Jackie-Jiang commented on code in PR #20112:
URL: https://github.com/apache/pinot/pull/20112#discussion_r4475554960
##########
pinot-tools/pom.xml:
##########
@@ -99,7 +99,7 @@
</dependency>
<dependency>
<groupId>org.apache.pinot</groupId>
- <artifactId>pinot-kafka-3.0</artifactId>
+ <artifactId>pinot-kafka-4.0</artifactId>
Review Comment:
[P1] Package jose4j with the Kafka 4 plugin
Replacing Kafka 3 removes its transitive `org.bitbucket.b_c:jose4j` runtime
dependency, which previously came through `kafka_2.13`. The Kafka 4 plugin
depends on `kafka-clients`, whose POM does not supply jose4j, and there is no
remaining runtime dependency supplying it. Kafka 4's built-in OAuth callback
still requires it: constructing `DefaultJwtValidator` throws
`NoClassDefFoundError: org/jose4j/keys/resolvers/VerificationKeyResolver`,
preventing OAuth consumer/AdminClient initialization even with the documented
URL allowlist configured.
A class-loading probe against Kafka 4.2.0 reproduced the failure at
`getDeclaredConstructor()` and succeeded after adding jose4j. Please add an
explicit managed runtime dependency to `pinot-kafka-4.0` and cover OAuth
callback initialization using the packaged runtime classpath; the current
callback tests only verify class-name translation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
