I got the security issue with a big Eclipse plugin Maven project, which uses Xtext, Xtend and fornax-oaw-m2-plugin (which fails).
I extracted the used classpath, and searched in there if the incriminated class is present in at least two jars, but no. It is only present in one bundle. Could I grab more information into the stacktrace? I could provide many more information.. I google since two days and not found interesting clue so far. As the class in in an Eclipse bundle, i can't change it safely..
[INFO] Caused by: org.eclipse.emf.common.util.WrappedException: java.lang.SecurityException: class "org.eclipse.emf.ecore.impl.MinimalEObjectImpl$Container"'s signer information does not match signer information of other classes in the same package.
Here is the project's MANIFEST.MF :
Manifest-Version: 1.0
Bundle-ManifestVersion: 2
Bundle-Name: com.mds.regseq
Bundle-Vendor: Magillem Design Services S.A.S.
Bundle-Version: 1.0.0.qualifier
Bundle-SymbolicName: com.mds.regseq; singleton:=true
Bundle-ActivationPolicy: lazy
Require-Bundle: org.eclipse.xtext;bundle-version="2.3.1";visibility:=reexport,
org.apache.log4j;visibility:=reexport,
org.apache.commons.logging;resolution:=optional;visibility:=reexport,
org.eclipse.xtext.generator;resolution:=optional,
org.eclipse.emf.codegen.ecore;resolution:=optional,
org.eclipse.emf.mwe.utils;resolution:=optional,
org.eclipse.emf.mwe2.launch;resolution:=optional,
org.eclipse.xtext.util,
org.eclipse.emf.common,
org.antlr.runtime,
org.eclipse.xtext.common.types,
com.mds.spiritschema.xmlfactory,
com.mds.mrv;visibility:=reexport,
com.mds.regseq.mrv.binding;visibility:=reexport
Import-Package: org.apache.commons.logging,
org.apache.log4j, org.eclipse.emf.ecore
Export-Package: com.mds.regseq,
com.mds.regseq.formatting,
com.mds.regseq.interpreter,
com.mds.regseq.parseTreeConstruction,
com.mds.regseq.parser.antlr,
com.mds.regseq.parser.antlr.internal,
com.mds.regseq.properties,
com.mds.regseq.register_sequencing,
com.mds.regseq.register_sequencing.impl,
com.mds.regseq.register_sequencing.util,
com.mds.regseq.scoping,
com.mds.regseq.services,
com.mds.regseq.type,
com.mds.regseq.util,
com.mds.regseq.validation
Bundle-RequiredExecutionEnvironment: JavaSE-1.6
Related
I have an Eclipse RCP-based application that has a dependency on a bundle that requires sun.misc. At start time, it is not resolved because it can't find the package:
id State Bundle
150 INSTALLED org.diirt.support.diirt-pva_3.1.6.20170118092719
osgi> start 150
gogo: BundleException: Could not resolve module: org.diirt.support.diirt-pva [150]
Unresolved requirement: Import-Package: org.epics.pvaccess; version="[4.1.0,5.0.0)"
-> Export-Package: org.epics.pvaccess; bundle-symbolic-name="org.epics.pvAccessJava"; bundle-version="4.1.3"; version="4.1.3"; uses:="org.epics.pvdata.pv"
org.epics.pvAccessJava [307]
Unresolved requirement: Import-Package: sun.misc
Meanwhile in the built product's plugins directory is com.diffplug.osgi.extension.sun.misc_0.0.0.jar. This provides the package sun.misc:
Manifest-Version: 1.0
Export-Package: sun.misc
Fragment-Host: system.bundle; extension:=framework
Bundle-ManifestVersion: 2
Bundle-License: public domain - http://unlicense.org/
Bundle-SymbolicName: com.diffplug.osgi.extension.sun.misc
Bundle-Version: 0.0.0
However, this is not loaded when the application starts:
osgi> ss diff
"Framework is launched."
id State Bundle
Why is this required bundle not loaded?
Incidentally, this plugin is required in a feature that is included in the product.
As far as I can tell, sun.misc should be resolvable in com.diffplug.osgi:com.diffplug.osgi.extension.sun.misc:0.0.0
Perhaps you could try adding this to your project?
I want to use cglib in an RCP client. The RCP client is build using maven and the tycho plugin. We are useing a manifest first strategy.
