[
https://issues.apache.org/jira/browse/HDDS-16683?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Attila Doroszlai updated HDDS-16683:
------------------------------------
Fix Version/s: 2.3.0
Resolution: Done
Status: Resolved (was: Patch Available)
> Upgrade Jetty from 12.0.38 to 12.1.14
> -------------------------------------
>
> Key: HDDS-16683
> URL: https://issues.apache.org/jira/browse/HDDS-16683
> Project: Apache Ozone
> Issue Type: Improvement
> Reporter: Andrey Yarovoy
> Assignee: Andrey Yarovoy
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.3.0
>
>
> h2. Problem
> HDDS-8280 moved Ozone from Jetty 9.4 to Jetty \{{12.0.38}} on the EE8
> environment (\{{javax.servlet}} 4.0).
> Jetty has since opened the \{{12.1.x}} line, currently at \{{12.1.13}}, which
> is where new work and most
> fixes now land.
> This is a get-ahead-of-it upgrade, not a forced one: the \{{12.0.x}} line is
> still actively released
> (\{{12.0.39}} shipped after our pin), so nothing is end-of-life today. The
> reason to do it now is that the
> Ozone surface is small and verifiably unaffected, which will not stay true
> indefinitely — and \{{12.1.x}}
> is also where the Jakarta EE 11 environment lives, which is the eventual exit
> path off EE8.
> h2. Current shape
> | Item | Value | Where |
> |---|---|---|
> | \{{jetty.version}} | \{{12.0.38}} | \{{pom.xml}} L113 |
> | BOMs | \{{org.eclipse.jetty:jetty-bom}} +
> \{{org.eclipse.jetty.ee8:jetty-ee8-bom}} | \{{pom.xml}} L263-271 |
> | \{{servlet-api.version}} | \{{4.0.9}}
> (\{{org.eclipse.jetty.toolchain:jetty-servlet-api}}) | \{{pom.xml}} L201,
> L1585 |
> | EE8 artifacts in use | \{{jetty-ee8-}}\{{{}servlet, webapp, nested, proxy,
> cdi{}}} | framework, server-scm, ozone-manager, recon, s3gateway,
> httpfsgateway, integration-test-s3 |
> | Jetty import footprint | 30 distinct types — \{{server.*}}, \{{util.*}},
> \{{http.*}}, \{{ee8.*}} only | 13 files |
> h2. Proposed change
> Bump \{{jetty.version}} to \{{12.1.13}}. Keep EE8, keep
> \{{servlet-api.version}} at \{{4.0.9}}, keep every
> artifact coordinate. In principle a one-property change plus whatever the
> verification below turns up.
> h2. Behavior-default changes to assert, not assume
> These are the real risk in this upgrade. Each is a silent default flip in a
> knob Ozone does not currently
> set, so the existing tests would not notice:
> * \{{HttpConfiguration.maxResponseHeaderSize}} default \{{-1}} → \{{16384}}.
> * \{{HttpConfiguration.relativeRedirectAllowed}} default flipped to \{{true}}
> (jetty#11947).
> * \{{SslContextFactory.renegotiationAllowed}} default → \{{false}}
> (jetty#12378).
> * Session \{{flushOnResponseCommit}} default → \{{true}} (jetty#12339).
> * \{{UriCompliance}} is now also applied to query-string parsing
> (jetty#12750), and a new
> {\{UriCompliance.Violation.FRAGMENT}} exists (jetty#11579). This touches
> Ozone directly:
> {\{OZONE_AMBIGUOUS_URI_COMPLIANCE}} in \{{HttpServer2}} and the
> \{{allowAmbiguousUri}} opt-ins in S3
> Gateway and httpfs.
> * EE8/EE9 \{{ContextHandler.setCompactPath}} behavior was restored for
> back-compat (jetty#12821).
> h2. Scope
> Included: the version bump, any exclusion or \{{dependency:analyze}} fallout
> it causes, and tests covering
> the default flips above — extending \{{TestHttpServer2}},
> \{{TestHttpServer2SSL}} and \{{TestBaseHttpServer}}
> rather than adding new suites.
> Out of scope: migrating off EE8 to EE10 or EE11, and adopting any new 12.1
> feature
> (\{{CompressionHandler}}, the new deployer, \{{MultiAuthenticator}}). Each is
> its own Jira.
> h2. How to verify
> # \{{mvn -q validate}} at root (sortpom \{{verifyFailOn=Strict}}), then
> {\{mvn clean install -DskipTests -DskipShade -DskipRecon -DskipDocs}}.
> # \{{mvn dependency:tree
> -Dincludes=org.eclipse.jetty:*,org.eclipse.jetty.ee8:*,org.eclipse.jetty.toolchain:*}}
> — every coordinate reads \{{12.1.13}} (\{{4.0.9}} for
> \{{jetty-servlet-api}}); no \{{12.0.*}}, no \{{9.4.*}},
> no \{{ee9}}/\{{ee10}}/\{{ee11}}.
> # \{{mvn dependency:tree -Dincludes=javax.servlet:*,jakarta.servlet:*}} —
> empty.
> # \{{build.sh}} *without* \{{-Dmdep.analyze.skip}} — \{{analyze-only}} runs
> at \{{verify}} and "Used
> undeclared dependency" is CI-fatal.
> # Framework and s3gateway unit suites; then \{{checkstyle.sh}}.
> # \{{mvn -Pdist -DskipTests package}}, then \{{dependency.sh}} and
> \{{license.sh}}, applying the reported
> {\{jar-report.txt}} diff mechanically.
> # Compose smoketests — \{{ozone}}, \{{ozonesecure}}, the s3/secret suites,
> and an httpfs run —
> spot-checking \{{/conf}}, \{{/jmx}}, \{{/prom}}, \{{/logLevel}},
> \{{/stacks}}, \{{/logs}}, \{{/static}}, the
> Recon UI, and S3 Gateway XML content types. The dist-only runtime regressions
> in HDDS-8280 (Recon JAXB,
> s3g Weld bean discovery) were invisible to unit tests, so the dist run is not
> optional.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
