Relying on aem-sdk-api:latest may break runtime compatibility with AEM 6.5.x and older AEMaaCS versions

adobe / asset-share-commons

A modern, open-source asset share reference implementation built on Adobe Experience Manager (AEM)

https://opensource.adobe.com/asset-share-commons/

Apache License 2.0

88 stars 107 forks source link

Relying on aem-sdk-api:latest may break runtime compatibility with AEM 6.5.x and older AEMaaCS versions #740

Closed kwin closed 2 years ago

kwin commented 2 years ago

The build creates the Import-Package OSGi headers from the package version of the referenced Maven dependency com.adobe.aem:aem-sdk-api with version range [2022,) (details in https://bnd.bndtools.org/chapters/170-versioning.html#import-version-policy)

This not only makes the build non-reproducable (due to the dynamic version range) but also may lead to incompatible Import-Package version ranges with older AEMaaCS or AEM 6.5.x versions.

The Maven build should only reference the dependency in the oldest supported version (according to the readme this is AEM 6.5.7), which means https://repo1.maven.org/maven2/com/adobe/aem/uber-jar/6.5.7/ should be used as dependency.

kwin commented 2 years ago

Although most import-ranges are fixed in https://github.com/adobe/asset-share-commons/blob/8eb97f843e78c9dc8372a5a86a2a0b6dc99bb141/core/pom.xml#L49-L67

some import-packages may be easily missed
manually tweaking the import range is very error prone

If the same automatically generated ranges do not work for both AEMaaCS and AEM 6.5.7+ one should rather create dedicated bundles/packages for onPrem and cloud.

davidjgonzalez commented 2 years ago

@kwin if you want to take a stab at creating 2 different builds and maybe adding a GAction for releasing everything - that would be great!

This is one of those things that has worked up until it doesn't, and since there arent many contributors to the project, its never received much attention. IIRC it gets worse after 2022.4+ as some OSGi wiring header versions become mismatched with whats available on 6.5.7+

But eventually well want to upgrade past 2022.4 anyhow to support asset sourcing, so the workaround of pegging the current setup to 2022.3 is also only a stopgap.

kwin commented 2 years ago

I can take a look, but only after the current PRs have been merged to prevent too many conflicts.

kwin commented 2 years ago

Compatibility is already broken due to generating Declarative Services 1.5 metatypes (declared e.g. in https://repo1.maven.org/maven2/com/adobe/aem/aem-sdk-api/2022.5.7493.20220524T082827Z-220401/aem-sdk-api-2022.5.7493.20220524T082827Z-220401.pom) while AEM 6.5.x only supports OSGi DS 1.4!