You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "akatona84 (via GitHub)" <gi...@apache.org> on 2023/03/23 14:15:59 UTC
[GitHub] [hadoop] akatona84 opened a new pull request, #5507: HADOOP-18587. Fixing jettison vulnerability of hadoop-common lib
akatona84 opened a new pull request, #5507:
URL: https://github.com/apache/hadoop/pull/5507
<!--
Thanks for sending a pull request!
1. If this is your first time, please read our contributor guidelines: https://cwiki.apache.org/confluence/display/HADOOP/How+To+Contribute
2. Make sure your PR title starts with JIRA issue id, e.g., 'HADOOP-17799. Your PR title ...'.
-->
### Description of PR
### How was this patch tested?
### For code changes:
- [ ] Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
- [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`, `NOTICE-binary` files?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] akatona84 commented on a diff in pull request #5507: HADOOP-18587. Fixing jettison vulnerability of hadoop-common lib
Posted by "akatona84 (via GitHub)" <gi...@apache.org>.
akatona84 commented on code in PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#discussion_r1146418819
##########
hadoop-client-modules/hadoop-client/pom.xml:
##########
@@ -290,6 +302,10 @@
<groupId>com.github.pjfanning</groupId>
<artifactId>jersey-json</artifactId>
</exclusion>
+ <exclusion>
Review Comment:
as you wish, updating
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] pjfanning commented on a diff in pull request #5507: HADOOP-18587. Fixing jettison vulnerability of hadoop-common lib
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on code in PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#discussion_r1146339189
##########
hadoop-client-modules/hadoop-client/pom.xml:
##########
@@ -290,6 +302,10 @@
<groupId>com.github.pjfanning</groupId>
<artifactId>jersey-json</artifactId>
</exclusion>
+ <exclusion>
Review Comment:
I'm no expert on maven but I would have expected that by excluding com.github.pjfanning:jersey-json above that its jettison transitive dependency would have been excluded as a result. I could be wrong - I can have a look at what happens with the hadoop-common 3.3.5 later.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] brumi1024 commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "brumi1024 (via GitHub)" <gi...@apache.org>.
brumi1024 commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1482897517
@pjfanning is anything outstanding with this ticket? If not can we merge this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] hadoop-yetus commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "hadoop-yetus (via GitHub)" <gi...@apache.org>.
hadoop-yetus commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1481621398
:broken_heart: **-1 overall**
| Vote | Subsystem | Runtime | Logfile | Comment |
|:----:|----------:|--------:|:--------:|:-------:|
| +0 :ok: | reexec | 0m 54s | | Docker mode activated. |
|||| _ Prechecks _ |
| +1 :green_heart: | dupname | 0m 0s | | No case conflicting files found. |
| +0 :ok: | codespell | 0m 0s | | codespell was not available. |
| +0 :ok: | detsecrets | 0m 0s | | detect-secrets was not available. |
| +0 :ok: | xmllint | 0m 0s | | xmllint was not available. |
| +1 :green_heart: | @author | 0m 0s | | The patch does not contain any @author tags. |
| -1 :x: | test4tests | 0m 0s | | The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch. |
|||| _ trunk Compile Tests _ |
| +0 :ok: | mvndep | 16m 22s | | Maven dependency ordering for branch |
| +1 :green_heart: | mvninstall | 25m 40s | | trunk passed |
| +1 :green_heart: | compile | 23m 4s | | trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 |
| +1 :green_heart: | compile | 20m 28s | | trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| +1 :green_heart: | mvnsite | 2m 21s | | trunk passed |
| +1 :green_heart: | javadoc | 1m 50s | | trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 |
| +1 :green_heart: | javadoc | 1m 27s | | trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| +1 :green_heart: | shadedclient | 111m 25s | | branch has no errors when building and testing our client artifacts. |
|||| _ Patch Compile Tests _ |
| +0 :ok: | mvndep | 0m 28s | | Maven dependency ordering for patch |
| +1 :green_heart: | mvninstall | 1m 15s | | the patch passed |
| +1 :green_heart: | compile | 22m 35s | | the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 |
| +1 :green_heart: | javac | 22m 35s | | the patch passed |
| +1 :green_heart: | compile | 20m 29s | | the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| +1 :green_heart: | javac | 20m 29s | | the patch passed |
| +1 :green_heart: | blanks | 0m 0s | | The patch has no blanks issues. |
| +1 :green_heart: | mvnsite | 2m 23s | | the patch passed |
| +1 :green_heart: | javadoc | 1m 42s | | the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 |
