geyanggang commented on code in PR #14532:
URL: https://github.com/apache/gravitino/pull/14532#discussion_r4450529780
##########
catalogs/hive-metastore3-libs/build.gradle.kts:
##########
@@ -44,6 +44,10 @@ dependencies {
implementation(libs.snappy.java)
implementation(libs.commons.beanutils)
implementation(libs.woodstox.core)
+ // hadoop-common, hadoop-auth, Curator and the Hive shims bring ZooKeeper
3.6.3, which is end of
+ // life. Only the ZooKeeper client classes are on this classpath.
+ implementation(libs.zookeeper)
+ implementation(libs.zookeeper.jute)
Review Comment:
This doesn't add a new dependency — it's inside the constraints block, so it
only pins the version. ZooKeeper is already shipped in
catalogs/hive/libs/hive-metastore{2,3}-libs today as a transitive dependency of
hadoop-common, hadoop-auth, Curator and the Hive shims, resolved to 3.6.3,
which is end of life and flagged by the scan in #14435. Gravitino itself
doesn't use ZooKeeper: the only classes that reference it in these directories
are Hadoop/Hive server-side features (HA failover, ZooKeeper delegation token
stores, HiveServer2/HMS discovery), and the HMS client path we use (UGI,
SecurityUtil, thrift) doesn't touch it. I chose to upgrade rather than exclude
it, because those Hadoop/Curator/Hive classes still reference ZooKeeper and an
exclusion could surface as a NoClassDefFoundError on a rarely used path. With
3.8.8 the bytecode linkage check shows the same results as 3.6.3, and the Hive
2.3/3.1 (incl. Kerberos) ITs pass in both embedded and deploy modes. I've also
reworded
the comment to make this clearer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
