Bug 582394 - Resource files such as "plugin.properties" at top level of JAR may clash with other JARs
Summary: Resource files such as "plugin.properties" at top level of JAR may clash with...
Status: RESOLVED FIXED
Alias: None
Product: JGit
Classification: Technology
Component: JGit (show other bugs)
Version: 5.13   Edit
Hardware: PC Windows 10
: P3 normal (vote)
Target Milestone: 6.8   Edit
Assignee: Thomas Wolf CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-08 09:20 EDT by Hugh Greene CLA
Modified: 2023-09-18 07:11 EDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Hugh Greene CLA 2023-09-08 09:20:37 EDT
In general, resources files in JARs should appear in a namespaced folder hierarchy under a top-level "resources" folder.  In both org.eclipse.jgit-5.13.0.202109080827-r.jar and org.eclipse.jgit-6.7.0.202309050840-r.jar, there is a top-level file "plugin.properties".

In a Gradle build I am using the plugin "org.cyclonedx:cyclonedx-gradle-plugin:1.7.4", which also does not follow this best practice, and has its own "plugin.properties" file at top level.  It tries to read that file at execution time to insert some metadata into its output (an SBOM file), using ClassLoader#getResourceAsStream.  However, depending on the version of JGit used, it may fail because the JGit file is the first on the classpath, and does not contain the properties it needs.

I believe the correct fix is for both JARs to put their resources under a folder such as (in the case of this project) "resources/org/eclipse/jgit".

FYI, in my problem build, jgit is being pulled in through both "com.netflix.nebula:gradle-info-plugin:9.2.0" and "org.ajoberstar.grgit:grgit-gradle:4.1.0".
Comment 1 Hugh Greene CLA 2023-09-08 09:23:58 EDT
I have raise a corresponding issue for the CycloneDx project, at https://github.com/CycloneDX/cyclonedx-core-java/issues/325
Comment 2 Thomas Wolf CLA 2023-09-08 18:17:52 EDT
JGit JARs are also OSGi bundles, and specifically also Eclipse plug-ins.

The plugin.properties files in JGit exist only for localization in MANIFEST.MF. I think OSGi would allow us to place these somewhere else via the Bundle-Localization header.[1] But if the Eclipse documentation is still up to date (I'm not sure), Eclipse plug-ins need to have their plugin.properties or fragment.properties at the root.[2] (Which I find a bit strange; the OSGi platform of Eclipse (called Equinox) should honor that Bundle-Localization header. But maybe there is indeed something in Eclipse that requires these files to be at the root.)

[1] https://docs.osgi.org/specification/osgi.core/8.0.0/framework.module.html#i2654895
[2] https://help.eclipse.org/latest/index.jsp?topic=%2Forg.eclipse.platform.doc.isv%2Fguide%2Fproduct_def_nl.htm
Comment 3 Thomas Wolf CLA 2023-09-12 14:36:21 EDT
I have the impression that the description in the Eclipse Help [1] is outdated.

At least for JGit (which uses OSGi bundle localization only for two fields in the MANIFEST.MF) everything works perfectly fine if the properties file is moved to sub-directory OSGI-INF/l10n.

It even works for a normal Eclipse plug-in: I gave it a try with EGit UI and moved the plugin.properties there also into OSGI-INF/l10n. Everything still works as expected in Eclipse. I did not try the translation mechanisms described at [1], but I guess even those would work if the localized files were also placed at OSGI/l10n.

So here is https://git.eclipse.org/r/c/jgit/jgit/+/204299 , which moves the JGit plugin.properties out of the way.

[1] https://help.eclipse.org/latest/index.jsp?topic=%2Forg.eclipse.platform.doc.isv%2Fguide%2Fproduct_def_nl.htm
Comment 4 Thomas Wolf CLA 2023-09-12 14:39:31 EDT
One caveat: I have no idea what would need to be done to make the bazel build include this OSGI-INF directory. However, the p2 repository for JGit is built in the maven/tycho build, while the bazel build is mainly used for building from source in non-OSGi environments (Gerrit).
Comment 5 Thomas Wolf CLA 2023-09-15 08:12:45 EDT
Fixed in 6.8.

Gradle apparently has a plug-in system that doesn't provide classpath isolation to plug-ins. OSGi does.

I notice that grgit-core:4.1.0 depends on JGit [5.9,6.0), so possibly this fix doesn't help you directly. The main branch there depends on JGit [6.0,7.0). JGit 6.x requires Java 11 to run.

BTW, why did you create the Github issue at cyclonedx-core-java when the problem is in https://github.com/CycloneDX/cyclonedx-gradle-plugin ?
Comment 6 Hugh Greene CLA 2023-09-18 07:11:27 EDT
Ah, I'll re-raise the issue on the cyclonedx plugin project, thanks!  I was busy digging into the source of of both to solve various issues, and must have clicked "New issue" without paying enough attention.

It seem that grgit 5.2.0 depends on jgit [6.0,7.0) so that should do for us.  Thanks for the quick turn-around :-)