wenhao created HBASE-30489:
------------------------------
Summary: hbase-assembly should exclude unshaded Jetty pulled in
transitively by Hadoop
Key: HBASE-30489
URL: https://issues.apache.org/jira/browse/HBASE-30489
Project: HBase
Issue Type: Bug
Components: build
Affects Versions: 2.4.17
Reporter: wenhao
h2. Problem
The HBase binary distribution built with the Hadoop 3 profile ships unshaded
Jetty
jars (org.eclipse.jetty:jetty-*, 9.4.x) in lib/. HBase does not use them: all of
HBase's web UIs are served by hbase-shaded-jetty from hbase-thirdparty, whose
classes
are relocated to org.apache.hbase.thirdparty.org.eclipse.jetty. The build
already
enforces this - the root pom.xml has a "banned-jetty" enforcer rule for
org.eclipse.jetty:** dependencies and a forbidden-apis rule for
org.eclipse.jetty.**
imports.
The same problem exists in the Hadoop 2 profile, where the leaked artifacts are
org.mortbay.jetty:jetty, jetty-util and jetty-sslengine 6.1.26 (Jetty 6, EOL).
h2. Environment
- HBase: rel/2.4.17 (also reproducible on current branch-2)
- Hadoop: 3.1.1 / 3.2.0 / 3.4.1 (built with -Dhadoop.profile=3.0), and 2.10.0
(default profile)
- JDK 8 / JDK 11, Maven 3.8.x
h2. Steps to reproduce
# 1. build a binary tarball against Hadoop 3
mvn clean install -DskipTests -Dhadoop.profile=3.0
mvn -pl hbase-assembly -Pdist package
# 2. list the packaged Jetty jars
tar -tzf hbase-assembly/target/hbase-*-bin.tar.gz | grep -i jetty
Alternatively, inspect the dependency tree of any module that depends on
hadoop-common
without excluding Jetty (e.g. hbase-server):
h2. Expected behavior
The binary tarball only contains the shaded Jetty that HBase actually uses
(org.apache.hbase.thirdparty:hbase-shaded-jetty); no unshaded Jetty jars are
packaged, and HBase modules do not expose unshaded Jetty as a transitive
dependency.
h2. Actual behavior
hbase-assembly copies the unshaded Jetty jars that Hadoop declares as
compile-scope
dependencies into lib/:
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
