Merge pull request #27611 from vespa-engine/fail-on-embedded-provided-deps

Fail on embedded provided deps

15 files changed, 359 insertions, 55 deletions

diff --git a/bundle-plugin-test/test-bundles/main/pom.xml b/bundle-plugin-test/test-bundles/main/pom.xml
index 18963343283..21399291442 100644
--- a/bundle-plugin-test/test-bundles/main/pom.xml
+++ b/bundle-plugin-test/test-bundles/main/pom.xml
@@ -35,6 +35,7 @@
         <extensions>true</extensions>
         <configuration>
           <bundleType>INTERNAL</bundleType>
+          <allowEmbeddedArtifacts>javax.xml.bind:jaxb-api:2.3.0</allowEmbeddedArtifacts>
           <Import-Package>
             manualImport.withoutVersion,
             manualImport.withVersion;version="12.3.4",
diff --git a/bundle-plugin/src/main/java/com/yahoo/container/plugin/bundle/AnalyzeBundle.java b/bundle-plugin/src/main/java/com/yahoo/container/plugin/bundle/AnalyzeBundle.java
index 8b32c6c0d0d..df48b56967e 100644
--- a/bundle-plugin/src/main/java/com/yahoo/container/plugin/bundle/AnalyzeBundle.java
+++ b/bundle-plugin/src/main/java/com/yahoo/container/plugin/bundle/AnalyzeBundle.java
@@ -14,6 +14,8 @@ import java.util.List;
 import java.util.Optional;
 import java.util.jar.Manifest;
 
+import static com.yahoo.container.plugin.util.JarFiles.getMainAttributeValue;
+
 /**
  * Static utilities for analyzing jar files.
  *
@@ -80,10 +82,6 @@ public class AnalyzeBundle {
                 .orElseGet(ArrayList::new);
     }
 
-    private static Optional<String> getMainAttributeValue(Manifest manifest, String attributeName) {
-        return Optional.ofNullable(manifest.getMainAttributes().getValue(attributeName));
-    }
-
     private static boolean isOsgiManifest(Manifest mf) {
         return getBundleSymbolicName(mf).isPresent();
     }
diff --git a/bundle-plugin/src/main/java/com/yahoo/container/plugin/mojo/GenerateOsgiManifestMojo.java b/bundle-plugin/src/main/java/com/yahoo/container/plugin/mojo/GenerateOsgiManifestMojo.java
index 261518d13f3..8f588ffa5b0 100644
--- a/bundle-plugin/src/main/java/com/yahoo/container/plugin/mojo/GenerateOsgiManifestMojo.java
+++ b/bundle-plugin/src/main/java/com/yahoo/container/plugin/mojo/GenerateOsgiManifestMojo.java
@@ -8,6 +8,7 @@ import com.yahoo.container.plugin.classanalysis.PackageTally;
 import com.yahoo.container.plugin.osgi.ExportPackages;
 import com.yahoo.container.plugin.osgi.ExportPackages.Export;
 import com.yahoo.container.plugin.osgi.ImportPackages.Import;
+import com.yahoo.container.plugin.util.ArtifactId;
 import com.yahoo.container.plugin.util.Artifacts;
 import org.apache.maven.artifact.Artifact;
 import org.apache.maven.plugin.MojoExecutionException;
@@ -18,6 +19,7 @@ import org.apache.maven.plugins.annotations.ResolutionScope;
 import java.io.File;
 import java.nio.file.Paths;
 import java.util.Collection;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -30,7 +32,10 @@ import static com.yahoo.container.plugin.bundle.AnalyzeBundle.nonPublicApiPackag
 import static com.yahoo.container.plugin.classanalysis.Packages.disallowedImports;
 import static com.yahoo.container.plugin.osgi.ExportPackages.exportsByPackageName;
 import static com.yahoo.container.plugin.osgi.ImportPackages.calculateImports;
+import static com.yahoo.container.plugin.util.Artifacts.VESPA_GROUP_ID;
+import static com.yahoo.container.plugin.util.Artifacts.getVespaArtifact;
 import static com.yahoo.container.plugin.util.Files.allDescendantFiles;
+import static com.yahoo.container.plugin.util.JarFiles.providedArtifactsFromManifest;
 
