From f55b086a1a7fbe0a99f50f3673f1149fcdcf6aa5 Mon Sep 17 00:00:00 2001
From: "vijaya.boddipudi" <216913149+vijaya-boddipudi@users.noreply.github.com>
Date: Mon, 24 Aug 2026 19:53:20 +0530
Subject: [PATCH] fix(dts): bundle ZipSlipGuard into delivery-tier-distribution
 jar (#65)

MainDTSPreInstall calls com.percussion.security.io.ZipSlipGuard but
delivery-tier-distribution declared no dependency on perc-security-utils
and its jar was built without bundled dependencies. Running
java -jar delivery-tier-distribution.jar at pre-install time then
threw NoClassDefFoundError: com/percussion/security/io/ZipSlipGuard.

- Declare compile-scope dep on com.percussion:perc-security-utils.
- Add maven-assembly-plugin with jar-with-dependencies so the
  produced jar bundles runtime deps, mirroring the pattern in
  modules/perc-distribution-tree/pom.xml.

Spotless comment-wrap delta in MainDTSPreInstall.java is incidental.
---
 .../delivery-tier-distribution/pom.xml        | 29 +++++++++++++++++++
 .../preinstall/MainDTSPreInstall.java         |  6 ++--
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/pom.xml b/deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/pom.xml
index 77f9c8c918..839f36534b 100644
--- a/deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/pom.xml
+++ b/deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/pom.xml
@@ -14,6 +14,11 @@
         <tomcat-directory>${basedir}/target/tomcat</tomcat-directory>
     </properties>
     <dependencies>
+        <dependency>
+            <groupId>com.percussion</groupId>
+            <artifactId>perc-security-utils</artifactId>
+            <version>${project.parent.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.percussion.deliverytier</groupId>
             <artifactId>perc-metadata-services</artifactId>
@@ -909,6 +914,30 @@
                     </archive>
                 </configuration>
             </plugin>
+            <plugin>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>create-my-bundle</id>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                        <phase>package</phase>
+                        <configuration>
+                            <descriptorRefs>
+                                <descriptorRef>jar-with-dependencies</descriptorRef>
+                            </descriptorRefs>
+                            <finalName>delivery-tier-distribution</finalName>
+                            <appendAssemblyId>false</appendAssemblyId>
+                            <archive>
+                                <manifest>
+                                    <mainClass>com.percussion.preinstall.MainDTSPreInstall</mainClass>
+                                </manifest>
+                            </archive>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-antrun-plugin</artifactId>
diff --git a/deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/java/com/percussion/preinstall/MainDTSPreInstall.java b/deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/java/com/percussion/preinstall/MainDTSPreInstall.java
index 4e454e3760..025f2b0749 100644
--- a/deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/java/com/percussion/preinstall/MainDTSPreInstall.java
+++ b/deliverytiersuite/delivery-tier-suite/delivery-tier-distribution/src/main/java/com/percussion/preinstall/MainDTSPreInstall.java
@@ -219,12 +219,14 @@ public static void extractArchive(Path archiveFile, Path destPath, String folder
         }
 
         if (entry.isDirectory()) {
-          // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by 2027-07-31
+          // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by
+          // 2027-07-31
           Files.createDirectory(newFile.toPath());
           continue;
         }
         System.out.println("Creating file " + newFile);
-        // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by 2027-07-31
+        // codeql[java/zipslip] justification: ZipSlipGuard + canonical startsWith; re-review by
+        // 2027-07-31
         Files.copy(archive.getInputStream(entry), newFile.toPath());
 
         // Preserve executable permissions for shell scripts