All the small things

Last week the OSGi website[1] published the early draft of the OSGi R4.2 specification[2]. Reason enough to have a short look at what is covered in the upcoming release.

First of all one has to notice that this is not a minor release as the version number may suggest. Release 4.2 is actually way more significant than the R4.1 release last year. At some points I would even say it is more important than the R4 release, because with that one usage becomes way more easier, especially for none OSGi experts. But first things first. What is actually in the new draft?

Core design changes/ enhancements:
RFC 120 – Security Enhancements
RFC 121 – Bundle Tracker
RFC 125 – Bundle License
RFC 126 – Service Registry Hooks
RFC 128 – Accessing Exit Values from Applications
RFC 129 – Initial Provisioning Update
RFC 132 – Command Line Interface and Launching
RFC 134 – Declarative Services Update

Enterprise design changes:
RFC 98   – Transactions in OSGi
RFC 119 – Distributed OSGi
RFC 124 – A Component Model for OSGi

Covering all of these RFCs in this post won’t be possible, but I want to pick some of them and go a little bit into the details.

RFC 120 – Security Enhancements (P. 5)
The major change here is the introduction of the concept of a black list. Now, you are able to say something like everyone is allowed to do such and such, unless… and here comes the clause. Before, only white lists were possible. Although, this is a tremendous improvements in terms of simplicity, there is a reason why black lists are not as secure as white lists and why certain systems don’t implement black list approaches. I think this feature should be treated with extreme caution and I hope this won’t hunt back the OSGi, when security flaws based on this are surfacing, which will most certainly will.

RFC 125 – Bundle License (P. 62)
Licenses are always a problem in Software development. Especially when a lot of 3rd party libraries are involved. The OSGi now addresses these issues by defining a header for the manifest, which conforms to a distinct syntax, which subsequently allows vendors to not only express the kind of license a certain bundle is published, but also which portion of the code is associated with what license within a bundle. In my opinion, this is a really cool feature. Conceptually certainly not rocket science, but the benefits are many folded. Now, it is possible to display, which licenses are actually contained in your container and even more important, you can define rules for certain Licenses not being deployed in your environment. I am just thinking on the typical viral problem of GPL[3] like licenses.

RFC 126 – Service Registry Hooks (P. 71)
This is going to be a mechanism, mainly used for framework related services and not applications in general. The idea is to allow hooks, to tweak the service registry behavior. One very likely use case are remote services, as discussed for quite a while in the OSGi community. Although very useful and powerful, I can see the problem that you get indirect dependencies with this one and eventually have similar problems like with plain java jar files. A bundle doesn’t express which tweaked service manipulation it needs (similar to the “which jar also needs to be at what pssition in your class path” problem). Of course, this is not the aim of the spec, but as soon as it is possible, people start using it, even if it is not intended by the designers. Fragments are the most famous example for this pattern.

RFC 129 – Initial Provisioning Update (P. 97)
The initial provisioning specification as published in the R4.1 spec has a major drawback. It assumes, that the created jar can be manipulated in terms of setting properties to the zipped content (information about the MIME type). Although, this can easily be done in Java, all major build tools I know of are lacking this feature, so custom implementations had to be used instead. A reason, why I once chose not to go with this solution. This is now addressed in the RFC. A very useful update, if you ask me.

RFC 132 – Command Line Interface and Launching (P. 103)
Till now, all OSGi implementations differed in the way they were started and one could extend the console. This will change with this new RFC. For me this is the right direction. We really need clear interfaces to instrument the container, so that exchanging the container becomes easier. Of course, every framework provider will still have it’s own “enhanced” features, which is a good thing, but you easier avoid the typical lock in. This should boost transparency between frameworks.

RFC 134 – Declarative Services Update (P. 144)
I haven’t looked very close into that, because Spring (as well as iPOJO[4] or SAT[5]) are way superior and wider used than DS, but in general, the reliability of obtaining a service was increased. Some oddities have also been removed/solved.

