HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8.1 due to CVEs #2895

virajjasani · 2021-04-12T12:15:56Z

No description provided.

steveloughran · 2021-04-12T18:29:54Z

I worry about the lines on the json-smart import

        <!-- HACK.  Transitive dependency for nimbus-jose-jwt.  Needed for
             packaging.  Please re-check this version when updating
             nimbus-jose-jwt.  Please read HADOOP-14903 for more details.
          -->

The assumption here is: nimbus-jose-jwt needs to be updated in sync, and kerby. Are there any related JIRAS/issues we could reference there?

virajjasani · 2021-04-13T08:58:42Z

I just tested locally and realized that nimbus-jose-jwt 9.8 does not even produce json-smart hence all the places where we have excluded json-smart from nimbus-jose-jwt no longer needs to be done. Let me also check with latest version of kerby.

virajjasani · 2021-04-13T09:06:44Z

[INFO] org.apache.hadoop:hadoop-minikdc:jar:3.4.0-SNAPSHOT
[INFO] +- commons-io:commons-io:jar:2.5:compile
[INFO] +- org.apache.kerby:kerb-simplekdc:jar:1.0.1:compile
[INFO] |  +- org.apache.kerby:kerb-client:jar:1.0.1:compile
[INFO] |  |  +- org.apache.kerby:kerby-config:jar:1.0.1:compile
[INFO] |  |  +- org.apache.kerby:kerb-core:jar:1.0.1:compile
[INFO] |  |  |  \- org.apache.kerby:kerby-pkix:jar:1.0.1:compile
[INFO] |  |  |     +- org.apache.kerby:kerby-asn1:jar:1.0.1:compile
[INFO] |  |  |     \- org.apache.kerby:kerby-util:jar:1.0.1:compile
[INFO] |  |  +- org.apache.kerby:kerb-common:jar:1.0.1:compile
[INFO] |  |  |  \- org.apache.kerby:kerb-crypto:jar:1.0.1:compile
[INFO] |  |  +- org.apache.kerby:kerb-util:jar:1.0.1:compile
[INFO] |  |  \- org.apache.kerby:token-provider:jar:1.0.1:compile
[INFO] |  |     \- com.nimbusds:nimbus-jose-jwt:jar:9.8:compile
[INFO] |  |        \- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO] |  \- org.apache.kerby:kerb-admin:jar:1.0.1:compile

&

[INFO] +- com.nimbusds:nimbus-jose-jwt:jar:9.8:compile
[INFO] |  \- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile

virajjasani · 2021-04-13T11:59:18Z

@steveloughran I have run tests locally for some affected modules and they seem fine.
However, this PR's build seems to be stuck (build#2 is still not over after 17+ hr). Thread dump from Jenkins build also doesn't seem that useful. By any chance, are you aware of any build issues with hadoop-project module specifically? My last PR change related to hadoop-project also had the similar issue, build did not post any result on PR (PR #2757 ). Hadoop commons, HDFS changes do post result on PR.
Build link here

virajjasani · 2021-04-13T17:14:01Z

json-smart is used directly by hadoop-auth and through hadoop-auth, it is used by multiple modules as transitive dependency in hadoop-common, hadoop-nfs, hadoop-hdfs, hadoop-yarn-common etc. I have run unit tests for majority modules locally and tests look good.

virajjasani · 2021-04-13T17:34:32Z

FYI @ayushtkn @jojochuang , if you would also like to take a look.
Thanks

hadoop-yetus · 2021-04-14T04:22:44Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 38s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 37s		Maven dependency ordering for branch
+1 💚	mvninstall	20m 28s		trunk passed
+1 💚	compile	23m 46s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	compile	18m 26s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	mvnsite	25m 39s		trunk passed
+1 💚	javadoc	7m 20s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	7m 47s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	28m 21s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 39s		Maven dependency ordering for patch
+1 💚	mvninstall	20m 3s		the patch passed
+1 💚	compile	20m 21s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javac	20m 21s		the patch passed
+1 💚	compile	18m 14s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	javac	18m 14s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	20m 55s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	xml	0m 2s		The patch has no ill-formed XML file.
+1 💚	javadoc	8m 25s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	8m 17s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	31m 49s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	789m 31s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	1m 52s		The patch does not generate ASF License warnings.
		1039m 7s

