[
https://issues.apache.org/jira/browse/HADOOP-15832?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16655708#comment-16655708
]
Eric Yang commented on HADOOP-15832:
------------------------------------
When looking at mvn dependency:tree, it shows that:
{code}
[INFO] +- org.apache.hadoop:hadoop-minicluster:jar:3.3.0-SNAPSHOT:test
[INFO] | +- org.apache.hadoop:hadoop-hdfs:test-jar:tests:3.3.0-SNAPSHOT:test
[INFO] | +-
org.apache.hadoop:hadoop-yarn-server-tests:test-jar:tests:3.3.0-SNAPSHOT:test
[INFO] | | +-
org.apache.hadoop:hadoop-yarn-server-nodemanager:jar:3.3.0-SNAPSHOT:test
[INFO] | | +-
org.apache.hadoop:hadoop-yarn-server-resourcemanager:jar:3.3.0-SNAPSHOT:test
[INFO] | | | \-
org.apache.hadoop:hadoop-yarn-server-applicationhistoryservice:jar:3.3.0-SNAPSHOT:test
[INFO] | | | +- org.objenesis:objenesis:jar:1.0:test
[INFO] | | | \- de.ruedigermoeller:fst:jar:2.50:test
[INFO] | | | \- com.cedarsoftware:java-util:jar:1.9.0:test
[INFO] | | | \- com.cedarsoftware:json-io:jar:2.5.1:test
[INFO] | | \-
org.apache.hadoop:hadoop-yarn-server-timelineservice:jar:3.3.0-SNAPSHOT:test
[INFO] | | \- org.apache.commons:commons-csv:jar:1.0:test
[INFO] | +-
org.apache.hadoop:hadoop-mapreduce-client-jobclient:test-jar:tests:3.3.0-SNAPSHOT:test
[INFO] | | \-
org.apache.hadoop:hadoop-mapreduce-client-common:jar:3.3.0-SNAPSHOT:test
[INFO] | +-
org.apache.hadoop:hadoop-mapreduce-client-app:jar:3.3.0-SNAPSHOT:test
[INFO] | | +-
org.apache.hadoop:hadoop-yarn-server-web-proxy:jar:3.3.0-SNAPSHOT:test
[INFO] | | \-
org.apache.hadoop:hadoop-mapreduce-client-shuffle:jar:3.3.0-SNAPSHOT:test
[INFO] | +-
org.apache.hadoop:hadoop-mapreduce-client-core:jar:3.3.0-SNAPSHOT:test
[INFO] | +-
org.apache.hadoop:hadoop-mapreduce-client-jobclient:jar:3.3.0-SNAPSHOT:test
[INFO] | \-
org.apache.hadoop:hadoop-mapreduce-client-hs:jar:3.3.0-SNAPSHOT:test
{code}
Hadoop-yarn-server-web-proxy is included by hadoop-mapreduce-client-app, but
bouncy castle jar files are excluded in hadoop-yarn-server-web-proxy project.
If other project depends on minicluster, it will brought in client jars as well
as minicluster jar file AND yarn-server-web-proxy jar file. This cause unit
tests that depends on minicluster to reference the non-shaded version of
hadoop-yarn-server-web-proxy classes, but the transitive dependencies are
missing.
> Upgrade BouncyCastle to 1.60
> ----------------------------
>
> Key: HADOOP-15832
> URL: https://issues.apache.org/jira/browse/HADOOP-15832
> Project: Hadoop Common
> Issue Type: Improvement
> Affects Versions: 3.3.0
> Reporter: Robert Kanter
> Assignee: Robert Kanter
> Priority: Major
> Fix For: 3.3.0
>
> Attachments: HADOOP-15832.001.patch, HADOOP-15832.addendum.patch
>
>
> As part of my work on YARN-6586, I noticed that we're using a very old
> version of BouncyCastle:
> {code:xml}
> <dependency>
> <groupId>org.bouncycastle</groupId>
> <artifactId>bcprov-jdk16</artifactId>
> <version>1.46</version>
> <scope>test</scope>
> </dependency>
> {code}
> The *-jdk16 artifacts have been discontinued and are not recommended (see
> [http://bouncy-castle.1462172.n4.nabble.com/Bouncycaslte-bcprov-jdk15-vs-bcprov-jdk16-td4656252.html]).
>
> In particular, the newest release, 1.46, is from {color:#FF0000}2011{color}!
> [https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk16]
> The currently maintained and recommended artifacts are *-jdk15on:
> [https://www.bouncycastle.org/latest_releases.html]
> They're currently on version 1.60, released only a few months ago.
> We should update BouncyCastle to the *-jdk15on artifacts and the 1.60
> release. It's currently a test-only artifact, so there should be no
> backwards-compatibility issues with updating this. It's also needed for
> YARN-6586, where we'll actually be shipping it.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
