Joe McDonnell created IMPALA-11642:
--------------------------------------
Summary: Make postgresql jar a test-only dependency of Impala java
build
Key: IMPALA-11642
URL: https://issues.apache.org/jira/browse/IMPALA-11642
Project: IMPALA
Issue Type: Improvement
Components: Frontend
Affects Versions: Impala 4.2.0
Reporter: Joe McDonnell
The Impala java build has a dependency on the org.postgresql.postgresql jar:
{noformat}
<!-- https://mvnrepository.com/artifact/org.postgresql/postgresql -->
<dependency>
<groupId>org.postgresql</groupId>
<artifactId>postgresql</artifactId>
<version>${postgres.jdbc.version}</version>
</dependency>
{noformat}
This is strictly for testing purposes. Impala doesn't need to ship this jar.
Since there are regular CVEs in this postgresql jar requiring remediation, we
should stop shipping the jar. That would involve making this dependency have
the "test" scope and then fixing up this logic that references the current
location (which will change with the scope change):
{noformat}
# Hive looks for jar files in a single directory from HIVE_AUX_JARS_PATH plus
# any jars in AUX_CLASSPATH. (Or a list of jars in HIVE_AUX_JARS_PATH.)
# The Postgres JDBC driver is downloaded by maven when building the frontend.
# Export the location of Postgres JDBC driver so Ranger can pick it up.
export
POSTGRES_JDBC_DRIVER="${IMPALA_FE_DIR}/target/dependency/postgresql-${IMPALA_POSTGRES_JDBC_DRIVER_VERSION}.jar"{noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscr...@impala.apache.org
For additional commands, e-mail: issues-all-h...@impala.apache.org
