Lokesh Khurana created PHOENIX-7944:
---------------------------------------
Summary: maven-dependency-plugin analyze-only fails on hbase-2.6.0
profile due to bouncycastle jdk15on/jdk18on mismatch
Key: PHOENIX-7944
URL: https://issues.apache.org/jira/browse/PHOENIX-7944
Project: Phoenix
Issue Type: Bug
Reporter: Lokesh Khurana
Assignee: Lokesh Khurana
Fix For: 5.3.2
The 5.3.2RC1 publish-release build failed deterministically on the hbase-2.6.0
profile (3rd of 4 profiles: 2.5.0, 2.5, 2.6.0, 2.6). The
maven-dependency-plugin:3.1.1:analyze-only (enforce-dependencies) goal on
phoenix-core reports:
- Used undeclared: org.bouncycastle:bcprov-jdk15on:jar:1.68:test
- Unused declared: org.bouncycastle:bcprov-jdk18on:jar:1.79:test
Root cause: the 2.6.0 profile resolves HBase to 2.6.1-hadoop3
(hbase-2.6.0.runtime.version), whose test dependencies transitively pull the
OLD bcprov-jdk15on:1.68, while phoenix-core declares the NEW
bcprov-jdk18on:1.79.
The 2.5.x profiles do not pull jdk15on, so they pass — which is why RC0 (no
2.6.0
profile) and the 5.2.2 release never hit this. Adding the 2.6.0 profile to
hbase.profile.list (PHOENIX-XXXX / PR #2551) exposed the pre-existing latent
mismatch.
Fix: in the root pom maven-dependency-plugin config, add
org.bouncycastle:bcprov-jdk18on to <ignoredUnusedDeclaredDependencies> and
org.bouncycastle:bcprov-jdk15on to <ignoredUsedUndeclaredDependencies>,
mirroring
the existing log4j / commons-configuration2 cross-profile handling.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
