Cglib is code generation library. Hibernate uses cglib to generate lazy proxies.

There are some optimizations in this version and better integration with JAVA security. Generated classes have the same protection domain as cglib.jar (have the same signer and code base). It can be usefull if hibernate is used in app server with security
manager or for Web Start applications.

Does this have to be enabled, or is it default? Is this in the version of cglib shipped with the current Hibernate distribution?

it must be posible to replace cglib in the latest hibernate versions without recompiling. Changes are very trivial since RC2.
To "enable" security, just set security manager in code or use standard java system properties and grant permissions for cglib.

policy file used for test is this:

grant codeBase "file:${user.dir}/-"{

permission java.security.AllPermission;

};

It grants all permissions for classes loaded from current directory and all subdirectories. Gglib will use the same protection domain to define generated classes "ReflectUtils.class.getProtectionDomain()". Permissions granted for ReflectUtils are granted for generated code
(and generated code only, callback implementation is not defined by cglib)

It is
possible to add parameter to use alternatyve protection domain if somebody needs it (it can be more "secure").

Juozas, would you please add an issue to JIRA (eg. "upgrade to CGLIB2 final"), and mention anything which might cause a hiccup.

Thanks man.

Ok,
but looks like there are a few hibernate versions/subversions depend on cglib2 RC1, RC2.
hibernate versions dependant on cglib2 beta will not work with cglib final,
RC1 replacement may work, RC2 must work.

I hope community will help to test backward replacement too.

If I declare persistent class mutators to have scope 'protected' then Hibernate reports that the 'reflection optimizer is disabled':

2004-03-01 19:04:56,936 INFO [ReflectHelper:149] reflection optimizer disabled for: com.navis.argo.business.reference.EquipType, BulkBeanException: tried to access method com.navis.argo.business.reference.hbr.EquipTypeHbr.setEqtypRefSet(Ljava/lang/String;)V from class com.navis.argo.business.reference.EquipType$$BulkBeanByCGLIB$$fed996a3 (property setEqtypRefSet)

Cglib optimizer works for public methods only, just ignore this warning.
This optimization is not very meaningfull on jdk 1.4.x it optimizes reflection in the same way as cglib (it is possible to see in stack trace).

Thanks, I created JIRA issue HB-775 suggesting that this warning message be eliminated so other developers will not be similarly unnerved.

Where can i find out more information about CGLIB?