[jira] [Comment Edited] (STANBOL-1246) Exclude javax.transaction.* from FrameworkFragment

["Rupert Westenthaler (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/STANBOL-1246?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13878479#comment-13878479 ] 

Rupert Westenthaler edited comment on STANBOL-1246 at 1/22/14 10:06 AM:
------------------------------------------------------------------------

A short history:

 - first fixed with http://svn.apache.org/r1552244 and  http://svn.apache.org/r1552245 in 0.12 and trunk
 - reverted with http://svn.apache.org/r1557995 and http://svn.apache.org/r1558785 because of STANBOL-1254
 - fixed with http://svn.apache.org/r1559065 and http://svn.apache.org/r1560050 by reverting the change introduced by STANBOL-1254.

See also comments on STANBOL-1254 for more infos


was (Author: rwesten):
A short history:

 - first fixed with http://svn.apache.org/r1552244 and  http://svn.apache.org/r1552245 in 0.12 and trunk
 - reverted with 

> Exclude javax.transaction.* from FrameworkFragment
> --------------------------------------------------
>
>                 Key: STANBOL-1246
>                 URL: https://issues.apache.org/jira/browse/STANBOL-1246
>             Project: Stanbol
>          Issue Type: Improvement
>          Components: Commons, Contenthub
>    Affects Versions: 0.12.0
>            Reporter: Rupert Westenthaler
>            Assignee: Rupert Westenthaler
>             Fix For: 0.12.0
>
>
> Currently `javax.transaction`and `javax.transaction.xa` are imported from the JDK via the Stanbol framework fragment. This is potentially dangerous as the versions included in the JDK are incomplete. This can be easily checked by comparing the package summary of the packages in the Java6 javadoc [1] and the documentation of JSR 907: Java Transaction API (JTA) available at [2]
> This is for an OSGI environment especially dangerous vor several reasons:
> 1. OSGI does not allow to import classes for the same package from different bundles
> 2. As `javax.transaction.*` is exported from the system bundle it uses version 0.0.0 and not the correct JSR 907 version 1.1.
> 3. javax.transaction is referenced by `javax.sql` that is also exported from the system bundle. So `javax.sql` will always bind to the `javax.transaction` package exported by the system bundle. That means that Bundles that require both the full JTA AND SQL will end up importing two versions from the `javax.transaction.*` (1) version 1.1 from a user provided bundle with the full JSR 907 specification (e.g. [3]) and indirectly 0.0.0 provided by the system bundle (indirectly via the `javax.sql` package. This will cause OSGI to report a Constraint violations because a bundle MUST NOT depend on two versions of the same package (such a setting is best described in [4] page 101ff.
> A check with all modules present in the Stanbol Full Launcher showed that `javax.transaction` is only referenced by the Contenthub component. That means that we will need to add a Bundle for JTA 1.1 in the bundlelist for the Contenthub. I suggest to use the bundle provided by the JBoss community [3]. All other options are not packaged as OSGI bundles and [3] does not come with any additional dependencies.
> [1] http://docs.oracle.com/javase/6/docs/api/javax/transaction/package-summary.html
> [2] http://www.oracle.com/technetwork/java/javaee/jta/index.html
> [3] http://search.maven.org/#artifactdetails|org.jboss.spec.javax.transaction|jboss-transaction-api_1.1_spec|1.0.1.Final|jar
> [4] http://felix.apache.org/site/presentations.data/Learning_to_ignore_OSGi.pdf



--
This message was sent by Atlassian JIRA
(v6.1.5#6160)