Skip to content

build: drop the gRPC transport that google-cloud-storage never uses here - #3415

Merged
marevol merged 1 commit into
masterfrom
build/exclude-gcs-grpc
Sep 9, 2026
Merged

marevol merged 1 commit into
masterfrom
build/exclude-gcs-grpc

Conversation

@marevol

@marevol marevol commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Companion to codelibs/fess-crawler#200. Fess declares google-cloud-storage directly, so
the exclusions there do not reach it; the block here is the same one.

Why

GcsStorageClient builds its client with StorageOptions.newBuilder() — the
JSON-over-HTTP transport. The gRPC one is reachable only through StorageOptions.grpc(),
which nothing calls, but google-cloud-storage declares the dependencies of both.

Distribution zip: 218.9 MiB → 194.2 MiB (−24.7 MiB). 29 jars out, nothing in;
grpc-xds (10.5 MiB) and grpc-netty-shaded (10.3 MiB) are most of it.

After the change the war holds exactly two io.grpc jars, both deliberate:

grpc-api-1.82.2.jar
grpc-context-1.70.0.jar

and no opentelemetry-sdk-* or google-cloud-monitoring.

Three things deliberately kept

Kept Why
io.grpc:grpc-api HttpStorageRpc#startSpan opens an OpenCensus span on every request; OpenCensus keeps its span in io.grpc.Context, which has lived in grpc-api since gRPC 1.60.
proto-google-cloud-storage-v2 JsonConversions#bucketInfoDecode uses com.google.storage.v2.BucketName.
opentelemetry-api, -context, -common gax-httpjson uses them.

Both of the first two were found by running fess-crawler's live GCS tests, not by reading
the dependency tree — excluding them compiles clean and then throws NoClassDefFoundError
on the first call. Details and stack traces are in codelibs/fess-crawler#200.

The OpenTelemetry SDK and the generated gRPC client are safe because, reading the constant
pools of google-cloud-storage-2.71.0.jar, the only class referencing io/opentelemetry/sdk
is OpenTelemetryBootstrappingUtils, whose only caller in the jar is GrpcStorageOptions.

Verification, and its limit

I could not exercise GcsStorageClient against a live server, and the reason is a
separate pre-existing defect on master, not this change. Constructing the client throws
before it makes any request:

java.lang.NoSuchMethodError:
  'com.google.api.client.http.javanet.NetHttpTransport$Builder
   com.google.api.client.http.javanet.NetHttpTransport$Builder.setSecurityProvider(java.security.Provider)'
  at com.google.api.gax.httpjson.HttpJsonConscryptUtils.configureConscryptSecurityProvider
  at com.google.cloud.http.HttpTransportOptions$DefaultHttpTransportFactory.create
  ...
  at org.codelibs.fess.storage.GcsStorageClient.<init>(GcsStorageClient.java:106)

google-cloud-storage 2.71.0 needs google-http-client 2.x; fess-parent pins
google.http.client.version at 1.47.0 and this pom declares google-http-client,
-jackson2 and -xml at that version directly, so the direct declaration wins over the
2.2.0 the storage client asks for. grep google-http-client over the shipped war confirms
it: google-http-client-1.47.0.jar next to google-cloud-storage-2.71.0.jar.

I reproduced the same failure with an unmodified pom.xml, so it predates this PR and this
PR neither causes nor fixes it. It needs its own change — the bump is google-http-client
1.x → 2.x, which also affects OpenIdConnectAuthenticator and fess-ds-gsuite, so it wants
its own verification rather than being folded in here.

GcsStorageClient builds its client with StorageOptions.newBuilder(), which is the
JSON over HTTP transport. The gRPC one is reachable only through
StorageOptions.grpc(), which nothing calls, but google-cloud-storage declares the
dependencies of both, so the distribution carried the whole gRPC stack: 29 jars,
26.4 MiB, of which grpc-xds and grpc-netty-shaded are 21 MiB between them.

The exclusion block is the same one as codelibs/fess-crawler#200. Fess declares
google-cloud-storage directly, so the exclusions there do not reach it.

Three things stay because removing them breaks the JSON transport: io.grpc:grpc-api,
which holds io.grpc.Context that OpenCensus needs on every request;
proto-google-cloud-storage-v2, which JsonConversions decodes bucket names with; and
the OpenTelemetry api, context and common jars, which gax-httpjson uses.
@marevol marevol self-assigned this Sep 9, 2026
@marevol marevol added the task label Sep 9, 2026
@marevol marevol added this to the 15.9.0 milestone Sep 9, 2026
@marevol
marevol merged commit ee77da0 into master Sep 9, 2026
2 checks passed
@marevol
marevol deleted the build/exclude-gcs-grpc branch September 16, 2026 13:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant