Upgrade joda-time to support Amazon AWS S3 on Java 8u60 or later
Description
Environment
Activity

Andrea Aime February 15, 2017 at 11:48 AM
Mass closing all resolved issues not modified in the last 4 weeks

Ben Caradoc-Davies January 26, 2016 at 5:32 AM
GeoServer joda-time version pinned to 2.8.1 on master:
https://github.com/geoserver/geoserver/commit/f10ade7686ea14213c37fc29e2da805ac7f60916

Ben Caradoc-Davies January 26, 2016 at 5:31 AM
-------- Forwarded Message --------
Subject: Re: [Geowebcache-devel] Upgrade joda-time to support Amazon AWS S3 with Java 8u60 or later
Date: Tue, 26 Jan 2016 15:51:45 +1300
From: Ben Caradoc-Davies
To: Kevin Smith, geowebcache-devel@lists.sourceforge.net
Pull request:
https://github.com/GeoWebCache/geowebcache/pull/367
All tests pass on Java 8u72 including gwc-aws-s3 S3BlobStoreIntegrationTest:
-------------------------------------------------------------------------------
Test set: org.geowebcache.s3.S3BlobStoreIntegrationTest
-------------------------------------------------------------------------------
Tests run: 11, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 51.615 sec
Kind regards,
Ben.
On 26/01/16 14:55, Ben Caradoc-Davies wrote:
> Sounds good to me. I am happy to pin GeoWebCache to Joda Time 2.8.1. I
> will test and make a pull request.
>
> Kind regards,
> Ben.
>
> On 26/01/16 11:06, Kevin Smith wrote:
>> Ah, I see now.
>>
>> Given that AWS is the only reason we have it, pinning it to something
>> newer than 2.8.1 seems like it would just restrict our options in
>> upgrading AWS in future. So I'm inclined to either pin it to 2.8.1 or
>> update AWS now.
>>
>> If we pin, I'd like to add a comment to the pom pointing out that it's
>> only there for AWS and that since GWC is on Java 8 now,
>> JSR-310/java.time should be used in GWC.
>>
>> As for updating to AWS 1.10 now, I'm not averse to it but I don't know
>> how much effort would be involved. Quickly skimming the change logs,
>> with a bit more emphasis on 1.10.0 it doesn't sound like they made any
>> changes that should break the S3 blob store so it would hopefully just
>> be updating the POM.
>>
>
–
Ben Caradoc-Davies <ben@transient.nz>
Director
Transient Software Limited <http://transient.nz/>
New Zealand

Ben Caradoc-Davies January 26, 2016 at 5:30 AM
-------- Forwarded Message --------
Subject: Re: [Geowebcache-devel] Upgrade joda-time to support Amazon AWS S3 with Java 8u60 or later
Date: Tue, 26 Jan 2016 09:38:22 +1300
From: Ben Caradoc-Davies
To: Kevin Smith, geowebcache-devel@lists.sourceforge.net
Not quite. AWS works fine with the newest Joda Time. The problem is that
GeoServer master pinned to Joda Time 2.2, which does not work with AWS.
To fix this, I upgraded GeoServer master to use Joda Time 2.9.1 to match
GeoWebCache master.
The issue is that GeoWebCache master automatically uses the latest Joda
Time 2.9.1 through a transive aws-java-sdk-core 1.9.30 [2.2,)
dependency. More recent aws-java-sdk-core (e.g.) 1.10.47 uses Joda Time
2.8.1, so if GeoWebCache upgrades aws-java-sdk-core, GeoServer should
downgrade Joda Time for consistency. Furthermore, GeoWebCache will
automatically upgrade as soon as a new Joda Time is available, while
GeoServer will not.
Do you plan to keep this situation or upgrade AWS (and downgrade Joda
Time) to improve build determinism? Nothing is broken at the moment, we
just need to coordinate across projects.
Kind regards,
Ben.
On 26/01/16 09:02, Kevin Smith wrote:
> So the problem is that the most recent version of the AWS library
> doesn't like the newest version of Joda Time and you'd like to pin down
> both to specific versions that work together, either old AWS and new
> Joda Time, or new AWS and old Joda time?
–
Ben Caradoc-Davies <ben@transient.nz>
Director
Transient Software Limited <http://transient.nz/>
New Zealand

Ben Caradoc-Davies January 26, 2016 at 5:27 AM
GeoWebCache joda-time version pinned to 2.8.1 in PR 367:
https://github.com/GeoWebCache/geowebcache/pull/367
joda-time before 2.8.1 causes Java 8u60 or later to fail to connect to Amazon AWS S3 with the error "AWS authentication requires a valid Date or x-amz-date header" when configuring a GeoWebCache S3 blob store via the GeoServer web interface:
See:
https://github.com/JodaOrg/joda-time/issues/288
https://github.com/aws/aws-sdk-java/issues/444
https://github.com/aws/aws-sdk-java/issues/484
https://github.com/elastic/elasticsearch-cloud-aws/issues/233
https://issues.jenkins-ci.org/browse/JENKINS-30420
GeoWebCache gwc-aws-s3 unit tests pass with Java 8u72 because aws-java-sdk-core 1.9.30 depends on joda-time [2.2,), which resolves to the latest joda-time 2.9.1, which works with Java 8u72:
https://repo1.maven.org/maven2/com/amazonaws/aws-java-sdk-core/1.9.30/aws-java-sdk-core-1.9.30.pom
GeoServer has a fixed dependency on joda-time to 2.2, which satisfies the transitive dependency on aws-java-sdk-core via gs-gwc-s3, but is incompatible with Java 8u60 or later.
The solution is to change the GeoServer dependencyManagement version of joda-time to 2.8.1 or later. Although GeoWebCache gwc-aws-s3 is currently building against 2.9.1, later aws-java-sdk-core (e.g. 1.10.47) has a fixed dependency on 2.8.1 so it may be more consistent to fix the GeoServer dependency as joda-time 2.8.1:
https://repo1.maven.org/maven2/com/amazonaws/aws-java-sdk-core/1.10.47/aws-java-sdk-core-1.10.47.pom
We could instead use explicit dependencies for both GeoServer and GeoWebCache on joda-time 2.9.1 and see if Maven can handle the version management.
There are other GeoServer modules that user joda-time.