Dear RT PMC members, EMO, and IP team,
The Swordfish project has finalized the in-depth analysis of missing or not
matching CQs. These are our findings:
1. Third party libs w/o CQ
--------------------------
org.apache.servicemix.document_1.0.0.v200906161300.jar
servicemixcommon_2009.1.0.v200906161300.jar
servicemixhttp_2009.1.0.v200906161300.jar
servicemixsoap2_2009.1.0.v200906161300.jar
servicemixsoap_2009.1.0.v200906161300.jar
servicemixutils_1.1.0.v200906161300.jar
net.sf.cglib_2.1.3.v200906161300.jar
org.apache.axiom_1.2.5.v200906161300.jar
org.apache.servicemix.cxf.binding.nmr_4.0.0.v200906161300.jar
org.apache.servicemix.cxf.transport.nmr_4.0.0.v200906161300.jar
org.apache.servicemix.cxf.transport.osgi_4.0.0.v200906161300.jar
org.apache.xbean.xbean.spring_3.5.0.v200906161300.jar
org.codehaus.stax2_3.2.7.v200906161300.jar
org.jvnet.staxex_1.0.0.v200906161300.jar
org.objectweb.howl_1.0.1.1_v200906161300.jar
Of these, the following ones have been unnecessarily included and can be
removed without any impact on functionality:
org.codehaus.stax2_3.2.7.v200906161300.jar
org.jvnet.staxex_1.0.0.v200906161300.jar
org.objectweb.howl_1.0.1.1_v200906161300.jar
net.sf.cglib_2.1.3.v200906161300.jar
Of the remaining ones, one has previously been approved for use within
Eclipse:
org.apache.axiom_1.2.5.v200906161300.jar
This leaves us with 10 jars for which new CQs would have to be filed (all of
them Apache2-licensed, hosted at Apache and relatively small):
org.apache.servicemix.document_1.0.0.v200906161300.jar
servicemixcommon_2009.1.0.v200906161300.jar
servicemixhttp_2009.1.0.v200906161300.jar
servicemixsoap2_2009.1.0.v200906161300.jar
servicemixsoap_2009.1.0.v200906161300.jar
servicemixutils_1.1.0.v200906161300.jar
org.apache.servicemix.cxf.binding.nmr_4.0.0.v200906161300.jar
org.apache.servicemix.cxf.transport.nmr_4.0.0.v200906161300.jar
org.apache.servicemix.cxf.transport.osgi_4.0.0.v200906161300.jar
org.apache.xbean.xbean.spring_3.5.0.v200906161300.jar
@IP team: Given your prior experience analyzing ServiceMix source code, how
would you rate the risk?
2. Third party libs w/ CQ, but version shipped differs from CQ
--------------------------------------------------------------
org.apache.xbean.xbean.classloader_3.5.0.v200906161300.jar (approved: 3.4.1)
org.springframework.osgi.io_1.2.0.rc1_v200906161300.jar (approved: 1.0.2)
org.springframework.osgi.extender_1.2.0.rc1_v200906161300.jar (approved:
1.0.2)
org.springframework.osgi.core_1.2.0.rc1_v200906161300.jar (approved: 1.0.2)
org.springframework.core_2.5.6.v200906161300.jar (approved: 2.5.2)
org.springframework.context_2.5.6.v200906161300.jar (approved: 2.5.2)
org.springframework.beans_2.5.6.v200906161300.jar (approved: 2.5.2)
org.springframework.aop_2.5.6.v200906161300.jar (approved: 2.5.2)
org.apache.cxf.cxf-bundle_2.1.4.v200906161300.jar (approved: 2.1.3)
org.apache.cxf.cxf-rt-bindings-jbi_2.1.4.v200906161300.jar (approved: 2.1.3)
org.apache.cxf.cxf-rt-transports-jbi_2.1.4.v200906161300.jar (approved:
2.1.3)
Of these, for one we would have to file a new CQ requesting a version
change:
org.apache.xbean.xbean.classloader_3.5.0.v200906161300.jar (approved: 3.4.1)
In all other cases, we'll be able to switch back to the approved version.
We are confident that we would be able to file the missing CQs and create
and regression test a new build containing the correct versions and with all
the unnecessary jars removed until Friday EOB.
@RT PMC, EMO: Please advise us on how to proceed from here.
Best Regards,
Oliver
