apache / apache/pekko

review cases where Java/Scala packages are split across 2 or more jars

Open
#2,113 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Scala
Stars
1.6k
Forks
211
Avg merge
1d 6h
Merged PRs (30d)
89

Description

Java Modules (JPMs) discourage having packages where classes appear in different jars. It is a security risk to have the possibility of rogue jar including classes that hide classes in a well known jar.

cluster-typed and distributed-data share the package
* org.apache.pekko.cluster.ddata
* we may be ok as is because the cluster-typed packages are all grouped under `org.apache.pekko.cluster.ddata.typed` and there are packages in distributed-data that appear under `org.apache.pekko.cluster.ddata.typed` or packages that are grouped under it

There may are more instances. This is just one that I spotted today.

Related:
* https://github.com/apache/pekko-http/issues/733

Contributor guide

Open the contributing guide

Research direction

Start by comparing the package layouts of the cluster-typed and distributed-data modules, especially org.apache.pekko.cluster.ddata and its typed subpackages. Search the project for other Java/Scala packages present in multiple jars, then assess each case for the Java Modules security concern. Done means the split-package cases are identified and reviewed.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, scala
Domain
distributed-systems, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.