[
https://issues.apache.org/jira/browse/HBASE-30489?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
wenhao updated HBASE-30489:
---------------------------
Affects Version/s: 2.5.11
> hbase-assembly should exclude unshaded Jetty pulled in transitively by Hadoop
> -----------------------------------------------------------------------------
>
> Key: HBASE-30489
> URL: https://issues.apache.org/jira/browse/HBASE-30489
> Project: HBase
> Issue Type: Bug
> Components: build
> Affects Versions: 2.4.17, 2.5.11
> Reporter: wenhao
> Priority: Minor
>
> h2. Problem
> The HBase binary distribution built with the Hadoop 3 profile ships unshaded
> Jetty
> jars (org.eclipse.jetty:jetty-*, 9.4.x) in lib/. HBase does not use them: all
> of
> HBase's web UIs are served by hbase-shaded-jetty from hbase-thirdparty, whose
> classes
> are relocated to org.apache.hbase.thirdparty.org.eclipse.jetty. The build
> already
> enforces this - the root pom.xml has a "banned-jetty" enforcer rule for
> org.eclipse.jetty:** dependencies and a forbidden-apis rule for
> org.eclipse.jetty.**
> imports.
> The same problem exists in the Hadoop 2 profile, where the leaked artifacts
> are
> org.mortbay.jetty:jetty, jetty-util and jetty-sslengine 6.1.26 (Jetty 6, EOL).
> h2. Environment
> - HBase: rel/2.4.17 (also reproducible on current branch-2)
> - Hadoop: 3.1.1 / 3.2.0 / 3.4.1 (built with -Dhadoop.profile=3.0), and 2.10.0
> (default profile)
> - JDK 8 / JDK 11, Maven 3.8.x
> h2. Steps to reproduce
> # 1. build a binary tarball against Hadoop 3
> mvn clean install -DskipTests -Dhadoop.profile=3.0
> mvn -pl hbase-assembly -Pdist package
> # 2. list the packaged Jetty jars
> tar -tzf hbase-assembly/target/hbase-*-bin.tar.gz | grep -i jetty
> Alternatively, inspect the dependency tree of any module that depends on
> hadoop-common
> without excluding Jetty (e.g. hbase-server):
> h2. Expected behavior
> The binary tarball only contains the shaded Jetty that HBase actually uses
> (org.apache.hbase.thirdparty:hbase-shaded-jetty); no unshaded Jetty jars are
> packaged, and HBase modules do not expose unshaded Jetty as a transitive
> dependency.
> h2. Actual behavior
> hbase-assembly copies the unshaded Jetty jars that Hadoop declares as
> compile-scope
> dependencies into lib/:
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
