TEZ-4458:Upgrade Bouncy Castle to 1.70 due to high CVEs

[mayankkunwar]

No description provided.

[tez-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	32m 20s	Docker mode activated.
		_ Prechecks _
+1 💚	dupname	0m 0s	No case conflicting files found.
+1 💚	@author	0m 0s	The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s	The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
		_ master Compile Tests _
+1 💚	mvninstall	15m 22s	master passed
+1 💚	compile	2m 32s	master passed with JDK Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04
+1 💚	compile	2m 16s	master passed with JDK Private Build-1.8.0_352-8u352-ga-1~20.04-b08
+1 💚	javadoc	2m 45s	master passed with JDK Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04
+1 💚	javadoc	2m 4s	master passed with JDK Private Build-1.8.0_352-8u352-ga-1~20.04-b08
		_ Patch Compile Tests _
+1 💚	mvninstall	4m 1s	the patch passed
+1 💚	compile	2m 36s	the patch passed with JDK Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04
+1 💚	javac	2m 36s	the patch passed
+1 💚	compile	2m 19s	the patch passed with JDK Private Build-1.8.0_352-8u352-ga-1~20.04-b08
+1 💚	javac	2m 19s	the patch passed
+1 💚	whitespace	0m 0s	The patch has no whitespace issues.
+1 💚	xml	0m 1s	The patch has no ill-formed XML file.
+1 💚	javadoc	2m 22s	the patch passed with JDK Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04
+1 💚	javadoc	2m 4s	the patch passed with JDK Private Build-1.8.0_352-8u352-ga-1~20.04-b08
		_ Other Tests _
+1 💚	unit	73m 11s	root in the patch passed.
+1 💚	asflicense	0m 59s	The patch does not generate ASF License warnings.
		146m 10s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-253/2/artifact/out/Dockerfile
GITHUB PR	#253
JIRA Issue	TEZ-4458
Optional Tests	dupname asflicense javac javadoc unit xml compile
uname	Linux 133a5f87b5f8 4.15.0-191-generic #202-Ubuntu SMP Thu Aug 4 01:49:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	personality/tez.sh
git revision	master / 25fc8c4
Default Java	Private Build-1.8.0_352-8u352-ga-1~20.04-b08
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.17+8-post-Ubuntu-1ubuntu220.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_352-8u352-ga-1~20.04-b08
Test Results	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-253/2/testReport/
Max. process+thread count	1843 (vs. ulimit of 5500)
modules	C: . U: .
Console output	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-253/2/console
versions	git=2.25.1 maven=3.6.3
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

[mayankkunwar]

This is just a dependency upgrade, which should not require any additional tests. The changes are tested through existing unit tests.

[abstractdog]

just wondering: what kind of test failure came when bcpkix wasn't included?

[mayankkunwar]

Here is the test failure report: https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-253/1/testReport/
Tests were complaining that they were not able to find org/bouncycastle/asn1/bsi/BSIObjectIdentifiers

[abstractdog]

okay, thanks for clarifying!

[mayankkunwar]

And with this I also checked that hadoop and other dependencies under TEZ dependency tree and they were using older version of bcpkix. So I thought to upgrade that as well

[abstractdog]

+1