minimize shaded JAR

[abyrd]

We use the shade plugin (called shadow in Gradle) to combine OTP with its dependencies into a single JAR. This includes all the classes in those dependencies, even ones that are not used by OTP. Shade has a <minimizeJar>true</minimizeJar> parameter which attempts to remove unused classes. Experiments indicate this will probably reduce the size of otp.jar by roughly half to around 20MB.

Unfortunately even though we are now explicitly assembling the Jersey application and its optional features instead of relying on autoscanning, there is still some code (at least in Grizzly) that imports classes by mysterious reflective means that minimizeJar doesn't detect.

Someday we should get this working because it will make our distribution half as big.

[buma]

I just found about Capsule today on reddit.
It lets you package jar file without dependencies. And dependencies are automatically downloaded when jar is first started normally as any other jar.

This could maybe be one alternative.

[JordenVerwer]

Maybe, but it wouldn't replace the no-bullshit-just-download-this-one-file
JAR.

[abyrd]

I just tried this out again while revising the POM. Adding <minimizeJar>true</minimizeJar> to the shade plugin configuration cuts the OTP2 jar size from 80 to 40 MB. Still not sure if it's leaving out any classes loaded by name that can't be detected as necessary.

[t2gran]

@buma God to now about. But it is important to us that the jar contains everything, we will not open up the possibility for a component in our cluster to download anything from the internet, as this would make us more vulnerable to both failures (error in download) and to security risks.

[abyrd]

Also worth noting: as of October 2020 I've been phasing out using shaded/shadow JARs because they are not really how JARs were meant to be used, and it tends to waste lots of time due to conflicting JAR manifest entries, name collisions, etc. It's possible to just zip up all the dependencies, but you lose the convenience of having a single file you don't have to unzip.

In these cases though we wouldn't be minimizing the JAR, but it would probably be worth the tradeoff to have a larger archive that was following official practice instead of doing something hackish.

@t2gran has said there may be a new Java specification for a single-file runnable archive. We will look into that.

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 30 days