| +1 :green_heart: | javadoc | 1m 28s | | the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| +1 :green_heart: | shadedclient | 27m 54s | | patch has no errors when building and testing our client artifacts. |
|||| _ Other Tests _ |
| +1 :green_heart: | unit | 18m 21s | | hadoop-common in the patch passed. |
| +1 :green_heart: | unit | 0m 37s | | hadoop-client in the patch passed. |
| +1 :green_heart: | asflicense | 1m 1s | | The patch does not generate ASF License warnings. |
| | | 207m 13s | | |
| Subsystem | Report/Notes |
|----------:|:-------------|
| Docker | ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5507/1/artifact/out/Dockerfile |
| GITHUB PR | https://github.com/apache/hadoop/pull/5507 |
| Optional Tests | dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint |
| uname | Linux 27c03d374f6b 4.15.0-206-generic #217-Ubuntu SMP Fri Feb 3 19:10:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux |
| Build tool | maven |
| Personality | dev-support/bin/hadoop.sh |
| git revision | trunk / ef5c70d0d6cbaa3d505b24bb70b51b630ba02c94 |
| Default Java | Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| Multi-JDK versions | /usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| Test Results | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5507/1/testReport/ |
| Max. process+thread count | 1278 (vs. ulimit of 5500) |
| modules | C: hadoop-common-project/hadoop-common hadoop-client-modules/hadoop-client U: . |
| Console output | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5507/1/console |
| versions | git=2.25.1 maven=3.6.3 |
| Powered by | Apache Yetus 0.14.0 https://yetus.apache.org |
This message was automatically generated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] akatona84 commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "akatona84 (via GitHub)" <gi...@apache.org>.
akatona84 commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1483738206
Yes... it was a mistake to revert the exclusions from hadoop-client. sorry
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] akatona84 commented on a diff in pull request #5507: HADOOP-18587. Fixing jettison vulnerability of hadoop-common lib
Posted by "akatona84 (via GitHub)" <gi...@apache.org>.
akatona84 commented on code in PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#discussion_r1146423494
##########
hadoop-client-modules/hadoop-client/pom.xml:
##########
@@ -290,6 +302,10 @@
<groupId>com.github.pjfanning</groupId>
<artifactId>jersey-json</artifactId>
</exclusion>
+ <exclusion>
Review Comment:
thx for the quick review! appreciating :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] virajjasani commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "virajjasani (via GitHub)" <gi...@apache.org>.
virajjasani commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1483675293
The build failure on trunk seems related to this change?
e.g. https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5054/21/artifact/out/branch-mvninstall-root.txt
```
[INFO] -------< org.apache.hadoop:hadoop-client-check-test-invariants >--------
[INFO] Building Apache Hadoop Client Packaging Invariants for Test 3.4.0-SNAPSHOT [106/113]
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- maven-clean-plugin:3.1.0:clean (default-clean) @ hadoop-client-check-test-invariants ---
[INFO] Deleting /home/jenkins/jenkins-agent/workspace/hadoop-multibranch_PR-5054/ubuntu-focal/src/hadoop-client-modules/hadoop-client-check-test-invariants (includes = [dependency-reduced-pom.xml], excludes = [])
[INFO]
[INFO] --- maven-antrun-plugin:1.7:run (create-testdirs) @ hadoop-client-check-test-invariants ---
[INFO] Executing tasks
main:
[mkdir] Created dir: /home/jenkins/jenkins-agent/workspace/hadoop-multibranch_PR-5054/ubuntu-focal/src/hadoop-client-modules/hadoop-client-check-test-invariants/target/test-dir
[INFO] Executed tasks
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0:enforce (enforce-banned-dependencies) @ hadoop-client-check-test-invariants ---
[INFO] Adding ignore: module-info
[INFO] Adding ignore: META-INF/versions/*/module-info
[INFO] Adding ignorable dependency: org.apache.hadoop:hadoop-annotations:null
[INFO] Adding ignore: *
[WARNING] Rule 1: org.apache.maven.plugins.enforcer.BanDuplicateClasses failed with message:
Duplicate classes found:
Found in:
org.apache.hadoop:hadoop-client-minicluster:jar:3.4.0-SNAPSHOT:compile
org.apache.hadoop:hadoop-client-runtime:jar:3.4.0-SNAPSHOT:compile
Duplicate classes:
org/apache/hadoop/shaded/org/codehaus/jettison/json/JSONWriter.class
org/apache/hadoop/shaded/org/codehaus/jettison/json/JSONException.class
org/apache/hadoop/shaded/org/codehaus/jettison/Convention.class
org/apache/hadoop/shaded/org/codehaus/jettison/badgerfish/BadgerFishXMLInputFactory.class
org/apache/hadoop/shaded/org/codehaus/jettison/mapped/TypeConverter.class
