bom/application/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-project</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -141,8 +141,8 @@
         <rest-assured.version>5.4.0</rest-assured.version>
         <hamcrest.version>2.2</hamcrest.version><!-- The version needs to be compatible with both REST Assured and Awaitility -->
         <junit.jupiter.version>5.10.2</junit.jupiter.version>
-        <infinispan.version>15.0.0.Final</infinispan.version>
-        <infinispan.protostream.version>5.0.1.Final</infinispan.protostream.version>
+        <infinispan.version>15.0.1.Final</infinispan.version>
+        <infinispan.protostream.version>5.0.2.Final</infinispan.protostream.version>
         <caffeine.version>3.1.5</caffeine.version>
         <netty.version>4.1.108.Final</netty.version>
         <brotli4j.version>1.16.0</brotli4j.version>

bom/dev-ui/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-project</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>quarkus-bom-dev-ui</artifactId>

bom/test/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-project</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

build-parent/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-project</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/builder/pom.xml

@@ -10,7 +10,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-build-parent</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../../build-parent/pom.xml</relativePath>
     </parent>
 

core/class-change-agent/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <artifactId>quarkus-build-parent</artifactId>
         <groupId>io.quarkus</groupId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../../build-parent/pom.xml</relativePath>
     </parent>
 

core/deployment/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-core-parent</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
     </parent>
 
     <artifactId>quarkus-core-deployment</artifactId>
@@ -143,6 +143,30 @@
 
     <build>
         <plugins>
+            <plugin>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>download-signed-jar</id>
+                        <phase>generate-test-resources</phase>
+                        <goals>
+                            <goal>copy</goal>
+                        </goals>
+                        <configuration>
+                            <artifactItems>
+                                <artifactItem>
+                                    <groupId>org.eclipse.jgit</groupId>
+                                    <artifactId>org.eclipse.jgit.ssh.apache</artifactId>
+                                    <version>6.9.0.202403050737-r</version>
+                                    <type>jar</type>
+                                    <destFileName>signed.jar</destFileName>
+                                </artifactItem>
+                            </artifactItems>
+                            <outputDirectory>${project.build.testOutputDirectory}</outputDirectory>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <artifactId>maven-surefire-plugin</artifactId>
                 <configuration>

core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/JarResultBuildStep.java

@@ -5,7 +5,6 @@
 import java.io.BufferedInputStream;
 import java.io.BufferedWriter;
 import java.io.ByteArrayOutputStream;
-import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.ObjectOutputStream;
@@ -42,12 +41,12 @@
 import java.util.function.Consumer;
 import java.util.function.Predicate;
 import java.util.jar.Attributes;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
 import java.util.jar.Manifest;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipFile;
-import java.util.zip.ZipOutputStream;
 
 import org.jboss.logging.Logger;
 
@@ -92,14 +91,14 @@
 
 /**
  * This build step builds both the thin jars and uber jars.
- *
+ * <p>
  * The way this is built is a bit convoluted. In general, we only want a single one built,
  * as determined by the {@link PackageConfig} (unless the config explicitly asks for both of them)
- *
+ * <p>
  * However, we still need an extension to be able to ask for a specific one of these despite the config,
  * e.g. if a serverless environment needs an uberjar to build its deployment package then we need
  * to be able to provide this.
- *
+ * <p>
  * To enable this we have two build steps that strongly produce the respective artifact type build
  * items, but not a {@link ArtifactResultBuildItem}. We then
  * have another two build steps that only run if they are configured to consume these explicit
@@ -931,7 +930,7 @@ private void copyDependency(Set<ArtifactKey> parentFirstArtifacts, OutputTargetB
                 } else {
                     // we copy jars for which we remove entries to the same directory
                     // which seems a bit odd to me
-                    filterZipFile(resolvedDep, targetPath, removedFromThisArchive);
+                    filterJarFile(resolvedDep, targetPath, removedFromThisArchive);
                 }
             }
         }
@@ -1125,7 +1124,7 @@ private void copyLibraryJars(FileSystem runnerZipFs, OutputTargetBuildItem outpu
                                 + resolvedDep.getFileName();
                         final Path targetPath = libDir.resolve(fileName);
                         classPath.append(" lib/").append(fileName);
-                        filterZipFile(resolvedDep, targetPath, transformedFromThisArchive);
+                        filterJarFile(resolvedDep, targetPath, transformedFromThisArchive);
                     }
                 } else {
                     // This case can happen when we are building a jar from inside the Quarkus repository
@@ -1240,16 +1239,26 @@ private void handleParent(FileSystem runnerZipFs, String fileName, Map<String, S
         }
     }
 
-    private void filterZipFile(Path resolvedDep, Path targetPath, Set<String> transformedFromThisArchive) {
-
+    static void filterJarFile(Path resolvedDep, Path targetPath, Set<String> transformedFromThisArchive) {
         try {
             byte[] buffer = new byte[10000];
-            try (ZipFile in = new ZipFile(resolvedDep.toFile())) {
-                try (ZipOutputStream out = new ZipOutputStream(new FileOutputStream(targetPath.toFile()))) {
-                    Enumeration<? extends ZipEntry> entries = in.entries();
+            try (JarFile in = new JarFile(resolvedDep.toFile(), false)) {
+                Manifest manifest = in.getManifest();
+                if (manifest != null) {
+                    // Remove signature entries
+                    manifest.getEntries().clear();
+                } else {
+                    manifest = new Manifest();
+                }
+                try (JarOutputStream out = new JarOutputStream(Files.newOutputStream(targetPath), manifest)) {
+                    Enumeration<JarEntry> entries = in.entries();
                     while (entries.hasMoreElements()) {
-                        ZipEntry entry = entries.nextElement();
-                        if (!transformedFromThisArchive.contains(entry.getName())) {
+                        JarEntry entry = entries.nextElement();
+                        String entryName = entry.getName();
+                        if (!transformedFromThisArchive.contains(entryName)
+                                && !entryName.equals(JarFile.MANIFEST_NAME)
+                                && !entryName.equals("META-INF/INDEX.LIST")
+                                && !isSignatureFile(entryName)) {
                             entry.setCompressedSize(-1);
                             out.putNextEntry(entry);
                             try (InputStream inStream = in.getInputStream(entry)) {
@@ -1258,17 +1267,30 @@ private void filterZipFile(Path resolvedDep, Path targetPath, Set<String> transf
                                     out.write(buffer, 0, r);
                                 }
                             }
+                        } else {
+                            log.debugf("Removed %s from %s", entryName, resolvedDep);
                         }
                     }
                 }
                 // let's make sure we keep the original timestamp
                 Files.setLastModifiedTime(targetPath, Files.getLastModifiedTime(resolvedDep));
             }
         } catch (IOException e) {
-            throw new RuntimeException(e);
+            throw new UncheckedIOException(e);
         }
     }
 
+    private static boolean isSignatureFile(String entry) {
+        entry = entry.toUpperCase();
+        if (entry.startsWith("META-INF/") && entry.indexOf('/', "META-INF/".length()) == -1) {
+            return entry.endsWith(".SF")
+                    || entry.endsWith(".DSA")
+                    || entry.endsWith(".RSA")
+                    || entry.endsWith(".EC");
+        }
+        return false;
+    }
+
     /**
      * Manifest generation is quite simple : we just have to push some attributes in manifest.
      * However, it gets a little more complex if the manifest preexists.
@@ -1612,12 +1634,8 @@ public boolean downloadIfNecessary() {
                         "https://repo.maven.apache.org/maven2/org/vineflower/vineflower/%s/vineflower-%s.jar",
                         context.versionStr, context.versionStr);
                 try (BufferedInputStream in = new BufferedInputStream(new URL(downloadURL).openStream());
-                        FileOutputStream fileOutputStream = new FileOutputStream(decompilerJar.toFile())) {
-                    byte[] dataBuffer = new byte[1024];
-                    int bytesRead;
-                    while ((bytesRead = in.read(dataBuffer, 0, 1024)) != -1) {
-                        fileOutputStream.write(dataBuffer, 0, bytesRead);
-                    }
+                        OutputStream fileOutputStream = Files.newOutputStream(decompilerJar)) {
+                    in.transferTo(fileOutputStream);
                     return true;
                 } catch (IOException e) {
                     log.error("Unable to download Vineflower from " + downloadURL, e);

core/deployment/src/test/java/io/quarkus/deployment/pkg/steps/JarResultBuildStepTest.java