This is my MANIFEST.MF:
Manifest-Version: 1.0
Bundle-ManifestVersion: 2
Bundle-Name: INFO+ RCP Common UI Plug-in
Bundle-SymbolicName: a.company.prj.rcp.common.ui
Bundle-Version: 8.0.14.qualifier
Bundle-Vendor: Schweizerische Bundesbahnen SBB
Bundle-RequiredExecutionEnvironment: JavaSE-1.7
Bundle-Activator: a.company.prj.rcp.common.ui.CommonUIPlugin
Bundle-ActivationPolicy: lazy
Export-Package:
a.company.prj.rcp.common.ui,
...
a.company.prj.rcp.common.ui.wizards.page
Import-Package:
org.apache.log4j;version="1.2.17"
Require-Bundle:
org.eclipse.ui;bundle-version="3.7.0",
org.eclipse.ui.forms;bundle-version="3.5.101",
com.ibm.ws.jpa.thinclient;bundle-version="8.0.6",
...
a.company.prj.rcp.core;bundle-version="8.0.14",
...
To add cglib I changed the Import-Package section to:
Import-Package:
net.sf.cglib;version="3.2.0",
org.apache.log4j;version="1.2.17"
Now Eclipse complains with:
No available bundle exports package 'net.sf.cglib'
Ayn ideas how to include cglib with this environment?
You will need to add the cglib bundle to your target platform, i.e., the set of all bundles Tycho will consider when resolving dependencies. You have three options to do so (taken from the Tycho wiki page on this topic):
You can simply add an entire p2 repository to your target platform.
You can use a .target file and reference the cglib bundle therein (as already suggested by stempler).
You can declare a Maven <dependency> on cglib and make Tycho “consider” it.
As you already have a working Tycho build, I suggest you use whatever option you or your colleagues have used in the build before.
One more note: Options 1 and 2 require that the cglib bundle is available in a p2 repository, whereas option 3 works even if the bundle comes from a “normal” Maven repository like the Central Repository. But in all three cases the cglib JAR must be a valid OSGi bundle, i.e., include an OSGi MANIFEST.MF with Bundle-SymbolicName etc.
You should build the cglib jar file to a plugin and install it in Eclipse before you can use it. You can refer to this link: How can I add the external jar to the eclipse rcp application?
I have two different projects in Eclipse based on Bndtools.
The first produces a JAR with following manifest :
Manifest-Version: 1.0
Bnd-LastModified: 1450251340248
Bundle-Activator: org.osgi.tutorial.MessageCounterActivator3
Bundle-ManifestVersion: 2
Bundle-Name: org.osgi.tutorial
Bundle-SymbolicName: org.osgi.tutorial
Bundle-Version: 0.0.0.201512160735
Created-By: 1.8.0_66 (Oracle Corporation)
Import-Package: org.osgi.book.reader.api,org.osgi.framework;version="[1.3,2)",org.osgi.util.tracker;version="[1.4,2)"
Private-Package: org.osgi.tutorial
Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"
Tool: Bnd-3.0.0.201509101326
the second has the following manifest :
Manifest-Version: 1.0
Bnd-LastModified: 1450536025075
Bundle-Activator: org.osgi.book.configadmin.ServerConnectionActivator
Bundle-ManifestVersion: 2
Bundle-Name: org.osgi.book.configadmin
Bundle-SymbolicName: org.osgi.book.configadmin
Bundle-Version: 0.0.0.201512191440
Created-By: 1.8.0_66 (Oracle Corporation)
Import-Package: org.osgi.framework;version="[1.3,2)",org.osgi.service.cm;version="[1.3,2)"
Private-Package: org.osgi.book.configadmin;version="1.0.0"
Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"
Tool: Bnd-3.0.0.201509101326
The two projects need the osgi.cmpn : the first for ServiceTracker (package org.osgi.util.tracker) and the second for ManagedService (package org.osgi.service.cm).
The first project works great : I install and start the bundle without problems.
I can install the bundle from the second project but when I start it I receive the following error :
org.osgi.framework.BundleException: Unresolved constraint in bundle org.osgi.book.configadmin [6]: Unable to resolve 6.0: missing requirement [6.0] osgi.wiring.package; (&(osgi.wiring.package=org.osgi.service.cm)(version>=1.3.0)(!(version>=2.0.0)))
What's the problem ? If both the project need osgi.cmpn JAR ... why the first doesn't throw this error on starting ?
Thanks,
Paolo.
See this question. Never deploy the compendium jar in OSGi. Instead you need a bundle that implements the spec you depend on.
In your case you need a config admin service impl. There are implementations from felix and from eclipse. Both contain the api.
We have an OSGi project which needs spring and hibernate capability. I tried adding them separately as bundles, but they are not visible to the runtime environment. Below is a screenshot of our project (better picture http://i.stack.imgur.com/d6gV9.png). In the picture the plugins start with spring and hibernate contain the jars and I added them to the import packages in the needed bundles. I'm also attaching a sample manifest with this. Any help is appreciated. I always get classnotfoundexceptions for spring classes.