org/apache/hadoop/shaded/org/codehaus/jettison/mapped/Configuration.class
org/apache/hadoop/shaded/org/codehaus/jettison/AbstractDOMDocumentParser.class
org/apache/hadoop/shaded/org/codehaus/jettison/json/JSONArray.class
org/apache/hadoop/shaded/org/codehaus/jettison/json/JSONObject$Null.class
org/apache/hadoop/shaded/org/codehaus/jettison/AbstractXMLInputFactory.class
org/apache/hadoop/shaded/org/codehaus/jettison/AbstractDOMDocumentSerializer.class
org/apache/hadoop/shaded/org/codehaus/jettison/mapped/MappedDOMDocumentParser.class
org/apache/hadoop/shaded/org/codehaus/jettison/mapped/MappedXMLStreamWriter$JSONPropertyObject.class
org/apache/hadoop/shaded/org/codehaus/jettison/badgerfish/BadgerFishDOMDocumentSerializer.class
org/apache/hadoop/shaded/org/codehaus/jettison/mapped/MappedNamespaceConvention.class
org/apache/hadoop/shaded/org/codehaus/jettison/mapped/MappedXMLStreamWriter.class
org/apache/hadoop/shaded/org/codehaus/jettison/util/FastStack.class
org/apache/hadoop/shaded/org/codehaus/jettison/AbstractXMLOutputFactory.class
org/apache/hadoop/shaded/org/codehaus/jettison/mapped/MappedXMLStreamWriter$JSONProperty.class
org/apache/hadoop/shaded/org/codehaus/jettison/badgerfish/BadgerFishXMLStreamReader.class
org/apache/hadoop/shaded/org/codehaus/jettison/mapped/MappedXMLOutputFactory.class
org/apache/hadoop/shaded/org/codehaus/jettison/AbstractXMLStreamWriter.class
org/apache/hadoop/shaded/org/codehaus/jettison/XsonNamespaceContext.class
org/apache/hadoop/shaded/org/codehaus/jettison/json/JSONTokener.class
...
...
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] brumi1024 merged pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "brumi1024 (via GitHub)" <gi...@apache.org>.
brumi1024 merged PR #5507:
URL: https://github.com/apache/hadoop/pull/5507
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] akatona84 commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "akatona84 (via GitHub)" <gi...@apache.org>.
akatona84 commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1481502787
created this one: https://issues.apache.org/jira/browse/HADOOP-18676
but can't assign it to myself
renamed the PR title, we need to be sure to check before merging that the commit message will be correct
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] hadoop-yetus commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "hadoop-yetus (via GitHub)" <gi...@apache.org>.
hadoop-yetus commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1481809302
:broken_heart: **-1 overall**
| Vote | Subsystem | Runtime | Logfile | Comment |
|:----:|----------:|--------:|:--------:|:-------:|
| +0 :ok: | reexec | 0m 47s | | Docker mode activated. |
|||| _ Prechecks _ |
| +1 :green_heart: | dupname | 0m 0s | | No case conflicting files found. |
| +0 :ok: | codespell | 0m 0s | | codespell was not available. |
| +0 :ok: | detsecrets | 0m 0s | | detect-secrets was not available. |
| +0 :ok: | xmllint | 0m 0s | | xmllint was not available. |
| +1 :green_heart: | @author | 0m 0s | | The patch does not contain any @author tags. |
| -1 :x: | test4tests | 0m 0s | | The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch. |
|||| _ trunk Compile Tests _ |
| +0 :ok: | mvndep | 19m 47s | | Maven dependency ordering for branch |
| +1 :green_heart: | mvninstall | 36m 50s | | trunk passed |
| +1 :green_heart: | compile | 25m 10s | | trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 |
| +1 :green_heart: | compile | 21m 45s | | trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| +1 :green_heart: | mvnsite | 2m 8s | | trunk passed |
| +1 :green_heart: | javadoc | 1m 35s | | trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 |
| +1 :green_heart: | javadoc | 1m 10s | | trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| +1 :green_heart: | shadedclient | 131m 57s | | branch has no errors when building and testing our client artifacts. |
|||| _ Patch Compile Tests _ |
| +0 :ok: | mvndep | 0m 25s | | Maven dependency ordering for patch |
| +1 :green_heart: | mvninstall | 1m 15s | | the patch passed |
| +1 :green_heart: | compile | 24m 37s | | the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 |
| +1 :green_heart: | javac | 24m 37s | | the patch passed |
| +1 :green_heart: | compile | 21m 54s | | the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| +1 :green_heart: | javac | 21m 54s | | the patch passed |
| +1 :green_heart: | blanks | 0m 0s | | The patch has no blanks issues. |
| +1 :green_heart: | mvnsite | 2m 8s | | the patch passed |
| +1 :green_heart: | javadoc | 1m 28s | | the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 |
| +1 :green_heart: | javadoc | 1m 11s | | the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| -1 :x: | shadedclient | 30m 12s | | patch has errors when building and testing our client artifacts. |
|||| _ Other Tests _ |
| +1 :green_heart: | unit | 19m 31s | | hadoop-common in the patch passed. |
