ASM library jar contains inconsistently compiled class files - both against declared Java SE 5.0 and surprisingly also against Java SE 7 - causing OSGi tooling setting too high requirement on Java version
Summary
ASM library jar contains inconsistently compiled class files - both against declared Java SE 5.0 - major version in most of the *.class files is 49 (0x31 hex) - and surprisingly also against Java SE 7 - major version in module-info.class is 51 (0x33 hex).
Steps to reproduce
$ wget -q https://repository.ow2.org/nexus/content/repositories/releases/org/ow2/asm/asm/7.0/asm-7.0.jar
$ jar xvf asm-7.0.jar
created: META-INF/
inflated: META-INF/MANIFEST.MF
inflated: module-info.class
created: org/
created: org/objectweb/
created: org/objectweb/asm/
inflated: org/objectweb/asm/AnnotationVisitor.class
inflated: org/objectweb/asm/AnnotationWriter.class
inflated: org/objectweb/asm/Attribute$Set.class
inflated: org/objectweb/asm/Attribute.class
inflated: org/objectweb/asm/ByteVector.class
inflated: org/objectweb/asm/ClassReader.class
inflated: org/objectweb/asm/ClassTooLargeException.class
inflated: org/objectweb/asm/ClassVisitor.class
inflated: org/objectweb/asm/ClassWriter.class
inflated: org/objectweb/asm/ConstantDynamic.class
inflated: org/objectweb/asm/Constants.class
inflated: org/objectweb/asm/Context.class
inflated: org/objectweb/asm/CurrentFrame.class
inflated: org/objectweb/asm/Edge.class
inflated: org/objectweb/asm/FieldVisitor.class
inflated: org/objectweb/asm/FieldWriter.class
inflated: org/objectweb/asm/Frame.class
inflated: org/objectweb/asm/Handle.class
inflated: org/objectweb/asm/Handler.class
inflated: org/objectweb/asm/Label.class
inflated: org/objectweb/asm/MethodTooLargeException.class
inflated: org/objectweb/asm/MethodVisitor.class
inflated: org/objectweb/asm/MethodWriter.class
inflated: org/objectweb/asm/ModuleVisitor.class
inflated: org/objectweb/asm/ModuleWriter.class
inflated: org/objectweb/asm/Opcodes.class
inflated: org/objectweb/asm/Symbol.class
inflated: org/objectweb/asm/SymbolTable$Entry.class
inflated: org/objectweb/asm/SymbolTable.class
inflated: org/objectweb/asm/Type.class
inflated: org/objectweb/asm/TypePath.class
inflated: org/objectweb/asm/TypeReference.class
created: org/objectweb/asm/signature/
inflated: org/objectweb/asm/signature/SignatureReader.class
inflated: org/objectweb/asm/signature/SignatureVisitor.class
inflated: org/objectweb/asm/signature/SignatureWriter.class
$ od -t d1 -j 7 -N 1 org/objectweb/asm/AnnotationVisitor.class
0000007 49
0000010
$ od -t d1 -j 7 -N 1 module-info.class
0000007 53
0000010
$ cat META-INF/MANIFEST.MF
Manifest-Version: 1.0
Bundle-DocURL: http://asm.ow2.org
Bundle-ManifestVersion: 2
Bundle-Name: org.objectweb.asm
Bundle-RequiredExecutionEnvironment: J2SE-1.5
Bundle-SymbolicName: org.objectweb.asm
Bundle-Version: 7.0.0
Export-Package: org.objectweb.asm;version="7.0",org.objectweb.asm.sign
ature;version="7.0"
Implementation-Title: ASM, a very small and fast Java bytecode manipul
ation framework
Implementation-Version: 7.0
Impact
This issue causes tools like BND lib selecting wrong required Java version in case this version of ASM library is a dependency of given OSGi bundle - see the mechanism below:
- https://github.com/bndtools/bnd/blob/4.1.0.REL/biz.aQute.bndlib/src/aQute/bnd/osgi/Clazz.java#L70 and also:
- https://github.com/bndtools/bnd/blob/4.1.0.REL/biz.aQute.bndlib/src/aQute/bnd/osgi/Analyzer.java#L234
- https://github.com/bndtools/bnd/blob/4.1.0.REL/biz.aQute.bndlib/src/aQute/bnd/osgi/Analyzer.java#L3256
And then tools using it e.g. Maven Bundle Plugin is setting too high requirements on Java version, too:
Require-Capability: (...) osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=9))