[jira] [Commented] (SLING-10844) ResourceMapper.getMapping() returns null for empty path

2021-12-13 Thread Aditya Seth (Jira)


[ 
https://issues.apache.org/jira/browse/SLING-10844?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17458679#comment-17458679
 ] 

Aditya Seth commented on SLING-10844:
-

[~rombert] While running test cases in ResourceMapperImplTest.java I was 
getting error [0] for every test though with the latest pull it has been 
resolved and I working on adding a test as suggested.

[0]: 
"org.apache.sling.resourceresolver.impl.mapping.ResourceMapperImplTest.mapNonExistingEmptyPath[optimized
 alias resolution ? true]  Time elapsed: 1.845 s  <<< ERROR!
java.lang.IllegalArgumentException: Argument for @NotNull parameter 
'parentPath' of 
org/apache/sling/resourceresolver/impl/providers/stateful/BasicResolveContext.
 must not be null
"

> ResourceMapper.getMapping() returns null for empty path
> ---
>
> Key: SLING-10844
> URL: https://issues.apache.org/jira/browse/SLING-10844
> Project: Sling
>  Issue Type: Bug
>  Components: ResourceResolver
>Affects Versions: Resource Resolver 1.7.0
>Reporter: Mohit Arora
>Assignee: Robert Munteanu
>Priority: Major
>  Time Spent: 1h 10m
>  Remaining Estimate: 0h
>
> After the bug fix for SLING-9620, the behavior for 
> ResourceMapper.getAllMappings() was changed such that the mappings list 
> remains empty if the resourcePath provided is an empty string. Prior to this 
> bug fix, the mappings list contained a single entry for empty path.
> Since mappings list is empty, [ResourceMapper.getMapping() returns 
> null|https://github.com/apache/sling-org-apache-sling-resourceresolver/blob/master/src/main/java/org/apache/sling/resourceresolver/impl/mapping/ResourceMapperImpl.java#L74-L75].
>  The [javadoc of 
> ResourceMapper.getMapping()|https://github.com/apache/sling-org-apache-sling-api/blob/master/src/main/java/org/apache/sling/api/resource/mapping/ResourceMapper.java#L67]
>  API mentions that it will return a non null value if the resourcepath is not 
> null.
> We need to decide on the expected behavior here. If mappings list should not 
> be updated in case of empty resourcePath then the API annotation will have to 
> be changed and it can potentially be a backwards incompatible issue in theory 
> as the consumers of the API may not have added a null check to the return 
> value.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[GitHub] [sling-site] kwin commented on a change in pull request #74: Update docs for ResourceChangeListener, deprecate OSGI resource event…

2021-12-13 Thread GitBox


kwin commented on a change in pull request #74:
URL: https://github.com/apache/sling-site/pull/74#discussion_r768024453



##
File path: src/main/jbake/content/documentation/the-sling-engine/resources.md
##
@@ -215,16 +215,25 @@ To be notified whenever certain resources or their 
properties have been modified
 *This API is only available since Sling API 2.11.0 
([SLING-4751](https://issues.apache.org/jira/browse/SLING-4751)).*
 
 Register an OSGi service for 
[`org.apache.sling.api.resource.observation.ResourceChangeListener`][6] to be 
notified about local changes. To be also notified about external changes (i.e. 
changes triggered by another Sling instance leveraging a clustered repository  
make sure that your service implementation also implements the marker interface 
[`org.apache.sling.api.resource.observation.ExternalResourceChangeListener`][7].
 The interface `ExternalResourceChangeListener` is not supposed to be 
registered with OSGi though.
-Certain properties can be used to restrict subscription to only a subset of 
events.
+It is possible already at a registration level to specify, which events in 
which path you are interested. For this attach these properties as OSGI 
properties to your implementing service (all of them are multi-value):

Review comment:
   ```suggestion
   It is possible to specify already during registration which events in which 
paths you are interested in. To leverage this just set these service properties 
in your implementing OSGi service (all of them are multi-value strings):
   ```

##
File path: src/main/jbake/content/documentation/the-sling-engine/resources.md
##
@@ -215,16 +215,25 @@ To be notified whenever certain resources or their 
properties have been modified
 *This API is only available since Sling API 2.11.0 
([SLING-4751](https://issues.apache.org/jira/browse/SLING-4751)).*
 
 Register an OSGi service for 
[`org.apache.sling.api.resource.observation.ResourceChangeListener`][6] to be 
notified about local changes. To be also notified about external changes (i.e. 
changes triggered by another Sling instance leveraging a clustered repository  
make sure that your service implementation also implements the marker interface 
[`org.apache.sling.api.resource.observation.ExternalResourceChangeListener`][7].
 The interface `ExternalResourceChangeListener` is not supposed to be 
registered with OSGi though.
-Certain properties can be used to restrict subscription to only a subset of 
events.
+It is possible already at a registration level to specify, which events in 
which path you are interested. For this attach these properties as OSGI 
properties to your implementing service (all of them are multi-value):
 
-### OSGi Event Admin
+Property | Description
+--- | ---
+[ResourceChangeListener.PATHS](https://sling.apache.org/apidocs/sling11/org/apache/sling/api/resource/observation/ResourceChangeListener.html#PATHS)|
 denote the path (including sub paths) in which you are interested in. This 
property is required.
+[ResourceChangeListener.CHANGES](https://sling.apache.org/apidocs/sling11/org/apache/sling/api/resource/observation/ResourceChangeListener.html#CHANGES)|
 the type of changes you are interested in (optional)
+[ResourceChhangeListener.PROPERTY_NAMES_HINT](https://sling.apache.org/apidocs/sling11/org/apache/sling/api/resource/observation/ResourceChangeListener.html#PROPERTY_NAMES_HINT)|
 optional property to specify interested on changes certain sling properties.

Review comment:
   This is weird sentence: Rather something like filter only for event 
affecting the properties with the given names?

##
File path: src/main/jbake/content/documentation/the-sling-engine/resources.md
##
@@ -215,16 +215,25 @@ To be notified whenever certain resources or their 
properties have been modified
 *This API is only available since Sling API 2.11.0 
([SLING-4751](https://issues.apache.org/jira/browse/SLING-4751)).*
 
 Register an OSGi service for 
[`org.apache.sling.api.resource.observation.ResourceChangeListener`][6] to be 
notified about local changes. To be also notified about external changes (i.e. 
changes triggered by another Sling instance leveraging a clustered repository  
make sure that your service implementation also implements the marker interface 
[`org.apache.sling.api.resource.observation.ExternalResourceChangeListener`][7].
 The interface `ExternalResourceChangeListener` is not supposed to be 
registered with OSGi though.
-Certain properties can be used to restrict subscription to only a subset of 
events.
+It is possible already at a registration level to specify, which events in 
which path you are interested. For this attach these properties as OSGI 
properties to your implementing service (all of them are multi-value):
 
-### OSGi Event Admin
+Property | Description
+--- | ---

[GitHub] [sling-site] joerghoh opened a new pull request #74: Update docs for ResourceChangeListener, deprecate OSGI resource event…

2021-12-13 Thread GitBox


joerghoh opened a new pull request #74:
URL: https://github.com/apache/sling-site/pull/74


   …s in the docs as well


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




Re: Log4Shell

2021-12-13 Thread Oliver Lietz
On Monday, 13 December 2021 17:13:38 CET Carsten Ziegeler wrote:
> I did a check as well and couldn't find anything.
> 
> I guess the only place where log4j2 might be included is by pax exam
> tests - not sure about that though.

Pax Exam is using log4j 1.x. I'm already looking into it to double check and 
update.

At least we should have a statement on our homepage for Sling Starter which is 
using Sling Commons Log.

O.

> Regards
> Carsten
> 
> Am 13.12.2021 um 16:49 schrieb Robert Munteanu:
> > On Mon, 2021-12-13 at 16:40 +0100, Bertrand Delacretaz wrote:
> >> If we make a statement I think it should include the list of modules
> >> we have checked as "not embedding log4j2" and describe the method
> >> used
> >> for that check.
> > 
> > I have used `repo grep log4j` in the Sling repo checkout, manually
> > validated that we don't pull in log4j2.
> > 
> > If we exclude test code, we only get 54 lines, it should be quite easy
> > for someone else to cross-check my findings.
> > 
> > Thanks,
> > Robert






[ANN] Apache Sling Commons Messaging Mail 2.0.0 released

2021-12-13 Thread Oliver Lietz
The Apache Sling team is pleased to announce the release of Apache Sling 
Commons Messaging Mail 2.0.0

Commons Messaging Mail provides a simple layer on top of Jakarta Mail 2.0 
including a message builder and a service to send mails via SMTPS.

This is the very first release of Apache Sling which is using the new Jakarta 
namespace.

https://github.com/apache/sling-org-apache-sling-commons-messaging-mail

This release is available from https://sling.apache.org/downloads.cgi

Building from verified sources is recommended, but convenience binaries are
also available via Maven:


  org.apache.sling
  org.apache.sling.commons.messaging.mail
  2.0.0

 
Release Notes:

- Switch to Jakarta Mail and Activation APIs
- Support for arrays and collections of addresses in MessageBuilder
- Improved Header parameters support
- Support for server identity check (checks are enabled by default)
- Dedicated Properties and Session per SimpleMessageBuilder instance
- Various updates and code checks


A security issue ("SMTPS server hostname not checked when making TLS 
connection to SMTPS server") was reported by Michael Lescisin and accepted by 
the project. The issue is tracked as CVE-2021-44549.

The SimpleMailService in Commons Messaging Mail 1.0 lacks an option to enable 
server identity checks for the shared mail session.
A user could enable these checks nevertheless by accessing the session via the 
message created by SimpleMessageBuilder and setting the property 
mail.smtps.ssl.checkserveridentity to true.

- https://javaee.github.io/javamail/docs/SSLNOTES.txt
- 
https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html
- https://github.com/eclipse-ee4j/mail/issues/429

Enjoy!

-The Apache Sling team






Re: Log4Shell

2021-12-13 Thread Carsten Ziegeler

I did a check as well and couldn't find anything.

I guess the only place where log4j2 might be included is by pax exam 
tests - not sure about that though.


Regards
Carsten

Am 13.12.2021 um 16:49 schrieb Robert Munteanu:

On Mon, 2021-12-13 at 16:40 +0100, Bertrand Delacretaz wrote:

If we make a statement I think it should include the list of modules
we have checked as "not embedding log4j2" and describe the method
used
for that check.


I have used `repo grep log4j` in the Sling repo checkout, manually
validated that we don't pull in log4j2.

If we exclude test code, we only get 54 lines, it should be quite easy
for someone else to cross-check my findings.

Thanks,
Robert


--
Carsten Ziegeler
Adobe
cziege...@apache.org


Re: Log4Shell

2021-12-13 Thread Robert Munteanu
On Mon, 2021-12-13 at 16:40 +0100, Bertrand Delacretaz wrote:
> If we make a statement I think it should include the list of modules
> we have checked as "not embedding log4j2" and describe the method
> used
> for that check.

I have used `repo grep log4j` in the Sling repo checkout, manually
validated that we don't pull in log4j2.

If we exclude test code, we only get 54 lines, it should be quite easy
for someone else to cross-check my findings.

Thanks,
Robert


[GitHub] [sling-org-apache-sling-jcr-contentloader] stefanseifert merged pull request #10: SLING-10992 update javadocs for "maven:mount" directive

2021-12-13 Thread GitBox


stefanseifert merged pull request #10:
URL: https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/10


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




Re: Log4Shell

2021-12-13 Thread Bertrand Delacretaz
Hi,

On Mon, Dec 13, 2021 at 11:36 AM Carsten Ziegeler  wrote:
> ...we could state that Sling based applications are not affected if they
> use the standard logging setup with commons log and log4j-over-slf4j and
> if there no application bundles embedding a vulnerable log4j version...

Isn't there a (vague) risk that one of our transitive dependencies
embeds log4j2 ?

