How to define mandatory transitive import packages?

Jira Development Jira Server
, ,
1

Hi all! I want to use spring jdbc template to connect to third party database from jira plugin. I have added the following dependencies:

  <groupId>org.springframework</groupId>
  <artifactId>spring-jdbc</artifactId>
  <version>5.3.24</version>
  <scope>compile</scope>
</dependency>
<dependency>
  <groupId>org.springframework</groupId>
  <artifactId>spring-tx</artifactId>
  <version>5.3.24</version>
  <scope>provided</scope>
</dependency>
<dependency>
  <groupId>org.springframework</groupId>
  <artifactId>spring-core</artifactId>
  <version>5.3.24</version>
  <scope>provided</scope>
</dependency>
<dependency>
  <groupId>mysql</groupId>
  <artifactId>mysql-connector-java</artifactId>
  <version>8.0.30</version>
  <scope>compile</scope>
</dependency>
<dependency>
  <groupId>com.mchange</groupId>
  <artifactId>c3p0</artifactId>
  <version>0.9.5.5</version>
  <scope>compile</scope>
</dependency>
<dependency>
  <groupId>org.springframework</groupId>
  <artifactId>spring-dao</artifactId>
  <version>2.0.8</version>
  <scope>compile</scope>
</dependency>

I got osgi.wiring.package: missing requirement errors, so i also changed the import-packages block:

          org.springframework.osgi.*;resolution:="optional",
          org.eclipse.gemini.blueprint.*;resolution:="optional",
          com.oracle.bmc;resolution:="optional",
          com.sun.msv*;resolution:="optional",
          com.typesafe.config;resolution:="optional",
          javax.jms;resolution:="optional",
          kotlin*;resolution:="optional",
          org.apache.derby.jdbc;resolution:="optional",
          org.apache.logging.log4j;resolution:="optional",
          org.apache.logging.log4j.core;resolution:="optional",
          org.apache.logging.log4j.core.config;resolution:="optional",
          org.apache.logging.log4j.message;resolution:="optional",
          org.apache.logging.log4j.spi;resolution:="optional",
          org.apache.logging.log4j.core.appender;resolution:="optional",
          org.objectweb.jotm;resolution:="optional",
          org.relaxng.datatype;resolution:="optional",
          org.springframework.metadata;resolution:="optional",
          org.springframework.util.function;resolution:="optional",
          sun.misc;resolution:="optional",
          *
        </Import-Package>

Everything works well, however I have a misunderstanding.

Based on the atlassian documentation:

The *;resolution:=optional value instructs the plugin system to continue to scan your classes for packages, but to resolve all packages optionally. This means if you bundle a library that has code that depends on other libraries you do not need, the resolution will not fail.

And this:

Leaving the asterisk as mandatory**: all the imports that BND generates for you will implicitly be mandatory. The upside of this approach is that the plugin will fail fast with an informative error if any of these packages are not available when the plugin tries to load. The downside is that BND might generate mandatory imports for packages that you never actually need at runtime. For example, a StringUtils class in a bundled dependency might have a method that delegates to a hashing class from the com.example.hashing package in one of its own dependencies. Even if you never call that method, i.e. your plugin works fine without that package, BND will detect the reference to it and generate a mandatory import for it. This in turn means that unless the host OSGi container happens to provide that package, your plugin will fail to load, requiring you to add an explicit exclusion of that package to your Import-Package instruction (i.e. !com.example.hashing.*). You might need to add several such exclusions, one by one, until your plugin eventually loads. Even then, you can’t be certain that all of your mandatory package imports are legitimate, because any of them could be for a package that just happens to be present in your test environment but is never present in production. Furthermore, when confronted with an obscure package name from a transitive dependency, it can be hard to know whether it can safely be excluded or whether its absence is a legitimate bug.

I don’t understand the following points:

  1. I don’t know if the third party code I’m using creates classes from their transitive dependencies. Is there any way I can find out? What should I do in this case? Import explicitly with bulk compile dependencies specified in and marked as optional ?
  2. How can I know that using ;resolution:=“optional” for a particular package is safe for a plugin? Can I verify this only by full testing of the plugin?

Thanks for your help!