Re: [picocontainer-dev] ASM dependency in core.

Paul Hammant wrote:

> Y'all turned a blind eye when I put a dependency on ASM in the core :-)

Since it was you, I thought you do not care ;-)
> 
> Although the Parameter name stuff in PicoContainer can leverage post-
> processed classes without ASM, there is a fallback mechanism that
> will use ASM to peer into the debug tables if present on a class.
> 
> I think it would be cool to trim some 15K of classes out of ASM and
> repackage them inside PicoContainer's core Jar.  There are three ways
> to do this - http://tonicsystems.com/products/jarjar/ http://
> vafer.org/blog/tag/minijar and something that Jason and Mauro have
> made born from impatience issues for the previous two.
> 
> The Interesting thing is I'd like to consume the classes from ASM
> (ClassReader another others) into org.picocontainer.injectors.*
> 
> I'd then like to post process the resulting classes making all of the
> former public classes and methods 'package' meaning only our classes
> can use them.  That's org.picocontainer.injectors.IterativeInjector
> and org.picocontainer.injectors.SingleMemberInjector. The Pico jar
> uploaded to the repos would be those classes zipped.
> 
> Rationale?
> 
> Pico is quite locked down in terms of security. We're doing
> AccessController.doPrivileged(..) in multiple places.  It means that
> People could trust Pico to do the right thing then manage rights
> elsewhere in an invocation chain.  I.e. they can consider Pico to be
> as benign as classes in java.*
> 
> If we move the ASM classes there, we should be sure that they can
> only be used by PicoContainer it its normal operation.

+1

> Thoughts?

And we can be sure, that we don't get hit by ASM 4.0, ASM 2.0 and all other
packages that depend transitively on a different version ;-)

- Jörg


---------------------------------------------------------------------
To unsubscribe from this list please visit:

    http://xircles.codehaus.org/manage_email