[Red Hat JIRA] (WFLY-14287) NoClassDefFoundError: Failed to link org/bouncycastle/openpgp/PGPEncryptedDataList: org/bouncycastle/util/Iterable
by Radoslav Ivanov (Jira)
[ https://issues.redhat.com/browse/WFLY-14287?page=com.atlassian.jira.plugi... ]
Radoslav Ivanov edited comment on WFLY-14287 at 1/20/21 11:20 PM:
------------------------------------------------------------------
[~brian.stansberry], thanks for the reply and detailed explanation. I pretty well understand those about foodprint, independence, compatibility, etc. So I will understand if you reject changes.
Anyway, I would like to share some food for thought in a scenario and hopefully we can find a solution for it in the future. Let say we have a critical CVE (CVE-2020-28052 in bouncycastle). It is tricky to update the duplicate module only and not the private one for no newer WildFly (WF) reasons. Sometimes, for security reasons WF users may take the risk to depend on a private module and update it (after some regression testing) instead of running on vulnerable along with another updated version of bouncycastle.
was (Author: rady66):
[~brian.stansberry], thanks for the reply and detailed explanation. I pretty well understand those about foodprint, independence, compatibility, etc. So I will understand if you reject changes.
Anyway, I would like to share some food for thought in a scenario and hopefully we can find a solution for it in the future. Let say we have a critical CVE-2020-28052 in bouncycastle. It is tricky to not update the private (duplicate) older version until you get a newer WildFly (WF). Sometimes, for security reasons WF users may take the risk to depend on a private module and update it (after some regression testing) instead of running on vulnerable along with another updated version of bouncycastle.
> NoClassDefFoundError: Failed to link org/bouncycastle/openpgp/PGPEncryptedDataList: org/bouncycastle/util/Iterable
> ------------------------------------------------------------------------------------------------------------------
>
> Key: WFLY-14287
> URL: https://issues.redhat.com/browse/WFLY-14287
> Project: WildFly
> Issue Type: Bug
> Affects Versions: 21.0.1.Final
> Reporter: Radoslav Ivanov
> Assignee: Sudeshna Sur
> Priority: Major
>
> Could you please add missing dependencies in Bouncycastle modules?
> Problem (we got):
> {code:java}
> Caused by: java.lang.NoClassDefFoundError: Failed to link org/bouncycastle/openpgp/PGPEncryptedDataList (Module "org.bouncycastle.bcpg" version 1.66.00.0 from local module loader @1d1f7216 (finder: local module finder @423e4cbb (roots: /data/avoka/transact/manager/server/modules,/data/avoka/transact/manager/server/modules/system/layers/base))): org/bouncycastle/util/Iterable
> {code}
>
> Solution (adding dependency from bcpg to bcprov modules solves the issue):
> {code:java}
> modules\system\layers\base\org\bouncycastle\bcpg\main\module.xml{code}
> {code:java}
> <dependencies>
> <module name="org.bouncycastle.bcprov" export="true" services="export"/>
> </dependencies>
> {code}
>
--
This message was sent by Atlassian Jira
(v8.13.1#813001)
5 years, 2 months
[Red Hat JIRA] (WFLY-14287) NoClassDefFoundError: Failed to link org/bouncycastle/openpgp/PGPEncryptedDataList: org/bouncycastle/util/Iterable
by Radoslav Ivanov (Jira)
[ https://issues.redhat.com/browse/WFLY-14287?page=com.atlassian.jira.plugi... ]
Radoslav Ivanov commented on WFLY-14287:
----------------------------------------
[~brian.stansberry], thanks for the reply and detailed explanation. I pretty well understand those about foodprint, independence, compatibility, etc. So I will understand if you reject changes.
Anyway, I would like to share some food for thought in a scenario and hopefully we can find a solution for it in the future. Let say we have a critical CVE-2020-28052 in bouncycastle. It is tricky to not update the private (duplicate) older version until you get a newer WildFly (WF). Sometimes, for security reasons WF users may take the risk to depend on a private module and update it (after some regression testing) instead of running on vulnerable along with another updated version of bouncycastle.
> NoClassDefFoundError: Failed to link org/bouncycastle/openpgp/PGPEncryptedDataList: org/bouncycastle/util/Iterable
> ------------------------------------------------------------------------------------------------------------------
>
> Key: WFLY-14287
> URL: https://issues.redhat.com/browse/WFLY-14287
> Project: WildFly
> Issue Type: Bug
> Affects Versions: 21.0.1.Final
> Reporter: Radoslav Ivanov
> Assignee: Sudeshna Sur
> Priority: Major
>
> Could you please add missing dependencies in Bouncycastle modules?
