Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 343069

Summary: org.eclipse.core eventually depends upon org.osgi.foundation which poops all over java.lang.*
Product: [Technology] Dash Reporter: Chris West (Faux) <eclipse>
Component: MavenAssignee: Project Dash Incoming bugs <dash-inbox>
Status: CLOSED WONTFIX QA Contact:
Severity: normal    
Priority: P3 CC: digulla, d_a_carver, thanh.ha
Version: unspecified   
Target Milestone: ---   
Hardware: PC   
OS: Windows 7   
Whiteboard:

Description Chris West (Faux) CLA 2011-04-17 12:16:26 EDT
Build Identifier: I20110127-2034

For a project containing:
<dependency>
  <groupId>org.eclipse.jdt</groupId>
  <artifactId>org.eclipse.jdt.core</artifactId>
  <version>[3.6.0,3.7.0)</version>
</dependency>
...
<repository>
  <id>eclipse-testing</id>
  <url>http://maven.eclipse.org/nexus/content/repositories/testing/</url>
</repository>

mvn dependency:tree gives:

[INFO] +- org.eclipse.jdt:org.eclipse.jdt.core:jar:3.6.2:compile
[INFO] |  +- org.eclipse.core:org.eclipse.core.resources:jar:3.6.1:compile
[INFO] |  |  \- org.eclipse.core:org.eclipse.core.expressions:jar:3.4.200.v20100505:compile
[INFO] |  +- org.eclipse.core:org.eclipse.core.runtime:jar:3.6.0.v20100505:compile
[INFO] |  |  +- org.eclipse.core:org.eclipse.core.contenttype:jar:3.4.100.v20100505-1235:compile
[INFO] |  |  |  \- org.eclipse.equinox:org.eclipse.equinox.preferences:jar:3.3.0.v20100503:compile
[INFO] |  |  \- org.eclipse.equinox:org.eclipse.equinox.app:jar:1.3.0.v20100512:compile
[INFO] |  |     \- org.eclipse.osgi:org.eclipse.osgi.services:jar:3.2.100.v20100503:compile
[INFO] |  |        +- javax.servlet:servlet-api:jar:2.5:compile
[INFO] |  |        \- org.apache.felix:org.osgi.foundation:jar:1.2.0:compile


That is, that importing basically anything from org.eclipse eventually pulls in 
org.apache.felix:org.osgi.foundation:jar:1.2.0:compile.

This jar contains a java 1.4 reimplementation of most of java.lang.  This horribly breaks _every_ application written for Java 5 or above, i.e. within the written last 5 years, with errors like:
The type HashMap is not generic; it cannot be parameterized with arguments..
Can only iterate over an array or an instance of java.lang.Iterable..
etc.



This is because org.eclipse.core.runtme:3.6.0, http://maven.eclipse.org/nexus/content/repositories/testing/org/eclipse/core/org.eclipse.core.runtime/3.6.0/org.eclipse.core.runtime-3.6.0.pom ,
asks for org.eclipse.equnox.app [1.0.0,2.0.0):
<dependency>
  <groupId>org.eclipse.equinox</groupId>
  <artifactId>org.eclipse.equinox.app</artifactId>
  <version>[1.0.0,2.0.0)</version>
  <optional>false</optional>
</dependency>

which gets sourced from Central as
http://uk.maven.org/maven2/org/eclipse/equinox/org.eclipse.equinox.app/1.3.0.v20100512/org.eclipse.equinox.app-1.3.0.v20100512.pom instead of from the expected http://maven.eclipse.org/nexus/content/repositories/testing/org/eclipse/equinox/org.eclipse.equinox.app/1.3.1/org.eclipse.equinox.app-1.3.1.pom .

Please consider mitigating this to prevent developers from having to put exclusions all over their projects.

e.g. Please make org.eclipse.core.runtime depend on equinox.app:[1.3.1,2.0.0)?

Reproducible: Always

Steps to Reproduce:
1. Depend on org.eclipse.core:org.eclipse.core.runtime
2. Have some Java 5 code in your project.
3. Run mvn eclipse:eclipse and get a non-compiling project.
Comment 1 David Carver CLA 2011-05-30 10:33:00 EDT
Adding Aaron to the bug.
Comment 2 Aaron Digulla CLA 2011-05-30 11:09:46 EDT
Thanks, Dave.

Great ... Ok, what happens is this:

A while ago, part of Eclipse was imported into Maven Central. That import wasn't well fated for various reasons.

The problem is org.eclipse.equinox.app with "<version>[1.0.0,2.0.0)</version>" in org.eclipse.core.runtime-3.6.0.pom.

This plugin is available from both Maven Central (as 1.3.0.v20100512) and the testing POM (1.3.0.v20100512). The version range means: Pick whatever fits.

Unfortunately, those two versions are the same so Maven guesses (incorrectly in this case) that those two artifacts are the same -> doom.

1. Can you please try to add a dependencyManagement element to your parent/root POM? It should nail down the version to "1.3.1" (which is the version found on testing). Let me know if that works.

2. Import the huge dependency file from org.eclipse.dash:dependency-management:3.6.2 with:

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.eclipse.dash</groupId>
        <artifactId>dependency-management</artifactId>
        <version>3.6.2</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    <dependencies>
  <dependencyManagement>

This nails down *all* versions at once. Please try this, too.
Comment 3 Chris West (Faux) CLA 2011-05-31 15:04:43 EDT
Yeah, I worked around this by dependencyManagementing it up to <version>[1.3.1,2.0.0)</version>.

The question was, as it's trivial for you to do so, can you make it so I don't have to, please? :)

e.g. Please make org.eclipse.core.runtime depend on equinox.app:[1.3.1,2.0.0)?
Comment 4 Aaron Digulla CLA 2011-06-01 05:11:46 EDT
(In reply to comment #3)
> Yeah, I worked around this by dependencyManagementing it up to
> <version>[1.3.1,2.0.0)</version>.
> 
> The question was, as it's trivial for you to do so, can you make it so I don't
> have to, please? :)

I could add a patch, no problem. But ...

It would only solve this issue. There are thousands of similar issues all over the repo. In the end, all of those need to be fixed. But I don't the correct solution in all cases.

So you have to use dependencyManagement anyway. If I leave it like this, builds will fail early, people will stumble over this issue and learn "oh, we have to use dependencyManagement" and the issue is fixed for all cases.

Example: Some bundles depend on commons-logging 1.1 and some on 1.1.1. Those are simple: 1.1.1 is compatible with 1.1, so I could overwrite that.

Others need javax.xml.bind 2.0 and other 2.2. Or javax.servlet 2.4 vs. 2.5. Here, the API changed. So I can't simply overwrite one version with the other. Consumers of the repository need to make an educated guess.

On top of that, OSGi allows to include several versions of the same dependency in a project which doesn't work with Maven (OSGi uses several classloaders which avoids cross pollution while Maven doesn't).

That's why I'm a bit reluctant to modify the existing versions and why I developed the solution with importing the huge dependencyManagement POM.

If you can find a flaw in my chain of thought, I will reconsider my position. :-)
Comment 5 Thanh Ha CLA 2014-04-29 09:46:05 EDT
maven.eclipse.org was decommissioned via bug 405750 and replaced with
repo.eclipse.org.

See: https://wiki.eclipse.org/Services/Nexus