RFC 98 – Transactions in OSGi (P. 154)
Transaction are being introduced to provide a true ACID level support. For this the JTA is going to be used. Additionally the Distributed Transaction Processing (XA+ Specification Version 2, The Open Group, ISBN: 1-85912-046-6) protocol will be used, which is specifically tailored to meet OSGi’s needs. I haven’t dug really deep into this, but I hope with this RFC the issues user have reported with libraries like Hibernate will finally be solved. An issue popping up quite often.

RFC 119 – Distributed OSGi (P. 169)
The goal should be clear, but here is a citation taken from the spec:

• An OSGi bundle deployed in a JVM to invoke a service in another JVM, potentially on a remote computer accessed via a network protocol
• An OSGi bundle deployed in a JVM to invoke a service (or object, procedure, etc.) in another address space, potentially on a remote computer, in a non OSGi environment )
• An OSGi service deployed in another JVM, potentially on a remote computer, to find and access afrom remote OSGi bundle service running in the “local” OSGi JVM (i.e. an OSGi deployment can accept service invocations
• A program deployed in a non OSGi environment to find and access a service running in the “local” OSGi JVM (i.e. an OSGi deployment can accept service invocations from external environments)

[OSGi Spec R4.2 early draft (P.174) - August 22th, 2008]

I really like the idea of being able to use services from other JVM and even other machines, without having to worry about how to implement this. A very compelling idea! Unfortunately I don’t believe in a flat world and so I don’t believe in such a simple solution. Network connections tend to have a latency, drop unexpected or even return corrupted data. If your service consumer is not agnostic of that, I think there will be more and more problems popping up. However, I am open for this and will watch the development closely. Eric Newcomer[6] gave a pretty impressive demo how this works at the OSGi Community Event[7], so I am looking forward to get my hands dirty. Call me idealistic, but I actually want this to work and prove me wrong!

RFC 124 – A Component Model for OSGi (P. 216)
The most important change however is described in RFC 124 in my opinion. Here, the former known Spring DM[8] approach is translated into an OSGi standard. After a first quick look, it seems like it is indeed the Spring DM specification OSGi’ified topped with some additional semantic sugar, but I have to look closer to be sure. The only question which remains for me is, if this RFC will really make it into the final spec, what will happen with DS? In my opinion, RFC 124 is way superior to DS and there are no good reasons to keep DS. If I am wrong, maybe someone can shed some light.

Conclusion
Besides the facts mentioned in the early draft, I find particular interesting, what actually didn’t made it into the early draft. For me the whole EE issue with the mapping of web.xml’s for instance is completely missing. The enterprise features are the things I was eager to read, but instead total silence. Hopefully they are still working on it. Releasing the next version of OSGi without the a convincing Java EE story is like driving a car with the handbreak on. Let’s hope the EEG will manage to finalize theirs EE story in time!

As I final note I want to say, that I think it is a great move from the OSGi alliance to actually grant early access to the things they are working on. This makes it way more transparent for the community, what is going on behind the closed doors of the specification process of the OSGi. Maybe in the furture, we’ll see an open way of interacting with the whole JSR process, so that even Sun will eventually be satisfied. Well, time will tell…

Cheers,
Mirko

–

[1] OSGi Homepage: http://www.osgi.org/Main/HomePage
[2] OSGi R4.2 early draft: http://www.osgi.org/download/osgi-4.2-early-draft.pdf
[3] GPL License: http://www.opensource.org/licenses/gpl-3.0.html
[4] iPOJO: http://felix.apache.org/site/ipojo.html
[5] SAT: http://www.vanderleiindustries.com/sat/help/topic/org.eclipse.soda.sat.plugin.doc/books/book.html
[6] Eric Newcomer’s blog: http://blogs.iona.com/newcomer
[7] OSGi Community Event: http://www.osgi.org/CommunityEvent2008/HomePage
[8] Spring DM: http://www.springframework.org/osgi

I was actually planing on writing something about this topic for months now, but I never found time to do so. Now that Peter Kriens picked up the topic in his current post [1], I just felt the need to write about my thoughts on this issue.