> Problem (we got):
> {code:java}
> Caused by: java.lang.NoClassDefFoundError: Failed to link org/bouncycastle/openpgp/PGPEncryptedDataList (Module "org.bouncycastle.bcpg" version 1.66.00.0 from local module loader @1d1f7216 (finder: local module finder @423e4cbb (roots: /data/avoka/transact/manager/server/modules,/data/avoka/transact/manager/server/modules/system/layers/base))): org/bouncycastle/util/Iterable
> {code}
>
> Solution (adding dependency from bcpg to bcprov modules solves the issue):
> {code:java}
> modules\system\layers\base\org\bouncycastle\bcpg\main\module.xml{code}
> {code:java}
> <dependencies>
> <module name="org.bouncycastle.bcprov" export="true" services="export"/>
> </dependencies>
> {code}
>
--
This message was sent by Atlassian Jira
(v8.13.1#813001)
5 years, 2 months
[Red Hat JIRA] (WFLY-14271) NullPointerException when ejb timers services fails during loading timer from database upon activation
by Chao Wang (Jira)
[ https://issues.redhat.com/browse/WFLY-14271?page=com.atlassian.jira.plugi... ]
Chao Wang updated WFLY-14271:
-----------------------------
Labels: downstream_dependency (was: )
> NullPointerException when ejb timers services fails during loading timer from database upon activation
> ------------------------------------------------------------------------------------------------------
>
> Key: WFLY-14271
> URL: https://issues.redhat.com/browse/WFLY-14271
> Project: WildFly
> Issue Type: Bug
> Components: EJB
> Reporter: Enrique González Martínez
> Assignee: Enrique González Martínez
> Priority: Major
> Labels: downstream_dependency
> Fix For: 22.0.0.Final
>
>
> NullPointerException when ejb timers services fails during loading timer from database upon activation.
> This causes the timerObjectId set not being created and failing afterwards.
> {noformat}
> Caused by: java.lang.RuntimeException: java.lang.NullPointerException
> at org.jboss.as.ejb3@7.2.9.GA-redhat-00003//org.jboss.as.ejb3.timerservice.TimerServiceImpl.persistTimer(TimerServiceImpl.java:632)
> at org.jboss.as.ejb3@7.2.9.GA-redhat-00003//org.jboss.as.ejb3.timerservice.TimerServiceImpl.createTimer(TimerServiceImpl.java:480)
> at org.jboss.as.ejb3@7.2.9.GA-redhat-00003//org.jboss.as.ejb3.timerservice.TimerServiceImpl.createSingleActionTimer(TimerServiceImpl.java:305)
> at deployment.ROOT.war//org.jbpm.services.ejb.timer.EJBTimerScheduler.internalSchedule(EJBTimerScheduler.java:202)
> Caused by: java.lang.NullPointerException
> at org.jboss.as.ejb3@7.2.9.GA-redhat-00003//org.jboss.as.ejb3.timerservice.persistence.database.DatabaseTimerPersistence.addTimer(DatabaseTimerPersistence.java:337)
> at org.jboss.as.ejb3@7.2.9.GA-redhat-00003//org.jboss.as.ejb3.timerservice.TimerServiceImpl.persistTimer(TimerServiceImpl.java:613)
> {noformat}
--
This message was sent by Atlassian Jira
(v8.13.1#813001)
5 years, 2 months
[Red Hat JIRA] (WFLY-14219) Utilize JBoss Modules version 1.9 in module descriptors
by Brian Stansberry (Jira)
[ https://issues.redhat.com/browse/WFLY-14219?page=com.atlassian.jira.plugi... ]
Brian Stansberry reassigned WFLY-14219:
---------------------------------------
Fix Version/s: 23.0.0.Beta1
Assignee: Boris Unckel (was: Brian Stansberry)
Resolution: Done
> Utilize JBoss Modules version 1.9 in module descriptors
> -------------------------------------------------------
>
> Key: WFLY-14219
> URL: https://issues.redhat.com/browse/WFLY-14219
> Project: WildFly
> Issue Type: Task
> Components: Server
> Affects Versions: 22.0.0.Alpha1
> Reporter: Boris Unckel
> Assignee: Boris Unckel
> Priority: Major
> Fix For: 23.0.0.Beta1
>
> Attachments: 2020-12-13_wildfly-22.0.0.Beta1-SNAPSHOT_modules_15_16_17.txt, 2020-12-16_wfjdep2_22.0.0.Beta1-SNAPSHOT.7z, 2020-12-16_wfjdep_22.0.0.Beta1-SNAPSHOT.7z
>
>
> There are still modules which use 1.5, 1.6 or 1.7 and do not need that. The idea is to run jdeps on each artifact of a modul, add the relevant java.* and jdk.* modules to the dependencies of the module and upgrade to version 1.8. In a first change only none-jdk modules and none which depend on system dependency.
> List in 2020-12-13_wildfly-22.0.0.Beta1-SNAPSHOT_modules_15_16_17.txt
> Changes in a first set of modules in WildFly-Core [WFCORE-5229|https://issues.redhat.com/browse/WFCORE-5229] integration tests were successful.
--
This message was sent by Atlassian Jira
(v8.13.1#813001)
5 years, 2 months