Skip to content

Conversation

mcruzdev
Copy link
Contributor

@mcruzdev mcruzdev commented Sep 7, 2025

Description

I am not sure if this one is the best way to solve some issues related to native compilation. For Spring Native and Quarkus the grpc-netty-shaded is not recommended due to recents CVEs and a lot of GraalVM configurations and substitutions.

We strongly recommend NOT using a shaded Netty - the recent cves should tell you why

Not to mention that it increase drammatically the memory usage too: the most of the assumption from Netty related pooling is to be the only one (like last Highlander...)
if you shade it...it end up pretty bad.

I am not an expertise in the netty subject, I appreciate any suggestions and comments about this change.

Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: #[issue number]

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

  • Code compiles correctly
  • Created/updated tests
  • Extended the documentation

@mcruzdev mcruzdev requested review from a team as code owners September 7, 2025 17:09
Copy link

codecov bot commented Sep 7, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.89%. Comparing base (d759c53) to head (7477f84).
⚠️ Report is 217 commits behind head on master.

Additional details and impacted files
@@             Coverage Diff              @@
##             master    #1543      +/-   ##
============================================
+ Coverage     76.91%   78.89%   +1.98%     
- Complexity     1592     1937     +345     
============================================
  Files           145      237      +92     
  Lines          4843     5956    +1113     
  Branches        562      611      +49     
============================================
+ Hits           3725     4699     +974     
- Misses          821      938     +117     
- Partials        297      319      +22     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

import io.grpc.netty.shaded.io.netty.handler.ssl.util.InsecureTrustManagerFactory;
import io.grpc.netty.GrpcSslContexts;
import io.grpc.netty.NettyChannelBuilder;
import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

grpc/grpc-java#10931

As per this thread, shaded is still recommended

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, but for native compilation it is a disaster.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a link for the description in the PR ? Would like to read more about it

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not have, I got those comments on the Quarkus Zulip.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants