[
https://issues.apache.org/jira/browse/HBASE-15199?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15976032#comment-15976032
]
Xiang Li commented on HBASE-15199:
----------------------------------
Hi [~stack]
Agree with Sean. Your patch removes jruby-complete from <dependencyManagement>
of hbase parent pom, which can not move it down to hbase-shell. Currently, it
is already scoped to hbase-shell.
If an artifact is only declared in <dependencyManagement>, it will not be
actually included. Only when it is added to <dependencies> (the same level as
<dependencyManagement>, not the one under <dependencyManagement>), it is added
as a dependency. <dependencyManagement> can be used to control the version,
scope or exclusion.., so that you do not have to specify those in every pom of
child modules.
> Move jruby jar so only on hbase-shell module classpath; currently globally
> available
> ------------------------------------------------------------------------------------
>
> Key: HBASE-15199
> URL: https://issues.apache.org/jira/browse/HBASE-15199
> Project: HBase
> Issue Type: Task
> Components: dependencies, jruby, shell
> Reporter: stack
> Priority: Critical
> Fix For: 2.0.0
>
> Attachments: 15199.txt
>
>
> A suggestion that came up out of internal issue (filed by Mr Jan Van Besien)
> was to move the scope of the jruby include down so it is only a dependency
> for the hbase-shell. jruby jar brings in a bunch of dependencies (joda time
> for example) which can clash with the includes of others. Our Sean suggests
> that could be good to shut down exploit possibilities if jruby was not
> globally available. Only downside I can think is that it may no longer be
> available to our bin/*rb scripts if we move the jar but perhaps these can be
> changed so they can find the ruby jar in new location.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
