Skip to content

Commit 9566b78

Browse files
razvanrazvan
authored
fix: readd Hive 4.0.0 (#1031)
* fix: readd Hive 4.0.0 * add patches
1 parent ae47d9d commit 9566b78

File tree

7 files changed

+164
-0
lines changed

7 files changed

+164
-0
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ All notable changes to this project will be documented in this file.
3939
- omid: Use jmx_export 1.1.0 ([#1021]).
4040
- spark: Add 3.5.5 ([#1022]).
4141
- trino: Add libstdc++ package, needed by snappy and duckdb ([#1015]).
42+
- hive: Revert the removal of 4.0.0 ([#1031]).
4243

4344
### Changed
4445

‎hive/stackable/patches/4.0.0/0001-Include-Postgres-driver.patch

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From c5eb86648fe96b048723372024fa7278c9e108db Mon Sep 17 00:00:00 2001
2+
From: Sebastian Bernauer <sebastian.bernauer@stackable.de>
3+
Date: Tue, 3 Sep 2024 11:13:24 +0200
4+
Subject: Include Postgres driver
5+
6+
---
7+
standalone-metastore/metastore-server/pom.xml | 1 -
8+
standalone-metastore/pom.xml | 1 -
9+
2 files changed, 2 deletions(-)
10+
11+
diff --git a/standalone-metastore/metastore-server/pom.xml b/standalone-metastore/metastore-server/pom.xml
12+
index a8f680928c..7102f1b5ca 100644
13+
--- a/standalone-metastore/metastore-server/pom.xml
14+
+++ b/standalone-metastore/metastore-server/pom.xml
15+
@@ -334,7 +334,6 @@
16+
<dependency>
17+
<groupId>org.postgresql</groupId>
18+
<artifactId>postgresql</artifactId>
19+
- <optional>true</optional>
20+
</dependency>
21+
<dependency>
22+
<groupId>org.eclipse.jetty</groupId>
23+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
24+
index 28ac5ceb65..e3cbd821bd 100644
25+
--- a/standalone-metastore/pom.xml
26+
+++ b/standalone-metastore/pom.xml
27+
@@ -397,7 +397,6 @@
28+
<groupId>org.postgresql</groupId>
29+
<artifactId>postgresql</artifactId>
30+
<version>${postgres.version}</version>
31+
- <scope>runtime</scope>
32+
</dependency>
33+
<dependency>
34+
<groupId>org.apache.httpcomponents</groupId>

‎hive/stackable/patches/4.0.0/0002-Include-logging-dependencies.patch

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 69071d4d4525a8ceb27cbefa9a093d0678a1f3dd Mon Sep 17 00:00:00 2001
2+
From: Lars Francke <lars.francke@stackable.tech>
3+
Date: Tue, 13 Aug 2024 13:38:12 +0200
4+
Subject: Include logging dependencies
5+
6+
This adds dependencies required for use of the XmlLayout for logging
7+
---
8+
standalone-metastore/pom.xml | 5 +++++
9+
1 file changed, 5 insertions(+)
10+
11+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
12+
index e3cbd821bd..205fc31ec7 100644
13+
--- a/standalone-metastore/pom.xml
14+
+++ b/standalone-metastore/pom.xml
15+
@@ -493,6 +493,11 @@
16+
<groupId>com.fasterxml.jackson.core</groupId>
17+
<artifactId>jackson-databind</artifactId>
18+
</dependency>
19+
+ <dependency>
20+
+ <!-- Optional log4j dependency to be able to use the XmlLayout -->
21+
+ <groupId>com.fasterxml.jackson.dataformat</groupId>
22+
+ <artifactId>jackson-dataformat-xml</artifactId>
23+
+ </dependency>
24+
</dependencies>
25+
<build>
26+
<pluginManagement>

