[#60] Build and validate an explicit JPMS module from Java 8

[peter-lawrey]

Build an explicit net.openhft.hashing descriptor on Java 8 and validate the retained JAR on later class paths and module paths. This retains the Stages 2 and 3 work from #60, including the #123 implementation. The hashing algorithms are unchanged by this increment.

The history now contains bmarwell's original signed #107 commit (cdbdc506) unchanged and one consolidated integration commit (b373003). The comparison base remains 4e721919a6eace335ce5921dfa4bde590ab1697f; the #123 implementation is retained. The existing Build/Sonar workflow is identical to #125 on develop, including its coverage handoff and late JaCoCo argument evaluation.

Review corrections:

• Allow consecutive Maven lifecycles without clean by enabling ModiTect output replacement. CI repeats package after verification. The paired regression harness derives the JAR filename from project coordinates, so ordinary version bumps preserve the check.
• Target ordinary consumers at Java 8 and modular consumers at Java 9, selected on 9+. Select HTML5 explicitly to prevent the independently reproduced JDK 10 Javadoc warning.
• Inherit user Maven settings while keeping the isolated consumer repository. Document the complete ./mvnw verify lifecycle.
• Require the final multi-release manifest marker generated by ModiTect. Remove the redundant explicit JAR/bundle marker settings and their unsupported test claims. Declare optional requires static jsr305, and check descriptor semantics and annotation resolution with jdeps.
• Build once on Java 8, retain the binary and provenance, and execute that exact binary on JDK 8/9/10/11/17/21/25. Every job compares its installed JAR with the retained checksum and uploads its reports.

Use ModiTect 1.2.2 because 1.3 declares a Java 11 prerequisite. The new workflow uses the checked-in Maven 3.9.11 wrapper consistently. The existing project-wide version gate is preserved; TeamCity's Maven 3.8.2 was also verified directly.

Validation:

• Current-tree Java 8 verify/package pairs pass at the project version and a private 2026.2-SNAPSHOT version bump. Each verify arm reports 14,905 unit cases with 12 retained skips, three packaged-JAR tests and five classpath cases, with zero failures/errors. All 62 library class files match the retained CI binary at the current coordinates; at the bumped version, the descriptor differs only by its version string. Negative controls reproduce the hardcoded-path failure, missing-overwrite failure, unflipped-negative guard and final-manifest/descriptor assertions.
• Retained previous-head local verification passed on JDK 8, 9, 10, 11 and 21. Java 8 reports 14,905 unit cases with 12 skips; later JDKs run both string configurations, each reporting 14,905 cases with 5/8 skips. Three packaged-JAR checks and the applicable consumer fixtures pass. Java 21 coverage thresholds pass.
• Retained previous-head controls: repeat packaging passed with Maven 3.8.2 and 3.9.16. Removing the manifest marker fails the intended assertion. A cold-repository mirror-only dependency test passes with inherited settings and fails when the old override is restored.
• Retained CI on previous head 76ce46f: the Build job passes. The artifact workflow passes all seven consumer jobs: 59 cases, zero failures/errors/skips among executed cases. Java 8 deliberately skips the modular fixture. JDK 10 required one retry after Invoker failed to load before testing; that failed attempt is retained separately.
• The retained CI Java 8 binary has SHA-256 63087921e407c7d98d3673ddd9cd4827b5806796eac7d5e6fd432b5b1fda1cec. Its synthetic checkout matches the previous 76ce46f PR tree. Current-tree Java 8 builds preserve its 62 class-file bytes; the recorded whole-JAR hash and multi-JDK CI results retain their original subject identities.

Open and non-draft; the revised source awaits fresh review and CI results. Previous-head qualification recorded eight successful TeamCity jobs, with Windows and macOS pending. The previous-head Sonar job rejected the configured credential, leaving administrator repair outstanding. Its optional quality profile reported the same 7,844 Checkstyle violations as the merged baseline and stopped before SpotBugs.

Refs #60, #107, #119, #123, #125.

[peter-lawrey]

@bmarwell GitHub cannot add you as a formal requested reviewer because it reports that review requests are limited to repository collaborators, but your review is warmly invited. This continuation retains your original commit and the full #107 head unchanged in its ancestry.

[bmarwell]

It is totally fine as a start

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud