paulrutter commented on PR #433: URL: https://github.com/apache/felix-dev/pull/433#issuecomment-5464533076
## Status update: SecurityManager removed, JDK 25 build blockers fixed Picking up the two-branch approach discussed in [#433 (comment)](https://github.com/apache/felix-dev/pull/433#issuecomment-4543766603) and confirmed by @mbien's [JEP 14 reference](https://github.com/apache/felix-dev/pull/433#issuecomment-5407380786): **this branch drops the Security Manager entirely and fixes what actually breaks on JDK 25.** The branch has also been synced with master. Everything below was verified locally on **JDK 25.0.2**, each time against a **JDK 21 control run on the same tree**, so that pre-existing and platform-specific failures were not misattributed to JDK 25. ### What actually blocked JDK 25 Worth recording, because it was much narrower than expected: 1. `framework/pom.xml` passed `-Djava.security.manager=allow`. On JDK 25 that is a fatal **VM startup** error (JEP 486), so **zero tests ran** — this one flag was masking everything else. 2. Once removed, the *only* JDK-25-attributable failures were the two `URLHandlersTest` SecurityManager tests. Probing the API directly on JDK 25: only `System.setSecurityManager` actually throws. `AccessController.doPrivileged`, `getContext`, `Policy`, `ProtectionDomain` — and even subclassing `SecurityManager` — all still work. So the framework's sole *production* blocker was `Felix.init()`; the rest is dead code that could never execute again. ### SecurityManager removal (−8,000 lines) Enforcement is gone; **the OSGi API types are kept**, so bundles referencing `AdminPermission`, `ServicePermission`, `PackagePermission`, `Bundle.hasPermission`, `ProtectionDomain` etc. still compile and resolve. - `Felix.init()` no longer installs a Security Manager. Setting `org.osgi.framework.security` now **fails fast** with a `SecurityException` rather than silently launching without the security the launcher asked for. - `SecureAction`: **2113 → 656 lines**; all 65 `doPrivileged` wrappers collapsed to their direct calls, the `Actions` dispatch class deleted. - `SecurityManagerEx` no longer extends `SecurityManager` — it now uses `StackWalker`, the supported replacement for `getClassContext()`, which yields frames in the same order. No `extends SecurityManager` remains anywhere. - Enforcement removed from `BundleImpl`, `BundleContextImpl`, `BundleWiringImpl`, `EventDispatcher`, `WovenClassImpl`, `StatefulResolver`, `ExtensionManager`, `ServiceRegistrationImpl`, `FrameworkStartLevelImpl`, `FrameworkWiringImpl`, `URLHandlersBundleStreamHandler`, `BundleProtectionDomain`, plus `scr`, `webconsole` and `gogo`. Every removed branch was already unreachable without a Security Manager, so behaviour is unchanged. - **`framework.security` removed** — it existed only to implement the SM-based `SecurityProvider`. **`felix.java.version` for `framework` is now 9** — the *lowest* level it still builds at. To be explicit: JDK 25 did **not** force this; the old `SecurityManagerEx.getClassContext()` works fine on 25. The floor comes from replacing it with `StackWalker` so that no `extends SecurityManager` is left. Staying on 8 is possible if we keep that class — happy to go either way. ### Other JDK 25 blockers fixed The root cause of most was **stale parent poms**: several modules declare `felix-parent` 2.1–7 with `relativePath ../pom/pom.xml`, but the local pom is `10-SNAPSHOT`, so the relativePath does not match and Maven silently resolves the *old released parent from Central*. Those hardcode `felix.java.version` 6/7 (javac 25 rejects release < 8) and pin **surefire 2.x**, which cannot parse the JDK 25 version string and dies with an NPE before running a single test. Bumping to `felix-parent 9` fixes both at once — cleaner than overriding compiler/plugin settings per module. | | | |---|---| | `bundlerepository`, `configadmin`, `connect`, `log.extension`, `resolver`, `utils` | → `felix-parent 9` | | `log`, `log.extension`, `connect`, `bundlerepository`, `examples/extenderbased.*` | compiler level < 8 → 8 | | `resolver`, `bundlerepository` | `mockito-all` 1.x → `mockito-core` (its bundled cglib cannot generate classes on JDK 25) | | `gogo` | mockito-core 5.17.0 → 5.18.0 (5.17's byte-buddy cannot mock on JVM 25) | | `framework` | `asm-all` 5.2 → `asm`/`asm-tree` 9.8 (5.2 cannot read class files newer than Java 8) | | `configadmin` | `Thread.stop()` → `interrupt()`; `Thread.stop()` has thrown `UnsupportedOperationException` since Java 20, so that path could only turn a slow shutdown into a failed one | **`framework.tck` was failing on _every_ JDK, not just 25**: `tck.bndrun` still required `assertj-core [3.27.3,3.27.4)` after the dependency was bumped to 3.27.7 in #478, so the bndrun could not resolve. Fixed here. ### CI Matrix now builds **JDK 25** (GA, no longer `25-ea`). All modules changed here are covered — an audit also turned up pre-existing gaps: `gogo` was only in the `pull_request` trigger and not `push`, and `framework.tck` was in neither trigger and had no path filter, so TCK-only changes never triggered a build at all. ### Results on JDK 25 `framework` 118 tests · `scr` 170 · `configadmin` 111 · `utils` 108 · `bundlerepository` 42 · `resolver` 28 · `webconsole` 23 · plus `gogo`, `connect`, `log`, `log.extension` and `examples`. In every module the results **match the JDK 21 control run exactly**. The residual failures are pre-existing platform-specific ones (a test fixture filename containing characters invalid on NTFS, and `deleteDir` file locking) that fail identically on JDK 21 and pass on Linux. ### Deliberately not in scope - **iPOJO** — 22 poms with `source`/`target` 1.4–1.6, left alone since there is a removal PR open. - **eventadmin** — not actively maintained, and broken independently of JDK: its `maven-bundle-plugin` 4.2.1 bundles a bnd that hits a `TreeMap.computeIfAbsent` `ConcurrentModificationException` (fails identically on **JDK 21**), and its integration tests fetch a bundle from the long-dead `repository.springsource.com`. - **`bundlerepository.osgi-ct`** — not actively maintained; also references a stale sibling version. - **The wider bnd / maven-bundle-plugin upgrade** — only matters once a module is actually *compiled* at release 25, which none are. ### Separate: `sun.misc.Unsafe` / URL singletons @tjwatson's point in [#433 (comment)](https://github.com/apache/felix-dev/pull/433#issuecomment-3073468820) is **not** a JDK 25 blocker — the `Unsafe` block is guarded by `catch (Throwable)` with a `setAccessible` fallback, so on 25 it only warns. It is a JDK 26+ and framework-interop concern, so I have kept it out of this PR and opened **#552** as a draft prototype using plurl. There is an unresolved licensing question there (the vendored sources carry EPL-2.0 headers while plurl's LICENSE and pom say Apache-2.0) — @tjwatson, your input would be very welcome on that PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