 
 /**
@@ -46,8 +51,6 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
         USER
     }
 
-    private static final String VESPA_GROUP_ID = "com.yahoo.vespa";
-
     @Parameter
     private String discApplicationClass = null;
 
@@ -75,6 +78,8 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
     private boolean suppressWarningPublicApi;
     @Parameter(defaultValue = "false")
     private boolean suppressWarningOverlappingPackages;
+    @Parameter
+    private List<String> allowEmbeddedArtifacts = List.of();
 
     @Parameter(defaultValue = "false")
     private boolean failOnWarnings;
@@ -89,8 +94,11 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
 
             Artifacts.ArtifactSet artifactSet = Artifacts.getArtifacts(project);
             warnOnUnsupportedArtifacts(artifactSet.getNonJarArtifacts());
+
+            List<Artifact> artifactsToInclude = artifactSet.getJarArtifactsToInclude();
+
             if (! isContainerDiscArtifact(project.getArtifact()))
-                throwIfInternalContainerArtifactsAreIncluded(artifactSet.getJarArtifactsToInclude());
+                throwIfInternalContainerArtifactsAreIncluded(artifactsToInclude);
 
             List<Artifact> providedJarArtifacts = artifactSet.getJarArtifactsProvided();
             List<File> providedJarFiles = providedJarArtifacts.stream().map(Artifact::getFile).toList();
@@ -104,26 +112,27 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
             PackageTally projectPackages = getProjectClassesTally();
 
             // Packages defined in compile scoped jars
-            PackageTally compileJarsPackages = definedPackages(artifactSet.getJarArtifactsToInclude());
+            PackageTally compileJarsPackages = definedPackages(artifactsToInclude);
 
             // The union of packages in the project and compile scoped jars
             PackageTally includedPackages = projectPackages.combine(compileJarsPackages);
 
             logDebugPackageSets(exportedPackagesFromProvidedJars, includedPackages);
 
-            Optional<Artifact> jdiscCore = providedJarArtifacts.stream()
-                    .filter(artifact -> artifact.getArtifactId().equals("jdisc_core"))
-                    .findAny();
-
-            if (jdiscCore.isPresent()) {
-                // jdisc_core being provided guarantees that log output does not contain its exported packages
+            Optional<Artifact> jdisc_core = getVespaArtifact("jdisc_core", providedJarArtifacts);
+            Optional<Artifact> wantedProvidedArtifact = getVespaArtifact(wantedProvidedDependency(), providedJarArtifacts);
+            if (wantedProvidedArtifact.isPresent()) {
+                // Having our wanted artifact as provided guarantees that log output does not contain its exported packages
                 logMissingPackages(exportedPackagesFromProvidedDeps, projectPackages, compileJarsPackages, includedPackages);
-            } else if (! suppressWarningMissingImportPackages) {
+
+                logProvidedArtifactsIncluded(artifactsToInclude, providedArtifactsFromManifest(wantedProvidedArtifact.get().getFile()));
+            } else if (! suppressWarningMissingImportPackages && jdisc_core.isEmpty()) {
+                // TODO: Remove jdisc_core clause above and instead add suppressWarning to necessary vespa modules.
                 warnOrThrow(("This project does not have '%s' as provided dependency, so the generated 'Import-Package' " +
                         "OSGi header may be missing important packages.").formatted(wantedProvidedDependency()));
             }
+
             logOverlappingPackages(projectPackages, exportedPackagesFromProvidedDeps);
-            logUnnecessaryPackages(compileJarsPackages, exportedPackagesFromProvidedDeps);
 
             Map<String, Import> calculatedImports = calculateImports(includedPackages.referencedPackages(),
                                                                      includedPackages.definedPackages(),
@@ -132,10 +141,10 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
             List<String> nonPublicApiUsed = disallowedImports(calculatedImports, nonPublicApiPackagesFromProvidedJars);
             logNonPublicApiUsage(nonPublicApiUsed);
 
-            Map<String, String> manifestContent = generateManifestContent(artifactSet.getJarArtifactsToInclude(), calculatedImports, includedPackages);
+            Map<String, String> manifestContent = generateManifestContent(artifactsToInclude, calculatedImports, includedPackages);
             addAdditionalManifestProperties(manifestContent);
-            addManifestPropertiesForInternalBundles(manifestContent, includedPackages);
-            addManifestPropertiesForUserBundles(manifestContent, jdiscCore, nonPublicApiUsed);
+            addManifestPropertiesForInternalAndCoreBundles(manifestContent, includedPackages, providedJarArtifacts);
+            addManifestPropertiesForUserBundles(manifestContent, providedJarArtifacts, nonPublicApiUsed);
 
             createManifestFile(Paths.get(project.getBuild().getOutputDirectory()), manifestContent);
         } catch (Exception e) {
@@ -151,11 +160,6 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
         };
     }
 
-    private BundleType effectiveBundleType() {
-        if (bundleType != BundleType.USER) return bundleType;
-        return isVespaInternalGroupId(project.getGroupId()) ? BundleType.INTERNAL : BundleType.USER;
-    }
-
     private void addAdditionalManifestProperties(Map<String, String> manifestContent) {
         addIfNotEmpty(manifestContent, "Bundle-Activator", bundleActivator);
         addIfNotEmpty(manifestContent, "X-JDisc-Privileged-Activator", jdiscPrivilegedActivator);
@@ -165,7 +169,9 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
         addIfNotEmpty(manifestContent, "WebInfUrl", webInfUrl);
     }
 
-    private void addManifestPropertiesForInternalBundles(Map<String, String> manifestContent, PackageTally includedPackages) {
+    private void addManifestPropertiesForInternalAndCoreBundles(Map<String, String> manifestContent,
+                                                                PackageTally includedPackages,
+                                                                List<Artifact> providedJarArtifacts) {
         if (effectiveBundleType() == BundleType.USER) return;
 
         // TODO: this attribute is not necessary, remove?
@@ -175,11 +181,12 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
     }
 
     private void addManifestPropertiesForUserBundles(Map<String, String> manifestContent,
-                                                     Optional<Artifact> jdiscCore,
+                                                     List<Artifact> providedArtifacts,
                                                      List<String> nonPublicApiUsed) {
         if (effectiveBundleType() != BundleType.USER) return;
 
-        jdiscCore.ifPresent(
+        Optional<Artifact> jdisc_core = getVespaArtifact("jdisc_core", providedArtifacts);
+        jdisc_core.ifPresent(
                 artifact -> addIfNotEmpty(manifestContent, "X-JDisc-Vespa-Build-Version", artifact.getVersion()));
         addIfNotEmpty(manifestContent, "X-JDisc-Non-PublicApi-Import-Package", String.join(",", nonPublicApiUsed));
     }
@@ -237,19 +244,45 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
         }
     }
 
-    /*
-     * This mostly detects packages re-exported via composite bundles like jdisc_core and container-disc.
-     * An artifact can only be represented once, either in compile or provided scope. So if the project
-     * adds an artifact in compile scope that we deploy as a pre-installed bundle, we won't see the same
-     * artifact as provided via container-dev and hence can't detect the duplicate packages.
-     */
-    private void logUnnecessaryPackages(PackageTally compileJarsPackages,
-                                        Set<String> exportedPackagesFromProvidedDeps) {
-        Set<String> unnecessaryPackages = Sets.intersection(compileJarsPackages.definedPackages(), exportedPackagesFromProvidedDeps);
-        if (! unnecessaryPackages.isEmpty()) {
-            getLog().info("Compile scoped jars contain the following packages that are most likely " +
-                                  "available from jdisc runtime: " + unnecessaryPackages);
+    private void logProvidedArtifactsIncluded(List<Artifact> includedArtifacts,
+                                              List<ArtifactId> providedArtifacts) throws MojoExecutionException {
+        if (effectiveBundleType() == BundleType.CORE) return;
+
+        Set<ArtifactId> included = includedArtifacts.stream().map(ArtifactId::fromArtifact).collect(Collectors.toSet());
+        getLog().debug("Included  artifacts: " + included);
+        getLog().debug("Provided  artifacts: " + providedArtifacts);
+
+        Set<ArtifactId> includedProvided = Sets.intersection(included, new HashSet<>(providedArtifacts));
+        getLog().debug("Included provided artifacts: " + includedProvided);
+        HashSet<ArtifactId> allowed = getAllowedEmbeddedArtifacts(includedProvided);
+
+        List<String> violations = includedProvided.stream()
+                .filter(a -> ! allowed.contains(a))
+                .map(ArtifactId::stringValue)
+                .sorted().toList();
+
+        if (! violations.isEmpty()) {
+            warnOrThrow("Artifacts provided from Jdisc runtime are included in compile scope: " + violations
+                                + ". Direct dependencies should be removed."
+                                + " For transitive dependencies, run 'mvn dependency:tree' and add necessary exclusions.");
+        }
+    }
+
+    private HashSet<ArtifactId> getAllowedEmbeddedArtifacts(Set<ArtifactId> providedIncluded) throws MojoExecutionException {
+        if (allowEmbeddedArtifacts.isEmpty()) return new HashSet<>();
+
+        var allowed = new HashSet<ArtifactId>();
+        try {
+            allowEmbeddedArtifacts.stream().map(ArtifactId::fromStringValue).forEach(allowed::add);
+        } catch (Exception e) {
+            throw new MojoExecutionException("In config parameter 'allowEmbeddedArtifacts': " + e.getMessage(), e);
+        }
+        var allowedButUnused = Sets.difference(allowed, providedIncluded);
+        if (! allowedButUnused.isEmpty()) {
+            warnOrThrow("Configuration parameter 'allowEmbeddedArtifacts' contains artifact(s) not used in project: " + allowedButUnused);
         }
+        getLog().info("Ignoring artifacts embedded in bundle: " + allowed);
+        return allowed;
     }
 
     private static String trimWhitespace(Optional<String> lines) {
@@ -276,6 +309,11 @@ public class GenerateOsgiManifestMojo extends AbstractGenerateOsgiManifestMojo {
         }
     }
 
