[
https://issues.apache.org/jira/browse/BEAM-5495?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16998350#comment-16998350
]
Romain Manni-Bucau commented on BEAM-5495:
------------------------------------------
Ok, really no blaming there, the rational is that xbean is not that impacting
in most environment whereas classgraph will be a new dependency not yet managed
and under security scan radars + the maintenance point.
That said, I think dropping that feature from the core and letting it be a
plugin is likely the sanest default. Scanning the classpath can only be
relevant if the user is able to configure the environment explicitly (like skip
parent classloader for spark) or until the runner can become aware of it and
contribute to it - none of both options are there. We can indeed enhance the
SPI but it makes thing complicated and at the end this is not really a submit
feature compared to the job api which should handle that. So looks like a leak
in the sdk-core to me.
Any hope the feature is extracted in an extension or job api layer?
> PipelineResources algorithm is not working in most environments
> ---------------------------------------------------------------
>
> Key: BEAM-5495
> URL: https://issues.apache.org/jira/browse/BEAM-5495
> Project: Beam
> Issue Type: Bug
> Components: runner-flink, runner-spark, sdk-java-core
> Reporter: Romain Manni-Bucau
> Assignee: Lukasz Gajowy
> Priority: Major
> Fix For: 2.19.0
>
> Time Spent: 14.5h
> Remaining Estimate: 0h
>
> Issue are:
> 1. it assumes the classloader is an URLClassLoader (not always true and java
> >= 9 breaks that as well for the app loader)
> 2. it uses loader.getURLs() which leads to including the JRE itself in the
> staged file
> Looks like this detect resource algorithm can't work and should be replaced
> by a SPI rather than a built-in and not extensible algorithm. Another valid
> alternative is to just drop that "guess" logic and force the user to set
> staged files.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
