Avoiding java.net.* in bootdelegation path

[sudheerk84]

I have a use case where in i want to avoid the bundles using java.net packages in the bundles unedr spring dm.

Since these java.* are implicitly imported and i can not control this throught manifest file.

How can i avoid direct access of this java.net package ?

[oleg.zhurakousky]

Well, at this stage of the game you can’t. It is not as much about bootdelegation, as it is abut the fact that java.net is required by the dmServer kernel itself. Removing the java.net entry from the *profile will result in the server not being able to start.
But even if you could, how would you stop developers from using it (writing code) anyway. Java.net is part of JDK which means the developers would still see it during the development. So until there is an IDE that recognizes OSGi partitioning of JVM you have to rely on your local conventions and coding guidelines.
What is your use case for this anyway?

[sudheerk84]

My use case is that we have a third party vendor who will deploy his jar in our OSGi environment , and we want to impose restriction on using java.net packages in his bundles.

Having import in the manifest file helps us a easy way for us to identify if the third party is using any of the unwanted java packages .

One more thought is that in java* profile file, i did not see a listing for java.net package.i just saw i sun.com.* Then how did it get imported ?

I am using Dm version 1.0.1.

[oleg.zhurakousky]

As an FYI, java.net is listed under org.osgi.framework.system.packages, but in any event. . .

Section 3.8.5 of OSGi R4 spec states:
"The set of implicitly imported packages are all java.* packages, since these
packages are required by the Java runtime, . . . A bundle must not declare imports or exports for java.* packages; doing so
is an error and any such bundle must fail to install. . .", which means there is not much you can do as far as java.net. . . especially java.net which is not only about accessing network, but also about URLs, URIs etc. . which are widely used.

You can probably play with java policy files. . .

[sudheerk84]

java.net is not present in the system packages only javax.net is present in that.

[oleg.zhurakousky]

Nice catch :-). . .My bad, for whatever reason I assumed javax.net. But as I said all java.* are implicitly imported so there is no way to manage them via OSGi semantics