sha = sb.toString();
    } catch (Exception e) {
        LOGGER.warn("ERROR processing SHA-1 value for {}", jarFile.getPath());
        return null;
    }

    return getVersionBySha(sha);
}

public String getVersionBySha(String sha){
    String version = null;

    CloseableHttpClient httpClient = HttpClients.createDefault();

    List<NameValuePair> suQueryParams = new ArrayList<>();
    suQueryParams.add(new BasicNameValuePair("q", "1: \"" + sha + "\""));

    String result = null;

    try {
        result = MavenApiUtil.apiGETCall("http://search.maven.org/solrsearch/select", suQueryParams, null, httpClient);
    } catch (Exception e){
        LOGGER.warn("ERROR querying Maven for version for SHA {}", sha);
        return null;
    }

    //Parse response

    return version;
}