Uploaded image for project: 'Shiro'
  1. Shiro
  2. SHIRO-761

Bad OSGi import for javax.annotation in shiro-guice

Agile BoardAttach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Resolved
    • 1.5.2
    • 2.0.0-alpha
    • Integration: Guice
    • None
    • Patch

    Description

      shiro-guice 1.5.2 declares the following OSGi import for javax.annotation:

      javax.annotation;version="[3.0,4)"
      

      This is incorrect, the latest spec version for javax.annotation is 1.3

      This appears to be caused by the javax.annotation dependency appearing below the guice dependency in support/guice/pom.xml. The guice dependency pulls in com.google.code.findbugs:jsr305:jar:3.0.2 and the maven-bundle-plugin takes that as the version to use for the javax.annotation import, rather than the javax.annotation-api dependency (version 1.3.2)

      The following minor patch fixes the import range by changing the order of the dependencies:

      diff --git a/support/guice/pom.xml b/support/guice/pom.xml
      index 9d9e8b3..8217cfa 100644
      --- a/support/guice/pom.xml
      +++ b/support/guice/pom.xml
      @@ -46,6 +46,10 @@
                   <optional>true</optional>
               </dependency>
               <dependency>
      +            <groupId>javax.annotation</groupId>
      +            <artifactId>javax.annotation-api</artifactId>
      +        </dependency>
      +        <dependency>
                   <groupId>com.google.inject</groupId>
                   <artifactId>guice</artifactId>
               </dependency>
      @@ -54,10 +58,6 @@
                   <artifactId>guice-multibindings</artifactId>
               </dependency>
               <dependency>
      -            <groupId>javax.annotation</groupId>
      -            <artifactId>javax.annotation-api</artifactId>
      -        </dependency>
      -        <dependency>
                   <groupId>com.google.inject.extensions</groupId>
                   <artifactId>guice-servlet</artifactId>
                   <optional>true</optional>
      

      If you build the shiro-guice module before and after this fix then you should see the difference in support/guice/target/classes/META-INF/MANIFEST.MF

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            fpapon Francois Papon
            mcculls Stuart McCulloch
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

              Estimated:
              Original Estimate - Not Specified
              Not Specified
              Remaining:
              Remaining Estimate - 0h
              0h
              Logged:
              Time Spent - 20m
              20m

              Slack

                Issue deployment