Remove Brotli dependencies from the distribution and operator #22482
Description
Analysis:
-
Brotli is a compress algorithm - https://github.com/hyperxpro/Brotli4j
-
Quarkus Platform BOM 3.2.3 contains two dependencies with the
com.aayushatharva.brotli4jgroup ID:
<dependency>
<groupId>com.aayushatharva.brotli4j</groupId>
<artifactId>brotli4j</artifactId>
<version>1.12.0</version>
</dependency>
<dependency>
<groupId>com.aayushatharva.brotli4j</groupId>
<artifactId>native-linux-x86_64</artifactId>
<version>1.12.0</version>
</dependency>
- Quarkus seems to use brotli4j for its Netty extension, which is a part of the Quarkus foundation layer. They seem to override the dependency to an older version due to:
The recent version of Netty have a hard dependency on brotli, without this dependency, it's not possible to compile to native
https://github.com/quarkusio/quarkus/blob/3.2.3.Final/extensions/netty/runtime/pom.xml#L65-L74
- the Keycloak dependency tree output confirms the same findings:
Dependency tree for com.aayushatharva.brotli4j:brotli4j
---------------------------------------------------------------------------------------------------
org.keycloak:keycloak-quarkus-server:jar:999.0.0-SNAPSHOT
\- io.quarkus:quarkus-vertx:jar:3.2.3.Final:compile
\- io.quarkus:quarkus-netty:jar:3.2.3.Final:compile
\- com.aayushatharva.brotli4j:brotli4j:jar:1.12.0:compile
org.keycloak:keycloak-guides-maven-plugin:maven-plugin:999.0.0-SNAPSHOT
\- org.keycloak:keycloak-quarkus-server:jar:999.0.0-SNAPSHOT:compile
\- io.quarkus:quarkus-vertx:jar:3.2.3.Final:compile
\- io.quarkus:quarkus-netty:jar:3.2.3.Final:compile
\- com.aayushatharva.brotli4j:brotli4j:jar:1.12.0:compile
org.keycloak:keycloak-guides:pom:999.0.0-SNAPSHOT
\- org.keycloak:keycloak-guides-maven-plugin:jar:999.0.0-SNAPSHOT:compile
\- org.keycloak:keycloak-quarkus-server:jar:999.0.0-SNAPSHOT:compile
\- io.quarkus:quarkus-vertx:jar:3.2.3.Final:compile
\- io.quarkus:quarkus-netty:jar:3.2.3.Final:compile
\- com.aayushatharva.brotli4j:brotli4j:jar:1.12.0:compile
org.keycloak:keycloak-quarkus-server-deployment:jar:999.0.0-SNAPSHOT
\- org.keycloak:keycloak-quarkus-server:jar:999.0.0-SNAPSHOT:compile
\- io.quarkus:quarkus-vertx:jar:3.2.3.Final:compile
\- io.quarkus:quarkus-netty:jar:3.2.3.Final:compile
\- com.aayushatharva.brotli4j:brotli4j:jar:1.12.0:compile
org.keycloak:keycloak-quarkus-server-app:jar:999.0.0-SNAPSHOT
\- org.keycloak:keycloak-quarkus-server:jar:999.0.0-SNAPSHOT:compile
\- io.quarkus:quarkus-vertx:jar:3.2.3.Final:compile
\- io.quarkus:quarkus-netty:jar:3.2.3.Final:compile
\- com.aayushatharva.brotli4j:brotli4j:jar:1.12.0:compile
org.keycloak:keycloak-junit5:jar:999.0.0-SNAPSHOT
\- org.keycloak:keycloak-quarkus-server:jar:999.0.0-SNAPSHOT:compile
\- io.quarkus:quarkus-vertx:jar:3.2.3.Final:compile
\- io.quarkus:quarkus-netty:jar:3.2.3.Final:compile
\- com.aayushatharva.brotli4j:brotli4j:jar:1.12.0:compile
org.keycloak:keycloak-quarkus-integration-tests:jar:999.0.0-SNAPSHOT
\- org.keycloak:keycloak-junit5:jar:999.0.0-SNAPSHOT:test
\- org.keycloak:keycloak-quarkus-server:jar:999.0.0-SNAPSHOT:test
\- io.quarkus:quarkus-vertx:jar:3.2.3.Final:test
\- io.quarkus:quarkus-netty:jar:3.2.3.Final:test
\- com.aayushatharva.brotli4j:brotli4j:jar:1.12.0:test
==========================================================================
Dependency tree for com.aayushatharva.brotli4j:native-linux-x86_64
---------------------------------------------------------------------------------------------------
where netty/vertex seems to be transitively dependant on brotli4j and the second of the dependencies native-linux-x86_64 does not seem to be used anywhere.
On top of that, operator's dependency tree also contains brotli4j dependecy:
[INFO] --- dependency:3.1.2:tree (default-cli) @ keycloak-operator ---
[INFO] Verbose not supported since maven-dependency-plugin 3.0
[INFO] org.keycloak:keycloak-operator:jar:999.0.0-SNAPSHOT
[INFO] \- io.quarkus:quarkus-kubernetes-client:jar:3.2.3.Final:compile
[INFO] \- io.quarkus:quarkus-vertx:jar:3.2.3.Final:compile
[INFO] \- io.quarkus:quarkus-netty:jar:3.2.3.Final:compile
[INFO] \- com.aayushatharva.brotli4j:brotli4j:jar:1.12.0:compile
After a following discussion it's clear that Brotli (as an alternative to GZip) is not going to be supported by Keycloak. Therefore, the dependencies can be excluded.