Reason	Tests
Failed junit tests	hadoop.tools.dynamometer.TestDynamometerInfra
	hadoop.tools.fedbalance.TestDistCpProcedure
	hadoop.tools.fedbalance.procedure.TestBalanceProcedureScheduler
	hadoop.hdfs.server.balancer.TestBalancer
	hadoop.hdfs.TestDFSStripedOutputStreamWithRandomECPolicy
	hadoop.hdfs.server.namenode.snapshot.TestNestedSnapshots
	hadoop.hdfs.server.datanode.TestDirectoryScanner
	hadoop.hdfs.TestDecommissionWithStriped
	hadoop.hdfs.tools.TestDFSZKFailoverController
	hadoop.hdfs.server.balancer.TestBalancerWithHANameNodes
	hadoop.hdfs.server.federation.router.TestRouterRpcMultiDestination

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/4/artifact/out/Dockerfile
GITHUB PR	#2895
Optional Tests	dupname asflicense codespell shellcheck shelldocs compile javac javadoc mvninstall mvnsite unit shadedclient xml
uname	Linux 8c4dde093b0c 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / 424dc72fecacbd836007856eadef7d22db1689b7
Default Java	Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/4/testReport/
Max. process+thread count	3348 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/4/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0-SNAPSHOT https://yetus.apache.org

This message was automatically generated.

virajjasani · 2021-04-14T06:00:07Z

It looks like, since we touched LICENSE-binary with this PR, the build is running tests for all modules and hence taking 17+ hr ?

jojochuang · 2021-04-14T06:12:00Z

I don't worry too much about these two dependency bump. Netty, Jetty and jackson-databind are usually more brittle.

steveloughran · 2021-04-14T11:11:09Z

well, we did successfully run the full 17+ build test run. And I now know how to force a full retest after a JAR update. Looking at the test failures, I'm going to say "unrelated"...certainly the ZK one is known to be brittle

virajjasani · 2021-04-14T11:32:26Z

And I now know how to force a full retest after a JAR update.

+1, I also feel so good to know about this.

ayushtkn · 2021-04-14T14:08:34Z

hadoop-project/pom.xml

Guess 9.8.1 is also available? Or did I check it wrong, If so we can choose that?
Otherwise the build seems happy,

That's correct, 9.8.1 seems latest. Maven repository showed highest usage for 9.8 and 9.8.1 is quite recent, hence I thought of using 9.8. However, I think we can use 9.8.1 as things look good with 9.8 so there should not be much difference with 9.8.1 either.

Edit: Just realized 9.8 is also recent only, so I agree we should go with 9.8.1

… to CVEs

ayushtkn

+1(Pending Jenkins)
The build should take a day, If nothing bothers there, Will wait for a day post that.

If anyone has concerns with this, do let me know,

hadoop-yetus · 2021-04-15T06:06:05Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 38s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 46s		Maven dependency ordering for branch
+1 💚	mvninstall	20m 46s		trunk passed
+1 💚	compile	22m 8s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	compile	19m 17s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	mvnsite	26m 51s		trunk passed
+1 💚	javadoc	7m 35s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	7m 57s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	29m 26s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 38s		Maven dependency ordering for patch
+1 💚	mvninstall	21m 10s		the patch passed
+1 💚	compile	22m 48s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javac	22m 48s		the patch passed
+1 💚	compile	20m 9s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	javac	20m 9s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	21m 48s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	xml	0m 2s		The patch has no ill-formed XML file.
+1 💚	javadoc	8m 10s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	8m 12s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	31m 17s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	789m 29s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	1m 58s		The patch does not generate ASF License warnings.
		1046m 52s

