I'm +1 on maintaining JDK7 compatibility and releasing 1.7.0 with the older Thrift version.
Peter On Wed, Apr 14, 2021 at 5:01 AM Nick Dimiduk <[email protected]> wrote: > hbase-thrift is itself optional though. It’s “just” a gateway, not a core > service. Agree, where it’s used, it’s critical for those users. But it’s > not in the critical path for all users. Maybe it’s easier to bend on this > than the minimum JDK version? Just a thought... > > On Tue, Apr 13, 2021 at 18:27 张铎(Duo Zhang) <[email protected]> wrote: > > > The hbase-thrift module depends on thrift, it can not be optional... > > > > Nick Dimiduk <[email protected]> 于2021年4月14日周三 上午8:44写道： > > > > > Oh. Bad. > > > > > > Can we mark the Thrift dependency optional, mark the ANNOUNCEMENT with > a > > > big fat notice, and let users proceed at their own risk? > > > > > > On Tue, Apr 13, 2021 at 2:05 PM Geoffrey Jacoby <[email protected]> > > > wrote: > > > > > > > It appears that both thrift 0.12 (which HBase 1.6 uses) and Thrift > 0.13 > > > > (which HBase 1.7 is targeted for and that Reid is having trouble > > building > > > > for JDK 7) have CVEs attached to them, which is why later branches > are > > > > using Thrift 0.14.1. > > > > > > > > (See CVE-2019-0205 [1] for Thrift 0.12, and CVE-2020-13949 [2] for > both > > > > Thrift 0.12 and 0.13) > > > > > > > > Given that we need to support JDK 7 due to HBase 1.x compatibility > > > > guidelines, and the 0.14 version of Thrift doesn't support JDK 7 [3], > > do > > > we > > > > have a way forward? I hope so, but I'm not seeing one offhand. > > > > > > > > Geoffrey > > > > > > > > [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0205 > > > > [2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13949 > > > > [3] https://github.com/apache/thrift/blob/v0.14.0/LANGUAGES.md > > > > > > > > On Tue, Apr 13, 2021 at 12:35 AM Reid Chan <[email protected]> > > > wrote: > > > > > > > > > Hi team and community: > > > > > > > > > > This is the error message when I tried to make a release 1.7.0: > > > > > > > > > > [INFO] Restricted to JDK 1.7 yet > > > > > org.apache.thrift:libthrift:jar:0.13.0:compile contains > > > > > org/apache/thrift/TNonblockingMultiFetchClient.class targeted to > JDK > > > 1.8 > > > > > HBase has unsupported dependencies. > > > > > HBase requires that all dependencies be compiled with version 1.7 > > or > > > > > earlier > > > > > of the JDK to properly build from source. You appear to be > using a > > > > newer > > > > > dependency. You can use > > > > > either "mvn -version" or "mvn enforcer:display-info" to verify > what > > > > > version is active. > > > > > Non-release builds can temporarily build with a newer JDK version > > by > > > > > setting the > > > > > 'compileSource' property (eg. mvn -DcompileSource=1.8 clean > > package). > > > > > Found Banned Dependency: org.apache.thrift:libthrift:jar:0.13.0 > > > > > [ERROR] Failed to execute goal > > > > > org.apache.maven.plugins:maven-enforcer-plugin:3.0.0-M1:enforce > > > > > (enforce-maven-version) on project hbase-thrift: Some Enforcer > rules > > > have > > > > > failed. Look above for specific messages explaining why the rule > > > failed. > > > > -> > > > > > [Help 1] > > > > > [ERROR] > > > > > [ERROR] To see the full stack trace of the errors, re-run Maven > with > > > the > > > > -e > > > > > switch. > > > > > [ERROR] Re-run Maven using the -X switch to enable full debug > > logging. > > > > > [ERROR] > > > > > [ERROR] For more information about the errors and possible > solutions, > > > > > please read the following articles: > > > > > [ERROR] [Help 1] > > > > > > > > > http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException > > > > > [ERROR] > > > > > [ERROR] After correcting the problems, you can resume the build > with > > > the > > > > > command > > > > > [ERROR] mvn <args> -rf :hbase-thrift > > > > > > > > > > > > > > > This happened at Thrift module, it seems that thrift-0.13.0 is > > targeted > > > > to > > > > > JDK 1.8, but I need to use JDK 7 to do the release. > > > > > > > > > > Thus I couldn't run the make_rc.sh successfully, any hints or > > > experiences > > > > > about how to resolve this? > > > > > > > > > > > > > > > ------ > > > > > Best Regards, > > > > > R.C > > > > > > > > > > > > > > >
