[PHOENIX-6010] Create phoenix-thirdparty, and consume guava through it

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.1.0, 4.16.0
• Fix Version/s: 5.1.0
• Component/s: core, omid, tephra
• Assignee: Istvan Toth
• Reporter: Istvan Toth
• Created: 15/Jul/20 04:31
• Updated: 03/Feb/22 05:19
• Resolved: 21/Sep/20 08:51

Description

We have long-standing and well-documented problems with Guava, just like the rest of the Hadoop components.

Adopt the solution used by HBase:

• create phoenix-thirdparty repo
• create a pre-shaded phoenix-shaded-guava artifact in it
• Use the pre-shaded Guava in every phoenix component

The advantages are well-known, but to name a few:

• Phoenix will work with Hadoop 3.1.3+
• One less CVE in our direct dependencies
• No more conflict with our consumer's Guava versions

Issue Links

• fixes: PHOENIX-5331 Get onto newer guava
• incorporates: PHOENIX-6234 Replace Guava with phoenix-thirdparty version in 4.x
• is a parent of: OMID-156 refactor Omid to use phoenix-shaded-guava
• is a parent of: TEPHRA-308 create artifact with shaded Guava and Twill in Tephra
• is duplicated by: PHOENIX-4262 Create shaded packages to shade all uses of Guava
• links to: PR

Sub-Tasks

• Create phoenix-thirdparty git repo: Closed
• Create phoenix-thirdparty main project, and add phoenix-shaded-guava as a subproject: Closed
• refactor Phoenix to use phoenix-shaded-guava: Resolved
• Update Phoenix dependencies to the shaded Tephra, and the thirdparty-based Omid artifacts: Resolved