Description of problem: Update the RPM based on upstream Beryllium
Looks like the old, unsafe commons-collections is still there. The beryllium build log shows 3.1, and should be at least 3.2.2 or 4.1: http://download.englab.bne.redhat.com//brewroot/packages/org.opendaylight.ovsdb-ovsdb/1.2.1.Beryllium_redhat_1/1/data/logs/maven/root.log DEBUG util.py:257: [INFO] Downloading: http://download.devel.redhat.com/brewroot/packages/org.opendaylight.yangtools-yangtools-aggregator/0.8.0.Beryllium_redhat_1/1/maven/commons-collections/commons-collections/3.1/commons-collections-3.1.pom (See flaw: https://bugzilla.redhat.com/show_bug.cgi?id=1279330)
Does commons-collections actually end up in the resulting Karaf distribution? As far as I'm aware the only places commons-collections still turns up is the Checkstyle and Karaf plugins, which are only used during the build or tests. https://git.opendaylight.org/gerrit/35414 removes the dependency from the Karaf plugin.
OK I backported Sthephen's patches and incorporated them into a new build, please try the new version.
The jar needs to be at least 3.2.2: From http://download.englab.bne.redhat.com//brewroot/packages/org.opendaylight.ovsdb-ovsdb/1.2.1.Beryllium_redhat_2/1/data/logs/maven/root.log: Still pulling in 3.2.1. For example: DEBUG util.py:257: [INFO] Downloading: http://download.devel.redhat.com/brewroot/packages/org.opendaylight.netconf-netconf-parent/1.0.0.Beryllium_redhat_2/1/maven/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar (also: brew list-tagged --inherit --latest rhos-8.0-odl-rhel-7-maven-imports | grep commons-collections commons-collections-commons-collections-1.0-1 rhos-8.0-odl-rhel-7-maven-imports mkolesni)
(In reply to Summer Long from comment #5) > The jar needs to be at least 3.2.2: > From > http://download.englab.bne.redhat.com//brewroot/packages/org.opendaylight. > ovsdb-ovsdb/1.2.1.Beryllium_redhat_2/1/data/logs/maven/root.log: > > Still pulling in 3.2.1. For example: > DEBUG util.py:257: [INFO] Downloading: > http://download.devel.redhat.com/brewroot/packages/org.opendaylight.netconf- > netconf-parent/1.0.0.Beryllium_redhat_2/1/maven/commons-collections/commons- > collections/3.2.1/commons-collections-3.2.1.jar > > (also: brew list-tagged --inherit --latest rhos-8.0-odl-rhel-7-maven-imports > | grep commons-collections > commons-collections-commons-collections-1.0-1 > rhos-8.0-odl-rhel-7-maven-imports mkolesni) The commons collections jar is not packaged in the RPM any more.
The doc text for this bug has been incorporated into the formal Technology Preview section, and does not need to be collected from this bug. Changing 'requires_doc_text' to '-'.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-0636.html