Why does Findbugs JSR305 break OSGi package export of javax.annotations in RedHat/JBoss Fuse 6.3.0? - osgi

Question

We need FindBugs JSR305 as a dependency and we deploy it as a wrapped OSGi bundle to Fuse 6.3.0. At first it looks like everything is fine and the components are working well. But after a restart, many bundles that depend on javax.annoation API are not starting anymore. We found out, that the javax.annoation API Bundle that comes with the Fuse installation does not export the package javax.annoation after the restart. Although the bundle of the javax.annotation API starts without errors and exports other packages.
The error occurs with RedHat Fuse 6.3.0.475 and the corresponding Karaf 2.4.0.redhat-630475.
We already tried the ServiceMix JSR305 Bundle from Maven Repository, but it exports the javax.annotation in version 1.1.0 and we need version 3.0.2. Maybe this is a mistake too, because I would expect an export of javax.annotation 3.0.2 from the bundle version 3.0.2_1.
Manifest-Version: 1.0
Bnd-LastModified: 1493877706145
Build-Jdk: 1.8.0_111
Built-By: jbonofre
Bundle-Description: This OSGi bundle wraps jsr305 1.1.0 jar file.
Bundle-DocURL: http://www.apache.org/
Bundle-License: http://www.apache.org/licenses/LICENSE-2.0.txt
Bundle-ManifestVersion: 2
Bundle-Name: Apache ServiceMix :: Bundles :: jsr305
Bundle-SymbolicName: org.apache.servicemix.bundles.jsr305
Bundle-Vendor: The Apache Software Foundation
Bundle-Version: 3.0.2.1
Created-By: Apache Maven Bundle Plugin
Export-Package: javax.annotation;version="1.1.0";uses:="javax.annotation.meta",javax.annotation.concurrent;version="1.1.0",javax.annotation.meta;version="1.1.0";uses:="javax.annotation"
Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))"
Tool: Bnd-3.2.0.201605172007
Reproduction
Setup a new Fuse 6.3.0 installation. With "pacakges:exports | grep javax.annoation;" you can find out that javax.annoation is exported in version 1.0.0 from System Bundle and in version 1.2.0 from javax.annoation API.
JBossFuse:karaf#root> packages:exports | grep javax.annotation\;
0 javax.annotation; version=1.0.0
60 javax.annotation; version=1.2.0
Now install FindBugs JSR305 as a wrapped OSGi bundle to the instance. There are three exports of the javax.annotation package now including version 3.0.2 of the FindBugs JSR305 bundle and everything is working.
JBossFuse:karaf#root> packages:exports | grep javax.annotation\;
0 javax.annotation; version=1.0.0
60 javax.annotation; version=1.2.0
294 javax.annotation; version=3.0.2
Now restart the instance via admin script or "dev:restart" and after the instance is up again you will see some broken bundles, because javax.annoation API stopped to export version 1.2.0 of the javax.annotation package.
JBossFuse:karaf#root> packages:exports | grep javax.annotation\;
0 javax.annotation; version=1.0.0
294 javax.annotation; version=3.0.2
If you try the same with a fresh Fuse 7.0.0 installation, which runs with Karaf 4.2.0 and where javax.annotation API is still included, the error will not occur. It also works with Fuse 7.7.0, but there javax.annotation API is not included anymore and the java.annotation packages are exported just from Sytem Bundle.

Answer 1

I had the same problem (and yes - in JBoss Fuse). After upgrading to Zookeeper 3.4.14 we had this in mvn dependency:tree:
[INFO] | \- org.apache.zookeeper:zookeeper:jar:3.4.14:compile
[INFO] | +- org.slf4j:slf4j-log4j12:jar:1.7.10:compile
[INFO] | +- com.github.spotbugs:spotbugs-annotations:jar:3.1.9:compile
[INFO] | | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile
Findbugs library is simply broken:
JBossFuse:karaf#root> install mvn:com.google.code.findbugs/jsr305/3.0.2
Bundle ID: 295
JBossFuse:karaf#root> headers 295
FindBugs-jsr305 (295)
---------------------
Archiver-Version = Plexus Archiver
Created-By = Apache Maven Bundle Plugin
Manifest-Version = 1.0
Bnd-LastModified = 1490936130302
Build-Jdk = 1.8.0_101
Built-By = lan
Tool = Bnd-2.1.0.20130426-122213
Bundle-License = http://www.apache.org/licenses/LICENSE-2.0.txt
Bundle-ManifestVersion = 2
Bundle-SymbolicName = org.jsr-305
Bundle-Version = 3.0.2
Bundle-Name = FindBugs-jsr305
Bundle-Description = JSR305 Annotations for Findbugs
Export-Package =
javax.annotation;uses:=javax.annotation.meta;version=3.0.2,
javax.annotation.concurrent;version=3.0.2,
javax.annotation.meta;uses:=javax.annotation;version=3.0.2
because it exports javax.annotation package with non existing version. If you check JSR 250, Common Annotations for the JavaTM Platform, its version should be 1.3 and it matches the versions from Maven Central.
In our case, we've changed activemq-osgi to import javax.annotation;version="[1,4)" instead of just javax.annotation, so maven-bundle-plugin didn't generate bad javax.annotation;version="[3,4)".
But IMO, findbugs should NOT use javax.annotation package at all...