| +1 :green_heart: | unit | 0m 28s | | hadoop-client in the patch passed. |
| +1 :green_heart: | asflicense | 0m 52s | | The patch does not generate ASF License warnings. |
| | | 234m 17s | | |
| Subsystem | Report/Notes |
|----------:|:-------------|
| Docker | ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5507/2/artifact/out/Dockerfile |
| GITHUB PR | https://github.com/apache/hadoop/pull/5507 |
| Optional Tests | dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint |
| uname | Linux f98cc91d170b 4.15.0-206-generic #217-Ubuntu SMP Fri Feb 3 19:10:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux |
| Build tool | maven |
| Personality | dev-support/bin/hadoop.sh |
| git revision | trunk / c7b7bc455ae4a0711a90a61fa2b0f24fa9b41ff0 |
| Default Java | Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| Multi-JDK versions | /usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09 |
| Test Results | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5507/2/testReport/ |
| Max. process+thread count | 3144 (vs. ulimit of 5500) |
| modules | C: hadoop-common-project/hadoop-common hadoop-client-modules/hadoop-client U: . |
| Console output | https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5507/2/console |
| versions | git=2.25.1 maven=3.6.3 |
| Powered by | Apache Yetus 0.14.0 https://yetus.apache.org |
This message was automatically generated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] pjfanning commented on pull request #5507: HADOOP-18587. Fixing jettison vulnerability of hadoop-common lib
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1481344627
I see you added a comment to https://issues.apache.org/jira/browse/HADOOP-18587 about the issue yesterday.
The point about needing a new JIRA still stands.
It will be a while until the next hadoop release. It's likely that this will be merged but until there is a release, you will have to do the exclusion in your own build script as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] pjfanning commented on a diff in pull request #5507: HADOOP-18587. Fixing jettison vulnerability of hadoop-common lib
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on code in PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#discussion_r1146412827
##########
hadoop-client-modules/hadoop-client/pom.xml:
##########
@@ -290,6 +302,10 @@
<groupId>com.github.pjfanning</groupId>
<artifactId>jersey-json</artifactId>
</exclusion>
+ <exclusion>
Review Comment:
I think this is too cautious. If the excluded are not needed they should be removed. At least in theory, the explicit include of jettison should be enough.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] brumi1024 commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "brumi1024 (via GitHub)" <gi...@apache.org>.
brumi1024 commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1482999871
Thanks, and thanks for the review! Thanks @akatona84 for the patch! Merging to trunk.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] pjfanning commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1482997337
@brumi1024 this PR looks fine to me
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] pjfanning commented on pull request #5507: HADOOP-18587. Fixing jettison vulnerability of hadoop-common lib
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1481293694
@akatona84 could you create a new JIRA? HADOOP-18587 changes are released already. Hadoop 3.3.5 is published but I'm not sure all the announcements are done.
Could you provide evidence that hadoop 3.3.5 exposes a dependency on jettison 1.1?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] akatona84 commented on a diff in pull request #5507: HADOOP-18587. Fixing jettison vulnerability of hadoop-common lib
Posted by "akatona84 (via GitHub)" <gi...@apache.org>.
akatona84 commented on code in PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#discussion_r1146387357
##########
hadoop-client-modules/hadoop-client/pom.xml:
##########
@@ -290,6 +302,10 @@
<groupId>com.github.pjfanning</groupId>
<artifactId>jersey-json</artifactId>
</exclusion>
+ <exclusion>
Review Comment:
I added jettison as direct dependency of hadoop-common and (if i did not mistaking) these are pulling in hadoop-common in them. Just being cautious, they excluded the jersey-json (and jettison with it), so I excluded jettison too (which would come from hadoop-common now)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
[GitHub] [hadoop] virajjasani commented on pull request #5507: HADOOP-18676. Fixing jettison vulnerability of hadoop-common lib
Posted by "virajjasani (via GitHub)" <gi...@apache.org>.
virajjasani commented on PR #5507:
URL: https://github.com/apache/hadoop/pull/5507#issuecomment-1483678566
I just checked locally and the build is failing with this commit, with same error
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org