If we make a statement I think it should include the list of modules
we have checked as "not embedding log4j2" and describe the method used
for that check.

I suppose running "mvn dependency:tree | grep " is a
reasonable way of checking, so maybe this can be the script used to
check, from the top of a complete checkout of the Sling modules:

  $ export PATTERN=
  $ find . -name pom.xml | while read pom; do pushd $(dirname $pom);
mvn dependency:tree | grep $PATTERN ; popd ; done

-Bertrand


[GitHub] [sling-org-apache-sling-jcr-contentloader] sonarcloud[bot] commented on pull request #10: SLING-10992 update javadocs for "maven:mount" directive

2021-12-13 Thread GitBox


sonarcloud[bot] commented on pull request #10:
URL: 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/10#issuecomment-992601762


   Kudos, SonarCloud Quality Gate passed!  ![Quality Gate 
passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png
 'Quality Gate passed')
   
   
[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png
 
'Bug')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=BUG)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=BUG)
 [0 
Bugs](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=BUG)
  
   
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png
 
'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=VULNERABILITY)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=VULNERABILITY)
 [0 
Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=VULNERABILITY)
  
   [![Security 
Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png
 'Security 
Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=SECURITY_HOTSPOT)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=SECURITY_HOTSPOT)
 [0 Security 
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=SECURITY_HOTSPOT)
  
   [![Code 
Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png
 'Code 
Smell')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=CODE_SMELL)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=CODE_SMELL)
 [0 Code 
Smells](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=10=false=CODE_SMELL)
   
   [![No Coverage 
information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png
 'No Coverage 
information')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=10=coverage=list)
 No Coverage information  
   
[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png
 
'0.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=10=new_duplicated_lines_density=list)
 [0.0% 
Duplication](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=10=new_duplicated_lines_density=list)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[jira] [Commented] (SLING-6580) Use ResourceChangeListener for validation models

2021-12-13 Thread Konrad Windszus (Jira)


[ 
https://issues.apache.org/jira/browse/SLING-6580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17458476#comment-17458476
 ] 

Konrad Windszus commented on SLING-6580:


[~joerghoh] Every PR is appreciated.

> Use ResourceChangeListener for validation models
> 
>
> Key: SLING-6580
> URL: https://issues.apache.org/jira/browse/SLING-6580
> Project: Sling
>  Issue Type: Improvement
>  Components: Extensions, Validation
>Reporter: Oliver Lietz
>Priority: Major
>




--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[GitHub] [sling-org-apache-sling-jcr-contentloader] stefanseifert commented on a change in pull request #9: SLING-10992 emit WARN in case of unknown attributes or directives in

2021-12-13 Thread GitBox


stefanseifert commented on a change in pull request #9:
URL: 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/9#discussion_r767859875



##
File path: src/main/java/org/apache/sling/jcr/contentloader/PathEntry.java
##
@@ -100,6 +108,24 @@
  */
 public static final String IGNORE_CONTENT_READERS_DIRECTIVE = 
"ignoreImportProviders";
 
+/** Used in 
https://github.com/apache/sling-maven-plugin/blob/d67d5c1900782c68c1bfcbdc499c02cf31224916/sling-maven-plugin/src/main/java/org/apache/sling/maven/bundlesupport/fsresource/SlingInitialContentMounter.java#L97
 */
+private static final String MAVEN_MOUNT_DIRECTIVE = "maven:mount";
+
+/** All directive names which are valid for header Sling-Initial-Content */
+public Set VALID_DIRECTIVES = new HashSet<>(Arrays.asList(
+OVERWRITE_DIRECTIVE,
+OVERWRITE_PROPERTIES_DIRECTIVE,
+MERGE_PROPERTIES_DIRECTIVE,
+MERGE_NODES_DIRECTIVE,
+UNINSTALL_DIRECTIVE,
+PATH_DIRECTIVE,
+WORKSPACE_DIRECTIVE,
+CHECKIN_DIRECTIVE,
+AUTOCHECKOUT_DIRECTIVE,
+IGNORE_CONTENT_READERS_DIRECTIVE,
+MAVEN_MOUNT_DIRECTIVE

Review comment:
   ah, you're right - this is a flag to instruct the maven plugin to ignore 
a certain directive when the "mount" goal is used. i will update the javadoc 
here a bit to give it a bit more explanation.




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[jira] [Commented] (SLING-6580) Use ResourceChangeListener for validation models

2021-12-13 Thread Joerg Hoh (Jira)


[ 
https://issues.apache.org/jira/browse/SLING-6580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17458473#comment-17458473
 ] 

Joerg Hoh commented on SLING-6580:
--

[~kwin] What do you think, is it now time to proceed with this one? From what I 
can see this is one of the last instances where we use Resource Events.

> Use ResourceChangeListener for validation models
> 
>
> Key: SLING-6580
> URL: https://issues.apache.org/jira/browse/SLING-6580
> Project: Sling
>  Issue Type: Improvement
>  Components: Extensions, Validation
>Reporter: Oliver Lietz
>Priority: Major
>




--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[GitHub] [sling-org-apache-sling-jcr-contentloader] kwin commented on a change in pull request #9: SLING-10992 emit WARN in case of unknown attributes or directives in

2021-12-13 Thread GitBox


kwin commented on a change in pull request #9:
URL: 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/9#discussion_r767856575



##
File path: src/main/java/org/apache/sling/jcr/contentloader/PathEntry.java
##
@@ -100,6 +108,24 @@
  */
 public static final String IGNORE_CONTENT_READERS_DIRECTIVE = 
"ignoreImportProviders";
 
