[Task]: Also remove META-INF for excluded transitive dependencies in Beam vendored dependencies

[Abacn]

What needs to happen?

We vendor a few dependencies (nowadays only guava, grpc, calcite), where some transitive dependency were explicitly excluded, e.g.

beam/vendor/calcite-1_28_0/build.gradle

Lines 94 to 95 in b876299

	"org/apache/log4j/**",
	"org/apache/logging/log4j/**",

But their META-INF still exists in the vendored jar artifact. This gives false positive vulnerability alerts for some user.

This tasks involves

• Investigate whether removing these META-INF would break Beam
• If not, improve the vendor build script to also exclude META-INF for these excluded transitive dependencies

Issue Priority

Priority: 2

Issue Components

• Component: Python SDK
• Component: Java SDK
• Component: Go SDK
• Component: Typescript SDK
• Component: IO connector
• Component: Beam YAML
• Component: Beam examples
• Component: Beam playground
• Component: Beam katas
• Component: Website
• Component: Spark Runner
• Component: Flink Runner
• Component: Samza Runner
• Component: Twister2 Runner
• Component: Hazelcast Jet Runner
• Component: Google Cloud Dataflow Runner

[github-actions]

This issue has been marked as stale due to 150 days of inactivity. It will be closed in 30 days if no further activity occurs. If you think that’s incorrect or this issue still needs to be addressed, please simply write any comment. If closed, you can reopen the issue at any time. Thank you for your contributions.