In my opinion we have a few reasonable options, especially considering this is the last release from branch-1.
1. Make the hbase-thrift module's activation contingent of compilation with a Java 8+ JDK. Here's an example of how to do that: https://github.com/apache/hbase/pull/251 ( https://github.com/apache/hbase/pull/251/files#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8) . Dependencies in other modules (like hbase-assembly) would need to be made optional. Downside here is our official release will not provide hbase-thrift artifacts to Maven as all others did. Users who want hbase-thrift would need to recompile with Java 8+ locally. 2. Compile the fixed Thrift version ourselves with Java 7 and shade the result into a org.apache.hbase.thirdparty namespace, release this new hbase-shaded-thrift, then update branch-1 POMs to depend on this artifact instead. All of the import statements in the generated files in hbase-thrift/src/ will need updating too, but we'd only need to do that once since this is the end of the road and generating them again seems unlikely. We would continue to release hbase-thrift, and, bonus, it won't conflict with any other thrift libraries on the user classpath. 3. Ignore this issue and keep the version of the Thrift dependency in branch-1 to a version that is still compatible with Java 7. We would also continue to release hbase-thrift but we should advise in release notes about the known CVEs. The question really falls to Reid... How much work do you want to do ? What seems like a reasonable compromise? On Tue, Apr 13, 2021 at 12:35 AM Reid Chan <[email protected]> wrote: > Hi team and community: > > This is the error message when I tried to make a release 1.7.0: > > [INFO] Restricted to JDK 1.7 yet > org.apache.thrift:libthrift:jar:0.13.0:compile contains > org/apache/thrift/TNonblockingMultiFetchClient.class targeted to JDK 1.8 > HBase has unsupported dependencies. > HBase requires that all dependencies be compiled with version 1.7 or > earlier > of the JDK to properly build from source. You appear to be using a newer > dependency. You can use > either "mvn -version" or "mvn enforcer:display-info" to verify what > version is active. > Non-release builds can temporarily build with a newer JDK version by > setting the > 'compileSource' property (eg. mvn -DcompileSource=1.8 clean package). > Found Banned Dependency: org.apache.thrift:libthrift:jar:0.13.0 > [ERROR] Failed to execute goal > org.apache.maven.plugins:maven-enforcer-plugin:3.0.0-M1:enforce > (enforce-maven-version) on project hbase-thrift: Some Enforcer rules have > failed. Look above for specific messages explaining why the rule failed. -> > [Help 1] > [ERROR] > [ERROR] To see the full stack trace of the errors, re-run Maven with the -e > switch. > [ERROR] Re-run Maven using the -X switch to enable full debug logging. > [ERROR] > [ERROR] For more information about the errors and possible solutions, > please read the following articles: > [ERROR] [Help 1] > http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException > [ERROR] > [ERROR] After correcting the problems, you can resume the build with the > command > [ERROR] mvn <args> -rf :hbase-thrift > > > This happened at Thrift module, it seems that thrift-0.13.0 is targeted to > JDK 1.8, but I need to use JDK 7 to do the release. > > Thus I couldn't run the make_rc.sh successfully, any hints or experiences > about how to resolve this? > > > ------ > Best Regards, > R.C > -- Best regards, Andrew Words like orphans lost among the crosstalk, meaning torn from truth's decrepit hands - A23, Crosstalk