What is it all about?

When working on computer programs for a while, you pretty soon realize that you don’t want to invent the wheel all over again. So, people came up with concepts driving software reuse further and further. Starting from functional programming, finding its way to the fine world of objects and in our days driving more and more towards component based programming. Nothing surprising – though. With the help of OSGi I’d like to say Java has a pretty good standing among its competitors and could already be considered component ready.

However, there is one problem, at least as far as I am concerned. Looking at software product lines (I know, I know, they are more considered a fancy dream than a real world solution, but please hang in there for a moment and let me explain) the core concept – as I would call it – is the idea of divide and conquer. In a complex domain as computer science, it is not feasible to believe one can manage everything down to the finest granularity. So what you end up doing is creating the big picture and drill down on a “as needed” basis – a typical top down approach. Of course, this assumes you already have your main building blocks to work with. OSGi by its nature in general supports you in doing so. You only pick your functionality in terms of simple bundles and throw them into an OSGi container and everything just works – well, almost.

Unfortunately, that’s just the simplest scenario when things like this are working. Peter is saying in his blog that applications (bundles belonging to one domain and providing a certain functionality with their collective interaction, as I would define it) are simple to manage, because they express their dependencies. Tools like the OBR[2] make installation issues disappear and all the remaining requirements for an “application” concept to solve their problems are actually derived f.i. from the use of Class.forName() in legacy code to extend their applications and the sharing of implementation classes rather than interfaces. Here I have to disagree. Of course, the whole Class.forName() ideology is a problem within OSGi, but I don’t think this is the major reason for the demand for an application model.

Why is the concept of an application worth while?

Let’s assume you’re building a pretty complex application with … 400+ different bundles or so. Referring to software product line design you’re no longer managing all of these bundles, but you’re managing some sort of an application stack. If your interested in (see figure 1) creating a new application with “Domain Logic 1″ and “Domain Logic 3″, you just pick those and all the underlying plumbing should be taken as well. Of course (and here it becomes tricky) this involves loose coupling, which doesn’t include dependencies on a specific implementation or even worse implementer on the domain logic stack. Everything is abstracted from the implementation and everything just depends on interfaces and services.

One of my core problem here is that there is no distinct bundle representing an application. There is no syntax, convention, anything. I need to know which bundle in the application is my “core” (and I am not even talking about finding out, what my applications are, I can choose from). Having figured out which one to use, we are still not in a safe harbor. The problem continues with the separation of API and implementation. Ones both are separated by design (as shown in figure 2), I can happily resolve all my bundles, but nothing works, when solely relying on Package-Import statement scoping (which I – again! – highly recommend). Automatic tools dependency discovery tools just can’t find a path to the implementation. In figure 2 you can see the problem show by the arrow. Starting from the “Core Bundle”, I only have a dependency on the API. The API doesn’t have any dependency on the implementation. The Implementation bundle does have a dependency on the API, but for the dependency resolution tool, it is not clear, if the bundle is just using the API or implementing it.

As you now see, there is a certain problem and I wasn’t actually surprised when I heard about Springs approach to this problem. Although Springs way is a fast solution for the immanent problem, it introduces dependencies one might not want. Bundling components together in the Spring way ties the interface to the implementation, limiting the flexibility of the whole design.

So, basically we are doomed, right?

Well, the question is, what do we REALLY need. As I mentioned before, in my opinion, it is a set of just a few features:

1. an application identifier (this is great to figure out what functionality I actually have)
2. a way to express simple dependencies (with Import-Package, I think we pretty much have that)
3. some way to express dependencies on our environment, like the existence of a certain service implementation.

Looking closely at the core spec, we can actually find almost everything we need. Unfortunately, we can’t use this right away. Feature number one for instance can very easily be achieved by just introducing a new property in the Manifest.mf file – even a version can be introduced, although I am not sure this is a good idea yet.

