openHAB (a smart home platform) uses the Smack library in several bindings. After upgrading to version 4.4.0 or later, we ran into issues loading the library in Karaf.
smack-core depends on sun.security.pkcs11. This is a Sun‑specific package that is not supported by all JREs, which limits the range of compatible runtimes. It is generally best practice not to use sun.* packages directly. In addition, OSGi environments like Karaf do not export these packages, which prevents Smack from being used there. Typically, Bouncy Castle is used as an alternative for PKCS#11 functionality.
smack-core depends on hsluv 0.2, whose manifest is missing OSGi headers. We have already opened an issue in their repository (hsluv/hsluv#93) but also wanted to make you aware. If possible, it might make sense to drop or replace this dependency.
That’s only a soft dependency via reflection, isn’t it? Could you elaborate on the issues you are seeing?
As far as I can tell, it’s not smack-core that depends on hsluv, but smack-experimental.
If you don’t use o.j.smackx.colors, then you don’t need the hsluv library in the classpath. Some build systems, like gradle, allow to filter out dependencies in such cases. Maybe that is an option for you? Alternatively, OpenHAB may not require smack-experimental?
From what i understand one should not rely on this package. Searching the smack code, i found only the related part in the PR. Possibly this dependency is added by reflection into the manifest.
When digging into it, i noticed the code is a bad practice and updated it to the suggested code.
Avoid using sun.security.pkcs11 directly. It is an internal JDK package, not part of the official Java API, and may change or be removed in future Java versions. For compatibility and stability, use standard Java security APIs or official PKCS#11 libraries instead.
