[GitHub] [beam] kennknowles commented on a change in pull request #13846: Removed conscrypt from a shaded dataflow-worker jar

[GitBox <gi...@apache.org>]

kennknowles commented on a change in pull request #13846:
URL: https://github.com/apache/beam/pull/13846#discussion_r573238061



##########
File path: runners/google-cloud-dataflow-java/worker/legacy-worker/build.gradle
##########
@@ -213,7 +206,7 @@ dependencies {
     compile project(":sdks:java:fn-execution")
     compile project(path: ":runners:google-cloud-dataflow-java:worker:windmill", configuration: "shadow")
     shadow library.java.vendored_guava_26_0_jre
-    compile "org.conscrypt:conscrypt-openjdk:2.5.1:linux-x86_64"
+    compileOnly "org.conscrypt:conscrypt-openjdk:2.5.1:linux-x86_64"

Review comment:
       Can you comment here:
   
    - why this unusual configuration? (because jar signing)
    - why is it OK? (because gRPC brings it in)
   
   Later, we can include it in the container instead of getting lucky with transitive deps.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org