[
https://issues.apache.org/jira/browse/HADOOP-19912?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jose Luis López updated HADOOP-19912:
-------------------------------------
Attachment: report-maven.md
> Upgrade to Jetty 12 on the ee8 environment keeping javax.servlet
> ----------------------------------------------------------------
>
> Key: HADOOP-19912
> URL: https://issues.apache.org/jira/browse/HADOOP-19912
> Project: Hadoop Common
> Issue Type: Task
> Reporter: PJ Fanning
> Assignee: Jose Luis López
> Priority: Major
> Labels: pull-request-available
> Attachments: report-maven.md
>
>
> The goal of this task is to move Hadoop's web servers off Jetty 9.4, which is
> end of life: its releases are now rare and sponsored, and its CVEs keep
> coming (HADOOP-19910, HADOOP-19915).
> h3. Approach
> Jetty 12 serves two servlet APIs side by side: the ee8 environment serves
> {{javax.servlet}}, while ee10 and ee11 serve {{jakarta.servlet}}. This issue
> moves Hadoop to Jetty 12 on ee8, so the servlet namespace, Jersey 2 and every
> public signature stay as they are.
> We will rollout changes to the modules preparing them for the migration to
> Jetty12-ee8 (handling of the HTTP reason code, auth filters, others).
> The move to the jakarta namespace (Jetty ee10, Jersey 3, JAXB 4) is a
> separate decision, tracked in HADOOP-19395, which starts from here.
> Jetty 12 needs Java 17, so this is for trunk. Release lines that stay on
> Jetty 9.4 are covered by HADOOP-19915.
> h3. Tasks
> * Resolve one Jetty release and one servlet API on every module classpath,
> without changing the Jetty version.
> * Drop jetty-util-ajax in favour of Jackson.
> * Upgrade Jetty 9.4 to 12 on the ee8 environment: {{HttpServer2}}, KMS,
> HttpFS, the YARN web apps, WebSocket, SLS, the services API, the shaded
> clients and LICENSE-binary. Keep trunk's behaviour wherever Jetty 12 allows,
> and list the rest for the release note.
> * Move the YARN application catalog off Jetty 9.4, the last Jetty 9.4 in the
> build, which it needs for Solr 8: retire the module, or upgrade it to Solr 10.
> * Remove the JAX-RS 1.1 API ({{jsr311-api}}) from
> {{hadoop-yarn-server-timelineservice-hbase-tests}}, where it duplicates
> JAX-RS 2.1 on the classpath.
> * Upgrade Guice to 6.X, as supports both javax and jakarta namespaces.
> h3. Behaviour changes
> The Jetty 12 upgrade is an incompatible change. Its release note covers what
> Jetty 12 changes for callers:
> * no custom HTTP reason phrase; refusal messages travel in the response body
> instead, and Hadoop's clients read them there;
> * stricter URI parsing, adjustable with
> {{hadoop.http.uri.compliance.violations}};
> * TLS 1.2 renegotiation off by default, adjustable with
> {{hadoop.http.ssl.renegotiation.allowed}};
> * the five async HTTP metrics read 0, because Jetty 12 cannot count them;
> * Jetty's own output: error-page markup, {{charset=utf-8}} and {{Vary}} on
> static files, a {{Date}} header on error responses, and the default acceptor
> count.
> h3. Done when
> * No Jetty 9.4 artifact is left on any module classpath of the trunk build.
> * Every daemon serves on Jetty 12, and the full test suite passes.
> * The release note lists every incompatible change.
> h3. Out of scope
> * The jakarta namespace, Jetty ee10/ee11, Jersey 3 and JAXB 4: HADOOP-19395.
> * Jetty 9.4 security updates on release lines that cannot move to Java 17:
> HADOOP-19915.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
