Bug 350792 - org.apache.batik.pdf JAR pollutes classpath with classes from commons-io
Summary: org.apache.batik.pdf JAR pollutes classpath with classes from commons-io
Status: NEW
Alias: None
Product: Orbit
Classification: Tools
Component: bundles (show other bugs)
Version: unspecified   Edit
Hardware: All All
: P2 normal with 3 votes (vote)
Target Milestone: ---   Edit
Assignee: Anthony Hunter CLA
QA Contact:
URL:
Whiteboard:
Keywords:
: 388514 (view as bug list)
Depends on:
Blocks:
 
Reported: 2011-06-30 06:13 EDT by Aaron Digulla CLA
Modified: 2017-08-02 16:00 EDT (History)
10 users (show)

See Also:


Attachments
Small project which cleans the JAR (463.63 KB, application/octet-stream)
2011-07-01 05:07 EDT, Aaron Digulla CLA
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Aaron Digulla CLA 2011-06-30 06:13:33 EDT
[I'm not sure if this is the correct place to report this; please move the report to Orbit or wherever it belongs if this isn't a BIRT bug]

org.apache.batik.pdf contains classes from other Apache projects:

Avalon: org/apache/avalon/framework/
commons-io: org/apache/commons/io/
commons-logging: org/apache/commons/logging/

Some of these classes are incomplete. For example, IOUtils just contains a small fraction of all available commons-io classes. My own project uses IOUtils and now I get build errors if I include BIRT via the POJO runtime.

I can't solve this short of deleting those classes because I have no control over the order in my classpath when the app runs in a web container.

Please don't merge several OSS projects into one. Use the proper Orbit bundles instead.
Comment 1 Aaron Digulla CLA 2011-06-30 10:01:20 EDT
This is related to bug 344560 but I can't use that solution since I'm not consuming the bundles via OSGi.

Please delete those classes from the bundle.

For a quick workaround, I'd like to patch the bundle myself but I can't figure out how it is built.

Is it in the orbit git repo at git://dev.eclipse.org/org.eclipse.orbit/org.eclipse.orbit.git?

I switched to the v1_6 branch as per the README but the directory org.apache.batik.pdf only contains these files:

./plugin.properties
./META-INF
./META-INF/MANIFEST.MF
./about_files
./about_files/NOTICE-FOP
./about.html
./build.properties

Where are the .java/.class files??
Comment 2 Wei Yan CLA 2011-06-30 13:39:29 EDT
You can try to replace the orbit batik 1.6 with the original one from Apache to see if it works.
Comment 3 Xiaoying Gu CLA 2011-07-01 01:39:11 EDT
Move to Orbit project
Comment 4 Aaron Digulla CLA 2011-07-01 04:56:18 EDT
I've done a more thorough analysis.

The JAR in question (org.apache.batik.pdf_1.6.0.v201105071520.jar) contains classes from other Apache projects.

It seems that it was created from the original batik-1.6-src/lib/pdf-transcoder.jar which has *some* resemblance to what you get when you compile FOP. But it's not a 1:1 copy of the classes from FOP, either. It seems someone already modified it and added the additional classes which I want to get rid of.

I've attached my current solution. I don't like it, either.

Would it be possible to create a new Orbit release with a version of 1.6.1 or 1.6.0-1 for this file so users can distinguish between the broken original and the new version which should include additional dependencies to commons-io and logging.

Not sure about Avalon, though. Maybe the best solution would be to create a new JAR org.apache.batik.pdf.avalon to go along with the original.

That way, I could cook the dependencies when I create Maven artifacts out of the Orbit bundles.
Comment 5 Aaron Digulla CLA 2011-07-01 05:07:19 EDT
Created attachment 198949 [details]
Small project which cleans the JAR

Needs ant and Maven 2 or 3 in the path.

To build, run "ant"

To install the patched JAR in your Maven repository, run "ant install"
Comment 6 David Williams CLA 2011-07-03 22:51:19 EDT
(In reply to comment #1)
> This is related to bug 344560 but I can't use that solution since I'm not
> consuming the bundles via OSGi.
> 

Just to back up, at bit ... if you are not consuming the bundles via OSGi, why use the Orbit provided versions at all? I'm sure you have a reason, but thought I'd ask. The purpose of Orbit is to provide "third party" libraries that are tweaked specifically to be used with OSGi ... so, I am not sure we can "support" using them in a non OSGi environment ... if I understand your comment.
Comment 7 Aaron Digulla CLA 2011-07-04 03:39:59 EDT
(In reply to comment #6)
> (In reply to comment #1)
> > This is related to bug 344560 but I can't use that solution since I'm not
> > consuming the bundles via OSGi.
> > 
> 
> if you are not consuming the bundles via OSGi, why
> use the Orbit provided versions at all?