+/** Used in 
https://github.com/apache/sling-maven-plugin/blob/d67d5c1900782c68c1bfcbdc499c02cf31224916/sling-maven-plugin/src/main/java/org/apache/sling/maven/bundlesupport/fsresource/SlingInitialContentMounter.java#L97
 */
+private static final String MAVEN_MOUNT_DIRECTIVE = "maven:mount";
+
+/** All directive names which are valid for header Sling-Initial-Content */
+public Set VALID_DIRECTIVES = new HashSet<>(Arrays.asList(
+OVERWRITE_DIRECTIVE,
+OVERWRITE_PROPERTIES_DIRECTIVE,
+MERGE_PROPERTIES_DIRECTIVE,
+MERGE_NODES_DIRECTIVE,
+UNINSTALL_DIRECTIVE,
+PATH_DIRECTIVE,
+WORKSPACE_DIRECTIVE,
+CHECKIN_DIRECTIVE,
+AUTOCHECKOUT_DIRECTIVE,
+IGNORE_CONTENT_READERS_DIRECTIVE,
+MAVEN_MOUNT_DIRECTIVE

Review comment:
   I thought this code is from you @stefanseifert : 
https://github.com/apache/sling-maven-plugin/blame/d67d5c1900782c68c1bfcbdc499c02cf31224916/sling-maven-plugin/src/main/java/org/apache/sling/maven/bundlesupport/fsresource/SlingInitialContentMounter.java#L97




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[GitHub] [sling-org-apache-sling-jcr-contentloader] stefanseifert commented on a change in pull request #9: SLING-10992 emit WARN in case of unknown attributes or directives in

2021-12-13 Thread GitBox


stefanseifert commented on a change in pull request #9:
URL: 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/9#discussion_r767854969



##
File path: src/main/java/org/apache/sling/jcr/contentloader/PathEntry.java
##
@@ -100,6 +108,24 @@
  */
 public static final String IGNORE_CONTENT_READERS_DIRECTIVE = 
"ignoreImportProviders";
 
+/** Used in 
https://github.com/apache/sling-maven-plugin/blob/d67d5c1900782c68c1bfcbdc499c02cf31224916/sling-maven-plugin/src/main/java/org/apache/sling/maven/bundlesupport/fsresource/SlingInitialContentMounter.java#L97
 */
+private static final String MAVEN_MOUNT_DIRECTIVE = "maven:mount";
+
+/** All directive names which are valid for header Sling-Initial-Content */
+public Set VALID_DIRECTIVES = new HashSet<>(Arrays.asList(
+OVERWRITE_DIRECTIVE,
+OVERWRITE_PROPERTIES_DIRECTIVE,
+MERGE_PROPERTIES_DIRECTIVE,
+MERGE_NODES_DIRECTIVE,
+UNINSTALL_DIRECTIVE,
+PATH_DIRECTIVE,
+WORKSPACE_DIRECTIVE,
+CHECKIN_DIRECTIVE,
+AUTOCHECKOUT_DIRECTIVE,
+IGNORE_CONTENT_READERS_DIRECTIVE,
+MAVEN_MOUNT_DIRECTIVE

Review comment:
   i do not understand why "maven:mount" is a directive. "mount" is a goal 
in sling-maven-plugin, what has it to do with the directives for the content 
loader?




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




Re: Sling affected by latest log4j vulnerability?

2021-12-13 Thread Robert Munteanu
Hello Juerg,

On Mon, 2021-12-13 at 13:56 +0100, JCR wrote:
> https://www.cisa.gov/news/2021/12/11/statement-cisa-director-easterly-log4j-vulnerability
> 
> I don't think so. But there are folks here who know much more about
> the internals...
> 
> Anybody?
> 
> Thanks,
> Juerg

We are working on an official statement to be posted on the Sling
website. In the meantime, we have checked the sling source repos and
there are no traces of log4j2, so user applications should be fine as
long as they do not import log4j2 on their own.

Thanks,
Robert


Sling affected by latest log4j vulnerability?

2021-12-13 Thread JCR

https://www.cisa.gov/news/2021/12/11/statement-cisa-director-easterly-log4j-vulnerability

I don't think so. But there are folks here who know much more about the 
internals...

Anybody?

Thanks,
Juerg


[jira] [Commented] (SLING-10988) Provide web console plugin for initial content

2021-12-13 Thread Robert Munteanu (Jira)


[ 
https://issues.apache.org/jira/browse/SLING-10988?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17458307#comment-17458307
 ] 

Robert Munteanu commented on SLING-10988:
-

[~kwin] - ack, I'll wait for this issue then.

> Provide web console plugin for initial content
> --
>
> Key: SLING-10988
> URL: https://issues.apache.org/jira/browse/SLING-10988
> Project: Sling
>  Issue Type: Improvement
>Reporter: Konrad Windszus
>Assignee: Konrad Windszus
>Priority: Major
> Fix For: JCR ContentLoader 2.5.0
>
> Attachments: Screenshot 2021-12-11 at 20.01.09.png
>
>  Time Spent: 1h 50m
>  Remaining Estimate: 0h
>
> The plugin should expose all Sling-Initial-Content headers on all bundles in 
> the system (linking to the bundle overview) and in addition the metadata from 
> {{/var/sling/bundle/content}}



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[GitHub] [sling-org-apache-sling-jcr-contentloader] kwin commented on pull request #8: SLING-10988 provide web console plugin for initial content

2021-12-13 Thread GitBox


kwin commented on pull request #8:
URL: 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/8#issuecomment-992345505


   @rombert As said in 
https://issues.apache.org/jira/browse/SLING-10988?focusedCommentId=17458301=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-17458301
 this is just an issue with registering BundleContentLoaderListener as 
BundleHelper. It works without that service registration for some reason...


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[GitHub] [sling-org-apache-sling-jcr-contentloader] rombert commented on pull request #8: SLING-10988 provide web console plugin for initial content

2021-12-13 Thread GitBox


rombert commented on pull request #8:
URL: 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/8#issuecomment-992343775


   I was trying to understand whether the failure is caused by the new bundle 
requirements ( servlet-api, sling.api ), but I can't find any clues. Maybe 
someone with a better understanding of the test framework can tell whether the 
bundle is active or not. AFAICT, since we wait for the `ResourcePresence` 
reference, we fail fast before trying to assert that the bundle is active.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[jira] [Commented] (SLING-10988) Provide web console plugin for initial content

2021-12-13 Thread Konrad Windszus (Jira)


[ 
https://issues.apache.org/jira/browse/SLING-10988?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17458301#comment-17458301
 ] 

Konrad Windszus commented on SLING-10988:
-

I am almost done with the PR. Only remaining issue is paxexam IT failing. They 
work once {{BundleContentLoaderListener}} does no longer register service 
{{BundleHelper.class}} 
(https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/8/files#diff-fc66299bb273bada828c9944c3ac78fcea669bdd407eec1b1a93e06f0435bcefR62).
 I don't see a reason, why this should not work. Also at run time there is no 
issue with that service being registered by DS.
[~olli] Any more ideas?

