Uploaded image for project: 'Grouper'
  1. Grouper
  2. GRP-5136

Remove forked classes in ext and extMore

    XMLWordPrintable

Details

    • Improvement
    • Resolution: Unresolved
    • Minor
    • None
    • None
    • API, grouperClient
    • None

    Description

      Files in an "ext" source directory in grouperClient and grouper-installer are forked classes from external dependency source code, with packages renamed. Was the goal to not have external jars so that a standalone jar could be executable? There are ways in Maven to unpack and repackage required classes from dependencies into a single jar (shade plugin), so this fork method is no longer necessary. It's also a security risk, as the classes are frozen in time from the time they are forked, and are not easily upgraded. They are also not as visible to security scanners, since they are not in their own published jars.

      There is also an ext directory in the Grouper api for Apache ddlutils classes. It's possible that was a workaround to fix functionality.

      Attachments

        Activity

          People

            chris.hyzer@at.internet2.edu Chris Hyzer (upenn.edu)
            chad.redman.3@at.internet2.edu Chad Redman
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: