[jira] [Updated] (ZOOKEEPER-2654) Support Fedora 25: use pkg-config instead of obsolete M4 macros

2016-12-22 Thread Olaf Flebbe (JIRA)

 [ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2654?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Olaf Flebbe updated ZOOKEEPER-2654:
---
Attachment: ZOOKEEPER-2654.2.patch

Sigh, patch without prefix

> Support Fedora 25: use pkg-config instead of obsolete M4 macros
> ---
>
> Key: ZOOKEEPER-2654
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2654
> Project: ZooKeeper
>  Issue Type: Bug
>  Components: build
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
> Attachments: ZOOKEEPER-2654.2.patch
>
>
> While compiling Bigtop on Fedora 25 we found that there is an issue with the 
> autoconf detection of cppunit: See BIGTOP-2642 for error.
> Some background regarding the issue can be found here: 
> https://bugzilla.redhat.com/show_bug.cgi?id=1311694
> The fedora maintainers encourage use of pkg-config rather crufty *.m4 
> autoconf magic by only supplying pkg-config files *.pc.
> The patch is surprisingly easy but adds the additional requirement for 
> pkg-config which should be available on every well maintained system for ages.
> Please see for me proposed patch. Works for me for Fedora 25, Centos 6, 
> MacOSX with HomeBrew.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (ZOOKEEPER-2654) Support Fedora 25: use pkg-config instead of obsolete M4 macros

2016-12-22 Thread Olaf Flebbe (JIRA)

 [ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2654?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Olaf Flebbe updated ZOOKEEPER-2654:
---
Attachment: (was: ZOOKEEPER-2654.patch)

> Support Fedora 25: use pkg-config instead of obsolete M4 macros
> ---
>
> Key: ZOOKEEPER-2654
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2654
> Project: ZooKeeper
>  Issue Type: Bug
>  Components: build
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>
> While compiling Bigtop on Fedora 25 we found that there is an issue with the 
> autoconf detection of cppunit: See BIGTOP-2642 for error.
> Some background regarding the issue can be found here: 
> https://bugzilla.redhat.com/show_bug.cgi?id=1311694
> The fedora maintainers encourage use of pkg-config rather crufty *.m4 
> autoconf magic by only supplying pkg-config files *.pc.
> The patch is surprisingly easy but adds the additional requirement for 
> pkg-config which should be available on every well maintained system for ages.
> Please see for me proposed patch. Works for me for Fedora 25, Centos 6, 
> MacOSX with HomeBrew.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-2654) Support Fedora 25: use pkg-config instead of obsolete M4 macros

2016-12-22 Thread Olaf Flebbe (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2654?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15770646#comment-15770646
 ] 

Olaf Flebbe commented on ZOOKEEPER-2654:


One additinal benefit of this patch is that one does not need to have cppunit 
installed when regenerating the autoconf files.


> Support Fedora 25: use pkg-config instead of obsolete M4 macros
> ---
>
> Key: ZOOKEEPER-2654
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2654
> Project: ZooKeeper
>  Issue Type: Bug
>  Components: build
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
> Attachments: ZOOKEEPER-2654.patch
>
>
> While compiling Bigtop on Fedora 25 we found that there is an issue with the 
> autoconf detection of cppunit: See BIGTOP-2642 for error.
> Some background regarding the issue can be found here: 
> https://bugzilla.redhat.com/show_bug.cgi?id=1311694
> The fedora maintainers encourage use of pkg-config rather crufty *.m4 
> autoconf magic by only supplying pkg-config files *.pc.
> The patch is surprisingly easy but adds the additional requirement for 
> pkg-config which should be available on every well maintained system for ages.
> Please see for me proposed patch. Works for me for Fedora 25, Centos 6, 
> MacOSX with HomeBrew.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (ZOOKEEPER-2654) Support Fedora 25: use pkg-config instead of obsolete M4 macros

2016-12-22 Thread Olaf Flebbe (JIRA)

 [ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2654?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Olaf Flebbe updated ZOOKEEPER-2654:
---
Attachment: ZOOKEEPER-2654.patch

> Support Fedora 25: use pkg-config instead of obsolete M4 macros
> ---
>
> Key: ZOOKEEPER-2654
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2654
> Project: ZooKeeper
>  Issue Type: Bug
>  Components: build
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
> Attachments: ZOOKEEPER-2654.patch
>
>
> While compiling Bigtop on Fedora 25 we found that there is an issue with the 
> autoconf detection of cppunit: See BIGTOP-2642 for error.
> Some background regarding the issue can be found here: 
> https://bugzilla.redhat.com/show_bug.cgi?id=1311694
> The fedora maintainers encourage use of pkg-config rather crufty *.m4 
> autoconf magic by only supplying pkg-config files *.pc.
> The patch is surprisingly easy but adds the additional requirement for 
> pkg-config which should be available on every well maintained system for ages.
> Please see for me proposed patch. Works for me for Fedora 25, Centos 6, 
> MacOSX with HomeBrew.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Created] (ZOOKEEPER-2654) Support Fedora 25: use pkg-config instead of obsolete M4 macros

2016-12-22 Thread Olaf Flebbe (JIRA)
Olaf Flebbe created ZOOKEEPER-2654:
--

 Summary: Support Fedora 25: use pkg-config instead of obsolete M4 
macros
 Key: ZOOKEEPER-2654
 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2654
 Project: ZooKeeper
  Issue Type: Bug
  Components: build
Reporter: Olaf Flebbe
Assignee: Olaf Flebbe


While compiling Bigtop on Fedora 25 we found that there is an issue with the 
autoconf detection of cppunit: See BIGTOP-2642 for error.

Some background regarding the issue can be found here: 
https://bugzilla.redhat.com/show_bug.cgi?id=1311694

The fedora maintainers encourage use of pkg-config rather crufty *.m4 autoconf 
magic by only supplying pkg-config files *.pc.

The patch is surprisingly easy but adds the additional requirement for 
pkg-config which should be available on every well maintained system for ages.

Please see for me proposed patch. Works for me for Fedora 25, Centos 6, MacOSX 
with HomeBrew.





--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-2594) Use TLS for downloading artifacts during build

2016-10-02 Thread Olaf Flebbe (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15540028#comment-15540028
 ] 

Olaf Flebbe commented on ZOOKEEPER-2594:


[~phunt] : I do not understand the failures. Does zookeeper QA have a problem 
by itself?

> Use TLS for downloading artifacts during build
> --
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Affects Versions: 3.4.9, 3.5.2
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>Priority: Blocker
>  Labels: security
> Fix For: 3.4.10, 3.5.3, 3.6.0
>
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, ZOOKEEPER-2594.patch, 
> compile.log
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Comment Edited] (ZOOKEEPER-2594) Use TLS for downloading artifacts during build

2016-10-02 Thread Olaf Flebbe (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15539986#comment-15539986
 ] 

Olaf Flebbe edited comment on ZOOKEEPER-2594 at 10/2/16 8:10 AM:
-

Updated the patch with --no-prefix to make qabot happy. 


was (Author: oflebbe):
Updated the patch with --no-prefix to make qabot happy. Sigh.

> Use TLS for downloading artifacts during build
> --
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Affects Versions: 3.4.9, 3.5.2
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>Priority: Blocker
>  Labels: security
> Fix For: 3.4.10, 3.5.3, 3.6.0
>
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, ZOOKEEPER-2594.patch, 
> compile.log
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (ZOOKEEPER-2594) Use TLS for downloading artifacts during build

2016-10-02 Thread Olaf Flebbe (JIRA)

 [ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Olaf Flebbe updated ZOOKEEPER-2594:
---
Attachment: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch

Updated the patch with --no-prefix to make qabot happy. Sigh.

> Use TLS for downloading artifacts during build
> --
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Affects Versions: 3.4.9, 3.5.2
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>Priority: Blocker
>  Labels: security
> Fix For: 3.4.10, 3.5.3, 3.6.0
>
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, ZOOKEEPER-2594.patch, 
> compile.log
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-2594) Use TLS for downloading artifacts during build

2016-09-25 Thread Olaf Flebbe (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15521024#comment-15521024
 ] 

Olaf Flebbe commented on ZOOKEEPER-2594:


I couldn't trigger ant to download ivy via contrib, but anyway, I included your 
requested change.

There is a unsafe code download left, but I like to fix problems in other 
projects, first. The "eclipse" target downloads an ant-eclipse plugin from 
sourceforge. Sourceforge redirects the url to one of its mirrors via http:// 
and ant is blocking a redirect from TLS to http. Nice from security standpoint 
but not good for automation. 
{code}
olaf@9dec01f17711:~/zookeeper$ ant eclipse
Buildfile: /home/olaf/zookeeper/build.xml

ant-eclipse-download:
  [get] Getting: 
https://downloads.sourceforge.net/project/ant-eclipse/ant-eclipse/1.0/ant-eclipse-1.0.bin.tar.bz2
  [get] To: /home/olaf/zookeeper/src/java/ant-eclipse-1.0.bin.tar.bz2
  [get] 
https://downloads.sourceforge.net/project/ant-eclipse/ant-eclipse/1.0/ant-eclipse-1.0.bin.tar.bz2
 moved to 
http://netix.dl.sourceforge.net/project/ant-eclipse/ant-eclipse/1.0/ant-eclipse-1.0.bin.tar.bz2

BUILD FAILED
/home/olaf/zookeeper/build.xml:1693: Redirection detected from https to http. 
Protocol switch unsafe, not allowed.

Total time: 0 seconds
{code}


Please consider including the patch as is. (modulo backporting to branches). I 
will "port" it to Apache Bigtop as well.

Thanks
  Olaf

> Use TLS for downloading artifacts during build
> --
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Affects Versions: 3.4.9, 3.5.2
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>Priority: Blocker
>  Labels: security
> Fix For: 3.4.10, 3.5.3, 3.6.0
>
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, ZOOKEEPER-2594.patch, 
> compile.log
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (ZOOKEEPER-2594) Use TLS for downloading artifacts during build

2016-09-25 Thread Olaf Flebbe (JIRA)

 [ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Olaf Flebbe updated ZOOKEEPER-2594:
---
Attachment: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch

Added file from contrib

> Use TLS for downloading artifacts during build
> --
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Affects Versions: 3.4.9, 3.5.2
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>Priority: Blocker
>  Labels: security
> Fix For: 3.4.10, 3.5.3, 3.6.0
>
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, ZOOKEEPER-2594.patch, 
> compile.log
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-2594) Use TLS for downloading artifacts during build

2016-09-19 Thread Olaf Flebbe (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15505665#comment-15505665
 ] 

Olaf Flebbe commented on ZOOKEEPER-2594:


BTW: One can see that netty is now downloaded from {{repo1.maven.org}} . The 
jboss repository seems to be not necessary any more .

> Use TLS for downloading artifacts during build
> --
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Affects Versions: 3.4.9, 3.5.2
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>Priority: Blocker
>  Labels: security
> Fix For: 3.4.10, 3.5.3, 3.6.0
>
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> ZOOKEEPER-2594.patch, compile.log
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (ZOOKEEPER-2594) Use TLS for downloading artifacts during build

2016-09-19 Thread Olaf Flebbe (JIRA)

 [ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Olaf Flebbe updated ZOOKEEPER-2594:
---
Attachment: compile.log

> Use TLS for downloading artifacts during build
> --
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Affects Versions: 3.4.9, 3.5.2
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>Priority: Blocker
>  Labels: security
> Fix For: 3.4.10, 3.5.3, 3.6.0
>
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> ZOOKEEPER-2594.patch, compile.log
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-2594) Use TLS for downloading artifacts during build

2016-09-19 Thread Olaf Flebbe (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15505657#comment-15505657
 ] 

Olaf Flebbe commented on ZOOKEEPER-2594:


Regarding Tests: One cannot state a difference in the PreCommit Output since 
the artifacts have been cached by previous runs of the build.  In order to see 
the patch working one has to create a clean working environment. I am attaching 
a compile.log where you can see the  https:// URI rather http://

> Use TLS for downloading artifacts during build
> --
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Affects Versions: 3.4.9, 3.5.2
>Reporter: Olaf Flebbe
>Assignee: Olaf Flebbe
>Priority: Blocker
>  Labels: security
> Fix For: 3.4.10, 3.5.3, 3.6.0
>
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch, 
> ZOOKEEPER-2594.patch, compile.log
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-2594) Use TLS for downloading

2016-09-19 Thread Olaf Flebbe (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15504376#comment-15504376
 ] 

Olaf Flebbe commented on ZOOKEEPER-2594:


Patch is relative to git head

> Use TLS for downloading
> ---
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Reporter: Olaf Flebbe
>  Labels: security
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (ZOOKEEPER-2594) Use TLS for downloading

2016-09-19 Thread Olaf Flebbe (JIRA)

 [ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Olaf Flebbe updated ZOOKEEPER-2594:
---
Attachment: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch

> Use TLS for downloading
> ---
>
> Key: ZOOKEEPER-2594
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: build
>Reporter: Olaf Flebbe
>  Labels: security
> Attachments: 0001-ZOOKEEPER-2594-Use-TLS-for-downloading.patch
>
>
> Zookeeper builds are downloading dependencies using the insecure http:// 
> protocol. 
> An outdated java.net repository can be removed now, since its content is now 
> on maven.org.
> The https://repo2.maven.org cannot be used, since its certificate is invalid. 
> Use repo1.maven.org instead (IMHO this is intentional).
> Appended you'll find a proposed patch (against git head) to fix these issues, 
> for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Created] (ZOOKEEPER-2594) Use TLS for downloading

2016-09-19 Thread Olaf Flebbe (JIRA)
Olaf Flebbe created ZOOKEEPER-2594:
--

 Summary: Use TLS for downloading
 Key: ZOOKEEPER-2594
 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2594
 Project: ZooKeeper
  Issue Type: Improvement
  Components: build
Reporter: Olaf Flebbe


Zookeeper builds are downloading dependencies using the insecure http:// 
protocol. 

An outdated java.net repository can be removed now, since its content is now on 
maven.org.

The https://repo2.maven.org cannot be used, since its certificate is invalid. 
Use repo1.maven.org instead (IMHO this is intentional).

Appended you'll find a proposed patch (against git head) to fix these issues, 
for a starter.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-1604) remove rpm/deb/... packaging

2016-03-13 Thread Olaf Flebbe (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-1604?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15192446#comment-15192446
 ] 

Olaf Flebbe commented on ZOOKEEPER-1604:


Exim is not in any way installed by Bigtop on Centos/RHEL. At least not in 
Bigtop-1.0.0 or later.

LSB-core happens to require a MTA, any one. And Centos/RHEL redhat-lsb-core 
chooses sendmail rather then exim at least in the bigtop default setup.

{code}
rpm -q zookeeper-server redhat-lsb-core sendmail exim
zookeeper-server-3.4.6-1.el6.x86_64
redhat-lsb-core-4.0-7.el6.centos.x86_64
sendmail-8.14.4-9.el6.x86_64
package exim is not installed
{code}

Either way, please consider java a huge target for remote exploits and avoid 
it. See for instance.
https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-19117/Oracle-JRE.html
 .


> remove rpm/deb/... packaging
> 
>
> Key: ZOOKEEPER-1604
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1604
> Project: ZooKeeper
>  Issue Type: Task
>  Components: build
>Affects Versions: 3.3.0
>Reporter: Patrick Hunt
>Assignee: Chris Nauroth
> Fix For: 3.5.2, 3.6.0
>
> Attachments: ZOOKEEPER-1604.001.patch, ZOOKEEPER-1604.patch
>
>
> Remove rpm/deb/... packaging from our source repo. Now that BigTop is 
> available and fully supporting ZK it's no longer necessary for us to attempt 
> to include this.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)