HBASE-28921 Avoid bundling hbase-webapps folder in default jars #6388
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are copying it to hbase-server tests.
NihalJain
commented
Oct 23, 2024
pom.xml
Outdated
| @@ -803,9 +803,9 @@ | |||
| <!-- override on command line to have generated LICENSE files include | |||
| diagnostic info for verifying notice requirements --> | |||
| <license.debug.print.included>false</license.debug.print.included> | |||
| <!-- When a particular module bundles its depenendencies, should be true --> | |||
| <!-- When a particular module bundles its dependencies, should be true --> | |||
There was a problem hiding this comment.
dummy change to trigger all tests
|
Built hbase locally, untarred and started master, rest and thrift server.
CC: @stoty |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
stoty
reviewed
Oct 24, 2024
This comment has been minimized.
This comment has been minimized.
NihalJain
force-pushed
the
HBASE-28921_v2
branch
from
68ea60a to
57942b6
Compare
|
Please ignore commit 552c419, will revert before merge. This is to force UTs for all modules |
NihalJain
commented
Oct 24, 2024
hbase-annotations/pom.xml
Outdated
| @@ -54,3 +54,4 @@ | |||
| </plugins> | |||
| </build> | |||
| </project> | |||
|
|
|||
There was a problem hiding this comment.
should revert at all places
There was a problem hiding this comment.
Why bunch of this new line change?
There was a problem hiding this comment.
i wanted to trigger all tests for this PR, so modified all files to add a dummy whitespace to each pom. Have reverted since build is GREEN now
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
stoty
reviewed
Oct 25, 2024
stoty
approved these changes
Oct 25, 2024
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
NihalJain
force-pushed
the
HBASE-28921_v2
branch
from
552c419 to
bc8ef80
Compare
NihalJain
force-pushed
the
HBASE-28921_v2
branch
from
bc8ef80 to
434a3ed
Compare
|
🎊 +1 overall
This message was automatically generated. |
|
🎊 +1 overall
This message was automatically generated. |
|
Will wait till EOD to see if any more reviews and then finally merge, in case no more comments here |
NihalJain
added a commit
to NihalJain/hbase
that referenced
this pull request
Nov 4, 2024
…he#6388) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain
added a commit
to NihalJain/hbase
that referenced
this pull request
Nov 4, 2024
…he#6388) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain
added a commit
to NihalJain/hbase
that referenced
this pull request
Nov 4, 2024
…he#6388) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain
added a commit
to NihalJain/hbase
that referenced
this pull request
Nov 4, 2024
…he#6388) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain
added a commit
that referenced
this pull request
Nov 6, 2024
… (#6429) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain
added a commit
that referenced
this pull request
Nov 6, 2024
… (#6430) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain
added a commit
that referenced
this pull request
Nov 6, 2024
… (#6431) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain
added a commit
that referenced
this pull request
Nov 6, 2024
… (#6432) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code.
With this JIRA, we want to avoid bundling static webapp resources in our default jars as these are available during runtime via hbase-webapps directory bundled in our assembly.
But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are copying it to hbase-server tests.