[CDAP-20872] Remove Tink dependency from cdap-security

cdapio · Nov 13, 2023 · 8abedf1 · 8abedf1
1 parent 4ad445e
commit 8abedf1
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 64 deletions.
diff --git a/cdap-hbase-compat-base/pom.xml b/cdap-hbase-compat-base/pom.xml
@@ -16,8 +16,8 @@
   -->
 
 <project xmlns="http://maven.apache.org/POM/4.0.0"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
   <parent>
     <artifactId>cdap</artifactId>
     <groupId>io.cdap.cdap</groupId>
@@ -138,6 +138,10 @@
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>
     </dependency>
+    <dependency>
+      <groupId>com.google.protobuf</groupId>
+      <artifactId>protobuf-java</artifactId>
+    </dependency>
   </dependencies>
 
   <build>

diff --git a/cdap-security/pom.xml b/cdap-security/pom.xml
@@ -134,10 +134,6 @@
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-minikdc</artifactId>
     </dependency>
-    <dependency>
-      <groupId>com.google.crypto.tink</groupId>
-      <artifactId>tink</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.apache.hbase</groupId>
       <artifactId>hbase-common</artifactId>
@@ -197,50 +193,6 @@
       </properties>
       <build>
         <plugins>
-          <plugin>
-            <groupId>org.apache.maven.plugins</groupId>
-            <artifactId>maven-shade-plugin</artifactId>
-            <version>3.2.4</version>
-            <configuration>
-              <createDependencyReducedPom>false</createDependencyReducedPom>
-              <artifactSet>
-                <includes>
-                  <include>com.google.crypto.tink:tink</include>
-                  <include>com.google.protobuf:protobuf-java</include>
-                </includes>
-              </artifactSet>
-              <relocations>
-                <relocation>
-                  <pattern>com.google.protobuf</pattern>
-                  <shadedPattern>io.cdap.cdap.shaded.com.google.protobuf</shadedPattern>
-                </relocation>
-                <relocation>
-                  <pattern>com.google.crypto.tink</pattern>
-                  <shadedPattern>io.cdap.cdap.shaded.com.google.crypto.tink</shadedPattern>
-                </relocation>
-              </relocations>
-            </configuration>
-            <executions>
-              <execution>
-                <id>shade</id>
-                <phase>package</phase>
-                <goals>
-                  <goal>shade</goal>
-                </goals>
-              </execution>
-              <execution>
-                <id>dist-shade</id>
-                <phase>package</phase>
-                <goals>
-                  <goal>shade</goal>
-                </goals>
-                <configuration>
-                  <outputDirectory>${stage.lib.dir}</outputDirectory>
-                  <finalName>${project.groupId}.${project.build.finalName}</finalName>
-                </configuration>
-              </execution>
-            </executions>
-          </plugin>
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-jar-plugin</artifactId>

diff --git a/pom.xml b/pom.xml
@@ -171,7 +171,6 @@
     <sshd.version>1.7.0</sshd.version>
     <tephra.version>0.15.0-incubating</tephra.version>
     <tez.version>0.8.4</tez.version>
-    <tink.version>1.6.0</tink.version>
     <thrift.version>0.9.3</thrift.version>
     <twill.version>1.3.1</twill.version>
     <unboundid.version>2.3.6</unboundid.version>
@@ -182,6 +181,8 @@
     <!-- Overwrite Apache Ivy version to 2.5.1 for remediating CVE-2022-37866-->
     <ivy.version>2.5.1</ivy.version>
     <jgit.version>5.9.0.202009080501-r</jgit.version>
+    <!-- Needed for cdap-hbase-compat-base -->
+    <protobuf.version>3.14.0</protobuf.version>
 
     <cask.packages.snapshot.repo>http://cask.invalid.snapshot.repo.co</cask.packages.snapshot.repo>
     <cask.packages.release.repo>http://cask.invalid.release.repo.co</cask.packages.release.repo>
@@ -1598,17 +1599,6 @@
         <artifactId>jackson-module-scala_2.12</artifactId>
         <version>${jackson.version}</version>
       </dependency>
-      <dependency>
-        <groupId>com.google.crypto.tink</groupId>
-        <artifactId>tink</artifactId>
-        <version>${tink.version}</version>
-        <exclusions>
-          <exclusion>
-            <groupId>com.google.code.gson</groupId>
-            <artifactId>gson</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
       <dependency>
         <groupId>commons-collections</groupId>
         <artifactId>commons-collections</artifactId>
@@ -1633,6 +1623,12 @@
         <scope>test</scope>
       </dependency>
       <!-- Git dependencies for Source Control Management end -->
+      <!-- Needed for cdap-hbase-compat-base -->
+      <dependency>
+        <groupId>com.google.protobuf</groupId>
+        <artifactId>protobuf-java</artifactId>
+        <version>${protobuf.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
@@ -2051,8 +2047,8 @@
         <package.rpm.arch>all</package.rpm.arch>
         <package.dirs>opt etc</package.dirs>
         <package.config.dirs>--config-files etc/cdap --config-files etc/logrotate.d --config-files etc/security</package.config.dirs>
-        <dependency.groupId.exclusions>org.apache.hadoop,org.apache.hbase,com.google.protobuf,\
-          org.datanucleus,asm,org.apache.spark,slf4j-log4j12,commons-logging,com.google.crypto.tink</dependency.groupId.exclusions>
+        <dependency.groupId.exclusions>org.apache.hadoop,org.apache.hbase,\
+          org.datanucleus,asm,org.apache.spark,slf4j-log4j12,commons-logging</dependency.groupId.exclusions>
       </properties>
       <build>
         <pluginManagement>