bryan-minimal · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
@@ -1,21 +1,27 @@
-let { Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let { Attrs, BuildSpec, Local, OutputBin, OutputData, OutputLib, Source, Test, .. } = import "minimal.ncl" in
 let base = import "../base/build.ncl" in
+let binutils = import "../binutils/build.ncl" in
 let bash = import "../bash/build.ncl" in
+let glibc = import "../glibc/build.ncl" in
 let jdk = import "../jdk/build.ncl" in
+let patchelf = import "../patchelf/build.ncl" in
 
-let version = "3.9.16" in
+let version = "3.10.0" in
 {
   name = "maven",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://archive.apache.org/dist/maven/maven-3/%{version}/binaries/apache-maven-%{version}-bin.tar.gz",
-      sha256 = "80ffca22aed9e8b9713a232f3394fd81d7f20322df75efdb2b047dbd3e3a23bb",
+      sha256 = "a46cc51bc74fa23fd267c7a0b9132b146dcf526da60d31aa5174e565632e9e0e",
     } | Source,
     base,
+    binutils, # objdump: verify the version-needs rewrite (build.sh)
+    patchelf, # repoints libjlinenative's stale libutil.so.1 dependency at libc (build.sh)
   ],
   runtime_deps = [
     bash, # mvn is a shell script
+    glibc, # libjlinenative.so (JLine's native terminal support, 3.10.0+)
     jdk,
   ],
 
@@ -26,7 +32,13 @@ let version = "3.9.16" in
 
   outputs = {
     mvn = { glob = "usr/bin/mvn" } | OutputBin,
-    maven_home = { glob = "usr/share/maven/**" } | OutputData,
+    # Maven 3.10.0 bundles JLine's native terminal library; bin/mvn points JLine
+    # at it with -Dlibrary.jline.path=$MAVEN_HOME/lib/jline-native, which looks
+    # under <OS>/<arch>/. build.sh keeps only Linux/<host arch>. Declared as a
+    # library, with maven_home's data glob allowed to span it -- the same split
+    # packages/jdk uses for usr/lib/jvm/lib.
+    jline_native = { glob = "usr/share/maven/lib/jline-native/**/*.so" } | OutputLib,
+    maven_home = { glob = "usr/share/maven/**", allow_executable = true } | OutputData,
   },
 
   attrs =

@@ -6,6 +6,40 @@ tar -xof "apache-maven-${MINIMAL_ARG_VERSION}-bin.tar.gz"
 mkdir -p $OUTPUT_DIR/usr/{bin,share/maven}
 cp -r "apache-maven-${MINIMAL_ARG_VERSION}"/* $OUTPUT_DIR/usr/share/maven/
 
+# 3.10.0+ ships JLine's native library prebuilt for 9 OS/arch pairs plus a
+# Windows DLL. Keep only the one this arch can load; bin/mvn resolves it as
+# $MAVEN_HOME/lib/jline-native/Linux/<arch>/libjlinenative.so.
+case $(uname -m) in
+  x86_64)  JLINE_ARCH="x86_64" ;;
+  aarch64) JLINE_ARCH="arm64" ;;
+  *)       echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;;
+esac
+JLINE_DIR="$OUTPUT_DIR/usr/share/maven/lib/jline-native"
+if [ -d "$JLINE_DIR" ]; then
+  test -f "$JLINE_DIR/Linux/$JLINE_ARCH/libjlinenative.so"
+  mv "$JLINE_DIR/Linux/$JLINE_ARCH" "$JLINE_DIR/.keep"
+  find "$JLINE_DIR" -mindepth 1 -maxdepth 1 ! -name .keep -exec rm -rf {} +
+  mkdir -p "$JLINE_DIR/Linux"
+  mv "$JLINE_DIR/.keep" "$JLINE_DIR/Linux/$JLINE_ARCH"
+  # The prebuilt lib was linked against a pre-2.34 glibc: it NEEDs
+  # libutil.so.1 for openpty (its only libutil symbol), recorded in BOTH
+  # DT_NEEDED and the version-needs table (.gnu.version_r: "required from
+  # libutil.so.1: GLIBC_2.2.5"). Since glibc 2.34 openpty lives in libc at
+  # that same version and libutil.so.1 is an empty stub, so minimal-check's
+  # missing-runtime_deps reports openpty missing. --replace-needed renames
+  # the file in both places, pointing the requirement at libc.so.6, which
+  # defines it. (--remove-needed only drops DT_NEEDED, leaving a version
+  # requirement on a library that is no longer loaded.)
+  JLINE_LIB="$JLINE_DIR/Linux/$JLINE_ARCH/libjlinenative.so"
+  patchelf --replace-needed libutil.so.1 libc.so.6 "$JLINE_LIB"
+  # Fail closed if either table still names libutil.
+  if patchelf --print-needed "$JLINE_LIB" | grep -qx libutil.so.1 \
+     || objdump -p "$JLINE_LIB" | grep -q 'required from libutil'; then
+    echo "libjlinenative.so still depends on libutil.so.1" >&2
+    exit 1
+  fi
+fi
+
 # Create wrapper script that sets M2_HOME
 cat > $OUTPUT_DIR/usr/bin/mvn << 'EOF'
 #!/bin/sh