The tricky part comes with feature number 3. Looking at the latest official OSGi core spec version 4.1, there is no meta data concept reflecting services*. Fortunately, there are still the old specs available for download [3] and here we can find in version 3 the “Export-Service” and “Import-Service” headers removed from the current specification. Assuming all bundles are correctly tagged with the right meta data, tools like the OBR can easily create a dependency tree and figure out which bundles to pick. Even better, such tools are now able to pick the best implementation based on their other dependencies and potential version conflicts on the imports of each implementation bundle. I think such a dynamic solution is way better fitting the OSGi way of doing things than any static one.

Ok, I know R3 is so “old school” and we are living in a brave new world. Swimming back is not an option in a buzz, hype and in general fast pace driven world. Fortunately, we don’t have to. With Spring DM [4], there is a way to express dependencies on services in a declarative way. Here you can define which services you are consuming and which ones you are providing, thus giving 3rd party tools the ability to analyze the dependencies way more subtle. If the Spring DM approach is used widely – as a new “official” standard, tools like OBR can now work again. They are able to assemble the right product configuration and deploy a runnable application based on the additional meta data from the Spring DM configuration. The only drawback so far, only if everyone is using this configuration, we will get the best results. If partially used, the results may not be providing any significant improvement based on the very bundle constellation.

Something I intentionally left out till now is the new idea of providing nested frameworks. I haven’t thought that entirely through though, I have to admit. In general I like the idea, but for other reasons. The main reason, why I don’t like it for this particular problem of the lack of the notion of applications is that when looking at figure 1, you might end up with several layers of applications, which would then ultimately end-up in requiring multiple layer nesting of frameworks. And speaking about complexity I am not sure, if a framework in a framework in a framework in a …. makes life so much easier. Besides, this still doesn’t solve the problem with discovering the necessary dependencies for an application – not counting manually configuration of such a sub framework of course.

Conclusion

For me there is a clear need for an application like notion in OSGi. As shown above, there are valid use cases even now, which make the use of OSGi kind of limited in the long run. However, I actually don’t see the need for an entirely new concept, above or beyond a bundle. The only thing we really need is a clear statement, how to provide and obtain the required information to do the described extended dependency analysis. With these information at hand, tools by 3rd parties can be developed and make us all equally happy. At the end, we should keep in mind that OSGi is (currently) about defining a component standard, which should be open and not enforcing any lock in. This is in contrast to most of the adapters wishes of having a simple technology, solving their immanent problems. I think, now there is time for great tools to support working with OSGi more easily, helping developer to adapt and embrase the functionality and freedom offered by OSGi.

Cheers,
Mirko

*) actually I was cheating a little bit here. OSGi R4 compendium contains the Declarative Service (DS) definition, which in fact defines valuable meta data. The reason, why I didn’t mention it here is basically related to the fact that Spring DM is superior to DS in many ways and DS is not part of the core specification, so I favored Spring DM for the sake of functionality.
–

[1] OSGi Blog: http://www.osgi.org/blog/2008/07/osgi-application-grouping.html
[2] OBR: www.osgi.org/Repository
[3] OSGi Spec Download Site: http://www.osgi.org/Specifications/HomePage
[4] Spring DM: http://www.springframework.org/osgi

Two weeks ago I received great news. The proposal I committed with my fellow coworkers (Boris Terzic and Markus Gumbel) got accepted at the OSGi community event, so I hope I’ll see some of you I only met virtually till now. Concerning the topic – I think it’ll be interesting for all of you working or at least intending to work with security and OSGi. Now, after I am allowed to talk about it, I will be able to share some of the experiences we gained.

In the talk titled “Do not disturb my circles! Secure Application Isolation with OSGi”[1], Markus Gumbel[2], and I are going to talk about how to isolate several application domains within one JVM – based on OSGi mechanisms. No big deal, some of you might say, but depending on your requirements, it actually might become a big deal or even serious issue. In our very case, we will face a Common Criteria(CC)[3], evaluation for our JVM based components ([4], gives a nice introduction on this topic – unfortunately only in German). But first things first…

InterComponentWare AG (ICW)[5],, the company I am working for right now, is one of the (if not the) leading eHealth provider in the business, with a wide ranging product portfolio. The core product is called LifeSensor[6],, which is an electronic health record like Google[7], and Microsoft[8], introduced recently in their first versions. If you, like me, are a little paranoid about privacy issues, I can recommend you “our” service for sure. We take security pretty serious and have a whole department dedicated to this. Medical data are always a big issue. Consider your CreditCard data is lost, you can get reimbursed from your CreditCard company, once the access to your medical data is compromised, it can’t be undone. Pretty serious from my point of view! Anyway, this is actually not where I am aiming at. We (and my group in particular) are involved in the implementation of the German Telematic Infrastructure project specified by the Gematik[9], and commissioned by the German government.

In our talk, we will take the “Konnektor” we are developing as the sample application to illustrate the usage of the OSGi security features. The Konnektor (we use the Cisco AXP platform[10], underneath) is the key device deployed at every medical practice and pharmacy. It is responsible for creating secure connections to the telematic infrastructure back end, as well as other security relevant tasks like reading eHealthCards, signing prescriptions or uploading emergency data on the electronicHealthCards for instance. [11], gives a nice overview, how things are done in more detail. Additionally the specification allows to have third party applications to be deployed on the connector as well, to extend its functionality. A concrete example would be the integration of the LifeSenor mentioned above to directly upload your X-Ray images to your eHealthRecord. You might understand, that security plays a very important role in such a scenario.

The key problem we are faced with is that the functionality of the Konnektor has to be certified according to the CC, which I mentioned at the beginning of this post. Well, certifying software in general is not easy, especially if you are talking about security and something as complex as we have. The real problem in our case however is not certifying that the software does exactly the stuff specified – no more, no less -, but also allowing third party “plug-ins” to extend its features without compromising its certified functionality or the security of the whole system. In a simple scenario, a doctor uploads a new “feature” from a malicious source to the Konnektor and we have to ensure beforehand that nothing serious can happen – tough one! Well, of course, we not only found a way, but also found a way using OSGi’s security features to do the trick even within the same JVM. The Konnektor and potentially dangerous third party extensions running side by side in the same JVM (of course, without restarting – there is a reason why we are using OSGi!).

Like every other cutting edge software project, we also found ourselves struggling with various problems no one has experience before and so I am pretty sure, we can contribute some important insights in the domain of secure OSGi application development. I hope this will be as interesting for you as it is for me to work on this topic. It is really something you can’t find a lot published about, if someone has done something similar or knows about something, I would be happy to hear about it!

Although, the sample we chose is pretty unique domain wise, the basic techniques we will present are applicable in many different domains as well (banking, insurance, development, personal live style,…). Just think of your Eclipse installation. Right now, you install your plug-ins without a SecurityManager and hope that the plug-in only does what it is supposed to do… What if it doesn’t – or better doesn’t intend to play by the rules? I can see OSGi frameworks running as general platforms combining various different application in one JVM in the furture – a kind of a meta Operating System. As soon as this vision becomes reality, I don’t want applications being able to communicate without restrictions with each other. My health insurance provider together with my personal medical record manager in one container… you never know what an insurer might do, when they get a hold of your sensitive medical records. At least I certainly don’t want to try this out!

I realize that parts of this post might sound like a commercial. If so, this is certainly not intended, but I felt the need to explain in more detail than I will be able at the talk, why we did what we did and why this is so important. In the talk, we will stick to the technology only and avoid as much as possible any relation to a concrete product – I really hate talks pretending to point out new technologies or lessons learned, but actually trying to sell a product instead, so you’re safe here for sure!

