<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 2019-04-03 10:51 a.m., Darran
Lofthouse wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAMxVf4OZUQ3yfPP0kvg5_rDP+t3Vie=+UcUcn+YZ7S_ceB0q9g@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Certainly a topic for the future.</div>
</blockquote>
<p><br>
</p>
<p>It is more like a "Back to the Future" case ;-)</p>
<p><br>
</p>
<p>We discuss this, get rid of all shaded code, then we gradually
forget and the cycle starts again.</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:CAMxVf4OZUQ3yfPP0kvg5_rDP+t3Vie=+UcUcn+YZ7S_ceB0q9g@mail.gmail.com"><br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, Apr 3, 2019 at 3:36 PM
Fernando Nasser <<a href="mailto:fnasser@redhat.com"
moz-do-not-send="true">fnasser@redhat.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<div class="gmail-m_2684602645108186651moz-cite-prefix">On
2019-04-03 4:43 a.m., Darran Lofthouse wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">+1 the tool is a shaded jar so should not
need to depend on another module.<br>
<div><br>
</div>
<div>We may want to look at shading again but that would
be a different topic.</div>
</div>
</blockquote>
<p><br>
</p>
<p>Indeed. <br>
</p>
<p>Who monitors/detects the shaded code does not contain a
CVE and fix it if it does? <br>
</p>
<p>Are the people who "shaded" it responsible for
supporting/maintaining that code?</p>
<p><br>
</p>
<blockquote type="cite"><br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Apr 2, 2019 at
10:13 PM James Perkins <<a
href="mailto:jperkins@redhat.com" target="_blank"
moz-do-not-send="true">jperkins@redhat.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px
0px 0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">I believe the
org.wildfly.security:wildfly-elytron-tool does use
org.apache.commons.lang3. However IIRC it's now
shaded in so likely not an issue. That could be why
it was originally there.<br
class="gmail-m_2684602645108186651gmail-m_-6902368537796706729gmail-Apple-interchange-newline">
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Apr 2,
2019 at 12:34 PM Brian Stansberry <<a
href="mailto:brian.stansberry@redhat.com"
target="_blank" moz-do-not-send="true">brian.stansberry@redhat.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px
0px 0px 0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div class="gmail_default">Currently WildFly
includes 3 JBoss Modules modules that are not
used in our runtime. I would like to remove
these in WildFly 17:</div>
<div class="gmail_default"><br>
</div>
org.apache.commons.cli<br>
org.apache.commons.lang<span
class="gmail_default">[1]</span><br>
org.apache.commons.lang3
<div><br>
</div>
<div>
<div class="gmail_default">All three have the
"jboss.api" = "private" property set in
their module.xml, meaning they are marked
for internal use only and we are free to
remove them. End user applications should
not have referenced these modules, and if
they do we log a WARN on boot advising not
to do that.</div>
<div class="gmail_default"><br>
</div>
<div class="gmail_default">However, other
projects that extend WildFly (i.e. write
their own subsystems) may be using these
modules, so I wanted to notify any such
folks that these will likely be going away
and you'll need to provide these
yourselves.ed.</div>
</div>
<div class="gmail_default"><br>
</div>
<div class="gmail_default">Best regards,</div>
<div class="gmail_default">Brian</div>
<div><br>
</div>
<div>
<div class="gmail_default">[1] This one is
referenced in a commented out module.xml
section related to My Faces 1.1 support.
I've checked with Farah Juma and that is no
longer relevant and the comment can be
removed.</div>
</div>
<br>
</div>
_______________________________________________<br>
wildfly-dev mailing list<br>
<a href="mailto:wildfly-dev@lists.jboss.org"
target="_blank" moz-do-not-send="true">wildfly-dev@lists.jboss.org</a><br>
<a
href="https://lists.jboss.org/mailman/listinfo/wildfly-dev"
rel="noreferrer" target="_blank"
moz-do-not-send="true">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr"
class="gmail-m_2684602645108186651gmail-m_-6902368537796706729gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>James R. Perkins</div>
<div>JBoss by Red Hat</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
wildfly-dev mailing list<br>
<a href="mailto:wildfly-dev@lists.jboss.org"
target="_blank" moz-do-not-send="true">wildfly-dev@lists.jboss.org</a><br>
<a
href="https://lists.jboss.org/mailman/listinfo/wildfly-dev"
rel="noreferrer" target="_blank"
moz-do-not-send="true">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></blockquote>
</div>
<br>
<fieldset
class="gmail-m_2684602645108186651mimeAttachmentHeader"></fieldset>
<pre class="gmail-m_2684602645108186651moz-quote-pre">_______________________________________________
wildfly-dev mailing list
<a class="gmail-m_2684602645108186651moz-txt-link-abbreviated" href="mailto:wildfly-dev@lists.jboss.org" target="_blank" moz-do-not-send="true">wildfly-dev@lists.jboss.org</a>
<a class="gmail-m_2684602645108186651moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" target="_blank" moz-do-not-send="true">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></pre>
</blockquote>
<p><br>
</p>
</div>
</blockquote>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>