Skip to content

HBASE-28943 Remove all jackson 1.x dependencies for hadoop-3 profile, since all jackson 1.x versions have vulnerabilities #6413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 4, 2024
Merged

HBASE-28943 Remove all jackson 1.x dependencies for hadoop-3 profile, since all jackson 1.x versions have vulnerabilities #6413

merged 1 commit into from
Nov 4, 2024

Conversation

NihalJain
Copy link
Contributor

@NihalJain
HBASE-28943 Remove all jackson 1.x dependencies for hadoop-3 profile,…
3bc41da 
… since all jackson 1.x versions have vulnerabilities (apache#6405)

- Building hbase with hadoop-3 profile on branch-2, still requires jackson 1.x jars, which has vulnerabilities. Ideally these should not be needed as with HADOOP-13332 hadoop has already "Remove jackson 1.9.13 and switch all jackson code to 2.x code line" for branch-3.
- Also in HBASE-27148, where we worked on "Move minimum hadoop 3 support version to 3.2.3", where we had done a similar cleanup for branch-3; but somehow we missed to port the relevant changes to the branch-2 backport of same jira. This task is to take care of this so that we do not need jackson 1.x to build/run hbase with hadoop-3 profile on branch-2.x.

Signed-off-by: Duo Zhang <zhangduo@apache.org>
Signed-off-by: Nick Dimiduk <ndimiduk@apache.org>
(cherry picked from commit 41621f0)
@NihalJain NihalJain added the backport This PR is a back port of some issue or issues already committed to master label Oct 30, 2024
@NihalJain
Copy link
Contributor Author

NihalJain commented Oct 30, 2024 •
edited
Loading

Verified that with this PR dependency:tree does not have jackson 1.x for hadoop-3 profile:

hbase %  grep  1.9.13  tree_with_HBASE-28943_branch-2.6.txt
hbase %

@Apache-HBase

This comment has been minimized.

Sign in to view
@Apache-HBase

This comment has been minimized.

Sign in to view
@Apache-HBase

This comment has been minimized.

Sign in to view
@Apache-HBase

This comment has been minimized.

Sign in to view
@Apache-HBase
Copy link

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 46s Docker mode activated.
-0 ⚠️ yetus 0m 4s Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --author-ignore-list --blanks-eol-ignore-file --blanks-tabs-ignore-file --quick-hadoopcheck
_ Prechecks _
_ branch-2.6 Compile Tests _
+0 🆗 mvndep 0m 12s Maven dependency ordering for branch
+1 💚 mvninstall 2m 20s branch-2.6 passed
+1 💚 compile 0m 45s branch-2.6 passed
+1 💚 javadoc 0m 36s branch-2.6 passed
+1 💚 shadedjars 5m 13s branch has no errors when building our shaded downstream artifacts.
_ Patch Compile Tests _
+0 🆗 mvndep 0m 13s Maven dependency ordering for patch
+1 💚 mvninstall 2m 26s the patch passed
+1 💚 compile 0m 45s the patch passed
+1 💚 javac 0m 45s the patch passed
+1 💚 javadoc 0m 35s the patch passed
+1 💚 shadedjars 5m 11s patch has no errors when building our shaded downstream artifacts.
_ Other Tests _
+1 💚 unit 0m 11s hbase-shaded-client-byo-hadoop in the patch passed.
+1 💚 unit 0m 12s hbase-shaded-mapreduce in the patch passed.
+1 💚 unit 0m 13s hbase-shaded-testing-util in the patch passed.
+1 💚 unit 0m 59s hbase-shaded-testing-util-tester in the patch passed.
22m 1s
Subsystem Report/Notes
Docker ClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/artifact/yetus-jdk8-hadoop2-check/output/Dockerfile
GITHUB PR #6413
Optional Tests javac javadoc unit shadedjars compile
uname Linux 0e2b5d6457a6 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision branch-2.6 / 3bc41da
Default Java Temurin-1.8.0_412-b08
Test Results https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/testReport/
Max. process+thread count 413 (vs. ulimit of 30000)
modules C: hbase-shaded/hbase-shaded-client-byo-hadoop hbase-shaded/hbase-shaded-mapreduce hbase-shaded/hbase-shaded-testing-util hbase-shaded/hbase-shaded-testing-util-tester U: hbase-shaded
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/console
versions git=2.34.1 maven=3.9.8
Powered by Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase
Copy link

