Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 348829

Summary:	javax.persistence should be signed for OSGi consumers
Product:	z_Archived	Reporter:	David Williams <david_williams>
Component:	Eclipselink	Assignee:	Nobody - feel free to take it <nobody>
Status:	ASSIGNED ---	QA Contact:
Severity:	normal
Priority:	P3	CC:	lukas.jungmann, martin.grebac, neil.hauge, tom.ware
Version:	unspecified
Target Milestone:	---
Hardware:	PC
OS:	Linux
Whiteboard:
Bug Depends on:
Bug Blocks:	460094

Description David Williams

2011-06-08 23:26:27 EDT

As discussed in bug 348670, javax.persistence is currently not signed, by EclipseLink project, for delivery to the release train, but there is no technical reason it can not be, for OSGi consumers. It is not signed, by EclipseLink, so they can use it "internally" in a runtime jar, provided for non-OSGi consumers. 

Seems to me, it would be feasible to deliver a signed version for main release, so that OSGi oriented runtime can be assured they are running with signed jars from Eclipse, while for the "internally" packaged jars could be unsigned ... slightly renamed, or something to avoid confusion, all by releng tasks. 

From looking at the zip file of bundles provided in 
bug 348670 comment #15, 
I've noticed EclipseLink has a number of other "unsigned internal jars": 

  eclipselink-jpa-modelgen_2.3.0.v20110604-r9504.jar
  javax.jms_1.1.0.jar
  javax.persistence.source_2.0.3.v201010191057.jar
  javax.persistence_2.0.3.v201010191057.jar
  javax.resource_1.5.0.jar
  javax.transaction_1.1.0.v201002051055.jar
  javax.xml.soap_1.3.0.jar

At least one of these, is similar to what is provided in Orbit in a signed form (javax.transaction_1.1.1.v201105210645.jar) . So that makes me think something similar could be done for javax.persistence.

Comment 1 Tom Ware

2011-06-09 08:33:31 EDT

We should probably just upgrade our javax.transaction bundle to the one in orbit.

There is some suggestion in the earlier bug that our unsigned javax.persistence case is "legacy".  (although it may not ultimately make a difference in what we do in the end)  I want to ensure it is understood that this is not the Legacy case.  This is, by far, the most common case. With Java EE just starting to be adopted as part of the OSGi spec, JPA in OSGi is still one of our least common deployment scenarios.  It remains to be seen if this will ever become a common usecase.

Comment 2 David Williams

2011-06-09 08:48:03 EDT

> 
> There is some suggestion in the earlier bug that our unsigned 
> javax.persistence
> case is "legacy".  ...
> I want to ensure it is understood that this is not the Legacy
> case.  

Yes, apologies. I was just trying to make a joke, that anything non-OSGi was legacy. I didn't mean anything by it. Thanks for clarifying and keeping the record (and me) straight.

Comment 3 Tom Ware

2011-06-09 09:00:24 EDT

BTW: I believe that the majority of the other jars (other than javax.persistence) in the list above are unsigned because we only use them in testing.  We may want to consider simply signing them.

Comment 4 Neil Hauge

2015-05-12 12:48:56 EDT

Found this bug instead of creating a new one to address the issues in bug 460094.  We need a signed javax.persistence jar for Eclipse IDE usage, as the unsigned jar is causing issues when users are adding Eclipse features, such as Dali Java Persistence tools.  More importantly, this is a blocker for Dali being delivered in the upcoming Mars release.

Comment 5 Neil Hauge

2015-05-18 17:54:25 EDT

Lukas, Martin...Wanted to let you know that our window on addressing this issue is closing fairly quickly.  We need to have some sort of solution in place by May 28th, with a drop dead date of June 4th.  Please let us know if this won't be possible so we can take necessary actions to get a signed bundle in place some other way.

Comment 6 Lukas Jungmann

2015-05-19 12:08:37 EDT

looking into this...

Comment 7 Neil Hauge

2015-05-28 15:38:57 EDT

There appears to be a problem with the proposed repo:

http://download.eclipse.org/rt/eclipselink/updates/2.6.0.1

It doesn't appear to contain all necessary bits.

Comment 8 Lukas Jungmann

2015-06-18 16:15:05 EDT

starting with 2.6.1 RC1 http://download.eclipse.org/rt/eclipselink/milestone-updates/ should contain signed javax.persistence bits. Would it be possible to check it and let us know whether this can be considered fixed or if there is still something wrong, please?

Comment 9 Neil Hauge

2015-06-18 17:03:19 EDT

Yes...not sure exactly when that will be, but at the very latest we can try pulling it into the early Neon builds in early July.

Comment 10 Eclipse Webmaster

2022-06-09 10:31:57 EDT

The Eclipselink project has moved to Github: https://github.com/eclipse-ee4j/eclipselink