I created the jar bundles using eclipse's create plugin fro archives. In the wizard I selected them to be standard OSGi plugins (not sure if that is the right way). I'm building the project through IBM RAD (Aries).
Manifest-Version: 1.0
Bundle-ManifestVersion: 2
Bundle-Name: org.xxx.scar.web1
Bundle-SymbolicName: org.xxx.scar.web1
Bundle-Version: 1.0.0.qualifier
Bundle-ClassPath: WEB-INF/classes
Bundle-RequiredExecutionEnvironment: JavaSE-1.6
Web-ContextPath: /org.frb.scar.web1
Import-Package: javax.el;version="2.0";resolution:=optional,
javax.faces,
javax.faces.application,
javax.faces.component,
javax.faces.component.html,
javax.faces.context,
javax.faces.convert,
javax.faces.el,
javax.faces.event,
javax.faces.lifecycle,
javax.faces.model,
javax.faces.render,
javax.faces.validator,
javax.faces.webapp,
javax.servlet;version="2.5",
javax.servlet.annotation;resolution:=optional,
javax.servlet.http;version="2.5",
javax.servlet.jsp;version="2.0",
javax.servlet.jsp.el;version="2.0",
javax.servlet.jsp.tagext;version="2.0",
org.frb.scar.entity,
org.frb.scar.manager,
org.frb.scar.services,
org.frb.scar.utils,
org.springframework.beans,
org.springframework.beans.annotation,
org.springframework.beans.factory,
org.springframework.beans.factory.access,
org.springframework.beans.factory.access.el,
org.springframework.beans.factory.annotation,
org.springframework.beans.factory.config,
org.springframework.beans.factory.parsing,
org.springframework.beans.factory.serviceloader,
org.springframework.beans.factory.support,
org.springframework.beans.factory.wiring,
org.springframework.beans.factory.xml,
org.springframework.beans.propertyeditors,
org.springframework.beans.support
and more spring jars, until web.
Error
java.lang.ClassNotFoundException: org.springframework.web.context.request.RequestContextListener
java.lang.ClassNotFoundException: org.springframework.web.context.ContextLoaderListener
and many....
Thanks,
Bab.
The answer is in the error message: ClassNotFoundException: org.springframework.web.context.request.RequestContextListener.
Package org.springframework.web.context.request is not listed in the imports of your bundle.
I have a Vaadin application, which I'm trying to build as a set of OSGI bundles using Maven + BND.
I can't deploy the bundles To Apache Felix because some dependencies can't be resolved.
Apache Felix complains that can't find package XYZ required by bundle "A", although this package is defined in this same bundle!!
I looked at the MANIFEST.MF file generated by Maven + BND and saw that the package (XYZ) from this bundle is added to both "import" and "export" sections. I understand why "export", but why "import"?? Why is the bundle trying to import its own package?
my MANIFEST.MF
Manifest-Version: 1.0
Export-Package: myexample.admin;uses:="com.vaadin.ui,myexample.webshared,
com.vaadin.terminal,myexample.mvc.view.impl,
myexample.mvc.model,myexample.mvc.renderer.map.impl,
myexample.mvc.renderer,myexample.mvc.model.impl,myexample.util"
Built-By: ask
Tool: Bnd-0.0.384
Bundle-Name: admin
Created-By: 1.6.0_21 (Sun Microsystems Inc.)
Bundle-Version: 0
Build-Jdk: 1.6.0_26
Bnd-LastModified: 1315674240833
Bundle-ManifestVersion: 2
Import-Package: myexample.admin;version="1.0",myexample.mvc.model,
myexample.mvc.model.impl,myexample.mvc.renderer,
myexample.mvc.renderer.map.impl,myexample.mvc.view.impl,
myexample.util,myexample.webshared,com.vaadin.terminal,com.vaadin.ui
Bundle-SymbolicName: admin
Include-Resource: ..\classes
Originally-Created-By: Apache Maven Bundle Plugin
This is correct behaviour. The explanation is in section 3.5.6 of the OSGi core specification.
Regarding the unresolved error from Felix... this must be related to something else. Please post the actual error message.
Niel is, of course correct. To be honest though, I've been very successful with using the noimports:=true to get around this. In my applications, I usually have the following in my maven-bundle-plugin section:
<Export-package>*;noimports:=true</export-package>
This results in all of your packages being exported into OSGi, and none of them will appear in your import-package section. If you only need a couple of your exported packages to not appear in your import-package section, you can set the noimports flag for each individual package. Lastly, this syntax is from BND, so it should also work in your .bnd files.