Add netty-transport-native-unix-common to modules/transport-netty4/bu…

[cwperks]

…ild.gradle to satisfy transitive dependency

Signed-off-by: Craig Perkins cwperx@amazon.com

Description

The upgrade from Netty 4.1.73.Final -> 4.1.78.Final introduced a new transitive dependency on netty-handler which is not getting included in the netty-transport4 module and causing build failures for 1.3.4 because the security plugin pulls in this module and uses the impacted jar.

This change pulls in the transitive dependency on netty-transport-native-unix-common into the module's build.gradle.

Details of the change in Netty can be found here: netty/netty@bc085b0

Issues Resolved

Security Plugin #1934

Check List

• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/394/
• CommitID: 0abe0070443aeee7dcc7c1c625d6d69cd75cae52

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/395/
• CommitID: 6b2fb61b4e7d9363d170835948918df8a93bd44b

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: FAILURE ❌
• URL: https://build.ci.opensearch.org/job/gradle-check/396/
• CommitID: 9a2d837

[github-actions]

Gradle Check (Jenkins) Run Completed with:

• RESULT: SUCCESS ✅
• URL: https://build.ci.opensearch.org/job/gradle-check/397/
• CommitID: bba7e61

[zelinh]

I think we might also need to backported to 1.3 branch as it's related to recent 1.3.4 build failure.

[reta]

I think we might also need to backported to 1.3 branch as it's related to recent 1.3.4 build failure.

This dependency was introduced in Netty 4.1.78 (or 4.1.77), 1.x uses older version

[cliu123]

@reta @zelinh This fix needs to be backported to all branches to which this PR got merged, including 1.x and 1.3 branches. 1.3.4 release is being blocked by this fix. Would you please help add the backport labels? I don't have the permissions.

[reta]

@reta @zelinh This fix needs to be backported to all branches to which this PR got merged, including 1.x and 1.3 branches. 1.3.4 release is being blocked by this fix. Would you please help add the backport labels? I don't have the permissions.

We have somewhat messy state here, 2.0 and 2.1 are missed:

• https://github.com/opensearch-project/OpenSearch/blob/2.0/buildSrc/version.properties#L23
• https://github.com/opensearch-project/OpenSearch/blob/2.1/buildSrc/version.properties#L23

[mch2]

Initiated a backport of the version bump to 2.1 - #3855. Waiting on this for passing gradle checks.

[mch2]

I don't think we actually need this change in 2.x or main correct @cwperks? Only for 1.3.4?

[cwperks]

@mch2 The fix should be backported to all branches that received the netty 4.1.73.Final -> 4.1.78.Final update. Since the transport-netty4 module requires netty-handler we should be pulling in required transitive dependencies so that anywhere this module is imported all of the required classes can be found.

[cwperks]

@dreamer-89 I think this needs to be backported to 2.0 as well.

[dreamer-89]

@dreamer-89 I think this needs to be backported to 2.0 as well.

#4440 is merged to 2.0. Are you talking about a different backport @cwperks ?

[cwperks]

@dreamer-89 This change needs to be on all branches that were upgraded to netty >=4.1.78.Final. See details in the PR description.

The upgrade from Netty 4.1.73.Final -> 4.1.78.Final introduced a new transitive dependency on netty-handler which is not getting included in the netty-transport4 module and causing build failures for 1.3.4 because the security plugin pulls in this module and uses the impacted jar.

This change pulls in the transitive dependency on netty-transport-native-unix-common into the module's build.gradle.

Details of the change in Netty can be found here: netty/netty@bc085b0

As you pointed out in this comment (#4440 (comment)), one of the reasons the backport PR failed was because a SHA file for this jar was present. Since this change was not backported to 2.0 it does not have the additional dependency.

See @cliu123 's comment here (opensearch-project/security#1934 (comment)) to see why this is necessary for the security plugin. The security plugin uses SSLHandler which requires this dependency.