[HADOOP-18307] remove hadoop-cos as a dependency of hadoop-cloud-storage

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.3
• Fix Version/s: 3.3.4
• Component/s: build, fs
• Labels: pull-request-available
• Target Version/s: 3.3.4
• Hadoop Flags: Incompatible change

Release Note

We have recently become aware that libraries which include a shaded apache httpclient libraries (hadoop-client-runtime.jar, aws-java-sdk-bundle.jar, gcs-connector-shaded.jar, cos_api-bundle-5.6.19.jar) all load and use the unshaded resource mozilla/public-suffix-list.txt. If an out of date version of this is found on the classpath first, attempts to negotiate TLS connections may fail with the error "Certificate doesn't match any of the subject alternative names". This release does not declare the hadoop-cos library to be a dependency of the hadoop-cloud-storage POM, so applications depending on that module are no longer exposed to this issue. If an application requires use of the hadoop-cos module, please declare an explicit dependency.

• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 20/Jun/22 17:43
• Updated: 10/Nov/23 18:46
• Resolved: 24/Jun/22 13:13

Description

to deal without HADOOP-18159 without qualifying an updated cos library, remove it as an explicit dependency of hadoop cloud storage

it will still be built and published,

Issue Links

• relates to: HADOOP-18159 Certificate doesn't match any of the subject alternative names: [*.s3.amazonaws.com, s3.amazonaws.com]
• links to: GitHub Pull Request #4481