[ https://issues.apache.org/jira/browse/SOLR-15966?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jan Høydahl updated SOLR-15966: ------------------------------- Description: Smoke tester found this {code:java} RuntimeError: JAR file "/private/tmp/smoke_solr_9.0.0_96bb28303424e40d1db18a9904729521d12926dc_6/unpack/solr-9.0.0/server/solr-webapp/webapp/WEB-INF/lib/jsr305-3.0.2.jar" contains sheisty class "javax/annotation/CheckForNull.class" {code} Our build includes the jar as a depenendcy of google libs {code:java} com.google.code.findbugs:annotations:3.0.1 (1 constraints: 0605fb35) com.google.code.findbugs:jsr305:3.0.2 (9 constraints: 057f5545) {code} {code:java} ./gradlew why --hash 057f5545 ... > Task :why com.google.code.findbugs:jsr305:3.0.2 com.google.api:api-common -> 3.0.2 com.google.api:gax -> 3.0.2 com.google.auth:google-auth-library-oauth2-http -> 3.0.2 com.google.cloud:google-cloud-core -> 3.0.2 com.google.cloud:google-cloud-nio -> 3.0.2 com.google.cloud:google-cloud-storage -> 3.0.2 com.google.code.findbugs:annotations -> 3.0.1 com.google.guava:guava -> 3.0.2 com.google.http-client:google-http-client -> 3.0.2 {code} Although it is "safe" to include this with Java11 (the package javax.annotations is not defined in JDK 11), it is better not to ship it since it is not needed runtime. Also, the {{gcs-repository]} module has this one {code} RuntimeError: JAR file "/private/tmp/smoke_solr_9.0.0_96bb28303424e40d1db18a9904729521d12926dc_7/unpack/solr-9.0.0/modules/gcs-repository/lib/javax.annotation-api-1.3.2.jar" contains sheisty class "javax/annotation/sql/DataSourceDefinitions.class" {code} was: Smoke tester found this {code:java} RuntimeError: JAR file "/private/tmp/smoke_solr_9.0.0_96bb28303424e40d1db18a9904729521d12926dc_6/unpack/solr-9.0.0/server/solr-webapp/webapp/WEB-INF/lib/jsr305-3.0.2.jar" contains sheisty class "javax/annotation/CheckForNull.class" {code} Our build includes the jar as a depenendcy of google libs {code:java} com.google.code.findbugs:annotations:3.0.1 (1 constraints: 0605fb35) com.google.code.findbugs:jsr305:3.0.2 (9 constraints: 057f5545) {code} {code:java} ./gradlew why --hash 057f5545 ... > Task :why com.google.code.findbugs:jsr305:3.0.2 com.google.api:api-common -> 3.0.2 com.google.api:gax -> 3.0.2 com.google.auth:google-auth-library-oauth2-http -> 3.0.2 com.google.cloud:google-cloud-core -> 3.0.2 com.google.cloud:google-cloud-nio -> 3.0.2 com.google.cloud:google-cloud-storage -> 3.0.2 com.google.code.findbugs:annotations -> 3.0.1 com.google.guava:guava -> 3.0.2 com.google.http-client:google-http-client -> 3.0.2 {code} Although it is "safe" to include this with Java11 (the package javax.annotations is not defined in JDK 11), it is better not to ship it since it is not needed runtime. > Get rid of WEB-INF/lib/jsr305-3.0.2.jar > --------------------------------------- > > Key: SOLR-15966 > URL: https://issues.apache.org/jira/browse/SOLR-15966 > Project: Solr > Issue Type: Bug > Security Level: Public(Default Security Level. Issues are Public) > Components: Build > Reporter: Jan Høydahl > Priority: Blocker > Fix For: 9.0 > > > Smoke tester found this > {code:java} > RuntimeError: JAR file > "/private/tmp/smoke_solr_9.0.0_96bb28303424e40d1db18a9904729521d12926dc_6/unpack/solr-9.0.0/server/solr-webapp/webapp/WEB-INF/lib/jsr305-3.0.2.jar" > contains sheisty class "javax/annotation/CheckForNull.class" {code} > Our build includes the jar as a depenendcy of google libs > {code:java} > com.google.code.findbugs:annotations:3.0.1 (1 constraints: 0605fb35) > com.google.code.findbugs:jsr305:3.0.2 (9 constraints: 057f5545) {code} > {code:java} > ./gradlew why --hash 057f5545 > ... > > Task :why > com.google.code.findbugs:jsr305:3.0.2 > com.google.api:api-common -> 3.0.2 > com.google.api:gax -> 3.0.2 > com.google.auth:google-auth-library-oauth2-http -> 3.0.2 > com.google.cloud:google-cloud-core -> 3.0.2 > com.google.cloud:google-cloud-nio -> 3.0.2 > com.google.cloud:google-cloud-storage -> 3.0.2 > com.google.code.findbugs:annotations -> 3.0.1 > com.google.guava:guava -> 3.0.2 > com.google.http-client:google-http-client -> 3.0.2 {code} > Although it is "safe" to include this with Java11 (the package > javax.annotations is not defined in JDK 11), it is better not to ship it > since it is not needed runtime. > Also, the {{gcs-repository]} module has this one > {code} > RuntimeError: JAR file > "/private/tmp/smoke_solr_9.0.0_96bb28303424e40d1db18a9904729521d12926dc_7/unpack/solr-9.0.0/modules/gcs-repository/lib/javax.annotation-api-1.3.2.jar" > contains sheisty class "javax/annotation/sql/DataSourceDefinitions.class" > {code} -- This message was sent by Atlassian Jira (v8.20.1#820001) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org For additional commands, e-mail: issues-h...@solr.apache.org