[SOLR-16048] Examine Tika dependencies that brought in javax classes

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 9.0
• Component/s: contrib - Solr Cell (Tika extraction)
• Assignee: Kevin Risden
• Reporter: Kevin Risden
• Created: 23/Feb/22 02:06
• Updated: 12/May/22 00:35
• Resolved: 23/Feb/22 16:24

Description

SOLR-15989 Tika 1.28.1 upgrade brought in some javax packaged classes which janhoy caught with the smoketester. Details from janhoy in SOLR-15989:

This upgrade adds many parsers and dependencies. I ran the smoketester, which introspects every jar looking for illegal "java." and "javax." class files. These libararies were flagged by the smoke tester:

modules/extraction/lib/unit-api-1.0.jar" contains sheisty class "javax/measure/Dimension.class"
modules/extraction/lib/jakarta.activation-1.2.2.jar" contains sheisty class "javax/activation/CommandInfo$Beans$1.class"
modules/extraction/lib/jakarta.annotation-api-1.3.5.jar" contains sheisty class "javax/annotation/security/PermitAll.class"
jakarta.xml.bind-api:2.3.3 

I believes all jakarta libs are OK license wise, but strangely they use the javax.xxx namespace instead of jakarta.xxx. The Units API (javax.measure.xxx) seems to be in the same category, that it is a JSR implemented with an allowed license.

We have excluded several annotation jars elsewhere, that's why I raise this here.

I assume the correct action is to make exceptions for these pacakges in the smoke tester. Any other insight?

Issue Links

• blocks: SOLR-16041 Prepare a Jenkins job that runs smoke tester on 9.0
• is caused by: SOLR-15989 Upgrade to Tika 1.28.1
• relates to: LUCENE-4430 Lucene Demo module should not ship with servlet-api.jar file
• relates to: SOLR-3879 war file has javax.servlet-api jar bundled
• links to: GitHub Pull Request #693