Apache Abdera needs to be replaced (as project was retired in 2017)

[tdonohue]

Recently, the DSpace project noticed that this old JavaServer2.0 library seems to be incompatible with Apache Solr 8.10.0 or above, because of the reliance on the retired Apache Abdera project.

The incompatibility with Solr 8.10.0 or above occurs via the Apache Axiom project. Here's a summary of what we found (documented further in DSpace/DSpace#8188)

JavaServer2.0 depends on Apache Abdera, retired in 2017

• As a temporary replacement, the Apache Axiom project had a FOM implementation (fom-impl) which was backwards compatible with Apache Adbera. DSpace took advantage of that, to continue to use JavaServer2.0 even after Abdera no longer worked for us.
• Apache Axiom has removed fom-impl (see apache/ws-axiom@5df98f4) and it no longer exists in Apache Axiom version 1.3.0 (or above), and Apache Axiom 1.3.0 doesn't work with the old fom-impl (I tested this and it resulted in a number of errors)
• SUMMARY: This means that JavaServer2.0 is only compatible with Apache Axiom version 1.2.22 (released in 2019).

In Solr version 8.10.0, the solr-cell client library now requires Woodstox (woodstox-core) version 6.

• Woodstox version 6 is incompatible with Apache Axiom version 1.2.22. It requires Apache Axiom version 1.3.0.
  • While it can compile with Axiom v1.2.22, our experience was that you would immediately hit DTD parsing errors, like documented here: https://stackoverflow.com/questions/68214287/dtd-parsing-with-axiom
  • In Apache Axiom version 1.3.0, Axiom added support for Woodstox version 6, fixing that DTD parsing error.
• SUMMARY: This means that projects that use solr-cell 8.10.0 (or above) are only compatible with Apache Axiom version 1.3.0 (or above). They won't work with Apache Axiom version 1.2.22

Overall, in our experience, this JavaServer2.0 library is quickly becoming obsolete. It won't function much longer with any platform that also uses the most recent Solr. It's also highly likely that similar incompatibilities will arise with other current Java libraries (Solr might just be the tip of the iceberg).

The only known solutions that we have come up with is one of the following:

• (Temporary fix) Stay on compatible libraries as much as possible. This means pinning to Solr 8.9.0 (or below), if you depend on solr-cell
• (Long term fix) Rewrite the JavaServer2.0 library to no longer depend on Apache Abdera. This looks like it would require rewriting many key classes to use a different Atom Java library (perhaps Rome?)

At this time the DSpace team is discussing our own directions. But, if there's anyone else out there who is interested in helping to rewrite the JavaServer2.0 library or already has started, we'd be interested in talking to you about that.

[tdonohue]

MAJOR UPDATE: After some more detailed analysis, I've discovered that the incompatibilities issues that DSpace was experiencing were the result of 3 dependencies:

• Apache Solr 8.10.0 or above (which uses Woodstox v6)
• Apache Axiom
• This JavaServer2.0 library

If Apache Axiom is removed from the picture, it's possible to run Apache Solr 8.10.0 (or above) alongside JavaServer2.0. However, if your codebase relies also on Apache Axiom, then it doesn't seem possible to run Apache Solr 8.10.0 + Apache Axiom + JavaServer 2.0 (for the reasons described above).

For DSpace's purposes, we've been able to work around this major incompatibility by removing Apache Axiom from our main API (by replacing Axiom with JDOM2).

However, the core issue in this ticket still exists. JavaServer2.0 depends heavily on Apache Abdera, which is retired. This is a major issue for this JavaServer2.0 library going forward, as it's likely to result in future dependency conflicts or undisclosed/undiscovered security vulnerabilities.

So, again, if there's anyone else out there who is interested in helping to rewrite the JavaServer2.0 library or already has started, we'd be interested in talking to you about that.