[
https://issues.apache.org/jira/browse/SOLR-14915?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17213888#comment-17213888
]
David Smiley commented on SOLR-14915:
-------------------------------------
Thanks for doing some build experimentation to show me your proposal. I do not
think that the Solr distribution should be bloated by duplicated dependencies
of SolrJ, which are quite some number of megabytes. Duplication of the other
libs seems more manageable (e.g. logging libs + Caffeine). I think I prefer
that SolrJ libs be externally referenced, but the rest be local to the lib
directory of this contrib. I also think this contrib ought to have its own
log4j2.xml. I think I could use your proposal as a guide on how I could
accomplish this... though I don't plan to get to this until next week.
> Prometheus-exporter should not depend on Solr-core
> --------------------------------------------------
>
> Key: SOLR-14915
> URL: https://issues.apache.org/jira/browse/SOLR-14915
> Project: Solr
> Issue Type: Improvement
> Components: contrib - prometheus-exporter
> Reporter: David Smiley
> Assignee: David Smiley
> Priority: Minor
> Attachments: patch.patch
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> I think it's *crazy* that our Prometheus exporter depends on Solr-core --
> this thing is a _client_ of Solr; it does not live within Solr. The exporter
> ought to be fairly lean. One consequence of this dependency is that, for
> example, security vulnerabilities reported against Solr (e.g. Jetty) can (and
> do, where I work) wind up being reported against this module even though
> Prometheus isn't using Jetty.
> From my evaluation today of what's going on, it appears the crux of the
> problem is that the prometheus exporter uses some utility mechanisms in
> Solr-core like XmlConfig (which depends on SolrResourceLoader and the rabbit
> hole goes deeper...) and DOMUtils (further depends on PropertiesUtil). It
> can easy be made to not use XmlConfig. DOMUtils & PropertiesUtil could move
> to SolrJ which already has lots of little dependency-free utilities needed by
> SolrJ and Solr-core alike.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
