HADOOP-18443. Upgrade snakeyaml to 1.32 #4906

ashutoshcipher · 2022-09-19T01:30:31Z

Description of PR

Upgrade snakeyaml to 1.32 to mitigate CVE-2022-38752

For code changes:

Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

hadoop-yetus · 2022-09-19T19:19:08Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 39s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+0 🆗	xmllint	0m 1s		xmllint was not available.
+0 🆗	shelldocs	0m 1s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 45s		Maven dependency ordering for branch
+1 💚	mvninstall	25m 53s		trunk passed
+1 💚	compile	23m 17s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	compile	20m 55s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	mvnsite	19m 25s		trunk passed
+1 💚	javadoc	8m 12s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	7m 22s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	35m 6s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 32s		Maven dependency ordering for patch
+1 💚	mvninstall	22m 13s		the patch passed
+1 💚	compile	22m 42s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javac	22m 42s		the patch passed
+1 💚	compile	20m 48s		the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	javac	20m 48s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	18m 51s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	javadoc	8m 8s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	7m 32s		the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	37m 34s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	798m 30s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	2m 4s		The patch does not generate ASF License warnings.
		1067m 12s

Reason	Tests
Failed junit tests	hadoop.http.TestHttpServer

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4906/1/artifact/out/Dockerfile
GITHUB PR	#4906
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux 34615d574c99 4.15.0-191-generic #202-Ubuntu SMP Thu Aug 4 01:49:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `67e5d8c`
Default Java	Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4906/1/testReport/
Max. process+thread count	4303 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4906/1/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

ashutoshcipher · 2022-09-19T20:24:31Z

hadoop.http.TestHttpServer

is unrelated to this change.

goiri · 2022-09-20T00:37:05Z

Let's get another build.

ashutoshcipher · 2022-09-20T02:59:34Z

Thanks @goiri. I have triggered another build.

hadoop-yetus · 2022-09-20T20:47:25Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 39s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+0 🆗	xmllint	0m 1s		xmllint was not available.
+0 🆗	shelldocs	0m 1s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 25s		Maven dependency ordering for branch
+1 💚	mvninstall	25m 56s		trunk passed
+1 💚	compile	23m 17s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	compile	20m 43s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	mvnsite	19m 21s		trunk passed
+1 💚	javadoc	8m 8s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	7m 26s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	35m 7s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 31s		Maven dependency ordering for patch
+1 💚	mvninstall	22m 30s		the patch passed
+1 💚	compile	22m 46s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javac	22m 46s		the patch passed
+1 💚	compile	20m 50s		the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	javac	20m 50s		the patch passed
+1 💚	blanks	0m 1s		The patch has no blanks issues.
+1 💚	mvnsite	19m 6s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	javadoc	7m 57s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	7m 21s		the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	37m 7s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	798m 22s		root in the patch passed.
+1 💚	asflicense	2m 7s		The patch does not generate ASF License warnings.
		1066m 50s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4906/2/artifact/out/Dockerfile
GITHUB PR	#4906
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux 4030eb5b332b 4.15.0-191-generic #202-Ubuntu SMP Thu Aug 4 01:49:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `6962f32`
Default Java	Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4906/2/testReport/
Max. process+thread count	4180 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4906/2/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

ashutoshcipher · 2022-09-21T00:27:23Z

@goiri, Please help in reviewing again. We don't have any UT failures now. Thanks.

ashutoshcipher · 2022-09-23T21:21:06Z

@goiri - Thanks for your review and approval. Can you additionally review below two related PRs for branch-3.3 and branch-3.2.

branch-3.2 - #4874
branch-3.3 - #4873

aajisaka · 2022-09-25T14:50:08Z

Merged into trunk. Thank you @ashutoshcipher and @goiri

ashutoshcipher · 2022-09-25T14:51:43Z

Thanks @aajisaka and @goiri

Co-authored-by: Ashutosh Gupta <ashugpt@amazon.com> Reviewed-by: Inigo Goiri <inigoiri@apache.org> Signed-off-by: Akira Ajisaka <aajisaka@apache.org>

HADOOP-18443. Upgrade snakeyaml to 1.32

67e5d8c

Trigger Build

6962f32

goiri approved these changes Sep 21, 2022

View reviewed changes

aajisaka approved these changes Sep 25, 2022

View reviewed changes

aajisaka merged commit 7923cac into apache:trunk Sep 25, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HADOOP-18443. Upgrade snakeyaml to 1.32 #4906

HADOOP-18443. Upgrade snakeyaml to 1.32 #4906

ashutoshcipher commented Sep 19, 2022 •

edited by aajisaka

hadoop-yetus commented Sep 19, 2022

ashutoshcipher commented Sep 19, 2022

goiri commented Sep 20, 2022

ashutoshcipher commented Sep 20, 2022

hadoop-yetus commented Sep 20, 2022

ashutoshcipher commented Sep 21, 2022

ashutoshcipher commented Sep 23, 2022

aajisaka commented Sep 25, 2022

ashutoshcipher commented Sep 25, 2022

HADOOP-18443. Upgrade snakeyaml to 1.32 #4906

HADOOP-18443. Upgrade snakeyaml to 1.32 #4906

Conversation

ashutoshcipher commented Sep 19, 2022 • edited by aajisaka

Description of PR

For code changes:

hadoop-yetus commented Sep 19, 2022

ashutoshcipher commented Sep 19, 2022

goiri commented Sep 20, 2022

ashutoshcipher commented Sep 20, 2022

hadoop-yetus commented Sep 20, 2022

ashutoshcipher commented Sep 21, 2022

ashutoshcipher commented Sep 23, 2022

aajisaka commented Sep 25, 2022

ashutoshcipher commented Sep 25, 2022

ashutoshcipher commented Sep 19, 2022 •

edited by aajisaka