Uh oh!
There was an error while loading. Please reload this page.
HBASE-28921 Avoid bundling hbase-webapps folder in default jars - #6388
Merged
Conversation
We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are copying it to hbase-server tests.
ContributorAuthor
NihalJain
commented
Oct 23, 2024
| diagnostic info for verifying notice requirements --> | ||
| <license.debug.print.included>false</license.debug.print.included> | ||
| <!-- When a particular module bundles its depenendencies, should be true --> | ||
| <!-- When a particular module bundles its dependencies, should be true --> |
ContributorAuthor
There was a problem hiding this comment.
dummy change to trigger all tests
ContributorAuthor
Built hbase locally, untarred and started master, rest and thrift server.
CC: @stoty |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
stoty
reviewed
Oct 24, 2024
Uh oh!
There was an error while loading. Please reload this page.
This comment has been minimized.
This comment has been minimized.
NihalJainforce-pushed
the
HBASE-28921_v2
branch
from
October 24, 2024 18:37
68ea60a to
57942b6CompareNihalJain
commented
Oct 24, 2024
ContributorAuthor
Please ignore commit 552c419, will revert before merge. This is to force UTs for all modules |
NihalJain
commented
Oct 24, 2024
| </plugins> | ||
| </build> | ||
| </project> | ||
ContributorAuthor
There was a problem hiding this comment.
should revert at all places
Contributor
There was a problem hiding this comment.
Why bunch of this new line change?
ContributorAuthor
There was a problem hiding this comment.
i wanted to trigger all tests for this PR, so modified all files to add a dummy whitespace to each pom. Have reverted since build is GREEN now
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
stoty
reviewed
Oct 25, 2024
Uh oh!
There was an error while loading. Please reload this page.
stoty
approved these changes
Oct 25, 2024
stoty
left a comment
Contributor
There was a problem hiding this comment.
+1 LGTM
Pending tests and reverting the spurious whitespace changes.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
NihalJainforce-pushed
the
HBASE-28921_v2
branch
from
October 28, 2024 06:27
552c419 to
bc8ef80CompareNihalJainforce-pushed
the
HBASE-28921_v2
branch
from
October 28, 2024 06:28
bc8ef80 to
434a3edCompareApache-HBase
commented
Oct 28, 2024
🎊 +1 overall
This message was automatically generated. |
Apache-HBase
commented
Oct 28, 2024
🎊 +1 overall
This message was automatically generated. |
NihalJain
commented
Oct 29, 2024
ContributorAuthor
Will wait till EOD to see if any more reviews and then finally merge, in case no more comments here |
NihalJain added a commit
to NihalJain/hbase
that referenced
this pull request
Nov 4, 2024
…he#6388) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain added a commit
to NihalJain/hbase
that referenced
this pull request
Nov 4, 2024
…he#6388) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain added a commit
to NihalJain/hbase
that referenced
this pull request
Nov 4, 2024
…he#6388) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain added a commit
to NihalJain/hbase
that referenced
this pull request
Nov 4, 2024
…he#6388) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain added a commit
that referenced
this pull request
Nov 6, 2024
… (#6429) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain added a commit
that referenced
this pull request
Nov 6, 2024
… (#6430) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain added a commit
that referenced
this pull request
Nov 6, 2024
… (#6431) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
NihalJain added a commit
that referenced
this pull request
Nov 6, 2024
… (#6432) We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code. With this JIRA, we want to avoid bundling static webapp resources in our jars as these are available during runtime via hbase-webapps directory bundled in our assembly. But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are adding hbase-webapps to hbase-server test resources. Signed-off-by: Istvan Toth <stoty@apache.org> (cherry picked from commit 16c51d8)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code.
With this JIRA, we want to avoid bundling static webapp resources in our default jars as these are available during runtime via hbase-webapps directory bundled in our assembly.
But, we still need this for our minicluster based tests which expects it to be present in test classpath. Hence, we are copying hbase-webapps to hbase-server tests jar, which contains class SingleProcessHBaseCluster responsible for hbase minicluster creation. This class eventually needs hbase-webapps in classpath during HttpServer initialisation and hence we are copying it to hbase-server tests.