[
https://issues.apache.org/jira/browse/SOLR-13973?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16982998#comment-16982998
]
Jan Høydahl commented on SOLR-13973:
------------------------------------
I think a better order of events is to start by converting these into plugin
packages to get a slimmer solr download. Then it will be up to the user whether
he installs Tika or Velocity or not, and since the code is only there by choice
there is no dormant attack vector in vanilla installs. Next step after that can
be a discussion on whether to stop maintaining them as official plugins and let
3rd party devs take over maintenance.
With Tika it has been discussed to replace the current fat contrib with a very
thin one that talks to Tika Server, thus avoiding all the jar dependencies and
also avoiding heavy PDF parsing in-process. Anyway, I encourage you to split
this issue into two - one for Tika and one for Velocity, they are not related.
> Deprecate Tika and Velocity
> ---------------------------
>
> Key: SOLR-13973
> URL: https://issues.apache.org/jira/browse/SOLR-13973
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Reporter: Ishan Chattopadhyaya
> Priority: Major
>
> Solr's primary responsibility should be to focus on search and scalability.
> Having to deal with the problems (CVEs) of Velocity, Tika etc. can slow us
> down. I propose that we deprecate it going forward.
> Tika can be run outside Solr, and no one needs to run velocity (if they do,
> they can consume JSON and do whatever transformations they need to do). Going
> forward, if someone wants to use these, it should be possible to bring them
> into third party packages and installed via package manager.
> Plan is to just to throw warnings in logs and add deprecation notes in
> reference guide for now. Removal can be done later (9x or 10x).
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
