dogtagpki / pki

The Dogtag Certificate System is an enterprise-class Certificate Authority (CA) which supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management.
https://www.dogtagpki.org
GNU General Public License v2.0
344 stars 133 forks source link

shouldn't declare a dependency on SLF4J binding #3186

Open pki-bot opened 3 years ago

pki-bot commented 3 years ago

This issue was migrated from Pagure Issue #3068. Originally filed by tjaalton (@tjaalton) on 2018-10-10 04:42:11:


From https://www.slf4j.org/codes.html#multiple_bindings

"Embedded components such as libraries or frameworks should not declare a dependency on any SLF4J binding but only depend on slf4j-api. When a library declares a compile-time dependency on a SLF4J binding, it imposes that binding on the end-user, thus negating SLF4J's purpose. When you come across an embedded component declaring a compile-time dependency on any SLF4J binding, please take the time to contact the authors of said component/library and kindly ask them to mend their ways."

noticed it when our resteasy had slf4j-simple.jar in it's classpath, and dogtag had -jdk14.jar:

loka 10 01:06:22 sid2.leon pki-tomcatd[13563]: SLF4J: Class path contains multiple SLF4J bindings. loka 10 01:06:22 sid2.leon pki-tomcatd[13563]: SLF4J: Found binding in [jar:file:/usr/share/java/slf4j-simple.jar!/org/slf4j/impl/StaticLoggerBinder.class] loka 10 01:06:22 sid2.leon pki-tomcatd[13563]: SLF4J: Found binding in [jar:file:/usr/share/java/slf4j-jdk14.jar!/org/slf4j/impl/StaticLoggerBinder.class] loka 10 01:06:22 sid2.leon pki-tomcatd[13563]: SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation. loka 10 01:06:22 sid2.leon pki-tomcatd[13563]: SLF4J: Actual binding is of type [org.slf4j.impl.SimpleLoggerFactory]

pki-bot commented 3 years ago

Comment from edewata (@edewata) at 2018-10-22 19:07:40

I'm not sure this ticket is valid.

AFAIK the PKI code does not have any explicit dependency on specific SLF4J binding. Some PKI code uses JUL API to set the logging level programmatically, but it should be possible to build PKI binaries without slf4j-jdk14. The pki.spec file does include a build dependency on slf4j-jdk14 because it is running the unit tests as part of the build process, but the PKI code itself does not depend on it.

If someone wants to include PKI library in their application, it should be possible to use any SLF4J binding by specifying it in the classpath of that application. However, in PKI applications (server, tools, tests) we specifically use slf4j-jdk14 in the classpath, so all other libraries (including RESTEasy) running in PKI applications will have to use this binding too.

pki-bot commented 3 years ago

Comment from edewata (@edewata) at 2018-10-22 19:07:42

Metadata Update from @edewata: