DataNucleus

[ http://www.datanucleus.org/servlet/jira/browse/NUCACCESS-61?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andy Jefferson moved NUCCORE-446 to NUCACCESS-61:
-------------------------------------------------

              Project: DataNucleus Access Platform  (was: DataNucleus Core)
                  Key: NUCACCESS-61  (was: NUCCORE-446)
    Affects Version/s: 2.0.0.release
                           (was: 2.0.0.release)

> Tighten import constraints of DataNucleus OSGi bundles.
> -------------------------------------------------------
>
>                 Key: NUCACCESS-61
>                 URL: http://www.datanucleus.org/servlet/jira/browse/NUCACCESS-61
>             Project: DataNucleus Access Platform
>          Issue Type: Improvement
>    Affects Versions: 2.0.0.release
>            Reporter: Jasper Siepkes
>            Priority: Minor
>
> The imports of the DataNucleus OSGi bundles do currently not specify version constraints. For example javax.transaction is imported as:
> javax.transaction;resolution:=optional, javax.transaction.xa;resolutio
> n:=optional
> This means import version 0.0.0. Normally this shouldn't be a problem since OSGi will look for the bundle who exports those packages with the highest version (in the case of javax.transaction probably version 1.1.0). Unless there is a bundle present which actually exports version 0.0.0. Now javax.transaction is by default not present in the Java 5 JRE, but it is present in the Java 6 JRE. So far this shouldn't be a problem because no bundle exports these JRE packages in a default OSGi environment. 
> However for the DataNucleus plugin system you need the Eclipse registry bundles and 'org.eclipse.core.runtime' does reexport all these packages with their version 0.0.0. And this is the crux of the story, other bundles besides DataNucleus specify javax.transaction with its version (1.1.0) and get the javax.transaction package from the javax.transaction bundle but DataNucleus doesn't specify a version and gets the package from the JRE.
> In the Eclipse community they call it 'the ever present evil of the org.eclipse.core.runtime's use of re-export for the org.eclipse.osgi bundle'. See https://bugs.eclipse.org/bugs/show_bug.cgi?id=298318 . So while this is probably more of an Eclipse issue then a DataNucleus issue, having version constraints on OSGi imports is also good practice.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://www.datanucleus.org/servlet/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://www.datanucleus.org/servlet/jira/browse/NUCACCESS-61?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17370#action_17370 ] 

Andy Jefferson commented on NUCACCESS-61:
-----------------------------------------

When you've time why not provide a patch for datanucleus-core/datanucleus-rdbms/datanucleus-jpa MANIFEST.MF files and they can be looked at when someone has time.

> Tighten import constraints of DataNucleus OSGi bundles.
> -------------------------------------------------------
>
>                 Key: NUCACCESS-61
>                 URL: http://www.datanucleus.org/servlet/jira/browse/NUCACCESS-61
>             Project: DataNucleus Access Platform
>          Issue Type: Improvement
>    Affects Versions: 2.0.0.release
>            Reporter: Jasper Siepkes
>            Priority: Minor
>
> The imports of the DataNucleus OSGi bundles do currently not specify version constraints. For example javax.transaction is imported as:
> javax.transaction;resolution:=optional, javax.transaction.xa;resolutio
> n:=optional
> This means import version 0.0.0. Normally this shouldn't be a problem since OSGi will look for the bundle who exports those packages with the highest version (in the case of javax.transaction probably version 1.1.0). Unless there is a bundle present which actually exports version 0.0.0. Now javax.transaction is by default not present in the Java 5 JRE, but it is present in the Java 6 JRE. So far this shouldn't be a problem because no bundle exports these JRE packages in a default OSGi environment. 
> However for the DataNucleus plugin system you need the Eclipse registry bundles and 'org.eclipse.core.runtime' does reexport all these packages with their version 0.0.0. And this is the crux of the story, other bundles besides DataNucleus specify javax.transaction with its version (1.1.0) and get the javax.transaction package from the javax.transaction bundle but DataNucleus doesn't specify a version and gets the package from the JRE.
> In the Eclipse community they call it 'the ever present evil of the org.eclipse.core.runtime's use of re-export for the org.eclipse.osgi bundle'. See https://bugs.eclipse.org/bugs/show_bug.cgi?id=298318 . So while this is probably more of an Eclipse issue then a DataNucleus issue, having version constraints on OSGi imports is also good practice.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://www.datanucleus.org/servlet/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://www.datanucleus.org/servlet/jira/browse/NUCACCESS-61?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17375#action_17375 ] 

Jasper Siepkes commented on NUCACCESS-61:
-----------------------------------------

Will do! Give me a couple of days to make some time for it.

> Tighten import constraints of DataNucleus OSGi bundles.
> -------------------------------------------------------
>
>                 Key: NUCACCESS-61
>                 URL: http://www.datanucleus.org/servlet/jira/browse/NUCACCESS-61
>             Project: DataNucleus Access Platform
>          Issue Type: Improvement
>    Affects Versions: 2.0.0.release
>            Reporter: Jasper Siepkes
>            Priority: Minor
>
> The imports of the DataNucleus OSGi bundles do currently not specify version constraints. For example javax.transaction is imported as:
> javax.transaction;resolution:=optional, javax.transaction.xa;resolutio
> n:=optional
> This means import version 0.0.0. Normally this shouldn't be a problem since OSGi will look for the bundle who exports those packages with the highest version (in the case of javax.transaction probably version 1.1.0). Unless there is a bundle present which actually exports version 0.0.0. Now javax.transaction is by default not present in the Java 5 JRE, but it is present in the Java 6 JRE. So far this shouldn't be a problem because no bundle exports these JRE packages in a default OSGi environment. 
> However for the DataNucleus plugin system you need the Eclipse registry bundles and 'org.eclipse.core.runtime' does reexport all these packages with their version 0.0.0. And this is the crux of the story, other bundles besides DataNucleus specify javax.transaction with its version (1.1.0) and get the javax.transaction package from the javax.transaction bundle but DataNucleus doesn't specify a version and gets the package from the JRE.
> In the Eclipse community they call it 'the ever present evil of the org.eclipse.core.runtime's use of re-export for the org.eclipse.osgi bundle'. See https://bugs.eclipse.org/bugs/show_bug.cgi?id=298318 . So while this is probably more of an Eclipse issue then a DataNucleus issue, having version constraints on OSGi imports is also good practice.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://www.datanucleus.org/servlet/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://www.datanucleus.org/servlet/jira/browse/NUCACCESS-61?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17840#action_17840 ] 

Andy Jefferson commented on NUCACCESS-61:
-----------------------------------------

SVN trunk has min versions on JDO (javax.jdo.*) and JPA (javax.persistence.*) now.

> Tighten import constraints of DataNucleus OSGi bundles.
> -------------------------------------------------------
>
>                 Key: NUCACCESS-61
>                 URL: http://www.datanucleus.org/servlet/jira/browse/NUCACCESS-61
>             Project: DataNucleus Access Platform
>          Issue Type: Improvement
>    Affects Versions: 2.0.0.release
>            Reporter: Jasper Siepkes
>            Priority: Minor
>
> The imports of the DataNucleus OSGi bundles do currently not specify version constraints. For example javax.transaction is imported as:
> javax.transaction;resolution:=optional, javax.transaction.xa;resolutio
> n:=optional
> This means import version 0.0.0. Normally this shouldn't be a problem since OSGi will look for the bundle who exports those packages with the highest version (in the case of javax.transaction probably version 1.1.0). Unless there is a bundle present which actually exports version 0.0.0. Now javax.transaction is by default not present in the Java 5 JRE, but it is present in the Java 6 JRE. So far this shouldn't be a problem because no bundle exports these JRE packages in a default OSGi environment. 
> However for the DataNucleus plugin system you need the Eclipse registry bundles and 'org.eclipse.core.runtime' does reexport all these packages with their version 0.0.0. And this is the crux of the story, other bundles besides DataNucleus specify javax.transaction with its version (1.1.0) and get the javax.transaction package from the javax.transaction bundle but DataNucleus doesn't specify a version and gets the package from the JRE.
> In the Eclipse community they call it 'the ever present evil of the org.eclipse.core.runtime's use of re-export for the org.eclipse.osgi bundle'. See https://bugs.eclipse.org/bugs/show_bug.cgi?id=298318 . So while this is probably more of an Eclipse issue then a DataNucleus issue, having version constraints on OSGi imports is also good practice.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://www.datanucleus.org/servlet/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://issues.datanucleus.org/browse/NUCACCESS-61?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andy Jefferson resolved NUCACCESS-61.
-------------------------------------

    Fix Version/s: 3.0.0.m5
       Resolution: Fixed

Marking as fixed since has been open too long with no input, and we do restrict on some dependencies now. If requiring others then please raise a new issue on the plugin in question and attach a patch

> Tighten import constraints of DataNucleus OSGi bundles.
> -------------------------------------------------------
>
>                 Key: NUCACCESS-61
>                 URL: http://issues.datanucleus.org/browse/NUCACCESS-61
>             Project: DataNucleus Access Platform
>          Issue Type: Improvement
>    Affects Versions: 2.0.0.release
>            Reporter: Jasper Siepkes
>            Priority: Minor
>             Fix For: 3.0.0.m5
>
>
> The imports of the DataNucleus OSGi bundles do currently not specify version constraints. For example javax.transaction is imported as:
> javax.transaction;resolution:=optional, javax.transaction.xa;resolutio
> n:=optional
> This means import version 0.0.0. Normally this shouldn't be a problem since OSGi will look for the bundle who exports those packages with the highest version (in the case of javax.transaction probably version 1.1.0). Unless there is a bundle present which actually exports version 0.0.0. Now javax.transaction is by default not present in the Java 5 JRE, but it is present in the Java 6 JRE. So far this shouldn't be a problem because no bundle exports these JRE packages in a default OSGi environment. 
> However for the DataNucleus plugin system you need the Eclipse registry bundles and 'org.eclipse.core.runtime' does reexport all these packages with their version 0.0.0. And this is the crux of the story, other bundles besides DataNucleus specify javax.transaction with its version (1.1.0) and get the javax.transaction package from the javax.transaction bundle but DataNucleus doesn't specify a version and gets the package from the JRE.
> In the Eclipse community they call it 'the ever present evil of the org.eclipse.core.runtime's use of re-export for the org.eclipse.osgi bundle'. See https://bugs.eclipse.org/bugs/show_bug.cgi?id=298318 . So while this is probably more of an Eclipse issue then a DataNucleus issue, having version constraints on OSGi imports is also good practice.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.datanucleus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira