[
https://issues.apache.org/jira/browse/KNOX-3429?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110247#comment-18110247
]
ASF subversion and git services commented on KNOX-3429:
-------------------------------------------------------
Commit 1f5d5c0617d500c8f46fad2eed60135984b3e414 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=1f5d5c061 ]
KNOX-3429: Harden source assembly to exclude build caches, runtime state, and
staging dirs (#1368)
> knox-<version>-src.zip can balloon far beyond its expected size (~40 MB ->
> GBs) and fail to stage to the Apache dist repo.
> --------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3429
> URL: https://issues.apache.org/jira/browse/KNOX-3429
> Project: Apache Knox
> Issue Type: Bug
> Components: Build, Release
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> {noformat}
> ant stage-candidate fails uploading the source archive:
> svn: E175002: PUT request on
> '.../dev/knox/knox-<version>/knox-<version>-src.zip' failed
> The PUT is rejected because the source zip is oversized.
> {noformat}
> *Root cause:* {{src/assembly.xml}} includes {{**}} from the repo root and
> subtracts only a short exclude list ({{target, node_modules, IDE files}}).
> The assembly snapshots the working tree at end-of-build, so anything else
> present gets bundled: Angular caches (.angular), runtime state generated by
> running the gateway/tests outside target/ (data/security keystores,
> data/ldap-server, data/deployments, logs, *.pid), JVM crash/heap dumps, and
> the {{candidate/}} staging dir (which re-bundles a previous *-src.zip).
> Shipping generated {{keystores/credentials}} in a source release is also a
> hygiene issue. A clean checkout builds correctly, so the logic is sound - the
> descriptor just isn't robust to leftover artifacts.
> *Fix:* Add scoped excludes to src/assembly.xml:
> {noformat}
> **/.angular/**, **/.scannerwork/**, candidate/**,
> **/data/{security,deployments,ldap-server}/**, **/logs/*.{log,out,err},
> **/*.pid, **/*.hprof, **/hs_err_pid*.log, **/replay_pid*.log. Patterns kept
> narrow and verified via git ls-files to drop no tracked source (preserving
> home/data/**/README, home/logs/.gitignore, sample .log).
> {noformat}
> *Acceptance Criteria*
> - Source zip stays ~40 MB even when built from a tree with runtime state /
> populated candidate/.
> - No generated keystores/credentials in the archive; no legitimate tracked
> files dropped.
> - ant stage-candidate uploads successfully.
> *Note*
> Excludes are a safety net - staging from a clean checkout remains the
> recommended practice.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
