-
Notifications
You must be signed in to change notification settings - Fork 4.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[BEAM-11227] Preparing vendored gRPC upgrade from 1.26 to 1.35 #14028
Conversation
netty-tcnative-boringssl-static version from https://github.com/grpc/grpc-java/blob/master/SECURITY.md#netty
Run Java Precommit |
Run Python_PVR_Flink PreCommit |
Discussion in https://issues.apache.org/jira/browse/BEAM-11227 : does this really mark the vendored gRPC artifact out of the CVE? |
$ ../../gradlew shadowJar | ||
$ find . -name '*.jar' | ||
./build/libs/beam-vendor-grpc-1_26_0-0.1.jar | ||
$ mvn install:install-file \ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Isn't the idea of the command to test the vendored artifact built from the unsubmitted and unpublished code?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, that's the purpose of my change. The original command does not seem to install the vendors gRPC artifact locally.
I'll try to apply the change to use the new vendored gRPC version. |
|
||
static def guava_version = "30.1-jre" | ||
// protobuf version from https://search.maven.org/artifact/io.grpc/grpc-protobuf/1.36.0/jar | ||
static def protobuf_version = "3.12.0" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
According to the Linkage Checker (output), this version 3.12.0 suffers from protocolbuffers/protobuf#7827.
java.nio.ByteBuffer's method position(int) is expected to return java.nio.ByteBuffer but instead returns java.nio.Buffer;
class GrpcVendoring_1_36_0 { | ||
|
||
static def guava_version = "30.1-jre" | ||
static def protobuf_version = "3.15.3" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is the latest available version of protobuf-java. We need a version higher than 3.14.0 otherwise it hits Java 8 incompatible problem in protobuf-java 3.13.0. (comment in the ticket)
GitHub Actions failed:
This seems the problem in the build (before this PR). |
"Java Tests / Java Unit Tests (macos-latest)" passed. |
d56edc0
to
c1144fc
Compare
@@ -116,7 +116,7 @@ class PrecommitJobBuilder { | |||
steps { | |||
gradle { | |||
rootBuildScriptDir(commonJobProperties.checkoutDir) | |||
tasks(gradleTask) | |||
tasks(':installVendoredGrpc', gradleTask) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jenkins does not respect this until we tell Jenkins to do so. (That might affect other PRs?)
@@ -40,7 +40,7 @@ PostcommitJobBuilder.postCommitJob('beam_PostCommit_Java', 'Run Java PostCommit' | |||
steps { | |||
gradle { | |||
rootBuildScriptDir(commonJobProperties.checkoutDir) | |||
tasks(':javaPostCommit') | |||
tasks(':installVendoredGrpc', ':javaPostCommit') |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jenkins does not respect this until we tell Jenkins to do so. (That might affect other PRs?)
build.gradle.kts
Outdated
// Because :model:job-management:runtimeClasspath requires the vendored gRPC at configuration phase | ||
// (before execution phase), we cannot rely on task dependencies. | ||
if (!project.hasProperty("installVendoredGrpcFlag")) { | ||
project.exec { | ||
commandLine = listOf( | ||
"./gradlew", ":installVendoredGrpc", "-PinstallVendoredGrpcFlag", "--info", "--stacktrace" | ||
) | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It worked! (I'll remove this piece of code before merging this to master)
Run Java Precommit |
Run SQL Postcommit |
Run Go PreCommit |
Run Java_Examples_Dataflow_Java11 PreCommit |
Run PythonDocker PreCommit |
Run Website_Stage_GCS PreCommit |
Run GoPortable PreCommit |
Run Python PreCommit |
"SQL Post Commit Tests" succeeded. |
Run Java Postcommit |
Run Java HadoopFormatIO Performance Test |
Run BigQueryIO Streaming Performance Test Java |
Run Dataflow ValidatesRunner |
Run Spark ValidatesRunner |
Just to understand more about this, my understanding of the steps would be:
Does that sound right? |
@kennknowles Yes, that matches my understanding. Although some tests failed due to timeout, they passed at dd2df58 . I just removed unnecessary build.gradle for testing (The BEAM-11227_parallel fails the GitHub checks because the vendored artifact is not available in Maven Central yet). My branch BEAM-11227_parallel is reach for you to publish the vendored artifact to staging location. http://s.apache.org/beam-release-vendored-artifacts says:
This uploads the artifacts to the staging Apache Nexus repository. Would you perform the staging release? |
We should commit the code for the thing before I publish it, though. |
Sure, let me prepare this PR so that this can be merged to master. (I will need to remove the references to the new vendored classes) |
This PR is good for testing but you could just cherrypick the commit with the new vendoring to a separate PR. Up to you! |
@kennknowles I also think another PR is better. I just created #14242 |
OK we should be able to adjust this to just the changes to move the SDK to the new version. |
@kennknowles I created another PR #14295 (I was reluctant to manage conflicts) |
The other PR 14295 has been merged. |
This PR prepares the vendored gRPC version upgrade from 1.26 to 1.35
Todo
Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:
R: @username
).[BEAM-XXX] Fixes bug in ApproximateQuantiles
, where you replaceBEAM-XXX
with the appropriate JIRA issue, if applicable. This will automatically link the pull request to the issue.CHANGES.md
with noteworthy changes.See the Contributor Guide for more tips on how to make review process smoother.
Post-Commit Tests Status (on master branch)
Pre-Commit Tests Status (on master branch)
See .test-infra/jenkins/README for trigger phrase, status and link of all Jenkins jobs.
GitHub Actions Tests Status (on master branch)
See CI.md for more information about GitHub Actions CI.