jarproof

Find JAR hell before production.

Verify the Java artifacts you will actually ship before the JVM finds their incompatibilities at runtime.

Use · Output · Finds · Model · Development

Use

jarproof check --application app.jar --classpath "lib/*" --target-java 17

Command	Purpose
check	Verify an application against its runtime classpath
baseline	Accept existing findings and fail only on new ones
inspect	Show the layout and bytecode facts in one artifact
explain	Explain a diagnostic such as JP1003

Output

$ jarproof check --application app.jar --classpath "lib/*" --target-java 17
error JP1003: referenced method is not declared anywhere above the resolved class
  symbol:      com.example.OrderPolicy.describe(String, int)
  at runtime:  NoSuchMethodError

next: Restore the method with the descriptor the call site compiled against, or align the versions.

1 error, 1 finding

Jarproof names the affected symbol, the artifacts involved, the JVM error the failure would cause, and the next step. It exits nonzero when findings meet the configured threshold, so the same command works locally and in CI.

Finds

Linkage Missing or incompatible classes, methods, and fields.	Classpath Duplicate classes, split packages, and ambiguous wildcard order.
Runtime Unsupported bytecode, access changes, and class-shape mismatches.	Services and modules Broken providers, module conflicts, and invalid declarations.

Model

application + runtime classpath + target Java
                     ↓
                  jarproof
                     ↓
        human report · JSON · SARIF · exit status

Jarproof reads JAR files, class directories, and bytecode without loading or executing analyzed classes. Analysis is deterministic and does not use reflection or network access.

Development

Jarproof is built with Zolt.

scripts/check

The check resolves the locked workspace, runs unit, integration, and Smoque smoke tests, checks coverage and architecture rules, and packages every member.

License

Apache-2.0. See LICENSE.