[Bug] Wrong jakarta OSGi imports in main branch

[marcanpilami]

Search before asking

• [X] I had searched in the issues and found no similar issues.

Environment

Apache Felix, OpenJDK 11 or 21

Shiro version

2.0.1-SNAPHOT (built by myself)

What was the actual outcome?

Cannot start the shiro-web bundle. This is a follow-up to #1324 (with a few comments, including a discussion on possible fixes).

The 1324 fix seems to be incomplete: it replaces the javax namespace by a jakarta one inside the manifest, but without changing the version of the import.

For example, the normal package imports javax.annotation.security;version="[1.3,2)". The fix for the jakarta version just renames it to jakarta.annotation.security;version="[1.3,2)".

However, Jakarta never released a 1.3.x bundle containing jakarta.* package - they only released a transition bundle containing javax.* packages. The first version of jakarta.annotations-api containing a jakarta.* package is 2.0.0.

So we need to change the version, not only the imports. I do not know what shade is able to do here - we may have to add a Maven profile to change the dependencies.

What was the expected outcome?

The bundle starts.

How to reproduce

Just try to start it in any OSGi container like Karaf.

Debug logs

No response

[lprimak]

Is there a proper way to just use version 1.3 or above in OSGi? Or 1.3 or 2 or above So we wouldn't have to "fix" a particular version unnecessarily?

[fpapon]

I'm playing with the shade maven plugin to make it work.

[lprimak]

This may be a source of your issues @steinarb

[fpapon]

Sorry guys but I'm missing free time to work on, I will do my best.

[steinarb]

@lprimak This is probably an issue for me too, but not related to the classloader issue mentioned earlier (probably the next thing I will run into once the classloader issue has a fix... :smile: )

@fpapon Noted! I will see what I can find out when I get to it.