There have been several Jakarta EE specifications that have migrated from our forks to use the standard spec API JAR's. While this is ideal, in some cases we may still need to fork. One of the common issues is most specifications use the ServiceLoader to find the implementation. Maybe of these do no happen in a privileged action which results in having to give too many permissions when running with the security manager enabled. The most common for tests is adding a file permission with <<ALL FILES>> so the implementation JAR can be read.

An example of this can be seen in https://github.com/wildfly/wildfly/pull/15819. Specifically the commit https://github.com/wildfly/wildfly/pull/15819/commits/f4ef8d65ab2670542570ee0f9117e9578c5fd2ae. This required new FilePermission("<<ALL FILES>>", "read"), to be added for the Jakarta Activation implementation to be found. We may end up needing to fork this specification and add some privileged actions in the jakarta.activation.FactoryFinder. However, this needs to be looked in detail.