[FELIX-6525] org.apache.felix.http.servlet-api exports multiple versions with no uses

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: http.servlet-api-1.2.0
• Fix Version/s: http.servlet-api-2.0.0
• Component/s: HTTP Service
• Assignee: Carsten Ziegeler
• Reporter: Tom Watson
• Created: 27/Apr/22 13:30
• Updated: 13/Jun/22 07:10
• Resolved: 28/Apr/22 13:31

Description

Here is the Export-Package for the bundle

Export-Package:
javax.servlet;version="2.6";uses:="javax.servlet.annotation,javax.servlet.descriptor",
javax.servlet.annotation;version="2.6";uses:="javax.servlet",javax.servlet.descriptor;version="2.6",
javax.servlet.http;version="2.6";uses:="javax.servlet",
javax.servlet;version="3.0",
javax.servlet.annotation;version="3.0",
javax.servlet.descriptor;version="3.0",
javax.servlet.http;version="3.0",
javax.servlet;version="3.1",
javax.servlet.annotation;version="3.1",
javax.servlet.descriptor;version="3.1",
javax.servlet.http;version="3.1",
javax.servlet;version="4.0",
javax.servlet.annotation;version="4.0",
javax.servlet.descriptor;version="4.0",
javax.servlet.http;version="4.0"

Only the lowest version of the packages is exported with the `uses` directive. I believe this will cause some very difficult to debug resolution issues. Each export becomes a distinct capability to the resolver. Bundles wiring to the 2.6 versions will be constrained by the used packages while bundles that can wiring to the higher versions will not be constrained.

This becomes even more prevalent if a bundle uses the recommended way to consume these osgi.contract bundles. There they would import the packages without any specified version, but then also put a requirement on the osgi.contract for JavaServlet at a specific version. This contract is also provided by this servlet-api bundle with the proper uses constraints. But now that leaves the resolver with the option to choose any versions exported by this bundle. Most likely the framework ResolveContext is going to start with the highest version available. And that package will have no uses contraints.