Skip to content

Conversation

@johnnyshields
Copy link

@johnnyshields johnnyshields commented Oct 25, 2025

Upgrade to Elasticsearch 9.1.4

This PR also does the following:

  • Upgrade Java to JVM 21
  • Upgrade Gradle to 8.11
  • Fix all deprecations
  • Fix integrations tests on Elasticsearch and re-enable them
  • Fixes the library to use the new entitlement-policy.yaml framework.
    • As part of this, in ES9 we can now ONLY load dicts, char.def, and subplugins from the config/sudachi directory. It is no longer allowed to load them from the root dir or other places.
    • entitlement-policy also forces us to load sudachi.jar directly, and require its files using .andThen(PathAnchor.classpath(ConfigAdapter::class.java)).

Follow-up Ticket:

After these changes, Sudachi loads, but there still seem to be some entitlement policy failures in the log lines. These may be silent failures; it looks like ES still ultimately loads.

I believe these are coming from the com.worksap.nlp.sudachi.PathAnchor class (see below). It seems like it's trying to load from the user's home dir first (not allowed by entitlement-policy.yaml). Possible solutions:

  1. Make PathAnchor not attempt to access the home dir, or alternatively, make a "locked down" mode where it doesn't do this (i.e. when "Anchored")
  2. Change entitlement-policy.yaml to allow accessing the user's home dir --> strongly not preferred, would prefer to keep security locked down as per other ES plugin standards.
[2025-10-28T20:34:11,591][WARN ][o.e.e.r.p.P.a.A.c.w.n.sudachi] [DESKTOP-G8M5HPP] Not entitled: component [analysis-sudachi], module [ALL-UNNAMED], class [class com.worksap.nlp.sudachi.PathAnchor], entitlement [file], operation [read], path [char.def]org.elasticsearch.entitlement.runtime.api.NotEntitledException: component [analysis-sudachi], module [ALL-UNNAMED], class [class com.worksap.nlp.sudachi.PathAnchor], entitlement [file], operation [read], path [char.def]
        at org.elasticsearch.entitlement@9.1.4/org.elasticsearch.entitlement.runtime.policy.PolicyCheckerImpl.notEntitled(PolicyCheckerImpl.java:467)
        at org.elasticsearch.entitlement@9.1.4/org.elasticsearch.entitlement.runtime.policy.PolicyCheckerImpl.checkFileRead(PolicyCheckerImpl.java:245)
        at org.elasticsearch.entitlement@9.1.4/org.elasticsearch.entitlement.runtime.policy.PolicyCheckerImpl.checkFileRead(PolicyCheckerImpl.java:208)
        at org.elasticsearch.entitlement@9.1.4/org.elasticsearch.entitlement.runtime.policy.ElasticsearchEntitlementChecker.check$java_nio_file_Files$$exists(ElasticsearchEntitlementChecker.java:2193)
        at java.base/java.nio.file.Files.exists(Files.java)

See logs for more details.

[2025-10-28T20:34:11,592][WARN ][o.e.e.r.p.P.a.A.c.w.n.sudachi] [DESKTOP-G8M5HPP] Not entitled: component [analysis-sudachi], module [ALL-UNNAMED], class [class com.worksap.nlp.sudachi.PathAnchor], entitlement [file], operation [read], path [unk.def]org.elasticsearch.entitlement.runtime.api.NotEntitledException: component [analysis-sudachi], module [ALL-UNNAMED], class [class com.worksap.nlp.sudachi.PathAnchor], entitlement [file], operation [read], path [unk.def]
        at org.elasticsearch.entitlement@9.1.4/org.elasticsearch.entitlement.runtime.policy.PolicyCheckerImpl.notEntitled(PolicyCheckerImpl.java:467)
        at org.elasticsearch.entitlement@9.1.4/org.elasticsearch.entitlement.runtime.policy.PolicyCheckerImpl.checkFileRead(PolicyCheckerImpl.java:245)
        at org.elasticsearch.entitlement@9.1.4/org.elasticsearch.entitlement.runtime.policy.PolicyCheckerImpl.checkFileRead(PolicyCheckerImpl.java:208)
        at org.elasticsearch.entitlement@9.1.4/org.elasticsearch.entitlement.runtime.policy.ElasticsearchEntitlementChecker.check$java_nio_file_Files$$exists(ElasticsearchEntitlementChecker.java:2193)
        at java.base/java.nio.file.Files.exists(Files.java)

- Upgrade Java to JVM 21
- Upgrade Gradle to 8.11
- Fix all deprecations
- Fix integrations tests on Elasticsearch and re-enable them
@johnnyshields johnnyshields force-pushed the es-upgrade-9.1.4 branch 5 times, most recently from f89efdb to 0994c0a Compare October 28, 2025 08:29
- Move sudachi lib requirement as a direct implementation dep (otherwise breaks entitlement policy)
- Add entitlement policy test

java {
sourceCompatibility = JavaVersion.VERSION_21
targetCompatibility = JavaVersion.VERSION_21
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JVM 21 is required by ES9

var esKind = sudachiEs.kind.get()
dependsOn embedVersion, packageJars, packageSpiJars
archiveBaseName.set("${esKind.engine.kind}-${esKind.version}-$archivesBaseName")
archiveBaseName.set("${esKind.engine.kind}-${esKind.version}-${base.archivesName.get()}")
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a deprecation fix in gradle

class EsTestEnvExtension {
Path bundlePath = null
Path systemDic = null
Path configFile = null
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are now handled by addConfigFile (see below)

dependencies {
spi(project(':spi'))
implementation(project(':spi'))
implementation('com.worksap.nlp:sudachi:0.7.4')
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is required to load the sudachi jar in ES9. We can't use the previous dynamic loading anymore due to entitlement-policy.yaml

into "build/package/${version}/${esKind.engine.kind}-${esKind.version}/spi"
} else {
into "build/package/${version}/${esKind.engine.kind}-${esKind.version}"
}
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See above, we can't do dynamic loading due to entitlement-policy.yaml--at least I couldn't get it to work.

private val basePath = resourcesPath(env, settings)
private val fullAnchor = PathAnchor.filesystem(basePath).andThen(anchor)
private val fullAnchor =
PathAnchor.filesystem(basePath).andThen(PathAnchor.classpath(ConfigAdapter::class.java))
Copy link
Author

@johnnyshields johnnyshields Oct 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this method ConfigAdapter(anchor: PathAnchor...), the anchor arg is no longer used in my code b/c we are now from forcing to load from either (1) config/sudachi dir or the (2) sudachi.jar itself. Things seem to work fine but perhaps I'm missing something. Perhaps we can remove the anchor arg entirely.

Note also the change to use ConfigAdapter::class.java. This is related to the fact that we are now loading the sudachi jar directly.

It would be a good idea to write more tests for this ConfigAdapter class so we can understand all usage scenarios.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant