Validate netty's linkage errors. If they are false positive, then add them to the default exclusion rule

[suztomo]

https://storage.googleapis.com/cloud-opensource-java-dashboard/com.google.cloud/libraries-bom/snapshot/io.grpc_grpc-netty_1.36.0.html

org.jboss.marshalling.Marshaller

If the netty user is not using MarshallingEncoder, the linkage errors will not cause an error.

io.netty:netty-codec:4.1.52.Final
25 target classes causing linkage errors referenced from 42 source classes.

Class org.jboss.marshalling.Marshaller is not found, referenced from 3 classes ▼

io.netty.handler.codec.marshalling.ThreadLocalMarshallerProvider
io.netty.handler.codec.marshalling.MarshallingEncoder
io.netty.handler.codec.marshalling.CompatibleMarshallingEncoder
Class org.jboss.marshalling.MarshallerFactory is not found, referenced from 4 classes ▼

io.netty.handler.codec.marshalling.ThreadLocalMarshallerProvider
io.netty.handler.codec.marshalling.ThreadLocalUnmarshallerProvider
io.netty.handler.codec.marshalling.DefaultMarshallerProvider
io.netty.handler.codec.marshalling.DefaultUnmarshallerProvider
Class org.jboss.marshalling.Unmarshaller is not found, referenced from 4 classes ▼

io.netty.handler.codec.marshalling.ThreadLocalUnmarshallerProvider
io.netty.handler.codec.marshalling.ContextBoundUnmarshallerProvider
io.netty.handler.codec.marshalling.MarshallingDecoder
io.netty.handler.codec.marshalling.CompatibleMarshallingDecoder

Class org.jboss.marshalling.ByteInput is not found, referenced from 2 classes ▼

io.netty.handler.codec.marshalling.LimitingByteInput
io.netty.handler.codec.marshalling.ChannelBufferByteInput

netty-codec declares jboss-marshalling as optional.

    <dependency>
      <groupId>org.jboss.marshalling</groupId>
      <artifactId>jboss-marshalling</artifactId>
      <optional>true</optional>
    </dependency>

This indicates that only those who need this serialization algorithm declare the dependencies.

protobuf-nano

Netty supports protobuf serialization.

Class com.google.protobuf.nano.MessageNano is not found, referenced from 2 classes ▼

io.netty.handler.codec.protobuf.ProtobufDecoderNano
io.netty.handler.codec.protobuf.ProtobufEncoderNano
Class com.google.protobuf.nano.CodedOutputByteBufferNano is not found, referenced from io.netty.handler.codec.protobuf.ProtobufEncoderNano

com.google.protobuf.nano.MessageNano is in protobuf-javanano and netty-codec declares the artifact as optional dependency.

    <dependency>
      <groupId>com.google.protobuf.nano</groupId>
      <artifactId>protobuf-javanano</artifactId>
      <optional>true</optional>
    </dependency>

This indicates that only those who need this serialization algorithm declare the dependencies.

jzlib

Class com.jcraft.jzlib.Deflater is not found, referenced from 2 classes ▼

io.netty.handler.codec.compression.JZlibEncoder
io.netty.handler.codec.compression.ZlibUtil
Class com.jcraft.jzlib.JZlib is not found, referenced from 3 classes ▼

io.netty.handler.codec.compression.JZlibEncoder
io.netty.handler.codec.compression.ZlibUtil
io.netty.handler.codec.compression.JZlibDecoder

Class com.jcraft.jzlib.Inflater is not found, referenced from 2 classes ▼

io.netty.handler.codec.compression.ZlibUtil
io.netty.handler.codec.compression.JZlibDecoder
Class com.jcraft.jzlib.JZlib$WrapperType is not found, referenced from io.netty.handler.codec.compression.ZlibUtil

netty-codec declares jzlib dependency as optional.

    <dependency>
      <groupId>com.jcraft</groupId>
      <artifactId>jzlib</artifactId>
      <optional>true</optional>
    </dependency>

Netty in action Chapter 11 says this dependency is only needed when users want the compression and using JDK 6 or earlier.

lzma

Class lzma.sdk.lzma.Encoder is not found, referenced from io.netty.handler.codec.compression.LzmaFrameEncoder

lzma-java is declared as optional.

    <dependency>
      <groupId>com.github.jponge</groupId>
      <artifactId>lzma-java</artifactId>
      <optional>true</optional>
    </dependency>

This indicates that only those who need the compression algorithm declare the dependencies.

lzf

Class com.ning.compress.lzf.LZFChunk is not found, referenced from io.netty.handler.codec.compression.LzfEncoder

Class com.ning.compress.lzf.ChunkEncoder is not found, referenced from io.netty.handler.codec.compression.LzfEncoder

Class com.ning.compress.lzf.util.ChunkEncoderFactory is not found, referenced from io.netty.handler.codec.compression.LzfEncoder

Class com.ning.compress.BufferRecycler is not found, referenced from 2 classes ▼

io.netty.handler.codec.compression.LzfEncoder
io.netty.handler.codec.compression.LzfDecoder
Class com.ning.compress.lzf.LZFEncoder is not found, referenced from io.netty.handler.codec.compression.LzfEncoder

netty-codec declares compress-lzf dependency as optional.

    <dependency>
      <groupId>com.ning</groupId>
      <artifactId>compress-lzf</artifactId>
      <optional>true</optional>
    </dependency>

This indicates that only those who need the compression algorithm declare the dependencies.

tcnative.SSL

Class io.netty.internal.tcnative.SSL is not found, referenced from 8 classes ▼

io.netty.handler.ssl.ReferenceCountedOpenSslEngine
io.netty.handler.ssl.OpenSslSessionContext
io.netty.handler.ssl.ReferenceCountedOpenSslContext
io.netty.handler.ssl.OpenSslX509KeyManagerFactory
io.netty.handler.ssl.OpenSslKeyMaterialProvider
io.netty.handler.ssl.OpenSslPrivateKey
io.netty.handler.ssl.DefaultOpenSslKeyMaterial
io.netty.handler.ssl.OpenSslServerSessionContext

netty-handler declares tcnative dependency as optional:

    <dependency>
      <groupId>${project.groupId}</groupId>
      <artifactId>${tcnative.artifactId}</artifactId>
      <classifier>${tcnative.classifier}</classifier>
      <optional>true</optional>
    </dependency>

The value of ${tcnative.classifier} differs depending on profiles defined in netty-parent. By default it uses netty-tcnative but users can opt to use boringssl

      <id>boringssl</id>
      <properties>
        <tcnative.artifactId>netty-tcnative-boringssl-static</tcnative.artifactId>
        <tcnative.classifier />
      </properties>
    </profile>

Why is tcnative (netty's folk of Tomcat Native) optional? It's because netty users should choose the artifact depending on their platform:

    <dependency>
      <groupId>io.netty</groupId>
      <artifactId>netty-tcnative</artifactId>
      <version>2.0.0.Final</version>
      <classifier>${os.detected.classifier}</classifier>
    </dependency>

from Netty's documentation.

BlockHound

Netty-BlockHound integration detects blocking calls. If we don't use BlockHound, then we don't need it.

Class reactor.blockhound.integration.BlockHoundIntegration is not found, referenced from io.netty.util.internal.Hidden

Class reactor.blockhound.BlockHound$Builder is not found, referenced from io.netty.util.internal.Hidden

[suztomo]

Even if I add them to the default exclusion file, it doesn't help Beam's vendored artifact, because the shaded class files have different package names prefixed with org.apache.beam.vendor.grpc.v1p36p0.io.netty.handler.ssl.ConscryptAlpnSslEngine...

https://gist.github.com/suztomo/6e76e09b33ff834726634175c458f096

[suztomo]

Done