Recursive pkgdiff for WAR and JAR comparison in Java

This’ll be one of the most useful utilities I’ve written to date


  • Whitelisting of Desired JAR String Matches
  • Option to enable/disable whitelisting
  • pkgdiff over parent WARs and all children JAR files
  • Option to enable/disable decompiling
    • Decompiles all detected/whitelisted (if enabled) jar files and attaches source back to jar file
    • Used for delta analysis in html report that pkgdiff creates
  • Timestamped Reports – Both Zipped and Regular Folders
    • Each time script is ran clears current working report directory
    • At end of script takes output and copies to timestamped directory
    • At end of script zips the timestamped directory for portability

The idea is to do the following:

  1. Runs pkgdiff on the initial two WAR files
  2. Unzips the WAR files
  3. Searches for any JAR files in each unzipped path and indexes them
  4. Attempts to find a JAR match across both of the unzipped WAR paths
    • Strips version numbers from the jar filenames
    • Checks the whitelist to see if the JAR matches ones you desire to be processed
  5. (Optional) Runs JD Decompiler and attaches the decompiled code back to the JAR
  6. Runs pkgdiff on the matched jar files
  7. Repeat steps 4-6 on all jars
  8. Takes output and copies all to timestamped directory
  9. Zips timestamped directory for portability
    • Does not remove timestamped directory just zips it

Repo URL

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s