> Provide web console plugin for initial content
> --
>
> Key: SLING-10988
> URL: https://issues.apache.org/jira/browse/SLING-10988
> Project: Sling
>  Issue Type: Improvement
>Reporter: Konrad Windszus
>Assignee: Konrad Windszus
>Priority: Major
> Fix For: JCR ContentLoader 2.5.0
>
> Attachments: Screenshot 2021-12-11 at 20.01.09.png
>
>  Time Spent: 1.5h
>  Remaining Estimate: 0h
>
> The plugin should expose all Sling-Initial-Content headers on all bundles in 
> the system (linking to the bundle overview) and in addition the metadata from 
> {{/var/sling/bundle/content}}



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[jira] [Commented] (SLING-10988) Provide web console plugin for initial content

2021-12-13 Thread Robert Munteanu (Jira)


[ 
https://issues.apache.org/jira/browse/SLING-10988?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17458297#comment-17458297
 ] 

Robert Munteanu commented on SLING-10988:
-

[~kwin] - do you plan to work on this in the following days? I plan to cut a 
release this week and am not sure whether to wait for this issue or not.

> Provide web console plugin for initial content
> --
>
> Key: SLING-10988
> URL: https://issues.apache.org/jira/browse/SLING-10988
> Project: Sling
>  Issue Type: Improvement
>Reporter: Konrad Windszus
>Assignee: Konrad Windszus
>Priority: Major
> Fix For: JCR ContentLoader 2.5.0
>
> Attachments: Screenshot 2021-12-11 at 20.01.09.png
>
>  Time Spent: 1.5h
>  Remaining Estimate: 0h
>
> The plugin should expose all Sling-Initial-Content headers on all bundles in 
> the system (linking to the bundle overview) and in addition the metadata from 
> {{/var/sling/bundle/content}}



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


Re: [VOTE] Release Apache Sling Starter Content 1.0.10

2021-12-13 Thread Robert Munteanu
We still need a +1 binding vote for the Starter Content 1.0.10.

Thanks,
Robert

On Thu, 2021-12-09 at 17:58 +0100, Robert Munteanu wrote:
> On Wed, 2021-12-08 at 15:01 +, Robert Munteanu wrote:
> > Please vote to approve this release:
> 
> +1 (for Starter Content 1.0.10 only)
> 
> Thanks,
> Robert



Re: Log4Shell

2021-12-13 Thread Carsten Ziegeler

Hi,

we could state that Sling based applications are not affected if they 
use the standard logging setup with commons log and log4j-over-slf4j and 
if there no application bundles embedding a vulnerable log4j version.


Regards
Carsten

Am 13.12.2021 um 10:19 schrieb Oliver Lietz:

Hi *,

How about putting a statement on our Sling homepage regarding Log4Shell?
Commons Log is using Logback so we should be fine. Carsten, Chetan?

Regards,
O.






--
Carsten Ziegeler
Adobe
cziege...@apache.org


[RESULT] [VOTE] Release Apache Sling Testing Clients version 3.0.4

2021-12-13 Thread Andrei Dulvac
Hi, The vote has passed with the following result : +1 (binding): Stefan,
Olli, Andrei +1 (non binding): none I will copy this release to the Sling
dist directory and promote the artifacts to the central Maven repository.

- Andrei

On Mon, Dec 13, 2021 at 11:20 AM Andrei Dulvac  wrote:

> Here's my +1
> - Andrei
>
> On Thu, Dec 9, 2021 at 10:43 PM Oliver Lietz 
> wrote:
>
>> On Thursday, 9 December 2021 11:41:48 CET Andrei Dulvac wrote:
>> > Hi,
>> >
>> > We solved 1 issue in this release:
>> > https://issues.apache.org/jira/projects/SLING/versions/12350884
>> >
>> >
>> > Staging repository:
>> > https://repository.apache.org/content/repositories/orgapachesling-2563
>>
>> +1 (we could drop several versions from POM as they are managed in parent)
>>
>> O.
>>
>>
>>
>>
>>


Re: [VOTE] Release Apache Sling Testing Clients version 3.0.4

2021-12-13 Thread Andrei Dulvac
Here's my +1
- Andrei

On Thu, Dec 9, 2021 at 10:43 PM Oliver Lietz  wrote:

> On Thursday, 9 December 2021 11:41:48 CET Andrei Dulvac wrote:
> > Hi,
> >
> > We solved 1 issue in this release:
> > https://issues.apache.org/jira/projects/SLING/versions/12350884
> >
> >
> > Staging repository:
> > https://repository.apache.org/content/repositories/orgapachesling-2563
>
> +1 (we could drop several versions from POM as they are managed in parent)
>
> O.
>
>
>
>
>


[jira] [Resolved] (SLING-10992) Emit warn in case Sling-Initial-Content header contains unknown directives or attributes

2021-12-13 Thread Konrad Windszus (Jira)


 [ 
https://issues.apache.org/jira/browse/SLING-10992?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Konrad Windszus resolved SLING-10992.
-
Resolution: Fixed

Fixed in 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/commit/f4e906d05b0ceb3f4af3e28d8ee6b09ab33ecb28.

