review cases where Java/Scala packages are split across 2 or more jars
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 211
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 89
Description
Java Modules (JPMs) discourage having packages where classes appear in different jars. It is a security risk to have the possibility of rogue jar including classes that hide classes in a well known jar.
cluster-typed and distributed-data share the package
* org.apache.pekko.cluster.ddata
* we may be ok as is because the cluster-typed packages are all grouped under `org.apache.pekko.cluster.ddata.typed` and there are packages in distributed-data that appear under `org.apache.pekko.cluster.ddata.typed` or packages that are grouped under it
There may are more instances. This is just one that I spotted today.
Related:
* https://github.com/apache/pekko-http/issues/733
Contributor guide
Research direction
Start by comparing the package layouts of the cluster-typed and distributed-data modules, especially org.apache.pekko.cluster.ddata and its typed subpackages. Search the project for other Java/Scala packages present in multiple jars, then assess each case for the Java Modules security concern. Done means the split-package cases are identified and reviewed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, scala
- Domain
- distributed-systems, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100