Skip to content

Migrate to SLF4J + Logback and Gson from Maven-Central instead of Orbit #931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 29, 2022

Conversation

HannesWell
Copy link
Contributor

@HannesWell HannesWell commented Sep 24, 2022

Build against slf4j and logback from Maven-Central and include them into m2e's p2 repo to contribute it to SimRel.
The version at Maven-Central is more recent and not jar-signed by the Eclipse-Foundation which helps to address the difficulties encountered in #926.

Logback from Orbit uses a different approach to wire org.slf4j.api and ch.qos.logback.classic (both from Orbit) . Besides logback-core and classic it is split additionally into a third fragment ch.qos.logback.slf4j whose host is org.slf4j.api (from Orbit) and that contains and exports the org.slf4j.impl package of logback-classic and imports packages from the latter. This way effectively org.slf4j.api requires ch.qos.logback.classic.

In order to now have two slf4j bindings on the classpath of Maven-build launched from within the IDE and thus to avoid corresponding warnings, I have adjusted the code in MavenEmbeddedRuntime to not pull in dependencies of slf4j (with old and new bundle name).

Fixes #738

@HannesWell
Copy link
Contributor Author

I also created eclipse-platform/eclipse.platform.releng.aggregator#588 to coordinate the logback migration through the whole Eclipse Platform/IDE.

@HannesWell
Copy link
Contributor Author

/request-license-review

@HannesWell
Copy link
Contributor Author

I wonder why those Eclipse artifacts are not inherently vetted? is there an issue with the lookup logic?

@github-actions
Copy link

github-actions bot commented Sep 24, 2022

Unit Test Results

595 tests   589 ✔️  8m 51s ⏱️
  93 suites      6 💤
  93 files        0

Results for commit c8cce60.

♻️ This comment has been updated with latest results.

Build against slf4j and logback from Maven-Central and include them into
M2E's p2 repo to contribute it to SimRel.
Furthermore guard against adding multiple slf4j binding to the
classpath, when launching the embedded Maven-Runtime, by explicitly not
adding dependencies of the slf4j bundles.

Fixes eclipse-m2e#738
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

logback RCE CVE-2021-42550
1 participant