[CASSANDRA-17750] Remove dependency on Maven Ant Tasks

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 5.0-beta1, 5.0, 5.1
• Component/s: Build, Dependencies, Packaging
• Labels: pull-request-available
• Change Category: Operability
• Complexity: Normal
• Platform: All
• Impacts: Security

Source Control Link

https://github.com/apache/cassandra-website/commit/7c5a25d7bc73786b37f21b6588b00f5de81fd0d0

Test and Documentation Plan

builds

• Assignee: Abe Ratnofsky
• Reporter: Abe Ratnofsky

Authors

Abe Ratnofsky

Reviewers

David Capwell, Ekaterina Dimitrova, Michael Semb Wever

• Created: 12/Jul/22 21:19
• Updated: 09/Nov/23 10:01
• Resolved: 25/Aug/22 05:41

Description

Apache Cassandra depends on Maven Ant Tasks (MAT) during build, for declaring dependencies and generating POM files from within build.xml. MAT has long been retired (no commits since maintenance in 2015), has registered CVEs in dependencies (CVE-2017-1000487), and encourages migration to its successor, Maven Artifact Resolver Ant Tasks (MARAT).

As part of CASSANDRA-16391 <https://issues.apache.org/jira/browse/CASSANDRA-16391>, mck migrated dependency resolution to MARAT, but MAT is still included in our build for generating POMs since MARAT does not have an alternative to the writepom task provided by MAT. I have a patch ready that removes MAT completely, with a workaround for POM generation.

I am not advocating for any kind of migration away from Ant to an alternative like Gradle or Maven, just to be extra clear.

Issue Links

• causes: CASSANDRA-17946 Upgrade back Mockito to 4.7.0 after CASSANDRA-17750
• relates to: CASSANDRA-18799 Update org.caffinitas.ohc:ohc-core dependency and remove org.caffinitas.ohc:ohc-core-j8
• links to: GitHub Pull Request #170