Reason	Tests
Failed junit tests	hadoop.tools.dynamometer.TestDynamometerInfra
	hadoop.tools.fedbalance.TestDistCpProcedure
	hadoop.tools.fedbalance.procedure.TestBalanceProcedureScheduler
	hadoop.yarn.client.api.impl.TestAMRMClient
	hadoop.yarn.server.nodemanager.amrmproxy.TestFederationInterceptor
	hadoop.yarn.server.timelineservice.security.TestTimelineAuthFilterForV2
	hadoop.hdfs.server.namenode.snapshot.TestNestedSnapshots
	hadoop.hdfs.TestRollingUpgrade
	hadoop.hdfs.server.namenode.ha.TestStandbyCheckpoints
	hadoop.hdfs.server.datanode.TestDirectoryScanner
	hadoop.hdfs.server.federation.router.TestRouterRpcMultiDestination

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/12/artifact/out/Dockerfile
GITHUB PR	#2895
Optional Tests	dupname asflicense codespell shellcheck shelldocs compile javac javadoc mvninstall mvnsite unit shadedclient xml
uname	Linux eaf304a72c38 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / 5d68e38f05c2d2573d5d4c69d90b89cda81e033a
Default Java	Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/12/testReport/
Max. process+thread count	3311 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/12/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0-SNAPSHOT https://yetus.apache.org

This message was automatically generated.

hadoop-yetus · 2021-04-15T07:58:57Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 43s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	16m 1s		Maven dependency ordering for branch
+1 💚	mvninstall	21m 54s		trunk passed
+1 💚	compile	22m 30s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	compile	20m 13s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	mvnsite	27m 33s		trunk passed
+1 💚	javadoc	8m 7s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	8m 18s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	29m 40s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 38s		Maven dependency ordering for patch
+1 💚	mvninstall	21m 19s		the patch passed
+1 💚	compile	23m 5s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javac	23m 5s		the patch passed
+1 💚	compile	21m 2s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	javac	21m 2s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	22m 41s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	xml	0m 1s		The patch has no ill-formed XML file.
+1 💚	javadoc	8m 9s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	8m 33s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	33m 28s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	783m 43s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	1m 57s		The patch does not generate ASF License warnings.
		1049m 20s

Reason	Tests
Failed junit tests	hadoop.tools.dynamometer.TestDynamometerInfra
	hadoop.tools.fedbalance.TestDistCpProcedure
	hadoop.tools.fedbalance.procedure.TestBalanceProcedureScheduler
	hadoop.yarn.client.api.impl.TestAMRMClient
	hadoop.yarn.server.router.clientrm.TestFederationClientInterceptor
	hadoop.hdfs.server.namenode.snapshot.TestNestedSnapshots
	hadoop.hdfs.server.datanode.TestDirectoryScanner
	hadoop.hdfs.server.federation.router.TestRouterRpcMultiDestination

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/13/artifact/out/Dockerfile
GITHUB PR	#2895
Optional Tests	dupname asflicense codespell shellcheck shelldocs compile javac javadoc mvninstall mvnsite unit shadedclient xml
uname	Linux c37c8e29993c 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / c511437f4d09d11669aa5fc348dd249d9282421d
Default Java	Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/13/testReport/
Max. process+thread count	3281 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/13/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0-SNAPSHOT https://yetus.apache.org

This message was automatically generated.

hadoop-yetus · 2021-04-15T08:16:58Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 41s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	16m 24s		Maven dependency ordering for branch
+1 💚	mvninstall	21m 49s		trunk passed
+1 💚	compile	21m 5s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	compile	18m 9s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	mvnsite	26m 35s		trunk passed
+1 💚	javadoc	7m 39s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	8m 51s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	33m 26s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 38s		Maven dependency ordering for patch
+1 💚	mvninstall	27m 5s		the patch passed
+1 💚	compile	28m 7s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javac	28m 7s		the patch passed
+1 💚	compile	24m 25s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	javac	24m 25s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	26m 30s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	xml	0m 2s		The patch has no ill-formed XML file.
+1 💚	javadoc	9m 32s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	8m 9s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	32m 21s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	772m 21s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	2m 0s		The patch does not generate ASF License warnings.
		1054m 37s

