[discovery-gce] Upgrade all Google dependencies by arteam · Pull Request #85132 · elastic/elasticsearch

arteam · 2022-03-19T23:03:24Z

Upgrade the dependencies in order to avoid them being flagged for CVEs.

fcofdez · 2022-03-31T15:29:46Z

plugins/discovery-gce/build.gradle


 versions << [
-  'google': '1.23.0'
+  'google'              : '1.41.4',


Sorry for the delay on this, I'm not sure if these versions align with what the library expects?

[INFO] \- com.google.apis:google-api-services-compute:jar:v1-rev235-1.25.0:compile [INFO] \- com.google.api-client:google-api-client:jar:1.25.0:compile [INFO] +- com.google.oauth-client:google-oauth-client:jar:1.25.0:compile [INFO] | +- com.google.http-client:google-http-client:jar:1.25.0:compile [INFO] | | +- org.apache.httpcomponents:httpclient:jar:4.5.5:compile [INFO] | | | +- org.apache.httpcomponents:httpcore:jar:4.4.9:compile [INFO] | | | +- commons-logging:commons-logging:jar:1.2:compile [INFO] | | | \- commons-codec:commons-codec:jar:1.10:compile [INFO] | | \- com.google.j2objc:j2objc-annotations:jar:1.1:compile [INFO] | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile [INFO] +- com.google.http-client:google-http-client-jackson2:jar:1.25.0:compile [INFO] | \- com.fasterxml.jackson.core:jackson-core:jar:2.9.6:compile [INFO] \- com.google.guava:guava:jar:20.0:compile

Am I missing something? @arteam

You're correct! Let me pinpoint the exact versions of the transitive dependencies instead of the latest.

Actually, now I remember why I picked the 1.41.4 version. google-api-services-compute uses an outdated version of google-api/google-oauth-client (1.25.0). The original intention was to upgrade google-oauth-client to 1.33.1+ to avoid it being flagged for CVEs

It seems like they discontinued that library in favor of https://mvnrepository.com/artifact/com.google.cloud/google-cloud-compute/1.8.1?

Interesting! Let me try this dependency

It seems it still gets updated! https://repo1.maven.org/maven2/com/google/apis/google-api-services-compute/v1-rev20220322-1.32.1/ got released a couple of days go. It seems that the artefacts stopped being indexed by mvnrepository.com at some point. I should have checked https://search.maven.org/search?q=google-api-services-compute at the beggining 🤦

Okay, it's there https://mvnrepository.com/artifact/com.google.apis/google-api-services-compute/v1-rev20220322-1.32.1, just the sorting on https://mvnrepository.com/artifact/com.google.apis/google-api-services-compute is broken

Oh 🤦, I was looking into the google cloud documentation and I didn't manage to find a good release list... thanks for looking into this!

This reverts commit 3bac565

arteam · 2022-04-01T10:47:20Z

@elasticmachine update branch

fcofdez · 2022-04-01T16:21:42Z

plugins/discovery-gce/build.gradle

+  'google'              : '1.41.1',
+  'google_api_client'   : '1.33.1',
+  'api_services_compute': 'v1-rev20220322-1.32.1',
+  'google_oauth_client' : '1.33.1',


I think this expects 1.33.0

[INFO] \- com.google.apis:google-api-services-compute:jar:v1-rev20220322-1.32.1:compile [INFO] \- com.google.api-client:google-api-client:jar:1.33.1:compile [INFO] +- com.google.oauth-client:google-oauth-client:jar:1.33.0:compile <--- [INFO] +- com.google.http-client:google-http-client-gson:jar:1.41.1:compile [INFO] | \- com.google.code.gson:gson:jar:2.8.9:compile [INFO] +- com.google.guava:guava:jar:31.0.1-jre:compile [INFO] | +- com.google.guava:failureaccess:jar:1.0.1:compile [INFO] | +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile [INFO] | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile [INFO] | +- org.checkerframework:checker-qual:jar:3.12.0:compile [INFO] | +- com.google.errorprone:error_prone_annotations:jar:2.7.1:compile [INFO] | \- com.google.j2objc:j2objc-annotations:jar:1.3:compile [INFO] +- com.google.http-client:google-http-client-apache-v2:jar:1.41.1:compile [INFO] +- org.apache.httpcomponents:httpcore:jar:4.4.15:compile [INFO] +- org.apache.httpcomponents:httpclient:jar:4.5.13:compile [INFO] | +- commons-logging:commons-logging:jar:1.2:compile [INFO] | \- commons-codec:commons-codec:jar:1.11:compile [INFO] \- com.google.http-client:google-http-client:jar:1.41.1:compile [INFO] +- io.opencensus:opencensus-api:jar:0.30.0:compile [INFO] | \- io.grpc:grpc-context:jar:1.27.2:compile [INFO] \- io.opencensus:opencensus-contrib-http-util:jar:0.30.0:compile

fcofdez · 2022-04-01T16:21:42Z

plugins/discovery-gce/build.gradle

+  'google'              : '1.41.1',
+  'google_api_client'   : '1.33.1',
+  'api_services_compute': 'v1-rev20220322-1.32.1',
+  'google_oauth_client' : '1.33.1',


