[jira] [Commented] (HADOOP-18786) Hadoop build depends on archives.apache.org

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HADOOP-18786?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17737829#comment-17737829 ] 

ASF GitHub Bot commented on HADOOP-18786:
-----------------------------------------

ctubbsii opened a new pull request, #5789:
URL: https://github.com/apache/hadoop/pull/5789

   ### Description of PR
   
   * Use Yetus 0.14.1 from downloads.apache.org in yetus-wrapper
   * Use Maven 3.8.8 from downloads.apache.org in Win 10 Dockerfile
   * Point users to downloads.apache.org for JVSC
   * Use Solr 8.11.2 from downloads.apache.org in YARN Dockerfile
   
   ### How was this patch tested?
   
   Download links verified to work.
   
   ### For code changes:
   
   - [x] Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
   




> Hadoop build depends on archives.apache.org
> -------------------------------------------
>
>                 Key: HADOOP-18786
>                 URL: https://issues.apache.org/jira/browse/HADOOP-18786
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: build
>    Affects Versions: 3.3.6
>            Reporter: Christopher Tubbs
>            Priority: Critical
>
> Several times throughout Hadoop's source, the ASF archive is referenced, including part of the build that downloads Yetus.
> Building a release from source should not require access to the ASF archives, as that contributes to end users being subject to throttling and blocking by INFRA, for "abuse" of the archives, even though they are merely building a current ASF release from source. This is particularly problematic for downstream packagers who must build from Hadoop's source, or for CI/CD situations that depend on Hadoop's source, and particularly problematic for those end users behind a NAT gateway, because even if Hadoop's use of the archive is modest, it adds up for multiple users.
> The build should be modified, so that it does not require access to fixed versions in the archives (or should work with the upstream of those dependent projects to publish their releases elsewhere, for routine consumptions). In the interim, the source could be updated to point to the current dependency versions available on downloads.apache.org.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org