‎hive/stackable/patches/4.0.0/0003-Add-CycloneDX-plugin.patch

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
From 23995b6c1ef70e4e119ce0493e63ff3a75ea1378 Mon Sep 17 00:00:00 2001
2+
From: Lukas Voetmand <lukas.voetmand@stackable.tech>
3+
Date: Fri, 6 Sep 2024 17:53:52 +0200
4+
Subject: Add CycloneDX plugin
5+
6+
---
7+
standalone-metastore/pom.xml | 18 ++++++++++++++++++
8+
1 file changed, 18 insertions(+)
9+
10+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
11+
index 205fc31ec7..2982a45ca0 100644
12+
--- a/standalone-metastore/pom.xml
13+
+++ b/standalone-metastore/pom.xml
14+
@@ -41,6 +41,7 @@
15+
<maven.compiler.useIncrementalCompilation>false</maven.compiler.useIncrementalCompilation>
16+
<maven.repo.local>${settings.localRepository}</maven.repo.local>
17+
<maven.exec.plugin.version>3.1.0</maven.exec.plugin.version>
18+
+ <maven.cyclonedx.plugin.version>2.8.0</maven.cyclonedx.plugin.version>
19+
<checkstyle.conf.dir>${basedir}/${standalone.metastore.path.to.root}/checkstyle</checkstyle.conf.dir>
20+
<!-- Test Properties -->
21+
<log4j.conf.dir>${project.basedir}/src/test/resources</log4j.conf.dir>
22+
@@ -594,6 +595,23 @@
23+
</excludes>
24+
</configuration>
25+
</plugin>
26+
+ <plugin>
27+
+ <groupId>org.cyclonedx</groupId>
28+
+ <artifactId>cyclonedx-maven-plugin</artifactId>
29+
+ <version>${maven.cyclonedx.plugin.version}</version>
30+
+ <configuration>
31+
+ <projectType>application</projectType>
32+
+ <schemaVersion>1.5</schemaVersion>
33+
+ </configuration>
34+
+ <executions>
35+
+ <execution>
36+
+ <phase>package</phase>
37+
+ <goals>
38+
+ <goal>makeBom</goal>
39+
+ </goals>
40+
+ </execution>
41+
+ </executions>
42+
+ </plugin>
43+
</plugins>
44+
</build>
45+
<profiles>

‎hive/stackable/patches/4.0.0/0004-Fix-CVE-2024-36114.patch

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From 4a85ad5ec7b0dbfb9f2c4524531ae0198a352b3d Mon Sep 17 00:00:00 2001
2+
From: Malte Sander <malte.sander.it@gmail.com>
3+
Date: Tue, 12 Nov 2024 11:49:57 +0100
4+
Subject: Fix CVE-2024-36114
5+
6+
see https://github.com/stackabletech/vulnerabilities/issues/834
7+
8+
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and
9+
Zstandard compression algorithms to Java. All decompressor
10+
implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash
11+
the JVM for certain input, and in some cases also leak the content of
12+
other memory of the Java process (which could contain sensitive
13+
information). When decompressing certain data, the decompressors try to
14+
access memory outside the bounds of the given byte arrays or byte
15+
buffers. Because Aircompressor uses the JDK class sun.misc.Unsafe to
16+
speed up memory access, no additional bounds checks are performed and
17+
this has similar security consequences as out-of-bounds access in C or
18+
C++, namely it can lead to non-deterministic behavior or crash the JVM.
19+
Users should update to Aircompressor 0.27 or newer where these issues
20+
have been fixed. When decompressing data from untrusted users, this can
21+
be exploited for a denial-of-service attack by crashing the JVM, or to
22+
leak other sensitive information from the Java process. There are no
23+
known workarounds for this issue.
24+
---
25+
standalone-metastore/pom.xml | 6 ++++++
26+
1 file changed, 6 insertions(+)
27+
28+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
29+
index 2982a45ca0..cd34884e3b 100644
30+
--- a/standalone-metastore/pom.xml
31+
+++ b/standalone-metastore/pom.xml
32+
@@ -121,6 +121,12 @@
33+
</properties>
34+
<dependencyManagement>
35+
<dependencies>
36+
+ <!-- Mitigate CVE-2024-36114: See https://github.com/stackabletech/vulnerabilities/issues/834 -->
37+
+ <dependency>
38+
+ <groupId>io.airlift</groupId>
39+
+ <artifactId>aircompressor</artifactId>
40+
+ <version>0.27</version>
41+
+ </dependency>
42+
<dependency>
43+
<groupId>org.apache.orc</groupId>
44+
<artifactId>orc-core</artifactId>

‎hive/stackable/patches/4.0.0/patchable.toml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
upstream = "https://github.com/apache/hive.git"
2+
base = "183f8cb41d3dbed961ffd27999876468ff06690c"

‎hive/versions.py

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,18 @@
1111
"azure_storage": "7.0.1",
1212
"azure_keyvault_core": "1.0.0",
1313
},
14+
{
15+
"product": "4.0.0",
16+
"jmx_exporter": "1.1.0",
17+
# Hive 4 must be built with Java 8 (according to GitHub README) but seems to run on Java 11
18+
"java-base": "11",
19+
"java-devel": "8",
20+
"hadoop": "3.3.6",
21+
# Keep consistent with the dependency from Hadoop: https://mvnrepository.com/artifact/org.apache.hadoop/hadoop-aws/3.3.6
22+
"aws_java_sdk_bundle": "1.12.367",
23+
"azure_storage": "7.0.1",
24+
"azure_keyvault_core": "1.0.0",
25+
},
1426
{
1527
"product": "4.0.1",
1628
"jmx_exporter": "1.1.0",

0 commit comments

Comments
 (0)