Reason	Tests
Failed junit tests	hadoop.hdfs.server.datanode.TestDirectoryScanner
	hadoop.hdfs.qjournal.server.TestJournalNodeSync
	hadoop.hdfs.TestRollingUpgrade
	hadoop.hdfs.server.namenode.snapshot.TestNestedSnapshots
	hadoop.hdfs.server.blockmanagement.TestBlockTokenWithDFSStriped
	hadoop.tools.dynamometer.TestDynamometerInfra
	hadoop.tools.fedbalance.procedure.TestBalanceProcedureScheduler
	hadoop.tools.fedbalance.TestDistCpProcedure
	hadoop.yarn.server.resourcemanager.TestSubmitApplicationWithRMHA

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/14/artifact/out/Dockerfile
GITHUB PR	#2895
Optional Tests	dupname asflicense codespell shellcheck shelldocs compile javac javadoc mvninstall mvnsite unit shadedclient xml
uname	Linux bbf3dd9c158b 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `e869d30`
Default Java	Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/14/testReport/
Max. process+thread count	3425 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/14/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0-SNAPSHOT https://yetus.apache.org

This message was automatically generated.

hadoop-yetus · 2021-04-15T23:14:37Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 43s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 41s		Maven dependency ordering for branch
+1 💚	mvninstall	24m 30s		trunk passed
+1 💚	compile	20m 44s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	compile	18m 33s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	mvnsite	27m 51s		trunk passed
+1 💚	javadoc	7m 32s		trunk passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	8m 29s		trunk passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	29m 42s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 37s		Maven dependency ordering for patch
+1 💚	mvninstall	22m 11s		the patch passed
+1 💚	compile	22m 21s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javac	22m 21s		the patch passed
+1 💚	compile	18m 59s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	javac	18m 59s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	22m 10s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	xml	0m 1s		The patch has no ill-formed XML file.
+1 💚	javadoc	8m 24s		the patch passed with JDK Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04
+1 💚	javadoc	8m 18s		the patch passed with JDK Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
+1 💚	shadedclient	32m 4s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	783m 35s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	1m 57s		The patch does not generate ASF License warnings.
		1044m 19s

Reason	Tests
Failed junit tests	hadoop.yarn.server.router.clientrm.TestFederationClientInterceptor
	hadoop.hdfs.server.federation.router.TestRouterRpc
	hadoop.hdfs.server.federation.router.TestRouterRpcMultiDestination
	hadoop.hdfs.server.namenode.ha.TestPendingCorruptDnMessages
	hadoop.hdfs.server.datanode.TestDirectoryScanner
	hadoop.hdfs.TestDFSShell
	hadoop.hdfs.server.namenode.snapshot.TestNestedSnapshots
	hadoop.hdfs.TestFileCreation
	hadoop.hdfs.TestDFSInotifyEventInputStreamKerberized
	hadoop.hdfs.server.blockmanagement.TestUnderReplicatedBlocks
	hadoop.tools.fedbalance.procedure.TestBalanceProcedureScheduler
	hadoop.tools.fedbalance.TestDistCpProcedure
	hadoop.tools.dynamometer.TestDynamometerInfra

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/16/artifact/out/Dockerfile
GITHUB PR	#2895
Optional Tests	dupname asflicense codespell shellcheck shelldocs compile javac javadoc mvninstall mvnsite unit shadedclient xml
uname	Linux c086fda257ae 4.15.0-58-generic #64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `e869d30`
Default Java	Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.10+9-Ubuntu-0ubuntu1.20.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_282-8u282-b08-0ubuntu1~20.04-b08
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/16/testReport/
Max. process+thread count	3162 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-2895/16/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0-SNAPSHOT https://yetus.apache.org

