<div dir="ltr">At this point in time there are no plans to modify how wildfly-elytron-tool is packaged so I would suggest for now we don&#39;t take into account how it could hypothetically be changed in the future.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 4, 2019 at 10:57 AM Carlo de Wolf &lt;<a href="mailto:cdewolf@redhat.com">cdewolf@redhat.com</a>&gt; wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF">
    Define the end-state.<br>
    <br>
    If commons-lang3 is part of that end-state it makes no sense to
    remove it from the matrix. Were it not for CXF it could however be
    removed from the runtime.<br>
    <br>
    Don&#39;t drive into a road which could potentially be a dead-end.<br>
    <br>
    Carlo<br>
    <br>
    <div class="gmail-m_3024006922276083933moz-cite-prefix">On 03-04-19 16:51, Darran Lofthouse
      wrote:<br>
    </div>
    <blockquote type="cite">
      
      <div dir="ltr">Certainly a topic for the future.</div>
      <br>
      <div class="gmail_quote">
        <div dir="ltr" class="gmail_attr">On Wed, Apr 3, 2019 at 3:36 PM
          Fernando Nasser &lt;<a href="mailto:fnasser@redhat.com" target="_blank">fnasser@redhat.com</a>&gt; wrote:<br>
        </div>
        <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
          <div bgcolor="#FFFFFF">
            <div class="gmail-m_3024006922276083933gmail-m_2684602645108186651moz-cite-prefix">On
              2019-04-03 4:43 a.m., Darran Lofthouse wrote:<br>
            </div>
            <blockquote type="cite">
              <div dir="ltr">+1 the tool is a shaded jar so should not
                need to depend on another module.<br>
                <div><br>
                </div>
                <div>We may want to look at shading again but that would
                  be a different topic.</div>
              </div>
            </blockquote>
            <p><br>
            </p>
            <p>Indeed.  <br>
            </p>
            <p>Who monitors/detects the shaded code does not contain a
              CVE and fix it if it does? <br>
            </p>
            <p>Are the people who &quot;shaded&quot; it responsible for
              supporting/maintaining that code?</p>
            <p><br>
            </p>
            <blockquote type="cite"><br>
              <div class="gmail_quote">
                <div dir="ltr" class="gmail_attr">On Tue, Apr 2, 2019 at
                  10:13 PM James Perkins &lt;<a href="mailto:jperkins@redhat.com" target="_blank">jperkins@redhat.com</a>&gt;
                  wrote:<br>
                </div>
                <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
                  <div dir="ltr">I believe the
                    org.wildfly.security:wildfly-elytron-tool does use
                    org.apache.commons.lang3. However IIRC it&#39;s now
                    shaded in so likely not an issue. That could be why
                    it was originally there.<br class="gmail-m_3024006922276083933gmail-m_2684602645108186651gmail-m_-6902368537796706729gmail-Apple-interchange-newline">
                  </div>
                  <br>
                  <div class="gmail_quote">
                    <div dir="ltr" class="gmail_attr">On Tue, Apr 2,
                      2019 at 12:34 PM Brian Stansberry &lt;<a href="mailto:brian.stansberry@redhat.com" target="_blank">brian.stansberry@redhat.com</a>&gt;
                      wrote:<br>
                    </div>
                    <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
                      <div dir="ltr">
                        <div class="gmail_default">Currently WildFly
                          includes 3 JBoss Modules modules that are not
                          used in our runtime. I would like to remove
                          these in WildFly 17:</div>
                        <div class="gmail_default"><br>
                        </div>
                        org.apache.commons.cli<br>
                        org.apache.commons.lang<span class="gmail_default">[1]</span><br>
                        org.apache.commons.lang3
                        <div><br>
                        </div>
                        <div>
                          <div class="gmail_default">All three have the
                            &quot;jboss.api&quot; = &quot;private&quot; property set in
                            their module.xml, meaning they are marked
                            for internal use only and we are free to
                            remove them. End user applications should
                            not have referenced these modules, and if
                            they do we log a WARN on boot advising not
                            to do that.</div>
                          <div class="gmail_default"><br>
                          </div>
                          <div class="gmail_default">However, other
                            projects that extend WildFly (i.e. write
                            their own subsystems) may be using these
                            modules, so I wanted to notify any such
                            folks that these will likely be going away
                            and you&#39;ll need to provide these
                            yourselves.ed.</div>
                        </div>
                        <div class="gmail_default"><br>
                        </div>
                        <div class="gmail_default">Best regards,</div>
                        <div class="gmail_default">Brian</div>
                        <div><br>
                        </div>
                        <div>
                          <div class="gmail_default">[1] This one is
                            referenced in a commented out module.xml
                            section related to My Faces 1.1 support.
                            I&#39;ve checked with Farah Juma and that is no
                            longer relevant and the comment can be
                            removed.</div>
                        </div>
                        <br>
                      </div>
                      _______________________________________________<br>
                      wildfly-dev mailing list<br>
                      <a href="mailto:wildfly-dev@lists.jboss.org" target="_blank">wildfly-dev@lists.jboss.org</a><br>
                      <a href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></blockquote>
                  </div>
                  <br clear="all">
                  <div><br>
                  </div>
                  -- <br>
                  <div dir="ltr" class="gmail-m_3024006922276083933gmail-m_2684602645108186651gmail-m_-6902368537796706729gmail_signature">
                    <div dir="ltr">
                      <div>
                        <div dir="ltr">
                          <div>James R. Perkins</div>
                          <div>JBoss by Red Hat</div>
                        </div>
                      </div>
                    </div>
                  </div>
                  _______________________________________________<br>
                  wildfly-dev mailing list<br>
                  <a href="mailto:wildfly-dev@lists.jboss.org" target="_blank">wildfly-dev@lists.jboss.org</a><br>
                  <a href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></blockquote>
              </div>
              <br>
              <fieldset class="gmail-m_3024006922276083933gmail-m_2684602645108186651mimeAttachmentHeader"></fieldset>
              <pre class="gmail-m_3024006922276083933gmail-m_2684602645108186651moz-quote-pre">_______________________________________________
wildfly-dev mailing list
<a class="gmail-m_3024006922276083933gmail-m_2684602645108186651moz-txt-link-abbreviated" href="mailto:wildfly-dev@lists.jboss.org" target="_blank">wildfly-dev@lists.jboss.org</a>
<a class="gmail-m_3024006922276083933gmail-m_2684602645108186651moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></pre>
            </blockquote>
            <p><br>
            </p>
          </div>
        </blockquote>
      </div>
      <br>
      <fieldset class="gmail-m_3024006922276083933mimeAttachmentHeader"></fieldset>
      <pre class="gmail-m_3024006922276083933moz-quote-pre">_______________________________________________
wildfly-dev mailing list
<a class="gmail-m_3024006922276083933moz-txt-link-abbreviated" href="mailto:wildfly-dev@lists.jboss.org" target="_blank">wildfly-dev@lists.jboss.org</a>
<a class="gmail-m_3024006922276083933moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></pre>
    </blockquote>
    <br>
  </div>

</blockquote></div>