I tried running it at the root project (hadoop), and got a meaningful dependency tree. It does print an exhaustive and transitive tree of dependencies.
As for log4j with your patch, I see two ways log4j is introduced: - log4j -> hadoop-common@2.8.5 -> hadoop-yarn-server-timelineservice-hbase-tests - log4j -> solr:slor-core@8.11.2 -> hadoop-yarn-applications-catalog-webapp:war That said, both are test-scoped. I'm not sure why we're packaging test-only dependencies into the hadoop distro. Is it a known thing? Sangjin On Tue, Feb 13, 2024 at 10:07 AM Steve Loughran <ste...@cloudera.com.invalid> wrote: > it does, but i'm not sure if there is a single module where you can ask for > it and get the full list. > > For that verification project I've got I may declare more poms as > dependencies so can do the aggregate scan there. this would also let me run > maven dependency -verbose, save the output to a file and see what is there. > would let us define lists of libraries we don't want in distributions > > On Mon, 12 Feb 2024 at 18:03, Sangjin Lee <sjl...@gmail.com> wrote: > > > Does the maven dependency plugin help? I might try mvn dependency:tree > and > > see if it takes you somewhere. > > > > Sangjin > > > > > > On Mon, Feb 12, 2024 at 9:50 AM Steve Loughran > <ste...@cloudera.com.invalid > > > > > wrote: > > > > > how can we work out the entire DAG of dependencies in a hadoop distro? > > > > > > I'm asking as there are things in 3.4.0 that we shouldn't need > (protobuf > > > 2.5), and when I add the pR to move off log4j 1.17 to reload4j, I still > > > find one in the yarn timeline lib dir > > > https://github.com/apache/hadoop/pull/6547 > > > > > > > > > see HADOOP-19074 for a list of what is in 3.4.0 RC0, which predates the > > new > > > shaded jar. > > > > > >
