Andrey Yarovoy created HDDS-16683:
-------------------------------------
Summary: Upgrade Jetty from 12.0.38 to 12.1.13
Key: HDDS-16683
URL: https://issues.apache.org/jira/browse/HDDS-16683
Project: Apache Ozone
Issue Type: Improvement
Reporter: Andrey Yarovoy
h2. Problem
HDDS-8280 moved Ozone from Jetty 9.4 to Jetty \{{12.0.38}} on the EE8
environment (\{{javax.servlet}} 4.0).
Jetty has since opened the \{{12.1.x}} line, currently at \{{12.1.13}}, which
is where new work and most
fixes now land.
This is a get-ahead-of-it upgrade, not a forced one: the \{{12.0.x}} line is
still actively released
(\{{12.0.39}} shipped after our pin), so nothing is end-of-life today. The
reason to do it now is that the
Ozone surface is small and verifiably unaffected, which will not stay true
indefinitely — and \{{12.1.x}}
is also where the Jakarta EE 11 environment lives, which is the eventual exit
path off EE8.
h2. Current shape
| Item | Value | Where |
|---|---|---|
| \{{jetty.version}} | \{{12.0.38}} | \{{pom.xml}} L113 |
| BOMs | \{{org.eclipse.jetty:jetty-bom}} +
\{{org.eclipse.jetty.ee8:jetty-ee8-bom}} | \{{pom.xml}} L263-271 |
| \{{servlet-api.version}} | \{{4.0.9}}
(\{{org.eclipse.jetty.toolchain:jetty-servlet-api}}) | \{{pom.xml}} L201, L1585
|
| EE8 artifacts in use | \{{jetty-ee8-}}\{{{}servlet, webapp, nested, proxy,
cdi{}}} | framework, server-scm, ozone-manager, recon, s3gateway,
httpfsgateway, integration-test-s3 |
| Jetty import footprint | 30 distinct types — \{{server.*}}, \{{util.*}},
\{{http.*}}, \{{ee8.*}} only | 13 files |
h2. Proposed change
Bump \{{jetty.version}} to \{{12.1.13}}. Keep EE8, keep
\{{servlet-api.version}} at \{{4.0.9}}, keep every
artifact coordinate. In principle a one-property change plus whatever the
verification below turns up.
h2. Behavior-default changes to assert, not assume
These are the real risk in this upgrade. Each is a silent default flip in a
knob Ozone does not currently
set, so the existing tests would not notice:
* \{{HttpConfiguration.maxResponseHeaderSize}} default \{{-1}} → \{{16384}}.
* \{{HttpConfiguration.relativeRedirectAllowed}} default flipped to \{{true}}
(jetty#11947).
* \{{SslContextFactory.renegotiationAllowed}} default → \{{false}}
(jetty#12378).
* Session \{{flushOnResponseCommit}} default → \{{true}} (jetty#12339).
* \{{UriCompliance}} is now also applied to query-string parsing (jetty#12750),
and a new
{\{UriCompliance.Violation.FRAGMENT}} exists (jetty#11579). This touches Ozone
directly:
{\{OZONE_AMBIGUOUS_URI_COMPLIANCE}} in \{{HttpServer2}} and the
\{{allowAmbiguousUri}} opt-ins in S3
Gateway and httpfs.
* EE8/EE9 \{{ContextHandler.setCompactPath}} behavior was restored for
back-compat (jetty#12821).
h2. Scope
Included: the version bump, any exclusion or \{{dependency:analyze}} fallout it
causes, and tests covering
the default flips above — extending \{{TestHttpServer2}},
\{{TestHttpServer2SSL}} and \{{TestBaseHttpServer}}
rather than adding new suites.
Out of scope: migrating off EE8 to EE10 or EE11, and adopting any new 12.1
feature
(\{{CompressionHandler}}, the new deployer, \{{MultiAuthenticator}}). Each is
its own Jira.
h2. How to verify
# \{{mvn -q validate}} at root (sortpom \{{verifyFailOn=Strict}}), then
{\{mvn clean install -DskipTests -DskipShade -DskipRecon -DskipDocs}}.
# \{{mvn dependency:tree
-Dincludes=org.eclipse.jetty:*,org.eclipse.jetty.ee8:*,org.eclipse.jetty.toolchain:*}}
— every coordinate reads \{{12.1.13}} (\{{4.0.9}} for \{{jetty-servlet-api}});
no \{{12.0.*}}, no \{{9.4.*}},
no \{{ee9}}/\{{ee10}}/\{{ee11}}.
# \{{mvn dependency:tree -Dincludes=javax.servlet:*,jakarta.servlet:*}} — empty.
# \{{build.sh}} *without* \{{-Dmdep.analyze.skip}} — \{{analyze-only}} runs at
\{{verify}} and "Used
undeclared dependency" is CI-fatal.
# Framework and s3gateway unit suites; then \{{checkstyle.sh}}.
# \{{mvn -Pdist -DskipTests package}}, then \{{dependency.sh}} and
\{{license.sh}}, applying the reported
{\{jar-report.txt}} diff mechanically.
# Compose smoketests — \{{ozone}}, \{{ozonesecure}}, the s3/secret suites, and
an httpfs run —
spot-checking \{{/conf}}, \{{/jmx}}, \{{/prom}}, \{{/logLevel}}, \{{/stacks}},
\{{/logs}}, \{{/static}}, the
Recon UI, and S3 Gateway XML content types. The dist-only runtime regressions
in HDDS-8280 (Recon JAXB,
s3g Weld bean discovery) were invisible to unit tests, so the dist run is not
optional.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
