<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 2019-04-03 4:43 a.m., Darran
Lofthouse wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAMxVf4MocPTnq3LgCjk4V22J2DF2+5ibuTDXrCG1pTMW_677BQ@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">+1 the tool is a shaded jar so should not need to
depend on another module.<br>
<div><br>
</div>
<div>We may want to look at shading again but that would be a
different topic.</div>
</div>
</blockquote>
<p><br>
</p>
<p>Indeed. <br>
</p>
<p>Who monitors/detects the shaded code does not contain a CVE and
fix it if it does? <br>
</p>
<p>Are the people who "shaded" it responsible for
supporting/maintaining that code?</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:CAMxVf4MocPTnq3LgCjk4V22J2DF2+5ibuTDXrCG1pTMW_677BQ@mail.gmail.com"><br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Apr 2, 2019 at 10:13
PM James Perkins <<a href="mailto:jperkins@redhat.com"
moz-do-not-send="true">jperkins@redhat.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">I believe the
org.wildfly.security:wildfly-elytron-tool does use
org.apache.commons.lang3. However IIRC it's now shaded in so
likely not an issue. That could be why it was originally
there.<br
class="gmail-m_-6902368537796706729gmail-Apple-interchange-newline">
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Apr 2, 2019 at
12:34 PM Brian Stansberry <<a
href="mailto:brian.stansberry@redhat.com"
target="_blank" moz-do-not-send="true">brian.stansberry@redhat.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif">Currently WildFly includes 3
JBoss Modules modules that are not used in our
runtime. I would like to remove these in WildFly 17:</div>
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif"><br>
</div>
org.apache.commons.cli<br>
org.apache.commons.lang<span class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif">[1]</span><br>
org.apache.commons.lang3
<div><br>
</div>
<div>
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif">All three have the "jboss.api"
= "private" property set in their module.xml,
meaning they are marked for internal use only and we
are free to remove them. End user applications
should not have referenced these modules, and if
they do we log a WARN on boot advising not to do
that.</div>
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif"><br>
</div>
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif">However, other projects that
extend WildFly (i.e. write their own subsystems) may
be using these modules, so I wanted to notify any
such folks that these will likely be going away and
you'll need to provide these yourselves.ed.</div>
</div>
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif"><br>
</div>
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif">Best regards,</div>
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif">Brian</div>
<div><br>
</div>
<div>
<div class="gmail_default"
style="font-family:"trebuchet
ms",sans-serif">[1] This one is referenced in a
commented out module.xml section related to My Faces
1.1 support. I've checked with Farah Juma and that
is no longer relevant and the comment can be
removed.</div>
</div>
<br>
</div>
_______________________________________________<br>
wildfly-dev mailing list<br>
<a href="mailto:wildfly-dev@lists.jboss.org"
target="_blank" moz-do-not-send="true">wildfly-dev@lists.jboss.org</a><br>
<a
href="https://lists.jboss.org/mailman/listinfo/wildfly-dev"
rel="noreferrer" target="_blank" moz-do-not-send="true">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr"
class="gmail-m_-6902368537796706729gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>James R. Perkins</div>
<div>JBoss by Red Hat</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
wildfly-dev mailing list<br>
<a href="mailto:wildfly-dev@lists.jboss.org" target="_blank"
moz-do-not-send="true">wildfly-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/wildfly-dev"
rel="noreferrer" target="_blank" moz-do-not-send="true">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
wildfly-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:wildfly-dev@lists.jboss.org">wildfly-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/wildfly-dev">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></pre>
</blockquote>
<p><br>
</p>
</body>
</html>