> Emit warn in case Sling-Initial-Content header contains unknown directives or 
> attributes
> 
>
> Key: SLING-10992
> URL: https://issues.apache.org/jira/browse/SLING-10992
> Project: Sling
>  Issue Type: Improvement
>Reporter: Konrad Windszus
>Assignee: Konrad Windszus
>Priority: Major
> Fix For: JCR ContentLoader 2.5.0
>
>  Time Spent: 2h 40m
>  Remaining Estimate: 0h
>
> The Sling-Initial-Content header only supports some directives and no 
> attributes at all according to the [common header 
> grammar|https://docs.osgi.org/specification/osgi.core/7.0.0/framework.module.html#framework.common.header.syntax]
>  and 
> https://sling.apache.org/documentation/bundles/content-loading-jcr-contentloader.html#initial-content-loading.
> Pretty often directives and attributes are mixed up, therefore it would be 
> good to emit a WARN for every unknown attribute or directive in that header.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[jira] [Assigned] (SLING-10994) Remove locking of JCR node

2021-12-13 Thread Konrad Windszus (Jira)


 [ 
https://issues.apache.org/jira/browse/SLING-10994?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Konrad Windszus reassigned SLING-10994:
---

Assignee: (was: Konrad Windszus)

> Remove locking of JCR node
> --
>
> Key: SLING-10994
> URL: https://issues.apache.org/jira/browse/SLING-10994
> Project: Sling
>  Issue Type: Improvement
>Affects Versions: JCR ContentLoader 2.4.2
>Reporter: Konrad Windszus
>Priority: Major
> Fix For: JCR ContentLoader 2.5.0
>
>
> Currently starting the jcr.contentloader bundle and loading initial content 
> bundles leads to the following warning (e.g. in Sling Starter 12-SNAPSHOT)
> {code}
> org.apache.jackrabbit.oak.jcr.lock.LockDeprecation Support for JCR Locking is 
> deprecated and will be disabled in a future version of Jackrabbit Oak (see 
> OAK-6421 for further information) - operation 'addMixin mix:lockable' called 
> from: 
> org.apache.sling.jcr.contentloader.internal.BundleContentLoaderListener.getBundleContentInfo(BundleContentLoaderListener.java:343)
>  
> org.apache.sling.jcr.contentloader.internal.BundleContentLoader.registerBundleInternal(BundleContentLoader.java:155)
>  
> org.apache.sling.jcr.contentloader.internal.BundleContentLoader.registerBundle(BundleContentLoader.java:122)
>  
> org.apache.sling.jcr.contentloader.internal.BundleContentLoaderListener.loadBundle(BundleContentLoaderListener.java:266)
>  
> org.apache.sling.jcr.contentloader.internal.BundleContentLoaderListener.activate(BundleContentLoaderListener.java:246)
> {code}
> Locking is currently used to make sure that in a clustered environment (i.e. 
> multiple sling instances leveraging the same repository) initial-content is 
> only processed once.
> Depending on the bundle location one might process content initialisation 
> only on the [cluster 
> leader|https://sling.apache.org/documentation/bundles/discovery-api-and-impl.html#instance-instancedescription].
> For bundles which are only installed one one cluster instance (e.g. local 
> installation) initial-content should always be performed (after checking the 
> potentially existing bundle content info from the repo).



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[GitHub] [sling-org-apache-sling-jcr-contentloader] kwin merged pull request #9: SLING-10992 emit WARN in case of unknown attributes or directives in

2021-12-13 Thread GitBox


kwin merged pull request #9:
URL: https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/9


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[GitHub] [sling-org-apache-sling-jcr-contentloader] sonarcloud[bot] removed a comment on pull request #9: SLING-10992 emit WARN in case of unknown attributes or directives in

2021-12-13 Thread GitBox


sonarcloud[bot] removed a comment on pull request #9:
URL: 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/9#issuecomment-991952093


   SonarCloud Quality Gate failed.  ![Quality Gate 
failed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/failed-16px.png
 'Quality Gate failed')
   
   
[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png
 
'Bug')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=BUG)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=BUG)
 [0 
Bugs](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=BUG)
  
   
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png
 
'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=VULNERABILITY)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=VULNERABILITY)
 [0 
Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=VULNERABILITY)
  
   [![Security 
Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png
 'Security 
Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=SECURITY_HOTSPOT)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=SECURITY_HOTSPOT)
 [0 Security 
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=SECURITY_HOTSPOT)
  
   [![Code 
Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png
 'Code 
Smell')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=CODE_SMELL)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=CODE_SMELL)
 [4 Code 
Smells](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=CODE_SMELL)
   
   
[![74.1%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/60-16px.png
 
'74.1%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=9=new_coverage=list)
 [74.1% 
Coverage](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=9=new_coverage=list)
  
   
[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png
 
'0.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=9=new_duplicated_lines_density=list)
 [0.0% 
Duplication](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=9=new_duplicated_lines_density=list)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[GitHub] [sling-org-apache-sling-jcr-contentloader] sonarcloud[bot] commented on pull request #9: SLING-10992 emit WARN in case of unknown attributes or directives in

2021-12-13 Thread GitBox


sonarcloud[bot] commented on pull request #9:
URL: 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/9#issuecomment-992270990


   SonarCloud Quality Gate failed.  ![Quality Gate 
failed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/failed-16px.png
 'Quality Gate failed')
   
   
[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png
 
'Bug')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=BUG)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=BUG)
 [0 
Bugs](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=BUG)
  
   
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png
 
'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=VULNERABILITY)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=VULNERABILITY)
 [0 
Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=VULNERABILITY)
  
   [![Security 
Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png
 'Security 
Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=SECURITY_HOTSPOT)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=SECURITY_HOTSPOT)
 [0 Security 
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=SECURITY_HOTSPOT)
  
   [![Code 
Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png
 'Code 
Smell')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=CODE_SMELL)
 
[![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png
 
'A')](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=CODE_SMELL)
 [4 Code 
Smells](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-jcr-contentloader=9=false=CODE_SMELL)
   
   
[![74.1%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/60-16px.png
 
'74.1%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=9=new_coverage=list)
 [74.1% 
Coverage](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=9=new_coverage=list)
  
   
[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png
 
'0.0%')](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=9=new_duplicated_lines_density=list)
 [0.0% 
Duplication](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-jcr-contentloader=9=new_duplicated_lines_density=list)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@sling.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[jira] [Commented] (SLING-10992) Emit warn in case Sling-Initial-Content header contains unknown directives or attributes

2021-12-13 Thread Konrad Windszus (Jira)


[ 
https://issues.apache.org/jira/browse/SLING-10992?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17458236#comment-17458236
 ] 

Konrad Windszus commented on SLING-10992:
-

Yes, indeed it is. Thanks [~rombert]. I added "maven:mount" to the list of 
valid directives in 
https://github.com/apache/sling-org-apache-sling-jcr-contentloader/pull/9/commits/ec8cecf8c8f278ff547f15a04b2f1c8b894f1df3.

> Emit warn in case Sling-Initial-Content header contains unknown directives or 
> attributes
> 
>
> Key: SLING-10992
> URL: https://issues.apache.org/jira/browse/SLING-10992
> Project: Sling
>  Issue Type: Improvement
>Reporter: Konrad Windszus
>Assignee: Konrad Windszus
>Priority: Major
> Fix For: JCR ContentLoader 2.5.0
>
>  Time Spent: 2h 10m
>  Remaining Estimate: 0h
>
> The Sling-Initial-Content header only supports some directives and no 
> attributes at all according to the [common header 
> grammar|https://docs.osgi.org/specification/osgi.core/7.0.0/framework.module.html#framework.common.header.syntax]
>  and 
> https://sling.apache.org/documentation/bundles/content-loading-jcr-contentloader.html#initial-content-loading.
> Pretty often directives and attributes are mixed up, therefore it would be 
> good to emit a WARN for every unknown attribute or directive in that header.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


Log4Shell

2021-12-13 Thread Oliver Lietz
Hi *,

How about putting a statement on our Sling homepage regarding Log4Shell?
Commons Log is using Logback so we should be fine. Carsten, Chetan?

Regards,
O.






[jira] [Created] (SLING-10995) OakMockSlingRepository: Support proper service authentication

2021-12-13 Thread Konrad Windszus (Jira)
Konrad Windszus created SLING-10995:
---

 Summary: OakMockSlingRepository: Support proper service 
authentication
 Key: SLING-10995
 URL: https://issues.apache.org/jira/browse/SLING-10995
 Project: Sling
  Issue Type: Improvement
Affects Versions: Testing Sling Mock Oak 3.1.2-1.40.0
Reporter: Konrad Windszus


Currently all calls to {{SlingRepository.loginService(...)}} are just delegated 
to {{loginAdministrative(...)}} 
(https://github.com/apache/sling-org-apache-sling-testing-sling-mock-oak/blob/0aa239d2a8aa4b7107f04080e1fabb6b20dbb256/src/main/java/org/apache/sling/testing/mock/sling/oak/OakMockSlingRepository.java#L164).
As a full Oak repository is leveraged, one should rather use a proper service 
session (like in 
https://github.com/apache/sling-org-apache-sling-jcr-oak-server/blob/master/src/main/java/org/apache/sling/jcr/oak/server/internal/OakSlingRepository.java#L86).



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[jira] [Updated] (SLING-10995) OakMockSlingRepository: Support proper service authentication

2021-12-13 Thread Konrad Windszus (Jira)


 [ 
https://issues.apache.org/jira/browse/SLING-10995?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Konrad Windszus updated SLING-10995:

Description: 
Currently all calls to {{SlingRepository.loginService(...)}} are just delegated 
to {{loginAdministrative(...)}} in 
[OakMockSlingRepository|https://github.com/apache/sling-org-apache-sling-testing-sling-mock-oak/blob/0aa239d2a8aa4b7107f04080e1fabb6b20dbb256/src/main/java/org/apache/sling/testing/mock/sling/oak/OakMockSlingRepository.java#L164].
As a full Oak repository is leveraged, one should rather use a proper service 
session (like in 
https://github.com/apache/sling-org-apache-sling-jcr-oak-server/blob/master/src/main/java/org/apache/sling/jcr/oak/server/internal/OakSlingRepository.java#L86).

  was:
Currently all calls to {{SlingRepository.loginService(...)}} are just delegated 
to {{loginAdministrative(...)}} 
(https://github.com/apache/sling-org-apache-sling-testing-sling-mock-oak/blob/0aa239d2a8aa4b7107f04080e1fabb6b20dbb256/src/main/java/org/apache/sling/testing/mock/sling/oak/OakMockSlingRepository.java#L164).
As a full Oak repository is leveraged, one should rather use a proper service 
session (like in 
https://github.com/apache/sling-org-apache-sling-jcr-oak-server/blob/master/src/main/java/org/apache/sling/jcr/oak/server/internal/OakSlingRepository.java#L86).


> OakMockSlingRepository: Support proper service authentication
> -
>
> Key: SLING-10995
> URL: https://issues.apache.org/jira/browse/SLING-10995
> Project: Sling
>  Issue Type: Improvement
>Affects Versions: Testing Sling Mock Oak 3.1.2-1.40.0
>Reporter: Konrad Windszus
>Priority: Major
>
> Currently all calls to {{SlingRepository.loginService(...)}} are just 
> delegated to {{loginAdministrative(...)}} in 
> [OakMockSlingRepository|https://github.com/apache/sling-org-apache-sling-testing-sling-mock-oak/blob/0aa239d2a8aa4b7107f04080e1fabb6b20dbb256/src/main/java/org/apache/sling/testing/mock/sling/oak/OakMockSlingRepository.java#L164].
> As a full Oak repository is leveraged, one should rather use a proper service 
> session (like in 
> https://github.com/apache/sling-org-apache-sling-jcr-oak-server/blob/master/src/main/java/org/apache/sling/jcr/oak/server/internal/OakSlingRepository.java#L86).