I think this expects 1.33.0

[INFO] \- com.google.apis:google-api-services-compute:jar:v1-rev20220322-1.32.1:compile [INFO] \- com.google.api-client:google-api-client:jar:1.33.1:compile [INFO] +- com.google.oauth-client:google-oauth-client:jar:1.33.0:compile <--- [INFO] +- com.google.http-client:google-http-client-gson:jar:1.41.1:compile [INFO] | \- com.google.code.gson:gson:jar:2.8.9:compile [INFO] +- com.google.guava:guava:jar:31.0.1-jre:compile [INFO] | +- com.google.guava:failureaccess:jar:1.0.1:compile [INFO] | +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile [INFO] | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile [INFO] | +- org.checkerframework:checker-qual:jar:3.12.0:compile [INFO] | +- com.google.errorprone:error_prone_annotations:jar:2.7.1:compile [INFO] | \- com.google.j2objc:j2objc-annotations:jar:1.3:compile [INFO] +- com.google.http-client:google-http-client-apache-v2:jar:1.41.1:compile [INFO] +- org.apache.httpcomponents:httpcore:jar:4.4.15:compile [INFO] +- org.apache.httpcomponents:httpclient:jar:4.5.13:compile [INFO] | +- commons-logging:commons-logging:jar:1.2:compile [INFO] | \- commons-codec:commons-codec:jar:1.11:compile [INFO] \- com.google.http-client:google-http-client:jar:1.41.1:compile [INFO] +- io.opencensus:opencensus-api:jar:0.30.0:compile [INFO] | \- io.grpc:grpc-context:jar:1.27.2:compile [INFO] \- io.opencensus:opencensus-contrib-http-util:jar:0.30.0:compile

fcofdez

LGTM, I left a comment about the expected google_oauth_client version but otherwise it looks good. Sorry again for the delay on this!

arteam · 2022-04-11T07:47:13Z

Thanks Francisco!

This commit syncs the dependencies for discovery GCE plugin with the dependency versions in use in main. Specifically, this commit upgrades the following for the discovery GCE plugin: com.google.apis:google-api-services-compute:v1-rev160-1.23.0 -> v1-rev20220322-1.32 com.google.api-client:google-api-client:1.23.0 -> 1.33.1 com.google.oauth-client:google-oauth-client:1.23.0 -> 1.34.1 com.google.code.findbugs:jsr305:1.3.9 -> 3.0.2 and introduces the following for the discovery GCE plugin: api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}" api "com.google.http-client:google-http-client-gson:1.41.1" runtimeOnly 'com.google.guava:guava:32.0.1-jre' runtimeOnly 'com.google.guava:failureaccess:1.0.1' api 'io.opencensus:opencensus-api:0.30.0' api 'io.opencensus:opencensus-contrib-http-util:0.30.0' api 'io.grpc:grpc-context:1.27.2' backport of #85132 and #91722

arteam added 2 commits March 18, 2022 11:18

[discovery-gce] Upgrade google-oauth-client to 1.33.1

10fe62c

Add missed classes

3b0d8ca

elasticsearchmachine added the v8.2.0 label Mar 19, 2022

[discovery-gce] Upgrade all Google dependencies

dc2b7dd

arteam force-pushed the update-all-gce-dependencies branch from 23eda98 to dc2b7dd Compare March 19, 2022 23:20

arteam added the :Distributed/Discovery-Plugins Anything related to our integration plugins with EC2, GCP and Azure label Mar 21, 2022

arteam marked this pull request as ready for review March 21, 2022 09:05

elasticmachine added the Team:Distributed Meta label for distributed team. label Mar 21, 2022

arteam mentioned this pull request Mar 21, 2022

[discovery-gce] Upgrade google-oauth-client to 1.33.1 #85095

Closed

arteam added the >non-issue label Mar 21, 2022

fcofdez self-requested a review March 21, 2022 10:04

salvatore-campagna added v8.3.0 and removed v8.2.0 labels Mar 30, 2022

fcofdez reviewed Mar 31, 2022

View reviewed changes

arteam added 5 commits March 31, 2022 18:47

Merge branch 'master' into update-all-gce-dependencies

03e303e

Update to google 1.41.5

3bac565

Update api_services_compute to v1-rev20220322-1.32.1

89f83f5

Revert "Update to google 1.41.5"

ede162a

This reverts commit 3bac565

Pinpoint google-api-client to 1.33.1

0cd0939

arteam force-pushed the update-all-gce-dependencies branch from 6868a7f to 0cd0939 Compare April 1, 2022 10:11

Pinpoint correct third-part dependencies

8e53914

Merge branch 'master' into update-all-gce-dependencies

344fe34

fcofdez reviewed Apr 1, 2022

View reviewed changes

fcofdez approved these changes Apr 1, 2022

View reviewed changes

arteam added 2 commits April 2, 2022 14:23

Upgrade google-oauth-client

6dfaf4e

Update JSR-305 dependency

857491c

arteam merged commit dfb39f5 into elastic:master Apr 11, 2022

arteam deleted the update-all-gce-dependencies branch April 11, 2022 07:46

tvernum mentioned this pull request Apr 12, 2022

Discovery GCE test fails on FIPS #85803

Closed

jakelandis mentioned this pull request Jan 8, 2024

[7.x] Sync discovery_gce versions with main #104086

Merged

Conversation

arteam commented Mar 19, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arteam Apr 1, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arteam commented Apr 1, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fcofdez left a comment

Choose a reason for hiding this comment

Uh oh!

arteam commented Apr 11, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

arteam commented Mar 19, 2022 •

edited

Loading

arteam Apr 1, 2022 •

edited

Loading