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 44s Docker mode activated.
-0 ⚠️ yetus 0m 5s Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --author-ignore-list --blanks-eol-ignore-file --blanks-tabs-ignore-file --quick-hadoopcheck
_ Prechecks _
_ branch-2.6 Compile Tests _
+0 🆗 mvndep 0m 12s Maven dependency ordering for branch
+1 💚 mvninstall 3m 11s branch-2.6 passed
+1 💚 compile 0m 51s branch-2.6 passed
+1 💚 javadoc 0m 39s branch-2.6 passed
+1 💚 shadedjars 6m 3s branch has no errors when building our shaded downstream artifacts.
_ Patch Compile Tests _
+0 🆗 mvndep 0m 17s Maven dependency ordering for patch
+1 💚 mvninstall 3m 6s the patch passed
+1 💚 compile 0m 52s the patch passed
+1 💚 javac 0m 52s the patch passed
+1 💚 javadoc 0m 39s the patch passed
+1 💚 shadedjars 6m 4s patch has no errors when building our shaded downstream artifacts.
_ Other Tests _
+1 💚 unit 0m 11s hbase-shaded-client-byo-hadoop in the patch passed.
+1 💚 unit 0m 14s hbase-shaded-mapreduce in the patch passed.
+1 💚 unit 0m 16s hbase-shaded-testing-util in the patch passed.
+1 💚 unit 0m 55s hbase-shaded-testing-util-tester in the patch passed.
25m 39s
Subsystem Report/Notes
Docker ClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR #6413
Optional Tests javac javadoc unit shadedjars compile
uname Linux 3f37c82a52bf 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision branch-2.6 / 3bc41da
Default Java Eclipse Adoptium-11.0.23+9
Test Results https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/testReport/
Max. process+thread count 438 (vs. ulimit of 30000)
modules C: hbase-shaded/hbase-shaded-client-byo-hadoop hbase-shaded/hbase-shaded-mapreduce hbase-shaded/hbase-shaded-testing-util hbase-shaded/hbase-shaded-testing-util-tester U: hbase-shaded
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/console
versions git=2.34.1 maven=3.9.8
Powered by Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase
Copy link

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 19s Docker mode activated.
-0 ⚠️ yetus 0m 5s Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --author-ignore-list --blanks-eol-ignore-file --blanks-tabs-ignore-file --quick-hadoopcheck
_ Prechecks _
_ branch-2.6 Compile Tests _
+0 🆗 mvndep 0m 11s Maven dependency ordering for branch
+1 💚 mvninstall 2m 46s branch-2.6 passed
+1 💚 compile 0m 58s branch-2.6 passed
+1 💚 javadoc 0m 44s branch-2.6 passed
+1 💚 shadedjars 5m 18s branch has no errors when building our shaded downstream artifacts.
_ Patch Compile Tests _
+0 🆗 mvndep 0m 15s Maven dependency ordering for patch
+1 💚 mvninstall 3m 2s the patch passed
+1 💚 compile 0m 54s the patch passed
+1 💚 javac 0m 54s the patch passed
+1 💚 javadoc 0m 39s the patch passed
+1 💚 shadedjars 7m 32s patch has no errors when building our shaded downstream artifacts.
_ Other Tests _
+1 💚 unit 0m 16s hbase-shaded-client-byo-hadoop in the patch passed.
+1 💚 unit 0m 21s hbase-shaded-mapreduce in the patch passed.
+1 💚 unit 0m 21s hbase-shaded-testing-util in the patch passed.
+1 💚 unit 0m 44s hbase-shaded-testing-util-tester in the patch passed.
25m 50s
Subsystem Report/Notes
Docker ClientAPI=1.47 ServerAPI=1.47 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/artifact/yetus-jdk17-hadoop3-check/output/Dockerfile
GITHUB PR #6413
Optional Tests javac javadoc unit shadedjars compile
uname Linux 1d30cb3f7bdf 5.4.0-192-generic #212-Ubuntu SMP Fri Jul 5 09:47:39 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision branch-2.6 / 3bc41da
Default Java Eclipse Adoptium-17.0.11+9
Test Results https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/testReport/
Max. process+thread count 434 (vs. ulimit of 30000)
modules C: hbase-shaded/hbase-shaded-client-byo-hadoop hbase-shaded/hbase-shaded-mapreduce hbase-shaded/hbase-shaded-testing-util hbase-shaded/hbase-shaded-testing-util-tester U: hbase-shaded
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/console
versions git=2.34.1 maven=3.9.8
Powered by Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase
Copy link

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 41s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ branch-2.6 Compile Tests _
+0 🆗 mvndep 0m 10s Maven dependency ordering for branch
+1 💚 mvninstall 2m 58s branch-2.6 passed
+1 💚 compile 0m 51s branch-2.6 passed
+1 💚 spotless 0m 44s branch has no errors when running spotless:check.
_ Patch Compile Tests _
+0 🆗 mvndep 0m 14s Maven dependency ordering for patch
+1 💚 mvninstall 2m 42s the patch passed
+1 💚 compile 0m 50s the patch passed
+1 💚 javac 0m 50s the patch passed
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 xmllint 0m 0s No new issues.
+1 💚 hadoopcheck 15m 25s Patch does not cause any errors with Hadoop 2.10.2 or 3.3.6 3.4.0.
+1 💚 spotless 0m 43s patch has no errors when running spotless:check.
_ Other Tests _
+1 💚 asflicense 0m 34s The patch does not generate ASF License warnings.
27m 46s
Subsystem Report/Notes
Docker ClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/artifact/yetus-general-check/output/Dockerfile
GITHUB PR #6413
Optional Tests dupname asflicense javac codespell detsecrets xmllint hadoopcheck spotless compile
uname Linux 733c581b3589 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision branch-2.6 / 3bc41da
Default Java Eclipse Adoptium-11.0.23+9
Max. process+thread count 74 (vs. ulimit of 30000)
modules C: hbase-shaded/hbase-shaded-client-byo-hadoop hbase-shaded/hbase-shaded-mapreduce hbase-shaded/hbase-shaded-testing-util hbase-shaded/hbase-shaded-testing-util-tester U: hbase-shaded
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-6413/2/console
versions git=2.34.1 maven=3.9.8 xmllint=20913
Powered by Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

@NihalJain NihalJain merged commit e1a610b into apache:branch-2.6 Nov 4, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
backport This PR is a back port of some issue or issues already committed to master
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@NihalJain @Apache-HBase