This message was automatically generated.

ayushtkn · 2021-04-16T07:04:33Z

Test failures doesn't seems related, mostly due to timeouts, or are known flaky

… to CVEs (#2895). Contributed by Viraj Jasani. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org> Conflicts: LICENSE-binary

… to CVEs (#2895). Contributed by Viraj Jasani. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>

… to CVEs (apache#2895). Contributed by Viraj Jasani. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>

Cherry-pick: HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8 due to CVEs (apache#2895). Contributed by Viraj Jasani. and bump json-smart to 2.4.7 Change-Id: I07d3b9a0917bf5b1a5bc9bfdeee6cb4c7316da0f

virajjasani changed the title ~~HADOOP-17633. Bump json-smart to 2.4.2 due to CVEs~~ HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8 due to CVEs Apr 13, 2021

ayushtkn reviewed Apr 14, 2021

View reviewed changes

HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8 due…

e869d30

… to CVEs

virajjasani force-pushed the HADOOP-17633-trunk branch from c511437 to e869d30 Compare April 14, 2021 14:41

ayushtkn approved these changes Apr 14, 2021

View reviewed changes

virajjasani changed the title ~~HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8 due to CVEs~~ HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8.1 due to CVEs Apr 15, 2021

ayushtkn merged commit f182798 into apache:trunk Apr 16, 2021

asfgit pushed a commit that referenced this pull request Apr 16, 2021

HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8 due…

bef21ce

… to CVEs (#2895). Contributed by Viraj Jasani. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org> Conflicts: LICENSE-binary

asfgit pushed a commit that referenced this pull request Apr 16, 2021

HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8 due…

9208218

… to CVEs (#2895). Contributed by Viraj Jasani. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org> Conflicts: LICENSE-binary

asfgit pushed a commit that referenced this pull request Apr 16, 2021

HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8 due…

49f6326

… to CVEs (#2895). Contributed by Viraj Jasani. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>

kiran-maturi pushed a commit to kiran-maturi/hadoop that referenced this pull request Nov 24, 2021

HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8 due…

1f1b930

… to CVEs (apache#2895). Contributed by Viraj Jasani. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>

HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8.1 due to CVEs #2895

HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to 9.8.1 due to CVEs #2895

Uh oh!

Conversation

virajjasani commented Apr 12, 2021

Uh oh!

steveloughran commented Apr 12, 2021

Uh oh!

virajjasani commented Apr 13, 2021

Uh oh!

virajjasani commented Apr 13, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

virajjasani commented Apr 13, 2021

Uh oh!

virajjasani commented Apr 13, 2021

Uh oh!

virajjasani commented Apr 13, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hadoop-yetus commented Apr 14, 2021

Uh oh!

virajjasani commented Apr 14, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jojochuang commented Apr 14, 2021

Uh oh!

steveloughran commented Apr 14, 2021

Uh oh!

virajjasani commented Apr 14, 2021

Uh oh!

ayushtkn Apr 14, 2021

Choose a reason for hiding this comment

Uh oh!

virajjasani Apr 14, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ayushtkn left a comment

Choose a reason for hiding this comment

Uh oh!

hadoop-yetus commented Apr 15, 2021

Uh oh!

hadoop-yetus commented Apr 15, 2021

Uh oh!

hadoop-yetus commented Apr 15, 2021

Uh oh!

hadoop-yetus commented Apr 15, 2021

Uh oh!

ayushtkn commented Apr 16, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

virajjasani commented Apr 13, 2021 •

edited

Loading

virajjasani commented Apr 13, 2021 •

edited

Loading

virajjasani commented Apr 14, 2021 •

edited

Loading

virajjasani Apr 14, 2021 •

edited

Loading