[ https://issues.apache.org/jira/browse/HBASE-15199?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15976032#comment-15976032 ]
Xiang Li commented on HBASE-15199: ---------------------------------- Hi [~stack] Agree with Sean. Your patch removes jruby-complete from <dependencyManagement> of hbase parent pom, which can not move it down to hbase-shell. Currently, it is already scoped to hbase-shell. If an artifact is only declared in <dependencyManagement>, it will not be actually included. Only when it is added to <dependencies> (the same level as <dependencyManagement>, not the one under <dependencyManagement>), it is added as a dependency. <dependencyManagement> can be used to control the version, scope or exclusion.., so that you do not have to specify those in every pom of child modules. > Move jruby jar so only on hbase-shell module classpath; currently globally > available > ------------------------------------------------------------------------------------ > > Key: HBASE-15199 > URL: https://issues.apache.org/jira/browse/HBASE-15199 > Project: HBase > Issue Type: Task > Components: dependencies, jruby, shell > Reporter: stack > Priority: Critical > Fix For: 2.0.0 > > Attachments: 15199.txt > > > A suggestion that came up out of internal issue (filed by Mr Jan Van Besien) > was to move the scope of the jruby include down so it is only a dependency > for the hbase-shell. jruby jar brings in a bunch of dependencies (joda time > for example) which can clash with the includes of others. Our Sean suggests > that could be good to shut down exploit possibilities if jruby was not > globally available. Only downside I can think is that it may no longer be > available to our bin/*rb scripts if we move the jar but perhaps these can be > changed so they can find the ruby jar in new location. -- This message was sent by Atlassian JIRA (v6.3.15#6346)