Fix/wavefront proxy

[smoser]

Fixes:

Related:

Pre-review Checklist

For new package PRs only

• This PR is marked as fixing a pre-existing package request bug
  • Alternatively, the PR is marked as related to a pre-existing package request bug, such as a dependency
• REQUIRED - The package is available under an OSI-approved or FSF-approved license
• REQUIRED - The version of the package is still receiving security updates
• This PR links to the upstream project's support policy (e.g. endoflife.date)

For new version streams

• The upstream project actually supports multiple concurrent versions.
• Any subpackages include the version string in their package name (e.g. name: ${{package.name}}-compat)
• The package (and subpackages) provides: logical unversioned forms of the package (e.g. nodejs, nodejs-lts)

For security-related PRs

• The security fix is recorded in the advisories repo

For version bump PRs

• The epoch field is reset to 0

For PRs that add patches

• Patch source is documented

[smoser]

Well, bummer. Test fails like this:

 2024/04/24 13:39:03 WARN + cat out
2024/04/24 13:39:03 INFO failed [1]: java -jar /usr/share/java/wavefront/wavefront-proxy/wavefront-proxy.jar
2024/04/24 13:39:03 INFO Exception in thread "main" java.lang.NoClassDefFoundError: io/netty/handler/codec/http/cors/CorsConfig
2024/04/24 13:39:03 INFO     at java.base/java.lang.Class.getDeclaredMethods0(Native Method)
2024/04/24 13:39:03 INFO     at java.base/java.lang.Class.privateGetDeclaredMethods(Class.java:3166)
2024/04/24 13:39:03 INFO     at java.base/java.lang.Class.getDeclaredMethod(Class.java:2473)
2024/04/24 13:39:03 INFO     at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:47)
2024/04/24 13:39:03 INFO     at org.springframework.boot.loader.Launcher.launch(Launcher.java:108)
2024/04/24 13:39:03 INFO     at org.springframework.boot.loader.Launcher.launch(Launcher.java:58)
2024/04/24 13:39:03 INFO     at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:65)
2024/04/24 13:39:03 INFO Caused by: java.lang.ClassNotFoundException: io.netty.handler.codec.http.cors.CorsConfig
2024/04/24 13:39:03 INFO     at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:476)
2024/04/24 13:39:03 INFO     at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:594)
2024/04/24 13:39:03 INFO     at org.springframework.boot.loader.LaunchedURLClassLoader.loadClass(LaunchedURLClassLoader.java:151)
2024/04/24 13:39:03 INFO     at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:527)
2024/04/24 13:39:03 INFO     ... 7 more
2024/04/24 13:39:03 WARN + exit 1
2024/04/24 13:39:03 INFO pod e02a90f14c3452f5ca879b358265b4e48b836169795298c31e38abfa860c28b9 terminated
2024/04/24 13:39:03 INFO ERROR: failed to test package. the test environment has been preserved:
2024/04/24 13:39:03 INFO   workspace dir: /temp/melange-workspace-706052928

some local user error made the test pass locally. I had removed the bump of netty-codec-http entirely, and then built the package, seen it work and then saw a 4.1.109 available and thought "oh maybe that fixes it". I put in that change, but didn't bump the epoch again.

Anyway, the test is good to have, and you can make the test pass simply with this diff:

diff --git a/wavefront-proxy/proxy/pombump-deps.yaml b/wavefront-proxy/proxy/pombump-deps.yaml
index a3d5de67b..aad2bee73 100644
--- a/wavefront-proxy/proxy/pombump-deps.yaml
+++ b/wavefront-proxy/proxy/pombump-deps.yaml
@@ -17,11 +17,6 @@ patches:
     version: 4.1.109.Final
     scope: import
     type: jar
-  - groupId: io.netty
-    artifactId: netty-codec-http
-    version: 4.1.109.Final
-    scope: import
-    type: jar
   - groupId: com.squareup.okio
     artifactId: okio
     version: 3.4.0

[pdeslaur]

Interesting, thanks for adding the test! Let's drop dependency bumps if they break the package, we can file a CVE advisory!

[smoser]

Interesting, thanks for adding the test! Let's drop dependency bumps if they break the package, we can file a CVE advisory!

ack. will do that.

[hectorj2f]

lgtm