Anything changed recently around removed-artifacts?

[vmuzikar]

Hi,
Keycloak leverages the quarkus.class-loading.removed-artifacts config option to dynamically enable/disable certain artifacts, including one of the DB vendors (the driver and its Quarkus extension). This worked fine up until now but with 3.14 something seems to have changed and excluded classes seem to be loaded by the classloader. This almost looks like a bug, or at the very least Migration Guide issue as there's no mention of it there.

Are you aware what might have changed? Any pointers would be appreciated!

[gsmet]

I don’t think it’s a desired behavior.

Any chance you could prepare a small Maven reproducer? I’ll have a look tomorrow.

[vmuzikar]

Nevermind, seems to be specific to the Oracle JDBC extension. Will investigate further.

[gsmet]

OK. Please ping me on Zulip if you find something odd on our side in the end (don't want to miss it).

[vmuzikar]

@gsmet Thanks.

Just for transparency, I'll send and update here as well.

I believe I was able to identify the root cause. It caused that now the recorder touches some classes of the DB driver itself. In Keycloak, we're excluding the driver JARs from our distribution (users then need to provide them manually) and we're excluding the extension from the classpath as well using quarkus.class-loading.removed-artifacts. That worked fine up until 3.14 but the changes to the Oracle extension revealed a deeper issue: it seems like the quarkus.class-loading.removed-artifacts option is not picked up during the initial augmentation during the maven build. This causes that the extension is present on the classpath (and the recorder is executed) until a proper reaugmentation is run. Does that seem correct?

[gsmet]

Yeah the artifacts are removed from the jar but they are present before that.

This thing has never been designed to disable extensions - meaning I expect the extension build steps to be executed.
Now if it helps we can revert this patch for 3.14/3.15 as it was just some cleanup. If you answer fast enough, it could even hit 3.14.2 that I will release tomorrow.
But we probably need a broader discussion about what you want to do and how we should support it.

[vmuzikar]

Seems we might be able to resolve it by requiring user to run reaugmentation and don't just run a freshly built Keycloak without doing that first. It's the correct thing to do anyway. I'll see if I hit any issues with that and get back to you. Thanks for now! :)