For those of you attending the conference, don’t hesitate to talk to me, if you have any questions or just say hello. I was and certainly am a big fan of technical discussions. All of you who won’t be able to attend the event and interested in the topic, don’t worry, after the talk, I am certainly blogging more about this topic in the near future Till then, stay tuned!

Cheers,
Mirko

UPDATE: the slides can be downloaded from the OSGi Website for everyone interested (pdf)

–

[1] http://www.osgi.org/CommunityEvent/Program
[2] http://www.osgi.org/CommunityEvent/Speakers#MG
[3] http://www.commoncriteriaportal.org
[4] http://www.bsi.bund.de/cc/
[5] http://www.icw-global.com
[6] https://www.lifesensor.com
[7] http://www.google.com/health
[8] http://www.healthvault.com
[9] http://www.gematik.de
[10] http://www.cisco.com/en/US/prod/routers/ps9701/axp_promo.html
[11] http://www.cisco.com/en/US/prod/collateral/routers/ps9701/data_sheet_c02_459078.html

At the beginning of this month[1], SpringSource published the first beta release of their so called SpringSource Application Platform[2], an (as I would call it) extension of the existing OSGi platform. The move came pretty surprising to me, I have to admit. No announcements prior to the release, no actual hints – nothing. Pretty impressive I have to admit. A company grown that popular being able to work on something from this magnitude without even seeding the glimpse of a rumor. Good job.

Well, I guess eventually the guys behind Spring are trying to make money. A very natural thing for a company, of course. After having provided the community with a great framework for so many “supposed to be” JEE applications for free, it is time to gain some revenue. I think they deserve it after all they have done for the community. Actually I find it in particular interesting how the strategic move, choosing GPL[3] as the license of choice, will work out. On the one hand, I can totally understand the point of view, choosing a license, which forces competitors to play with open cards and actually contribute to the community. On the other hand, I have to say, I am thinking twice before putting me in the hassle of dealing with a viral license. For instance, when I lately was involved in the decision between LOGBack[4] and Log4j[5] as a logging back end, the decision was not only based on features, but mostly licenses. In some scenarios, licenses are just a show stopper, so I honestly hope this will not be the case for my fellow colleagues from SpringSource.

Enough philosophizing… Spring released a very interesting extension to the existing OSGi specification. Summarizing all the new features they provide would certainly go beyond the scope of this blog, besides I am by far not as knowledgeable as the developers themselves, so I will just refer to their great introductions [6],[7] and [8]. Instead I want to point out some things I consider worth mentioning.

First of all, the repository[9] is just great. With the experiences I’ve made by migrating existing applications into modular, OSGi based bundles, I can tell this can be pretty time consuming and frustrating, if done accurately (not just adding some headers to the manifest.mf, but also changing the existing code to work within OSGi where necessary).

The second thing I’d like to mention is two sided… On the one side, OSGi is missing another abstraction layer, I think. Defining full functional, domain modules to help people jump start in OSGi is needed – no getting lost in dozens of bundles, versions and services. I think all of you, working with OSGi for a while, have been faced with the problem, where you resolved and started every bundle appropriately, but your program will just not work, because you forgot to deploy the actual implementation of a service. Knowing your system, it won’t be a big thing finding the problem, but in a unfamiliar application with hundreds of bundles deployed and more potentially ready to be deployed from a repository, just waiting to be picked… which one is the one to choose? An abstraction – bundling those, as Spring has done it with its PAR – might help.