I'm committer of the Dash project and working on a tool to make Eclipse bundles available for builds with Maven.

In this case, I converted the BIRT bundles and tried to build a web app which runs the reports. My app already uses commons-io and I got build errors because of the classpath order (org.apache.batik.pdf comes first).

I prefer to solve problems near the source. In this case, I probably won't get Batik to release a fix for 1.6, so I'm asking if Orbit can clean up the mess they created.

From what I've figured out so far, a clean solution would be to delete those classes and add a dependency to the original projects which both are already in Orbit.

I don't know much about how OSGi works but I hope that this solution means no change for anyone. From an API point of view, it should be safe.

If you refuse, I'll create a tool which can strip classes from bundles as they are converted for Maven. This should also work but there are some drawbacks:

- it doesn't solve the original problem
- to allow to load the JAR, I have to strip the signatures from it
- People will be confused why the JAR in Maven is different from the one in Orbit
Comment 8 David Williams CLA 2011-07-04 14:25:44 EDT
> 
> I prefer to solve problems near the source. In this case, I probably won't get
> Batik to release a fix for 1.6, so I'm asking if Orbit can clean up the mess
> they created.
> 

Wait, what? How did Orbit create this? I would have assumed we just "repackaged" what Batik provided. Is that not the case? And, apologies in advance, if this is all obvious to most ... but would appreciate an explanation if you are saying Orbit caused this.
Comment 9 David Williams CLA 2011-07-04 14:36:41 EDT
Assigning to Anthony, as the primary contact.
Comment 10 Aaron Digulla CLA 2011-07-05 06:49:21 EDT
(In reply to comment #8)
> > 
> > I prefer to solve problems near the source. In this case, I probably won't get
> > Batik to release a fix for 1.6, so I'm asking if Orbit can clean up the mess
> > they created.
> > 
> 
> Wait, what? How did Orbit create this? I would have assumed we just
> "repackaged" what Batik provided. Is that not the case? And, apologies in
> advance, if this is all obvious to most ... but would appreciate an explanation
> if you are saying Orbit caused this.

I think I said "Apache created a mess" but my English grammar might fail me.

longer version: FOP contains some code which you can find batik-1.6/lib/pdf-transcoder.jar but I couldn't figure out how to recreate this file from the FOP sources.

My guess is that someone hacked a quick "solution" by manually creating a JAR which makes all compile errors in Batik 1.6 go away.
Comment 11 David Williams CLA 2011-07-05 20:20:59 EDT
> 
> I think I said "Apache created a mess" but my English grammar might fail me.
> 

Ah, yes ... I see that now, re-reading, I read with wrong interpretation ... your grammar is good enough :) 

I'll let Anthony weigh in and see if there's improvements he'd feel comfortable with. (I agree, it's a mess ... but ... not sure if we in Orbit can clean up others messes ... as nice as that'd be).
Comment 12 Tony CHEMIT CLA 2013-12-08 06:58:55 EST
Hi,

What is the status of this issue?

From maven world we can use the shde plugin to remove this and create a *clean* version of this jar.

Moreover, I can't understand why some maven dependencies are relocated to birt-runtime, this feels so wrong to me. this means just that you will then have twice some dependencies since GAV willnot be the same.

Please do NOT relocate package, this is not how maven works.

I ca
Comment 13 Tony CHEMIT CLA 2013-12-08 07:00:17 EST
I can help if you'd like to have a nice and clean maven project for birt-runtime, just let me know.

Thanks,

tony.
Comment 14 Guido Wilken CLA 2017-08-01 12:10:58 EDT
Has this ever been solved?
We're running into the same issue...
Comment 15 Roland Grunberg CLA 2017-08-02 14:52:37 EDT
I still see those classes present (in Orbit and in the maven central artifact) I guess we could rebuild this package on the orbit-recipes side (exclude the avalon, apache.commons classes), and remove the existing one.
Comment 16 Roland Grunberg CLA 2017-08-02 16:00:54 EDT
*** Bug 388514 has been marked as a duplicate of this bug. ***