[jira] [Assigned] (FLINK-37672) Replace protoc-jar and xolstice protobuf plugins with ascopes protobuf-maven-plugin

["Martijn Visser (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/FLINK-37672?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Martijn Visser reassigned FLINK-37672:
--------------------------------------

    Assignee: Martijn Visser

> Replace protoc-jar and xolstice protobuf plugins with ascopes protobuf-maven-plugin
> -----------------------------------------------------------------------------------
>
>                 Key: FLINK-37672
>                 URL: https://issues.apache.org/jira/browse/FLINK-37672
>             Project: Flink
>          Issue Type: Improvement
>            Reporter: Siddharth R
>            Assignee: Martijn Visser
>            Priority: Major
>              Labels: pull-request-available
>
> Flink generates Java code from .proto files with two Maven plugins that are no longer maintained: protoc-jar-maven-plugin in flink-python and flink-protobuf (last release 2020), and the xolstice protobuf-maven-plugin in flink-parquet (archived, last release 2018). The reported CVEs are in the plugin's build-time dependencies only; bumping to 0.6.1 would still leave us on an archived plugin.
> We should replace both with https://github.com/ascopes/protobuf-maven-plugin. It resolves protoc per platform without os-maven-plugin, registers the generated sources itself, and sets the executable bit on protoc every run, which removes the workaround from FLINK-11427 and FLINK-19616 in flink-parquet and unpack_build_artifact.sh. Versions 4.0.0 and later require Java 17, so we stay on 3.10.3 while Flink builds on JDK 11.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)