Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 326520

Summary: SecurityException on starting bundle, uses a BundleTracker or BundleTracker Customizer
Product: [RT] Virgo Reporter: marcel.hanser
Component: unknownAssignee: Glyn Normington <glyn.normington>
Status: CLOSED FIXED QA Contact:
Severity: normal    
Priority: P3 CC: glyn.normington, tjwatson
Version: unspecified   
Target Milestone: 2.1.0.M05-incubation   
Hardware: PC   
OS: Windows XP   
Whiteboard:
Attachments:
Description Flags
bundle to reproduce the SecurityException none

Description marcel.hanser CLA 2010-09-29 08:11:28 EDT
Build Identifier: virgo-web-server-2.1.0.M04-incubation

While checking compatibility with several platforms, the virgo platform failed to start one of our bundles which uses a implementation of BundleTrackerCustomizer.

workaround:
delete ECLIPSEF.SF/ ECLIPSEF.RSA in META-INF folder of org.eclipse.osgi-3.5.1.R35x_v20091005.jar bundle.

following exception occurs: 

Caused by: java.lang.SecurityException: class "org.osgi.util.tracker.BundleTrackerCustomizer"'s signer information does not match signer information of other classes in the same package
	at java.lang.ClassLoader.checkCerts(ClassLoader.java:807)
	at java.lang.ClassLoader.preDefineClass(ClassLoader.java:488)
	at java.lang.ClassLoader.defineClassCond(ClassLoader.java:626)
	at java.lang.ClassLoader.defineClass(ClassLoader.java:616)
	at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:141)
	at java.net.URLClassLoader.defineClass(URLClassLoader.java:283)
	at java.net.URLClassLoader.access$000(URLClassLoader.java:58)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:197)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:190)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:307)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:248)
	at org.eclipse.osgi.launch.EquinoxFWClassLoader.loadClass(EquinoxFWClassLoader.java:46)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:248)
	at org.eclipse.osgi.internal.loader.SystemBundleLoader.findLocalClass(SystemBundleLoader.java:115)
	at org.eclipse.osgi.internal.loader.SingleSourcePackage.loadClass(SingleSourcePackage.java:33)
	at org.eclipse.osgi.internal.loader.BundleLoader.findClassInternal(BundleLoader.java:445)
	at org.eclipse.osgi.internal.loader.BundleLoader.findClass(BundleLoader.java:410)
	at org.eclipse.osgi.internal.loader.BundleLoader.findClass(BundleLoader.java:398)
	at org.eclipse.osgi.internal.baseadaptor.DefaultClassLoader.loadClass(DefaultClassLoader.java:105)
	at org.eclipse.virgo.kernel.userregion.internal.equinox.KernelBundleClassLoader.loadClass(KernelBundleClassLoader.java:135)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:248)
	at java.lang.Class.getDeclaredConstructors0(Native Method)
	at java.lang.Class.privateGetDeclaredConstructors(Class.java:2389)
	at java.lang.Class.getConstructor0(Class.java:2699)
	at java.lang.Class.newInstance0(Class.java:326)
	at java.lang.Class.newInstance(Class.java:308)
	at org.eclipse.osgi.framework.internal.core.AbstractBundle.loadBundleActivator(AbstractBundle.java:152)
	... 37 common frames omitted


Reproducible: Always

Steps to Reproduce:
1.put a bundle in pickup folder which uses a BundleTracker or BundleTrackerCustomizer
2.
3.
Comment 1 Thomas Watson CLA 2010-09-30 08:33:12 EDT
At first I thought this was related to bug 173673.

I now realize this is an issue with loading a class from the org.osgi.util.tracker package.  This package is exported by the system bundle and should be loaded by the "root" framework's class loader.  In this case we have the root framework being loaded by sun.misc.Launcher$AppClassLoader (app class loader) and some virgo region being loaded by org.eclipse.osgi.launch.EquinoxFWClassLoader.  As you can see from the stack track org.eclipse.osgi.launch.EquinoxFWClassLoader is delegating to sun.misc.Launcher$AppClassLoader for the BundleTrackerCustomizer class.  What is strange is that all the other classes in the org.osgi.util.tracker package should have also been loaded by the sun.misc.Launcher$AppClassLoader class loader.  Is there some other jar on the app class path that may have a subset of the org.osgi.util.tracker package?  Is that jar ahead of the org.eclipse.osgi.jar on the app class path?
Comment 2 Glyn Normington CLA 2010-09-30 13:06:56 EDT
Thanks for that Tom.

Marcel: If you are using Virgo "out of the box" then there are unlikely to be any other JARs supplying classes of the org.osgi.util.tracker package unless you have configured your JVM to add such JARs before launching Virgo. Please could you confirm the set up?

Also it would be very helpful if you could attach a binary bundle to this bug which can be used to reproduce the problem.
Comment 3 marcel.hanser CLA 2010-10-01 10:33:41 EDT
Hi Thomas, Glyn,
thank you very much for your fast responses.

Yes, I'm using a "out of the box" virgo version
"virgo-kernel-2.1.0.M04-incubation". I just create a folder called pickup in the root folder and pasting the (now) attached file to reproduce the exception. The bundle just includes following Activator class:

package de.test.bundle;

import org.osgi.framework.Bundle;
import org.osgi.framework.BundleActivator;
import org.osgi.framework.BundleContext;
import org.osgi.util.tracker.BundleTracker;

/**
 * <code>Activator</code>TODO - [imm0217], please write javadoc for class 'Activator'!
 * 
 * @author Marcel Hanser [imm0217]
 */
public class Activator implements BundleActivator
{
   private BundleTracker tracker;

   public void start( BundleContext context ) throws Exception
   {
      tracker = new BundleTracker( context, Bundle.ACTIVE, null );
   }

   public void stop( BundleContext context ) throws Exception
   {
      // TODO Auto-generated method stub

   }

}
Comment 4 marcel.hanser CLA 2010-10-01 10:34:44 EDT
Created attachment 180059 [details]
bundle to reproduce the SecurityException
Comment 5 Glyn Normington CLA 2010-10-01 11:24:00 EDT
I followed your instructions on an up to date kernel and your test bundle deployed normally with no exceptions:

[2010-10-01 16:18:58.407] fs-watcher                   <HD0001I> Hot deployer processing 'INITIAL' event for file 'de.test.bundle-1.0.0.jar'. 
[2010-10-01 16:18:58.448] fs-watcher                   <DE0000I> Installing bundle 'de.test.de.test.bundle' version '1.0.0'. 
[2010-10-01 16:18:58.464] fs-watcher                   <DE0001I> Installed bundle 'de.test.de.test.bundle' version '1.0.0'. 
[2010-10-01 16:18:58.474] fs-watcher                   <DE0004I> Starting bundle 'de.test.de.test.bundle' version '1.0.0'. 
[2010-10-01 16:18:58.483] start-signalling-1           <DE0005I> Started bundle 'de.test.de.test.bundle' version '1.0.0'.

I checked the status of the bundle and it is ACTIVE.

What JVM are you using?
Comment 6 Glyn Normington CLA 2010-10-01 11:26:28 EDT
BTW we fixed the bug about there being no empty pickup directory provided in the kernel zip.
Comment 7 Glyn Normington CLA 2010-10-01 11:28:37 EDT
I tried again on milestone 4 of the kernel and your problem reproduces. I am wondering if the upgrade to Equinox 3.6.1 may have fixed the problem as it was a pretty significant upgrade. Anyway, it seems sorted now, so closing off. You should re-test when we issue RC1, but the problem should have gone.