polaris-service binary distribution doesn't start

[jbonofre]

Is this a possible security vulnerability?

• This is NOT a possible security vulnerability

Describe the bug

We have binary distributions available in polaris-service/build/distributions (both shadow jar or all dependencies).

Extracting a binary distribution from there (for instance using tar zxvf polaris-service-x.x.x.tar), we have bin and lib folders.

Trying to start Polaris there using bin/polaris-service fails with:

java.lang.ClassNotFoundException: org.apache.polaris.service.PolarisApplication

The bin/polaris-service script is not fully correct here.

[MonkeyCanCode]

I am not very familiar with gradle but here is the finding:

With the script (auto generated by gradle I think), it will try to run following command:

java -classpath /xxx/lib/polaris-dropwizard-service-1.0.0-incubating-SNAPSHOT.jar org.apache.polaris.service.dropwizard.PolarisApplication

However, we don't have lib/polaris-dropwizard-service-1.0.0-incubating-SNAPSHOT.jar, Instead, we have lib/polaris-dropwizard-service-1.0.0-incubating-SNAPSHOT-raw.jar. The raw seems to be from polaris-shadow-jar.gradle.kts.

Another thing is, even if I fixed the file name above, that is still not the right command to use. Instead, here should be the right command:

java -classpath /xxx/lib/polaris-dropwizard-service-1.0.0-incubating-SNAPSHOT-raw.jar:/xxx/lib/* org.apache.polaris.service.dropwizard.PolarisApplication

Then you will see following:

usage: java -jar polaris-dropwizard-service-1.0.0-incubating-SNAPSHOT-raw.jar
       [-h] [-v] {server,check,bootstrap,purge} ...

positional arguments:
  {server,check,bootstrap,purge}
                         available commands

named arguments:
  -h, --help             show this help message and exit
  -v, --version          show the application version and exit

 @@@@   @@@  @       @    @@@@   @  @@@@    @@@@    @  @@@@@  @    @     @@@   @@@@
 @   @ @   @ @      @ @   @   @  @  @@     @       @ @   @   @ @   @    @   @ @
 @@@@  @   @ @     @@@@@  @@@@   @    @@   @      @@@@@  @  @@@@@  @    @   @ @  @@@
 @      @@@  @@@@ @     @ @  @@  @  @@@@    @@@@ @     @ @ @@   @@ @@@@  @@@   @@@@

                     *


                                      /////\
                                   //\\///T\\\
                                ///\\\////\\\\\\
                               //\\\\T////\\\\\\\\\
                          /T\ //\\\\\T///T\\//T\\\\\\
                        //\\\/////T\\////\\/////\\\\\\\  //\\
                     //\\\\\\T///////////////////T\\\\\\\T\\\\\
                  //\\\\/////T\//////////\///////T\\\\\T\\\\\\\\
                 //\\\\\/////\\\T////////////////\\\\\\/\\\\\\\\\
,,..,,,..,,,..,//\\\\////////\\\\\\\\\\/////////\\\\\///\\\\\\\\\\,,,..,,..,,,..,,,.
,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,.,,,..,,,..,

Hope this can help someone who is more familiar with gradle to fix this issue.

[jbonofre]

This works, my point is that our distribution distributions (polaris-service tar or zip) don't work out of the box.

I'm fixing that.

[jbonofre]

So, the current situation is:

• shadowJar based binary distribution works
• the "non Uber jar" binary distribution doesn't work because the classpath is not correct in bin/polaris-service: the CLASSPATH should contain $APP/lib/* (not the single Polaris service jar which is only valid for shadow jar).

Generally speaking, I don't see the reason about having two binary distributions (the shadowJar one and the "regular" one).

I think we should have only one binary distribution (for our end users). Maybe the non shadowJar one makes more sense because users can update some dependency in the distribution is needed (easier than exploding the shadowJar).

[snazy]

Generally speaking, I don't see the reason about having two binary distributions (the shadowJar one and the "regular" one).

Noting: the "shadow" one is probably "provided" by the shadow plugin.

I think we should have only one binary distribution (for our end users). Maybe the non shadowJar one makes more sense because users can update some dependency in the distribution is needed (easier than exploding the shadowJar).

I think, the issue rather goes away once we have #469 replacing dropwizard - and/or do not rely on Gradle's "distribution" functionality but just package our own zip/tgz with a start-script (it's really not rocket science - likely easier than "messing" with the specifics of distribution/shadow-plugin).

[jbonofre]

@snazy I agree. Let me push a short fix with custom binary distribution. And yeah, #469 will simplify/fix all this 😄