Junegunn Choi created HBASE-30338:
-------------------------------------
Summary: Shaded jar content check is a no-op
Key: HBASE-30338
URL: https://issues.apache.org/jira/browse/HBASE-30338
Project: HBase
Issue Type: Bug
Reporter: Junegunn Choi
h2. Problem
{{ensure-jars-have-correct-contents.sh}} has enforced nothing since
HBASE-29226. That change needed to allow the unrelocated servlet API that jetty
12 on ee8 requires, but wrote the allowance as a plain assignment wrapped in a
group with an empty alternative:
{code:java}
# Required by jetty 12 on ee8
allowed_expr="(|^javax/$)"
{code}
Two defects in one line.
- The assignment discards every rule accumulated above it.
- The empty alternative makes grep abort with {{{}empty (sub)expression{}}},
and the {{|| true}} on that grep swallows the failure, so {{bad_contents}}
comes back empty and the script reports the artifact as correct.
h2. Fix
{code:java}
-allowed_expr="(|^javax/$)"
+allowed_expr+="|^javax/$|^javax/servlet/"
{code}
Restoring the operator alone is not enough. The empty alternative survives,
grep still aborts, and the script still reports everything as correct.
Reviving the check then exposes 139 {{javax/servlet}} entries in
{{{}hbase-shaded-mapreduce{}}}, which jetty 12 on ee8 requires unrelocated.
{{^javax/$}} matches only the bare directory entry, so the original line would
not have covered them even with the right operator. The servlet package is
allowed explicitly.
h2. Test
h3. Before fix
{code:java}
SCRIPT=hbase-shaded/hbase-shaded-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh
bash $SCRIPT
hbase-shaded/hbase-shaded-client/target/hbase-shaded-client-4.0.0-alpha-1-SNAPSHOT.jar
# grep: empty (sub)expression
# [INFO] Artifact looks correct:
'hbase-shaded-client-4.0.0-alpha-1-SNAPSHOT.jar'
bash $SCRIPT --allow-hadoop
hbase-shaded/hbase-shaded-client/target/hbase-shaded-client-4.0.0-alpha-1-SNAPSHOT.jar
# grep: empty (sub)expression
# [INFO] Artifact looks correct:
'hbase-shaded-client-4.0.0-alpha-1-SNAPSHOT.jar'
bash $SCRIPT
hbase-shaded/hbase-shaded-mapreduce/target/hbase-shaded-mapreduce-4.0.0-alpha-1-SNAPSHOT.jar
# grep: empty (sub)expression
# [INFO] Artifact looks correct:
'hbase-shaded-mapreduce-4.0.0-alpha-1-SNAPSHOT.jar'
bash $SCRIPT --allow-hadoop
hbase-shaded/hbase-shaded-mapreduce/target/hbase-shaded-mapreduce-4.0.0-alpha-1-SNAPSHOT.jar
# grep: empty (sub)expression
# [INFO] Artifact looks correct:
'hbase-shaded-mapreduce-4.0.0-alpha-1-SNAPSHOT.jar'
{code}
h3. After fix
{code:java}
SCRIPT=hbase-shaded/hbase-shaded-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh
bash $SCRIPT
hbase-shaded/hbase-shaded-client/target/hbase-shaded-client-4.0.0-alpha-1-SNAPSHOT.jar
# [ERROR] Found artifact with unexpected contents:
'hbase-shaded/hbase-shaded-client/target/hbase-shaded-client-4.0.0-alpha-1-SNAPSHOT.jar'
# Please check the following and either correct the build or update
# the allowed list with reasoning.
#
# org/apache/hadoop/security/
# org/apache/hadoop/security/authentication/
# org/apache/hadoop/security/authentication/server/
#
org/apache/hadoop/security/authentication/server/MultiSchemeAuthenticationHandler.class
#
org/apache/hadoop/security/authentication/server/AuthenticationFilter.class
#
org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.class
# ....
bash $SCRIPT --allow-hadoop
hbase-shaded/hbase-shaded-client/target/hbase-shaded-client-4.0.0-alpha-1-SNAPSHOT.jar
# [INFO] Artifact looks correct:
'hbase-shaded-client-4.0.0-alpha-1-SNAPSHOT.jar'
bash $SCRIPT
hbase-shaded/hbase-shaded-mapreduce/target/hbase-shaded-mapreduce-4.0.0-alpha-1-SNAPSHOT.jar
# [INFO] Artifact looks correct:
'hbase-shaded-mapreduce-4.0.0-alpha-1-SNAPSHOT.jar'
bash $SCRIPT --allow-hadoop
hbase-shaded/hbase-shaded-mapreduce/target/hbase-shaded-mapreduce-4.0.0-alpha-1-SNAPSHOT.jar
# [INFO] Artifact looks correct:
'hbase-shaded-mapreduce-4.0.0-alpha-1-SNAPSHOT.jar'
{code}
h2. Notes
Whether {{hbase-shaded-mapreduce}} should ship the servlet API unrelocated at
all is a separate question. This issue restores the check and records the
content that is already shipping as allowed.
Affects master and branch-3. branch-2 never carried HBASE-29226.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
