XMLBeans
  1. XMLBeans
  2. XMLBEANS-308

jsr173_1.0_api.jar should be removed from dependencies in favor of stax-api-1.0.1.jar

    Details

    • Type: Improvement Improvement
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: unspecified, Version 2.1, Version 2.2
    • Fix Version/s: Version 2.3
    • Component/s: None
    • Labels:
      None

      Description

      jsr173_1.0_api.jar contains known bugs in the specification.

      See: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6306251

      While this problem does not directly affect the XmlBeans project, it can cause class loader problems if someone needs to use newer versions of the javax.stream api. Please update XmlBeans distirbutions to include the less-buggy stax-api-1.0.1.jar instead, especially in the maven/maven2 repositories.

        Activity

        Hide
        David Jencks added a comment -

        Jeff, could you try out the poms attached to XMLBEANS-277? I'm pretty confident in the one for xmlbeans but I haven't had time to try the one for the xmlquery extensions. It's definitely high time to get this fixed

        Show
        David Jencks added a comment - Jeff, could you try out the poms attached to XMLBEANS-277 ? I'm pretty confident in the one for xmlbeans but I haven't had time to try the one for the xmlquery extensions. It's definitely high time to get this fixed
        Hide
        Radu Preotiuc-Pietro added a comment -

        Actually, the main consideration surrounding our use of jsr173 is of a legal nature.

        jsr173_1.0_api.jar is what we have the legal go-ahead to use and I remember it was a long process to get this smoothed out and get Cliff's blessing.

        So first question I would ask: where and how is stax-api-1.0.1.jar distributed and what other Apache projects are using it? If this is something that is used widely inside Apache, we would be happy to get XmlBeans aligned.

        Show
        Radu Preotiuc-Pietro added a comment - Actually, the main consideration surrounding our use of jsr173 is of a legal nature. jsr173_1.0_api.jar is what we have the legal go-ahead to use and I remember it was a long process to get this smoothed out and get Cliff's blessing. So first question I would ask: where and how is stax-api-1.0.1.jar distributed and what other Apache projects are using it? If this is something that is used widely inside Apache, we would be happy to get XmlBeans aligned.
        Hide
        Jeff Peterson added a comment -

        I don't think that there is a legality issue with the stax-api jar. Unlike jsr173.jar, it is publicly available in the maven2 repository:

        http://mirrors.ibiblio.org/pub/mirrors/maven2/stax/stax-api/1.0.1/stax-api-1.0.1.jar

        The license (in stax-api-1.0.1.pom) says that it is ASL 2.0.

        Show
        Jeff Peterson added a comment - I don't think that there is a legality issue with the stax-api jar. Unlike jsr173.jar, it is publicly available in the maven2 repository: http://mirrors.ibiblio.org/pub/mirrors/maven2/stax/stax-api/1.0.1/stax-api-1.0.1.jar The license (in stax-api-1.0.1.pom) says that it is ASL 2.0.
        Hide
        David Jencks added a comment -

        Over in the geronimo project we discovered that the stax-api jar is not spec compliant (it fixes an obvious bug in the spec.... but the result is it has an incorrect method signature), and rather than spend time trying to get this fixed we simply reimplemented the api jar. We believe our implementation doesn't have the classloader bugs but we also haven't published a final 1.0 version yet.

        Show
        David Jencks added a comment - Over in the geronimo project we discovered that the stax-api jar is not spec compliant (it fixes an obvious bug in the spec.... but the result is it has an incorrect method signature), and rather than spend time trying to get this fixed we simply reimplemented the api jar. We believe our implementation doesn't have the classloader bugs but we also haven't published a final 1.0 version yet.
        Hide
        Cezar Andrei added a comment -

        Pom files fixed for 2.3 release, please reopen if needed.

        Show
        Cezar Andrei added a comment - Pom files fixed for 2.3 release, please reopen if needed.
        Hide
        Robert Liguori added a comment -

        Just FYI...
        Apache ActiveMQ is using stax-api-1.0.1.jar (and stax-1.2.0.jar)
        Apache CXF 2.4.1 is using stax2-api-3.1.3.jar.

        Show
        Robert Liguori added a comment - Just FYI... Apache ActiveMQ is using stax-api-1.0.1.jar (and stax-1.2.0.jar) Apache CXF 2.4.1 is using stax2-api-3.1.3.jar.

          People

          • Assignee:
            Unassigned
            Reporter:
            Jeff Peterson
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development