{"action":"created","issue":{"url":"https://api.github.com/repos/policeman-tools/forbidden-apis/issues/103","repository_url":"https://api.github.com/repos/policeman-tools/forbidden-apis","labels_url":"https://api.github.com/repos/policeman-tools/forbidden-apis/issues/103/labels{/name}","comments_url":"https://api.github.com/repos/policeman-tools/forbidden-apis/issues/103/comments","events_url":"https://api.github.com/repos/policeman-tools/forbidden-apis/issues/103/events","html_url":"https://github.com/policeman-tools/forbidden-apis/issues/103","id":159596618,"number":103,"title":"com.sun.net.httpserver should not be forbidden","user":{"login":"javanna","id":832460,"avatar_url":"https://avatars.githubusercontent.com/u/832460?v=3","gravatar_id":"","url":"https://api.github.com/users/javanna","html_url":"https://github.com/javanna","followers_url":"https://api.github.com/users/javanna/followers","following_url":"https://api.github.com/users/javanna/following{/other_user}","gists_url":"https://api.github.com/users/javanna/gists{/gist_id}","starred_url":"https://api.github.com/users/javanna/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javanna/subscriptions","organizations_url":"https://api.github.com/users/javanna/orgs","repos_url":"https://api.github.com/users/javanna/repos","events_url":"https://api.github.com/users/javanna/events{/privacy}","received_events_url":"https://api.github.com/users/javanna/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-06-10T09:36:49Z","updated_at":"2016-06-10T09:54:52Z","closed_at":null,"body":"In some elasticsearch integration tests we want to start an http server to send requests to. The easiest is to use `com.sun.net.httpserver.HttpServer` but it turns out that the jdk-non-portable bundled signature forbids its usage based on heuristic checks. We are discussing this with Simon and it seems like it should not be forbidden, the `HttpServer` class is also annotated [@Exported](https://docs.oracle.com/javase/8/docs/jdk/api/javac/tree/jdk/Exported.html) which seems ok. Would it be possible to ignore that whole package as part as the jdk-non-portable checks or should this really be forbidden?\r\n\r\nHere is the related discussion on the elasticsearch project: https://github.com/elastic/elasticsearch/pull/18735#discussion_r66576472 ."},"comment":{"url":"https://api.github.com/repos/policeman-tools/forbidden-apis/issues/comments/225142287","html_url":"https://github.com/policeman-tools/forbidden-apis/issues/103#issuecomment-225142287","issue_url":"https://api.github.com/repos/policeman-tools/forbidden-apis/issues/103","id":225142287,"user":{"login":"uschindler","id":1005388,"avatar_url":"https://avatars.githubusercontent.com/u/1005388?v=3","gravatar_id":"","url":"https://api.github.com/users/uschindler","html_url":"https://github.com/uschindler","followers_url":"https://api.github.com/users/uschindler/followers","following_url":"https://api.github.com/users/uschindler/following{/other_user}","gists_url":"https://api.github.com/users/uschindler/gists{/gist_id}","starred_url":"https://api.github.com/users/uschindler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/uschindler/subscriptions","organizations_url":"https://api.github.com/users/uschindler/orgs","repos_url":"https://api.github.com/users/uschindler/repos","events_url":"https://api.github.com/users/uschindler/events{/privacy}","received_events_url":"https://api.github.com/users/uschindler/received_events","type":"User","site_admin":false},"created_at":"2016-06-10T09:54:52Z","updated_at":"2016-06-10T09:54:52Z","body":"This is not an issue, as the following: The Webserver classes are \"non portable\". They are exported by the Oracle JDK, but they are still not part of any Java standard. So non-Oracle JDKs may not have it (e.g., IBM J9). This is similar to the HotspotMXBean, because Hotspot is Oracle/OpenJDK and not part of Java standard.\r\n\r\nThis issue cannot be fixed, as the algorithm cannot \"exclude\" somehow com.sun.net.httpserver. `jdk-non-portable` is not a signatures file, the checks are done algorithmically: Every class that is not part of the Java Standard's packages (this does not include com.sun.net.httpserver)  and is part of the runtime (comes from rt.jar or is part of \"java.*\" or \"jdk.*\" modules) if forbidden.\r\n\r\nIf you just want to forbid stuff that breaks with Java 9 by Oracle, you can use another bundled signatures: \"jdk-internal\". This signatures file is based on the packages that Oracle officially blacklists."}}
{"actor":{"display_login":"uschindler"}}