It's not too late for access control

[Alan Bateman]

On 15/07/2016 13:55, dalibor topic wrote:

> :
>
>> I can't say what other OSGi frameworks are doing, but for example
>> testing Hibernate in OSGi requires Apache Karaf, which is stuck on
>> issues like:
>>  - https://issues.apache.org/jira/browse/KARAF-3518
>
> Judging by http://markmail.org/message/6v3kiqabebwtuwpv they use the 
> endorsed standards mechanism to override non-endorsed classes.
If I read this correctly then they are attempting to override 
java.lang.Exception for some reason. That "worked" because the legacy 
endorsed standard override mechanism was essentially -Xbootclasspath/p.

For debugging purposes then  way to override a class in a module is 
-Xpatch (or --patch-module with the new option). In this case, it would 
be `--patch-module java.base=myexception.jar` although I don't expect it 
will work (at either compile-time or run-time) because code in java.base 
can't link to code in java.xml.bind (JAXB). They will need 
`--add-modules java.xml.bind --add-reads java.base=java.xml.bind` and 
additionally -Xmodule:java.base at compile-time.

As regards the endorsed standard override mechanism then it has been 
removed in JDK 9. It was deprecated in a MR of JSR 337. Also 
-XX:+CheckEndorsedAndExtDirs is documented in the release notes for JDK 
8 updates as a quick way to have the VM fail at startup if you are 
(unknowing) using this or the legacy extension mechanism.

-Alan