That would be the ideal solution; it would save us other headaches around dependency choices in Hadoop. However, based on the last time I tried to move us to those artifacts I know it's a ton of work and I don't think anyone is volunteering to do it.
So while I think there is a better long term option, I'm also in favor of shading jetty to continue our incremental improvements. On Tue, Feb 25, 2020 at 2:55 AM 张铎(Duo Zhang) <[email protected]> wrote: > > So the suggest solution is to depend on shaded hadoop jars, instead of > shading jetty? > > Sean Busbey <[email protected]> 于2020年2月25日周二 下午12:37写道： > > > Downstream users of hbase should be using our shaded testing until, which > > should already relocate jetty to avoid breaking out downstream users. > > > > On Mon, Feb 24, 2020, 19:42 张铎(Duo Zhang) <[email protected]> wrote: > > > > > It is a bit sad that we have to shade jetty, as it is only used at server > > > side I think. > > > > > > But anyway, HBase also has a testing-util module which will pull jetty > > in, > > > so we could also break our downstream users. > > > > > > +1 on shading. > > > > > > Josh Elser <[email protected]> 于2020年2月25日周二 上午8:12写道： > > > > > > > Yeah, re-reading my previous chatter with MikeD and Appy, shading in > > > > hbase-thirdparty appears to have been the consensus. > > > > > > > > Best as I remember, time was the only reason it didn't happen. I don't > > > > think there's any reason we can't shade our use of Jetty, and just let > > > > Hadoop do what they do (and instead try to get onto the shaded > > artifacts > > > > everywhere we can). > > > > > > > > Thanks for asking, Wei-Chiu! > > > > > > > > On 2/24/20 7:01 PM, Wei-Chiu Chuang wrote: > > > > > Not sure about the real deployment, but the tests fail with > > > > > NoSuchMethodError once they start a MiniDFSCluster. (as explained in > > > > > HBASE-18943 <https://issues.apache.org/jira/browse/HBASE-18943>) I > > can > > > > > verify this is still the case now. > > > > > > > > > > On Mon, Feb 24, 2020 at 3:53 PM Sean Busbey <[email protected]> > > wrote: > > > > > > > > > >> As an alternative, if we ensured the jetty from Hadoop wasn't in our > > > > >> classpath for our service roles would that allow us to version jetty > > > > >> independently? Or would we run into test problems? > > > > >> > > > > >> On Mon, Feb 24, 2020, 16:07 Wei-Chiu Chuang <[email protected]> > > > wrote: > > > > >> > > > > >>> Hi, > > > > >>> > > > > >>> While I work on this jira HBASE-23834 > > > > >>> <https://issues.apache.org/jira/browse/HBASE-23834> (HBase fails > > to > > > > run > > > > >> on > > > > >>> Hadoop 3.3.0/3.2.2/3.1.4 due to jetty version mismatch) and I > > > realized > > > > >> this > > > > >>> was attempted before. But it simply doesn't work when you have > > Hadoop > > > > and > > > > >>> HBase on different Jetty minor versions (9.3 / 9.4) unless Jetty is > > > > >> shaded > > > > >>> in HBase (or Hadoop). > > > > >>> > > > > >>> We should update Jetty in HBase for sure. 9.3 has known security > > > > >>> vulnerabilities and not fixed until 9.4. > > > > >>> > > > > >>> Given that hbase-thirdparty is the standard practice to place > > > > >>> thirdparty jars, should we also shade Jetty into hbase-thirdparty? > > > > >>> > > > > >> > > > > > > > > > > > > > >