+    private BundleType effectiveBundleType() {
+        if (bundleType != BundleType.USER) return bundleType;
+        return isVespaInternalGroupId(project.getGroupId()) ? BundleType.INTERNAL : BundleType.USER;
+    }
+
     private boolean isVespaInternalGroupId(String groupId) {
         return groupId.equals(VESPA_GROUP_ID)
                 || groupId.equals(VESPA_GROUP_ID + ".hosted")
diff --git a/bundle-plugin/src/main/java/com/yahoo/container/plugin/mojo/GenerateProvidedArtifactManifestMojo.java b/bundle-plugin/src/main/java/com/yahoo/container/plugin/mojo/GenerateProvidedArtifactManifestMojo.java
new file mode 100644
index 00000000000..b4c474fc72d
--- /dev/null
+++ b/bundle-plugin/src/main/java/com/yahoo/container/plugin/mojo/GenerateProvidedArtifactManifestMojo.java
@@ -0,0 +1,112 @@
+package com.yahoo.container.plugin.mojo;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.maven.plugin.AbstractMojo;
+import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
+import org.apache.maven.plugins.annotations.ResolutionScope;
+import org.apache.maven.plugins.shade.DefaultShader;
+import org.apache.maven.plugins.shade.ShadeRequest;
+import org.apache.maven.plugins.shade.relocation.Relocator;
+import org.apache.maven.plugins.shade.resource.ResourceTransformer;
+import org.apache.maven.project.MavenProject;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Set;
+import java.util.jar.Attributes;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
+import java.util.jar.Manifest;
+
+/**
+ * Replaces the Class-Path of a jar file manifest with a list of provided artifacts.
+ * The Class-Path is used because it is trivial to generate with the maven-jar-plugin.
+ *
+ * @author gjoranv
+ */
+@Mojo(name = "generate-provided-artifact-manifest", requiresDependencyResolution = ResolutionScope.COMPILE, threadSafe = true)
+public class GenerateProvidedArtifactManifestMojo extends AbstractMojo {
+
+    public static final String PROVIDED_ARTIFACTS_MANIFEST_ENTRY = "X-JDisc-Provided-Artifact";
+
+    @Parameter(defaultValue = "${project}")
+    public MavenProject project;
+
+    @Parameter(defaultValue = "${project.build.directory}")
+    public File outputDirectory;
+
+
+    @Override
+    public void execute() throws MojoExecutionException {
+        var originalJar = project.getArtifact().getFile();
+        var shadedJar = shadedJarFile();
+
+        var req = new ShadeRequest();
+        req.setJars(Set.of(originalJar));
+        req.setUberJar(shadedJar);
+        req.setResourceTransformers(List.of(new ProvidedArtifactsManifestUpdater()));
+        req.setRelocators(List.of());
+        req.setFilters(List.of());
+
+        try {
+            new DefaultShader().shade(req);
+        } catch (IOException e) {
+            throw new MojoExecutionException(e);
+        }
+        try {
+            getLog().info("Replacing original jar with transformed jar");
+            FileUtils.copyFile(shadedJar, originalJar);
+        } catch (IOException e) {
+            throw new MojoExecutionException(e);
+        }
+    }
+
+    private File shadedJarFile() {
+        var a = project.getArtifact();
+        var name = project.getArtifactId() + "-shaded." + a.getArtifactHandler().getExtension();
+        return new File(outputDirectory, name);
+    }
+
+    private static class ProvidedArtifactsManifestUpdater implements ResourceTransformer {
+
+        private Manifest manifest;
+
+        @Override
+        public boolean canTransformResource(String resource) {
+            return JarFile.MANIFEST_NAME.equalsIgnoreCase(resource);
+        }
+
+        @SuppressWarnings("deprecation")
+        @Override
+        public void processResource(String resource, InputStream is, List<Relocator> relocators) throws IOException {
+            manifest = new Manifest(is);
+            Attributes attributes = manifest.getMainAttributes();
+            var providedArtifacts = attributes.getValue("Class-Path");
+            if (providedArtifacts == null) return;
+
+            attributes.remove(new Attributes.Name("Class-Path"));
+            attributes.putValue(PROVIDED_ARTIFACTS_MANIFEST_ENTRY, providedArtifacts.replace(" ", ","));
+            attributes.putValue("Created-By", "vespa container maven plugin");
+        }
+
+        @Override
+        public boolean hasTransformedResource() {
+            return true;
+        }
+
+        @Override
+        public void modifyOutputStream(JarOutputStream os) throws IOException {
+            if (manifest == null) return;
+
+            JarEntry jarEntry = new JarEntry(JarFile.MANIFEST_NAME);
+            os.putNextEntry(jarEntry);
+            manifest.write(os);
+        }
+    }
+
+}
diff --git a/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/ArtifactId.java b/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/ArtifactId.java
new file mode 100644
index 00000000000..2786a9c559f
--- /dev/null
+++ b/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/ArtifactId.java
@@ -0,0 +1,56 @@
+package com.yahoo.container.plugin.util;
+
+import org.apache.maven.artifact.Artifact;
+
+import java.util.Objects;
+
+/**
+ * Helper class to work with artifacts, where version does not matter.
+ *
+ * @author gjoranv
+ */
+public class ArtifactId {
+
+    private final String groupId;
+    private final String artifactId;
+
+    private ArtifactId(String groupId, String artifactId) {
+        this.groupId = groupId;
+        this.artifactId = artifactId;
+    }
+
+    public static ArtifactId fromArtifact(Artifact artifact) {
+        return new ArtifactId(artifact.getGroupId(), artifact.getArtifactId());
+    }
+
+    public static ArtifactId fromStringValue(String stringValue) {
+        var parts = stringValue.trim().split(":");
+        if (parts.length == 2 || parts.length == 3) {
+            return new ArtifactId(parts[0], parts[1]);
+        }
+        throw new IllegalArgumentException(
+                "An artifact should be represented in the format 'groupId:ArtifactId[:version]', not: " + stringValue);
+    }
+
+    public String stringValue() {
+        return groupId + ":" + artifactId;
+    }
+
+    @Override
+    public String toString() {
+        return stringValue();
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+        ArtifactId that = (ArtifactId) o;
+        return Objects.equals(groupId, that.groupId) && Objects.equals(artifactId, that.artifactId);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(groupId, artifactId);
+    }
+}
diff --git a/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/Artifacts.java b/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/Artifacts.java
index bde0c124229..a62fe4dfcd8 100644
--- a/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/Artifacts.java
+++ b/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/Artifacts.java
@@ -7,12 +7,17 @@ import org.apache.maven.project.MavenProject;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
+import java.util.Optional;
 