But, there is also another side to this story. Maybe all we need is some sort of indicator, a meta data to indicate, that a specific bundle provides/ consumes a distinct service? This will remove the provider lock-in problem caused by solutions like “Require-Bundle” for instance. All we actually need is a (in some way) abstract concept of a working entity (or application or domain module as you might prefer calling it), which is more abstract than usual bundles. This can just be the aggregation of certain packages and service consumers as well as providers. Only APIs, no actual implementation dependencies and for sure no Bundle-SymbolicName dependencies. An ideal application now would only consist of a couple of domain modules, which have to be deployed in the OSGi container. The container (with the help of the repository) now just picks the required bundles and assembles the application. No need to define a specific vendor, everything will be resolved by the framework. That would be my dream…

Anyway, I think this is something, which should be discussed in more detail in official sources. The approach Spring choose is certainly a way to go and test drive, but honestly, I doubt that it’ll turn out to be the right fit in the long run. All solutions I can think of, which were created to solve a certain pain are a serious burden and actual blocker in the long run, like Eclipse Buddy Class Loading, the OSGi Require-Bundle* header or the (unlimited) backwards compatibility required by the jar specification.

The last thing to mention is the introduction of the new headers. In general, I am all in favor of doing so and I am not surprised about the chosen names. Of course, they might clash with later headers, potentially introduced by the OSGi Consortium, but this is nothing new in Java. If you take a look around, developers as it seams, consider the reverse domain nomenclature as a burden and just ignore it. Even if it is now better established on a package level (although there are still rather well known exceptions like the IAIK[10] or even Peter Kriens FileInstall[11] bundle for instance). On a Manifest level however most of us (including myself) can pledge guilty of silently ignoring Java best practices. Unfortunately the magnitude of such a decision hunts you down later. The recent discussion about the name space issues of the OSGi headers, was the perfect reminder for me to give these small things more thorough thought, as we usually tend to liberately ignore them most of the time in favor of fast development. Well, at least I pledge betterment and hopefully so does every responsible developer, too

Cheers,
Mirko

*) Sorry, but I just can’t help it. In my opinion this header is not only a hurdle, but a real drawback from a componentization point of view. From a migration strategy approach, I guess the opposite applies, but what lasts longer – migration or maintenance?

–

[1] http://www.springsource.com/web/guest/2008/applicationservermarket
[2] http://www.springsource.com/web/guest/products/suite/applicationplatform
[3] http://www.gnu.org/licenses/gpl.html
[4] http://logback.qos.ch
[5] http://logging.apache.org/log4j
[6] http://underlap.blogspot.com/2008/04/springsource-application-platform-ships.html
[7] http://blog.springsource.com/main/2008/04/30/introducing-the-springsource-
application-platform
[8] http://blog.springsource.com/main/2008/05/01/completing-the-picture-spring-
osgi-and-the-springsource-application-platform
[9] http://www.springsource.com/repository
[10] http://jce.iaik.tugraz.at
[11] http://www.aqute.biz/Code/FileInstall

Lately, I was working on a problem, which really got me. I had a class throwing an exception for no obvious reason and the provided message wasn’t helping either. When I tried to take a look at the class, causing this problem, I noticed that I had no idea, where the class was actually coming from. Working with a lot of bundles, you usually don’t have all of them available in your development environment (especially when you work remotely on an external device f.i.), so using the search capabilities of your favorite IDE is not always an option. One might say that with well defined conventions, this is not much of a problem, but you are not always using your own code (actually most of the time I don’t) and you can’t dictate the way they create their components. Standards are great, but only if everyone complies with them. Anyway, to solve my problem, I had to import all my bundles into Eclipse and and search inside of Eclipse after the class – not really convenient.

Over the weekend, I decided to do something about this inconvenience and started to create a bundle to do this job in the running OSGi container. I just defined a service interface with a single method, a console extension for the Equinox and ProSyst mBS Console and implemented the interface in a handful lines of code and voila, here it is – the inspector bundle. Yet only providing one very simple command to show the bundles containing the given class. The service interface (net.mjahn.tools.inspector.IBundleUtils) is as simple as you can imagine. All it does is providing you the bundle having the given class in its class path (not the bundle class space – the bundle must provide the defining class loader of the class).

No magic and certainly no rocket science, but quiet handy when you don’t have all your bundles in the IDE. If someone is interested, the jar in a first version can be downloaded from the tools section here.