Addon install cannot resolve "com.atlassian.bitbucket.dmz.permission" on Bitbucket 6.6.1

Issue Summary

Issue raised by an app vendor in DEVHELP:

Reproducing is easy.
1. Install the latest Kantega SSO for Bitbucket on Bitbucket 6.6.1 using UPM.
2. Observe stack trace

Our addon fails to install on Bitbucket 6.6.1. It's a transformer-plugin. The exception is:

Caused by: org.osgi.framework.BundleException: Unable to resolve no.kantega.kerberosauth.kerberosauth-plugin.stash [121](R 121.0): missing requirement [no.kantega.kerberosauth.kerberosauth-plugin.stash [121](R 121.0)] osgi.wiring.package; (&(osgi.wiring.package=com.atlassian.bitbucket.dmz.permission)(version>=6.6.1)(version<=6.6.1)) Unresolved requirements: [[no.kantega.kerberosauth.kerberosauth-plugin.stash [121](R 121.0)] osgi.wiring.package; (&(osgi.wiring.package=com.atlassian.bitbucket.dmz.permission)(version>=6.6.1)(version<=6.6.1))]at org.apache.felix.framework.Felix.resolveBundleRevision(Felix.java:4149)... 30 common frames omitted2019-09-05 08:52:26,607 ERROR [spring-startup]  c.a.plugin.manager.PluginEnabler Unable to enable plugin no.kantega.kerberosauth.kerberosauth-plugin.stashcom.atlassian.plugin.osgi.container.OsgiContainerException: Cannot start plugin: no.kantega.kerberosauth.kerberosauth-plugin.stash

This works fine on Bitbucket 6.6.0.

In terms of AMPS config, we have no custom OSGi instructions so the MANIFEST.MF is completely generated during the transformer/install phase. In the transformered(tm) version under /bitbucket/home/plugins/.osgi-cache/transformed-plugins/, I find this, among other things, this:

com.atlassian.bitbucket.dmz.permission;version="[6.6.0,6.6.0]"

Looks good. Works fine.

Now, when deploying on 6.6.1, then in MANIFEST.MF I similarly find a generated statement saying:

com.atlassian.bitbucket.dmz.permission;version="[6.6.1,6.6.1]"

However, this time the package fails to resolve causing the missing requirement message/stack trace above.

Looking at the OSGi browser, the package version 6.6.1 is available and exported by the System bundle, so I don't know why it fails to resolve. It also has resolution optional, so could you advice on why this appears to be working on 6.6.0 and not 6.6.1? This is HIGHLY critical for us as customers on 6.6.1 are already affected and can no longer install the addon. We have yet to find a way around this. By extension, it also means we currently have no way forward on Bitbucket and I'm worried that whichever change triggered this will find its way into newer releases on the rest of the Atlassian portfolio sooner rather than later (I assume the transformer/UPM stuff is all mostly shared libraries).

I've tried adding an OSGi instruction making the package optional and with a wider version range (though I didn't expect either to work - we don't even use this package directly but I assume it's pulled in transitively by us including bitbucket-api and bitbucket-spi). Now, the Import-Package statement actually gets changed to mandatory in the transformed JAR. The version also gets mangled somehow with an asterisk added to the end (not sure if this is significant or not). In any case the resolution fails. Example:

<Import-Package>com.atlassian.bitbucket.dmz.permission;resolution:="optional";version:="[5.0,6.6.2)"*;resolution:="optional"</Import-Package>

This yields a transformed MANIFEST.MF containing:

com.atlassian.bitbucket.dmz.permission;resolution:="mandatory";version:="[5.0,6.6.2)*"

Expected Results

Addon installs and finds package

Actual Results

org.osgi.framework.BundleException missing requirement

Notes

From vendor:

It may also be of interest to you that we had one customer reporting similar problems with some other plugins on 6.6.1 as well (I'm not familiar with any of them):

Customer says:
"Similar behavior is also occurring on MIBEX plugins:

Repository Dashboard for Bitbucket Server
Repository Templates for Bitbucket Server
Sonar for Bitbucket Server"

Workaround

From vendor:

We ended up hastily rewriting the plugin base to spring-scanner-1 over the weekend. This seems to have worked around the problem so this is no longer an issue for us.

The last reproducible version would be Kantega SSO 3.6.3, just in case you want to look into it (3.6.5 onwards is now transformerless).