 /**
  * @author Tony Vaagenes
  * @author ollivir
  */
 public class Artifacts {
+
+    public static final String VESPA_GROUP_ID = "com.yahoo.vespa";
+
+
     interface ScopeTranslator {
         String scopeOf(Artifact artifact);
     }
@@ -79,4 +84,14 @@ public class Artifacts {
     public static Collection<Artifact> getArtifactsToInclude(MavenProject project) {
         return getArtifacts(project, new NoopScopeTranslator()).getJarArtifactsToInclude();
     }
+
+    public static Optional<Artifact> getVespaArtifact(String artifactId, List<Artifact> availableArtifacts) {
+        for (Artifact artifact : availableArtifacts) {
+            if (artifactId.equals(artifact.getArtifactId()) && VESPA_GROUP_ID.equals(artifact.getGroupId())) {
+                return Optional.of(artifact);
+            }
+        }
+        return Optional.empty();
+    }
+
 }
diff --git a/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/JarFiles.java b/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/JarFiles.java
index 72d2adae13e..3ef58fc87b6 100644
--- a/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/JarFiles.java
+++ b/bundle-plugin/src/main/java/com/yahoo/container/plugin/util/JarFiles.java
@@ -3,17 +3,33 @@ package com.yahoo.container.plugin.util;
 
 import java.io.File;
 import java.io.InputStream;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
 import java.util.Optional;
 import java.util.jar.JarFile;
 import java.util.jar.Manifest;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
+import static com.yahoo.container.plugin.mojo.GenerateProvidedArtifactManifestMojo.PROVIDED_ARTIFACTS_MANIFEST_ENTRY;
+
 /**
  * @author Tony Vaagenes
  * @author ollivir
  */
 public class JarFiles {
+
+    public static List<ArtifactId> providedArtifactsFromManifest(File jarFile) {
+        return getManifest(jarFile).map(mf -> getMainAttributeValue(mf, PROVIDED_ARTIFACTS_MANIFEST_ENTRY)
+                        .map(s -> Arrays.stream(s.split(","))
+                                .map(ArtifactId::fromStringValue)
+                                .toList())
+                        .orElse(Collections.emptyList()))
+                .orElse(Collections.emptyList());
+
+    }
+
     public static <T> T withJarFile(File file, ThrowingFunction<JarFile, T> action) {
         try (JarFile jar = new JarFile(file)) {
             return action.apply(jar);
@@ -30,6 +46,10 @@ public class JarFiles {
         }
     }
 
+    public static Optional<String> getMainAttributeValue(Manifest manifest, String attributeName) {
+        return Optional.ofNullable(manifest.getMainAttributes().getValue(attributeName));
+    }
+
     public static Optional<Manifest> getManifest(File jarFile) {
         return withJarFile(jarFile, jar -> Optional.ofNullable(jar.getManifest()));
     }
diff --git a/cloud-tenant-cd/pom.xml b/cloud-tenant-cd/pom.xml
index baccbab54f5..0574177dd7a 100644
--- a/cloud-tenant-cd/pom.xml
+++ b/cloud-tenant-cd/pom.xml
@@ -83,6 +83,8 @@
                 <artifactId>bundle-plugin</artifactId>
                 <extensions>true</extensions>
                 <configuration>
+                    <allowEmbeddedArtifacts>com.fasterxml.jackson.core:jackson-core, com.yahoo.vespa:annotations,
+                        org.bouncycastle:bcpkix-jdk18on, org.bouncycastle:bcprov-jdk18on, org.bouncycastle:bcutil-jdk18on</allowEmbeddedArtifacts>
                     <useCommonAssemblyIds>true</useCommonAssemblyIds>
                 </configuration>
             </plugin>
@@ -92,4 +94,4 @@
             </plugin>
         </plugins>
     </build>
-</project>
\ No newline at end of file
+</project>
diff --git a/config-model/pom.xml b/config-model/pom.xml
index a634a40c93b..afb5a7f49c0 100644
--- a/config-model/pom.xml
+++ b/config-model/pom.xml
@@ -300,6 +300,11 @@
         <groupId>com.yahoo.vespa</groupId>
         <artifactId>bundle-plugin</artifactId>
         <extensions>true</extensions>
+        <configuration>
+          <allowEmbeddedArtifacts>com.fasterxml.jackson.core:jackson-annotations, com.fasterxml.jackson.core:jackson-core,
+            com.fasterxml.jackson.core:jackson-databind, com.yahoo.vespa:metrics, com.yahoo.vespa:predicate-search-core,
+            com.yahoo.vespa:searchcore</allowEmbeddedArtifacts>
+        </configuration>
       </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
diff --git a/configserver/pom.xml b/configserver/pom.xml
index 5bd155c797b..5b130969ae4 100644
--- a/configserver/pom.xml
+++ b/configserver/pom.xml
@@ -296,6 +296,8 @@
           <!-- TODO: Vespa > 8: remove importPackage when the jackson-jaxrs-json-provider bundle is no longer installed in jdisc -->
           <!--   added to ensure using the same class as orchestrator, core-dump-reporter, provision-controller and controller-clients -->
           <importPackage>com.fasterxml.jackson.jaxrs.json;version="[2.12.6,3)"</importPackage>
+          <allowEmbeddedArtifacts>com.fasterxml.jackson.core:jackson-annotations, com.fasterxml.jackson.core:jackson-core,
+            com.yahoo.vespa:airlift-zstd</allowEmbeddedArtifacts>
         </configuration>
       </plugin>
       <plugin>
diff --git a/container-dev/pom.xml b/container-dev/pom.xml
index 7d5deba4392..ef6ce1529ee 100644
--- a/container-dev/pom.xml
+++ b/container-dev/pom.xml
@@ -281,4 +281,35 @@
     </dependency>
     <!-- DO NOT add dependencies here, but above the NOTE! -->
   </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-jar-plugin</artifactId>
+        <configuration>
+          <archive>
+            <manifest>
+              <addClasspath>true</addClasspath>
+              <classpathLayoutType>custom</classpathLayoutType>
+              <customClasspathLayout>$${artifact.groupId}:$${artifact.artifactId}:$${artifact.version}</customClasspathLayout>
+            </manifest>
+          </archive>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>com.yahoo.vespa</groupId>
+        <artifactId>bundle-plugin</artifactId>
+        <executions>
+          <execution>
+            <phase>package</phase>
+            <goals>
+              <goal>generate-provided-artifact-manifest</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+
 </project>
diff --git a/container/pom.xml b/container/pom.xml
index fa81ba333e1..3d4fab05091 100644
--- a/container/pom.xml
+++ b/container/pom.xml
@@ -64,4 +64,35 @@
       </exclusions>
     </dependency>
   </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-jar-plugin</artifactId>
+        <configuration>
+          <archive>
+            <manifest>
+              <addClasspath>true</addClasspath>
+              <classpathLayoutType>custom</classpathLayoutType>
+              <customClasspathLayout>$${artifact.groupId}:$${artifact.artifactId}:$${artifact.version}</customClasspathLayout>
+            </manifest>
+          </archive>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>com.yahoo.vespa</groupId>
+        <artifactId>bundle-plugin</artifactId>
+        <executions>
+          <execution>
+            <phase>package</phase>
+            <goals>
+              <goal>generate-provided-artifact-manifest</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+
 </project>
diff --git a/jdisc-cloud-aws/pom.xml b/jdisc-cloud-aws/pom.xml
index 5ae3e056309..66b75bb6407 100644
--- a/jdisc-cloud-aws/pom.xml
+++ b/jdisc-cloud-aws/pom.xml
@@ -19,7 +19,7 @@
     <dependencies>
         <dependency>
             <groupId>com.yahoo.vespa</groupId>
-            <artifactId>container-disc</artifactId>
+            <artifactId>container-dev</artifactId>
             <version>${project.version}</version>
             <scope>provided</scope>
         </dependency>
@@ -47,18 +47,6 @@
             <groupId>com.amazonaws</groupId>
             <artifactId>aws-java-sdk-ssm</artifactId>
         </dependency>
-        <dependency>
-            <groupId>com.yahoo.vespa</groupId>
-            <artifactId>jdisc_core</artifactId>
-            <version>${project.version}</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>com.yahoo.vespa</groupId>
-            <artifactId>component</artifactId>
-            <version>${project.version}</version>
-            <scope>provided</scope>
-        </dependency>
     </dependencies>
 
