Fokko commented on code in PR #16214:
URL: https://github.com/apache/iceberg/pull/16214#discussion_r4535880236
##########
docker/iceberg-rest-fixture/entrypoint.sh:
##########
@@ -20,7 +20,8 @@
set -eu
-CLASSPATH="iceberg-rest-adapter.jar"
+# The staged runtime puts all REST server jars under libs/; Java expands this
wildcard.
+CLASSPATH="libs/*"
Review Comment:
Is LOG_LEVEL still picked up? The staged libs contain both slf4j-simple and
log4j-slf4j-impl (the latter via hadoop-common), and with two SLF4J providers
the one with the higher priority wins, which I believe is log4j. That would
make the simpleLogger property a no-op. Is this on purpose? Any way to verify
with tests that we don't change behavior?
##########
.github/workflows/cve-scan.yml:
##########
@@ -167,9 +167,10 @@ jobs:
scan-path: flink/v2.3/flink-runtime/build/libs
unpack: false
- distribution: open-api-test-fixtures-runtime
- build-task: :iceberg-open-api:shadowJar
- scan-path: open-api/build/libs
+ build-task: :iceberg-open-api:stageRESTFixtureRuntime
+ scan-path: open-api/build/iceberg-rest-server/libs
unpack: false
+ copy-all: true
Review Comment:
This job is red: Trivy flags CVE-2026-102554 (HIGH) in guava 33.4.8 embedded
in hadoop-shaded-guava-1.5.0.jar, which comes in via hadoop-common 3.4.3. 1.5.0
is the latest hadoop-shaded-guava release, so there is nothing to bump. Kafka
Connect already ignores this exact CVE for the same reason: would the same
trivyignore file work here?
```suggestion
build-task: :iceberg-open-api:stageRESTFixtureRuntime
scan-path: open-api/build/iceberg-rest-server/libs
unpack: false
copy-all: true
trivyignores:
.github/trivyignore/open-api-test-fixtures-runtime.trivyignore.yaml
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