@@ -0,0 +1,34 @@
+package io.quarkus.deployment.pkg.steps;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.nio.file.Path;
+import java.util.Set;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.Manifest;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/**
+ * Test for {@link JarResultBuildStep}
+ */
+class JarResultBuildStepTest {
+
+    @Test
+    void should_unsign_jar_when_filtered(@TempDir Path tempDir) throws Exception {
+        Path signedJarFilePath = Path.of(getClass().getClassLoader().getResource("signed.jar").toURI());
+        Path jarFilePath = tempDir.resolve("unsigned.jar");
+        JarResultBuildStep.filterJarFile(signedJarFilePath, jarFilePath,
+                Set.of("org/eclipse/jgit/transport/sshd/SshdSessionFactory.class"));
+        try (JarFile jarFile = new JarFile(jarFilePath.toFile())) {
+            assertThat(jarFile.stream().map(JarEntry::getName)).doesNotContain("META-INF/ECLIPSE_.RSA", "META-INF/ECLIPSE_.SF");
+            // Check that the manifest is still present
+            Manifest manifest = jarFile.getManifest();
+            assertThat(manifest.getMainAttributes()).isNotEmpty();
+            assertThat(manifest.getEntries()).isEmpty();
+        }
+    }
+
+}

core/devmode-spi/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <artifactId>quarkus-build-parent</artifactId>
         <groupId>io.quarkus</groupId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../../build-parent/pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/junit4-mock/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-core-parent</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
     </parent>
 
     <artifactId>quarkus-junit4-mock</artifactId>

core/launcher/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <artifactId>quarkus-build-parent</artifactId>
         <groupId>io.quarkus</groupId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../../build-parent/pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <artifactId>quarkus-build-parent</artifactId>
         <groupId>io.quarkus</groupId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
         <relativePath>../build-parent/pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/processor/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-core-parent</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
     </parent>
 
     <artifactId>quarkus-extension-processor</artifactId>

core/runtime/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>io.quarkus</groupId>
         <artifactId>quarkus-core-parent</artifactId>
-        <version>999-SNAPSHOT</version>
+        <version>3.9.4</version>
     </parent>
 
     <artifactId>quarkus-core</artifactId>

core/runtime/src/main/java/io/quarkus/runtime/logging/LoggingSetupRecorder.java

@@ -6,6 +6,7 @@
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
+import java.math.BigInteger;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -687,6 +688,24 @@ private static Handler configureSyslogHandler(final SyslogConfig config, final E
             handler.setTruncate(config.truncate);
             handler.setUseCountingFraming(config.useCountingFraming);
             handler.setLevel(config.level);
+            if (config.maxLength.isPresent()) {
+                BigInteger maxLen = config.maxLength.get().asBigInteger();
+                if (maxLen.compareTo(BigInteger.valueOf(Integer.MAX_VALUE)) > 0) {
+                    errorManager.error(
+                            "Using 2GB as the value of maxLength for SyslogHandler as it is the maximum allowed value", null,
+                            ErrorManager.GENERIC_FAILURE);
+                    maxLen = BigInteger.valueOf(Integer.MAX_VALUE);
+                } else {
+                    BigInteger minimumAllowedMaxLength = BigInteger.valueOf(128);
+                    if (maxLen.compareTo(minimumAllowedMaxLength) < 0) {
+                        errorManager.error(
+                                "Using 128 as the value of maxLength for SyslogHandler as using a smaller value is not allowed",
+                                null, ErrorManager.GENERIC_FAILURE);
+                        maxLen = minimumAllowedMaxLength;
+                    }
+                }
+                handler.setMaxLength(maxLen.intValue());
+            }
 
             Formatter formatter = null;
             boolean formatterWarning = false;

core/runtime/src/main/java/io/quarkus/runtime/logging/SyslogConfig.java

@@ -10,6 +10,7 @@
 
 import io.quarkus.runtime.annotations.ConfigGroup;
 import io.quarkus.runtime.annotations.ConfigItem;
+import io.quarkus.runtime.configuration.MemorySize;
 
 @ConfigGroup
 public class SyslogConfig {
@@ -95,6 +96,15 @@ public class SyslogConfig {
     @ConfigItem
     Optional<String> filter;
 
+    /**
+     * The maximum length, in bytes, of the message allowed to be sent. The length includes the header and the message.
+     * <p>
+     * If not set, the default value is {@code 2048} when {@code sys-log-type} is {@code rfc5424} (which is the default)
+     * and {@code 1024} when {@code sys-log-type} is {@code rfc3164}
+     */
+    @ConfigItem
+    Optional<MemorySize> maxLength;
+
     /**
      * Syslog async logging config
      */