[HBASE-16298] ESAPI.properties missing in hbase-server.jar

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 1.1.5, 1.2.2
• Component/s: API

Environment

Debian 8.2
Linux 3.16.0-4-amd64
OpenJDK 8u91-b14-3ubuntu1~16.04.1

• Assignee: Unassigned
• Reporter: Sylvain Veyrié
• Created: 28/Jul/16 08:11
• Updated: 18/Jun/18 15:09
• Resolved: 17/Feb/17 13:44

Description

For policy/compliance reasons, we removed the tests jars from lib/ directory on HBase Master. Everything was working fine from 1.0 to 1.1.3.

When I upgraded from 1.1.3 to 1.1.5, the /master-status page started to return an error 500: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.

After some search, I found out that ESAPI has been added following HBASE-15122 which also added the ESAPI.properties files into src/main/resources.

However, it seems an exclusion has been put on packaging: the file is absent from hbase-server-1.1.5.jar, but present in hbase-server-1.1.5-tests.jar, which is in the lib/ directory in the tar.gz distribution.

Our workaround is to deploy back hbase-server-1.1.5-tests.jar in lib/. However, it does not seem right to require tests jar to have HBase master propertly work.

Even if it is the current HBase policy to keep those jars, I think the hbase-server.jar should contain ESAPI.properties.

The same thing applies for 1.2 branch.

Issue Links

• is blocked by: HBASE-16328 Reimplement web UI fixes without license problems
• is related to: HBASE-16260 Audit dependencies for Category-X