oscerd opened a new issue, #733:
URL: https://github.com/apache/camel-karaf/issues/733

   ## Description
   
   
`core/camel-core-osgi/src/main/java/org/apache/camel/karaf/core/OsgiFactoryFinder.getResource`
   walks every installed bundle in `bundleContext.getBundles()` order and 
returns
   the first bundle that has a matching factory descriptor:
   
   ```java
   // As the META-INF of the Factory could not be export,
   // we need to go through the bundles to look for it
   // NOTE, the first found factory will be return
   public BundleEntry getResource(String name) {
       ...
       for (Bundle bundle : bundles) {
           url = bundle.getEntry(getResourcePath() + name);
           if (url != null) {
               entry = new BundleEntry();
               entry.url = url;
               entry.bundle = bundle;
               break;
           }
       }
   ```
   
   The class is then loaded from that bundle's classloader with no scoping to 
the
   requesting context's wiring -- in contrast to the `extenderCapabilityWired` /
   `canSee()` gates used elsewhere in this module. `findClass` caches the result
   per key via `addToClassMap` (line 49), so whichever bundle happened to be
   first stays selected for the lifetime of the finder.
   
   When two versions of the same component bundle are installed side by side --
   which is a normal state during a rolling upgrade -- which one supplies the
   factory depends on install order, and the choice is neither logged nor
   revisited.
   
   ## Expected Behavior
   
   Selection is either scoped to the requesting context's bundle wiring, or at
   minimum deterministic and observable, so that an operator who has installed a
   patched bundle can tell which one is actually in use.
   
   ## Actual Behavior
   
   Install order decides, silently, and the first answer is cached.
   
   ## Additional Context
   
   - Factory-finder keys are internal Camel SPI names; they are not derived from
     message content. This is a correctness/diagnosability issue, not an input
     handling one.
   - Changing the selection semantics of a core resolution path that has behaved
     this way for a long time carries real regression risk. It may be better to
     land the diagnostics first -- log at WARN when more than one bundle 
provides
     the same key, and log which bundle was chosen -- and treat wiring-scoped
     selection as a separate, opt-in change.
   
   ---
   _Claude Code on behalf of Andrea Cosentino_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to