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[jira] [Commented] (SLING-10992) Emit warn in case Sling-Initial-Content header contains unknown directives or attributes

2021-12-13 Thread Robert Munteanu (Jira)


[ 
https://issues.apache.org/jira/browse/SLING-10992?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17458225#comment-17458225
 ] 

Robert Munteanu commented on SLING-10992:
-

I think this is SLING-6630 / 
https://github.com/apache/sling-maven-plugin/commit/899f7234ac06788d9b04fc41929ed15cdd2aa735

> Emit warn in case Sling-Initial-Content header contains unknown directives or 
> attributes
> 
>
> Key: SLING-10992
> URL: https://issues.apache.org/jira/browse/SLING-10992
> Project: Sling
>  Issue Type: Improvement
>Reporter: Konrad Windszus
>Assignee: Konrad Windszus
>Priority: Major
> Fix For: JCR ContentLoader 2.5.0
>
>  Time Spent: 2h 10m
>  Remaining Estimate: 0h
>
> The Sling-Initial-Content header only supports some directives and no 
> attributes at all according to the [common header 
> grammar|https://docs.osgi.org/specification/osgi.core/7.0.0/framework.module.html#framework.common.header.syntax]
>  and 
> https://sling.apache.org/documentation/bundles/content-loading-jcr-contentloader.html#initial-content-loading.
> Pretty often directives and attributes are mixed up, therefore it would be 
> good to emit a WARN for every unknown attribute or directive in that header.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)


[jira] [Resolved] (SLING-9052) DistributionSubscriber is not failing correctly on OakConstraint0025

2021-12-13 Thread Christian Schneider (Jira)


 [ 
https://issues.apache.org/jira/browse/SLING-9052?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Christian Schneider resolved SLING-9052.

Resolution: Cannot Reproduce

I was not able to reproduce this error anymore with current code.

> DistributionSubscriber is not failing correctly on  OakConstraint0025
> -
>
> Key: SLING-9052
> URL: https://issues.apache.org/jira/browse/SLING-9052
> Project: Sling
>  Issue Type: Bug
>  Components: Content Distribution
>Reporter: Dominik Süß
>Assignee: Christian Schneider
>Priority: Major
> Fix For: Content Distribution Journal Core 0.1.22
>
>
> During the reproduction attempt of another issue a node was mistakenly 
> replicated incomplete (not satisfying the OakConstraints) leading to 
> OakConstraint0025 - this should have caused the replication to be considered 
> failed as the replicated node couldn't be written into the repository at 
> first hand - instead this caused >4000 retries within an hour until being 
> noticed.
> {code}
> *ERROR* [Queue Processor for Subscriber agent forwardSubscriber] 
> org.apache.sling.distribution.journal.impl.subscriber.DistributionSubscriber 
> Error processing queue item
> org.apache.sling.distribution.common.DistributionException: 
> javax.jcr.nodetype.ConstraintViolationException: OakConstraint0025: 
> /etc/packages/my_packages/temptest.zip[[nt:file]]: Mandatory child node 
> jcr:content not found in a new node
>   at 
> org.apache.sling.distribution.serialization.impl.vlt.FileVaultContentSerializer.importFromStream(FileVaultContentSerializer.java:170)
>  [org.apache.sling.distribution.core:0.4.1.T201912202217-537bb57]
>   at 
> org.apache.sling.distribution.packaging.impl.InMemoryDistributionPackageBuilder.installPackageInternal(InMemoryDistributionPackageBuilder.java:119)
>  [org.apache.sling.distribution.core:0.4.1.T201912202217-537bb57]
>   at 
> org.apache.sling.distribution.packaging.impl.AbstractDistributionPackageBuilder.installPackage(AbstractDistributionPackageBuilder.java:156)
>  [org.apache.sling.distribution.core:0.4.1.T201912202217-537bb57]
>   at 
> org.apache.sling.distribution.monitor.impl.MonitoringDistributionPackageBuilder.installPackage(MonitoringDistributionPackageBuilder.java:92)
>  [org.apache.sling.distribution.core:0.4.1.T201912202217-537bb57]
>   at 
> org.apache.sling.distribution.serialization.impl.vlt.VaultDistributionPackageBuilderFactory.installPackage(VaultDistributionPackageBuilderFactory.java:340)
>  [org.apache.sling.distribution.core:0.4.1.T201912202217-537bb57]
>   at 
> org.apache.sling.distribution.journal.impl.subscriber.PackageHandler.installAddPackage(PackageHandler.java:70)
>  [org.apache.sling.distribution.journal:0.1.7.T202023011551-c372493]
>   at 
> org.apache.sling.distribution.journal.impl.subscriber.PackageHandler.apply(PackageHandler.java:53)
>  [org.apache.sling.distribution.journal:0.1.7.T202023011551-c372493]
>   at 
> org.apache.sling.distribution.journal.impl.subscriber.BookKeeper.importPackage(BookKeeper.java:153)
>  [org.apache.sling.distribution.journal:0.1.7.T202023011551-c372493]
>   at 
> org.apache.sling.distribution.journal.impl.subscriber.DistributionSubscriber.processQueueItem(DistributionSubscriber.java:408)
>  [org.apache.sling.distribution.journal:0.1.7.T202023011551-c372493]
>   at 
> org.apache.sling.distribution.journal.impl.subscriber.DistributionSubscriber.fetchAndProcessQueueItem(DistributionSubscriber.java:369)
>  [org.apache.sling.distribution.journal:0.1.7.T202023011551-c372493]
>   at 
> org.apache.sling.distribution.journal.impl.subscriber.DistributionSubscriber.processQueue(DistributionSubscriber.java:353)
>  [org.apache.sling.distribution.journal:0.1.7.T202023011551-c372493]
>   at java.base/java.lang.Thread.run(Thread.java:834)
> Caused by: javax.jcr.nodetype.ConstraintViolationException: 
> OakConstraint0025: /etc/packages/my_packages/temptest.zip[[nt:file]]: 
> Mandatory child node jcr:content not found in a new node
> {code}
> Clarification: 
> The expected behavior would be at least having the queue being blocked (which 
> happened at no point) and in the specific case retries are doomed to 
> continously fail as the package is incompatible with the target while. The 
> errormessage does spam the error.log



--
This message was sent by Atlassian Jira
(v8.20.1#820001)