     <build>
@@ -71,6 +59,10 @@
                 <groupId>com.yahoo.vespa</groupId>
                 <artifactId>bundle-plugin</artifactId>
                 <extensions>true</extensions>
+                <configuration>
+                    <allowEmbeddedArtifacts>com.fasterxml.jackson.core:jackson-annotations, com.fasterxml.jackson.core:jackson-core,
+                        com.fasterxml.jackson.core:jackson-databind, commons-logging:commons-logging</allowEmbeddedArtifacts>
+                </configuration>
             </plugin>
         </plugins>
     </build>
diff --git a/tenant-cd-api/pom.xml b/tenant-cd-api/pom.xml
index f6c0b662c97..5c1199d34f9 100644
--- a/tenant-cd-api/pom.xml
+++ b/tenant-cd-api/pom.xml
@@ -7,8 +7,7 @@
 
     <groupId>com.yahoo.vespa</groupId>
     <artifactId>tenant-cd-api</artifactId>
-    <name>Hosted Vespa tenant CD API</name>
-    <description>Test API library for hosted Vespa applications.</description>
+    <description>Hosted Vespa tenant CD API, test API library for hosted Vespa applications.</description>
     <url>https://github.com/vespa-engine</url>
     <packaging>container-plugin</packaging>
 
diff --git a/zkfacade/pom.xml b/zkfacade/pom.xml
index dd890fef3a8..6ad514c5307 100644
--- a/zkfacade/pom.xml
+++ b/zkfacade/pom.xml
@@ -126,6 +126,8 @@
         <extensions>true</extensions>
         <configuration>
           <importPackage>com.sun.management</importPackage>
+          <allowEmbeddedArtifacts>com.google.errorprone:error_prone_annotations, com.google.guava:failureaccess,
+            com.google.guava:guava, com.google.j2objc:j2objc-annotations</allowEmbeddedArtifacts>
         </configuration>
       </plugin>
       <plugin>