vsantwana commented on code in PR #1105:
URL:
https://github.com/apache/flink-kubernetes-operator/pull/1105#discussion_r4421815332
##########
pom.xml:
##########
@@ -228,19 +226,6 @@ under the License.
</plugins>
</build>
</profile>
- <profile>
- <id>depend-on-okhttp4</id>
Review Comment:
The operator module excludes okhttp from `kubernetes-httpclient-okhttp`, and
the `kubernetes-client` entry in `dependencyManagement` excludes
`com.squareup.okhttp3:*`. This profile is what added okhttp 4.12.0 back. Could
you check with `mvn dependency:tree -pl flink-kubernetes-operator` which okhttp
version the operator resolves after this change, if any? The new okio filter
suggests okhttp still arrives some other way, possibly at a different version.
##########
flink-kubernetes-operator/pom.xml:
##########
@@ -272,11 +288,70 @@ under the License.
</goals>
<configuration>
<shadedArtifactAttached>true</shadedArtifactAttached>
+ <!--
+ The non-shaded JAR is the main artifact
(consumers like
+ flink-kubernetes-webhook compile against it as
a regular
+ Maven dep). Shade still tries to publish a
+ dependency-reduced-pom.xml that pretends every
dep was
+ absorbed into the shaded fat-JAR, which strips
compile-scope
+ deps (flink-core, slf4j, fabric8, jackson, …)
from the
+ installed pom and breaks downstream
compilation. Disable
+ pom reduction so the original pom — with the
full dep tree —
+ is the one published / installed for this
artifact.
+ -->
+
<createDependencyReducedPom>false</createDependencyReducedPom>
<filters combine.children="append">
<filter>
<artifact>*:*</artifact>
<excludes>
+ <!-- JPMS module descriptors: the
uber-JAR is not modular,
+ so these are meaningless and only
cause shade's
+ "Discovered module-info.class …"
warnings. -->
+ <exclude>module-info.class</exclude>
<exclude>META-INF/**/module-info.class</exclude>
+ <!-- Signature files of signed input
jars: keeping them
+ in an uber-JAR triggers
SecurityException at runtime. -->
+ <exclude>META-INF/*.SF</exclude>
+ <exclude>META-INF/*.DSA</exclude>
+ <exclude>META-INF/*.RSA</exclude>
+ <!-- Per-dependency Maven build
metadata: pom.xml /
+ pom.properties shipped under
META-INF/maven/ are only
+ used to identify the original dep, not
at runtime. -->
+ <exclude>META-INF/maven/**</exclude>
+ <!-- Per-dependency
LICENSE/NOTICE/DEPENDENCIES files.
+ NOTICE is already aggregated by the
parent pom's
+ ApacheNoticeResourceTransformer; the
project's
+ top-level LICENSE / NOTICE / licenses/
directory is the
+ canonical attribution and is shipped
at the repo root. -->
+
<exclude>META-INF/DEPENDENCIES</exclude>
+ <exclude>META-INF/LICENSE</exclude>
+ <exclude>META-INF/LICENSE.txt</exclude>
+ <exclude>META-INF/license.txt</exclude>
+ <exclude>META-INF/NOTICE</exclude>
Review Comment:
This exclude, and `META-INF/licenses/**` two lines below, also match this
module's own jar: shade adds the project artifact to every `*:*` filter, and it
applies filters before transformers. So the module's own `META-INF/NOTICE` and
`META-INF/licenses/LICENSE.*` (kryo, minlog, reflectasm, automaton,
checker-qual) never reach the shaded jar. `ApacheNoticeResourceTransformer`
gets no input at all, so the comment above doesn't hold.
I reproduced it with shade 3.6.2, the same transformer and this exclude
list, on a small project whose own jar has a NOTICE and a `licenses/` file, and
whose two dependencies have their own NOTICE and LICENSE:
| In the shaded jar | Without the filter | With this filter |
|---|---|---|
| `META-INF/NOTICE` | merged from the module and both dependencies |
present, 0 bytes |
| `META-INF/licenses/LICENSE.kryo` | present | missing |
| `META-INF/LICENSE.txt` | present | missing |
The NOTICE excludes aren't needed to silence warnings. Without the filter,
shade warned about `LICENSE.txt` and `MANIFEST.MF` but not about NOTICE,
because the transformer merges NOTICE files. Dropping the NOTICE and
`licenses/**` excludes keeps these files in the jar.
##########
flink-autoscaler-standalone/pom.xml:
##########
@@ -199,14 +215,58 @@ under the License.
</artifactSet>
<filters>
<filter>
- <!-- Do not copy the signatures in the
META-INF folder.
- Otherwise, this might cause
SecurityExceptions when using the JAR. -->
<artifact>*:*</artifact>
<excludes>
+ <!-- Do not copy the signatures in the
META-INF folder.
+ Otherwise, this might cause
SecurityExceptions when using the JAR. -->
<exclude>META-INF/*.SF</exclude>
<exclude>META-INF/*.DSA</exclude>
<exclude>META-INF/*.RSA</exclude>
+ <!-- JPMS module descriptors: the
uber-JAR is not modular,
+ so these are meaningless and only
cause shade's
+ "Discovered module-info.class …"
warnings. -->
+ <exclude>module-info.class</exclude>
<exclude>META-INF/**/module-info.class</exclude>
+ <!-- Per-dependency Maven build
metadata: pom.xml /
+ pom.properties shipped under
META-INF/maven/ are only
+ used to identify the original dep, not
at runtime. -->
+ <exclude>META-INF/maven/**</exclude>
+ <!-- Per-dependency
LICENSE/NOTICE/DEPENDENCIES files.
+ NOTICE is already aggregated by the
parent pom's
+ ApacheNoticeResourceTransformer; the
project's
+ top-level LICENSE / NOTICE / licenses/
directory is the
+ canonical attribution and is shipped
at the repo root. -->
+
<exclude>META-INF/DEPENDENCIES</exclude>
+ <exclude>META-INF/LICENSE</exclude>
+ <exclude>META-INF/LICENSE.txt</exclude>
+ <exclude>META-INF/license.txt</exclude>
+ <exclude>META-INF/NOTICE</exclude>
Review Comment:
Same as in the operator pom: this module also ships its own
`META-INF/NOTICE` and `META-INF/licenses/LICENSE.checker-qual`, and this filter
drops both from the shaded jar.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
