fix: normalize lockfiles for Windows

[joemorris-ncsu]

Normalize line endings before calculating checksum. Prevents false-positive mismatches on checksum validation.

Context:
My team at work and I are incorporating maven-lockfile. We have a mixed environment, with some of us on windows/mac/linux and we have been facing issues with the pom.xml checksum validation. My lead actually pointed this out to me so quickly made a patch.

[algomaster99]

Thanks for this change! None of the tests failed. It means none of the generated lockfiles in tests have crlf. Would you try the tests again by adding windows here? Maybe this way we can actually test that normalizing line endings will help.

[joemorris-ncsu]

sorry for the delay- changed code-quality.yml to run on windows instead. Checking it now

[joemorris-ncsu]

@algomaster99 looks like it's not running the changed code-quality.yml file, do you know what's going on here? I see it's queued, I'm not sure if this requires manual action or if it's failing.

[algomaster99]

@joemorris-ncsu I have no clue. Could it be a GitHub issue? I re-ran the workflow again just to check.

[joemorris-ncsu]

looks like a typo, I changed it to runs on: windows instead of runs on: windows-latest, giving it another shot. Sorry!

[algomaster99]

Ah probably. Running it again. Let's see.

[algomaster99]

The tests are failing because of this relative path.

I think this patch should work. Can you apply?

diff --git a/maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/LockFileFacade.java b/maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/LockFileFacade.java
index 689fa20..7beab01 100644
--- a/maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/LockFileFacade.java
+++ b/maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/LockFileFacade.java
@@ -12,6 +12,7 @@ import io.github.chains_project.maven_lockfile.resolvers.ProjectBuilder;
 import java.nio.file.Path;
 import java.util.*;
 import java.util.stream.Collectors;
+import java.util.stream.StreamSupport;
 import org.apache.maven.artifact.Artifact;
 import org.apache.maven.artifact.DefaultArtifact;
 import org.apache.maven.artifact.handler.DefaultArtifactHandler;
@@ -517,11 +518,17 @@ public class LockFileFacade {
 
             String relativePath = isExternalPom
                     ? null
-                    : initialProject
-                            .getBasedir()
-                            .toPath()
-                            .relativize(project.getFile().toPath())
-                            .toString();
+                    // Split path into components
+                    // <comp1>/<comp2>/...
+                    : StreamSupport.stream(
+                                    initialProject
+                                            .getBasedir()
+                                            .toPath()
+                                            .relativize(project.getFile().toPath())
+                                            .spliterator(),
+                                    false)
+                            .map(Path::toString)
+                            .collect(Collectors.joining("/"));
             String checksum;
             ResolvedUrl resolved = null;
             RepositoryId repoId = null;

And also run mvn spotless:apply. I think that is why doc generation is failing.

[joemorris-ncsu]

patched and ran spotless apply. should be good now?

[algomaster99]

Let's hope 🤞

[joemorris-ncsu]

all checks have passed! I can go ahead and squash the commit history, as well as undo the changes to code-quality.yml

[algomaster99]

Great, the tests passed. Now you can revert the change in CI (back to ubuntu-latest) and then I will merge. I also changed the PR title.

Would you like to add windows support in a separate PR?

[algomaster99]

all checks have passed! I can go ahead and squash the commit history,

You can make two separate commits for line-ending and relative paths because they both are distinct

as well as undo the changes to code-quality.yml

yes, thanks!

[joemorris-ncsu]

A) yes I planned on the two seperate commits, apologies for lack of being clear in that regard
B) Could you please clarify:

Would you like to add windows support in a separate PR?

[algomaster99]

A) yes I planned on the two seperate commits, apologies for lack of being clear in that regard

No issues. Sounds good!

B) Could you please clarify:

It is basically adding multiple OS in matrix. See docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations#adding-a-matrix-strategy-to-your-workflow-job.

…

________________________________ From: Joe Morris ***@***.***> Sent: Monday, May 11, 2026 6:48:00 PM To: chains-project/maven-lockfile Cc: Aman Sharma; Mention Subject: Re: [chains-project/maven-lockfile] fix: normalize lockfiles for Windows (PR #1556) [https://avatars.githubusercontent.com/u/264434928?s=20&v=4]joemorris-ncsu left a comment (chains-project/maven-lockfile#1556)<#1556 (comment)> A) yes I planned on the two seperate commits, apologies for lack of being clear in that regard B) Could you please clarify: Would you like to add windows support in a separate PR? — Reply to this email directly, view it on GitHub<#1556 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AIMPTOO5IWN5I5RGJND6NND42H74BAVCNFSM6AAAAACYLHODX2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DIMRSHAYTIMJZGY>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[algomaster99]

This slipped in 😅

[joemorris-ncsu]

hold please 😅😅😅

[algomaster99]

@joemorris-ncsu I think I will squash both of them anyway because 657c370 (this PR) fails the build due to tests and we try to avoid pushing commits with failed build on main.

[joemorris-ncsu]

sorry for delay, you're free to do what you like with it

[algomaster99]

Thank you so much @joemorris-ncsu ! Will merge as soon as the tests are green.

[joemorris-ncsu]

@algomaster99 Thanks! I mean to be polite but I am curious, does maven-lockfile have a regular release schedule/is there a planned release date when this will be ship? Thank you again!

[algomaster99]

We do release a beta every weekend. But I can create a patch release with this fix in :) Just need to merge #1559 before.

[joemorris-ncsu]

That would be awesome, tysm my team and I would really appreciate it!

[algomaster99]

@joemorris-ncsu I have created a beta release https://github.com/chains-project/maven-lockfile/releases/tag/v5.16.1-beta-1. You can try it out with mvn io.github.chains-project:maven-lockfile:5.16.1-beta-1:generate.

There are some PRs (#1569 #1564) that I need resolve before I can release a minor/patch version. I hope this beta releases suffices.