Siyao Meng created HDDS-17283:
---------------------------------
Summary: Pin and verify downloaded native build inputs
Key: HDDS-17283
URL: https://issues.apache.org/jira/browse/HDDS-17283
Project: Apache Ozone
Issue Type: Sub-task
Reporter: Siyao Meng
Files downloaded during the build are not pinned or verified, so the same
source can produce different artifacts depending on when and where it is built.
* libhadoop for the binary tarball ({{dist}} and {{hadoop-native-lib}}
profiles) is downloaded from the {{master}} branch of {{ozone-thirdparty}}
without a checksum. {{download-maven-plugin}} caches downloads
({{skipCache=false}}), so after {{master}} changes, a builder with an older
cached copy gets different bytes than a fresh download.
* The RocksDB source archive for {{hdds-rocks-native}} is downloaded from
GitHub without a checksum.
Proposed: reference a tag or commit instead of {{master}}, and set {{sha256}}
on each download.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
