Skip to content

Commit c8673ad

Browse files
maltesandermaltesander
committed
readd 4.0.0
1 parent eb1130f commit c8673ad

File tree

10 files changed

+224
-6
lines changed

10 files changed

+224
-6
lines changed

‎CHANGELOG.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,6 @@ All notable changes to this project will be documented in this file.
1515
- airflow: Bump celery version to 5.5.3 for Airflow 3.x ([#1343]).
1616
- hive: fixed 4.0.1 shaded hive-metastore-opa-authorizer jar by relocating dependencies ([#1356]).
1717

18-
### Removed
19-
20-
- hive: Remove `4.0.0` ([#1340]).
21-
2218
[#1336]: https://github.com/stackabletech/docker-images/pull/1336
2319
[#1337]: https://github.com/stackabletech/docker-images/pull/1337
2420
[#1343]: https://github.com/stackabletech/docker-images/pull/1343

‎hive/boil-config.toml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,21 @@ aws-java-sdk-bundle-version = "1.12.367"
1313
azure-storage-version = "7.0.1"
1414
azure-keyvault-core-version = "1.0.0"
1515

16+
[versions."4.0.0".local-images]
17+
# Hive 4 must be built with Java 8 (according to GitHub README) but seems to run on Java 11
18+
java-base = "11"
19+
java-devel = "8"
20+
"hadoop/hadoop" = "3.3.6"
21+
# hive-metastore-opa-authorizer from: https://github.com/boschglobal/hive-metastore-opa-authorizer
22+
"hive/hive-metastore-opa-authorizer" = "v1.0.0-hive-4.0.0-hadoop-3.3.6"
23+
24+
[versions."4.0.0".build-arguments]
25+
jmx-exporter-version = "1.3.0"
26+
# Keep consistent with the dependency from Hadoop: https://mvnrepository.com/artifact/org.apache.hadoop/hadoop-aws/3.3.6
27+
aws-java-sdk-bundle-version = "1.12.367"
28+
azure-storage-version = "7.0.1"
29+
azure-keyvault-core-version = "1.0.0"
30+
1631
[versions."4.0.1".local-images]
1732
# Hive 4.0 must be built with Java 8 (according to GitHub README) but seems to run on Java 11
1833
java-base = "11"

‎hive/hive-metastore-opa-authorizer/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ mvn versions:set -DnewVersion=${AUTHORIZER_VERSION}
5353
if [[ "${HIVE_VERSION}" == "3.1.3" ]]; then
5454
mvn clean package -DskipTests -Dhive.version=${HIVE_VERSION} -Dhadoop.version=${HADOOP_VERSION} -f hms-v3/pom.xml
5555
mv hms-v3/target/com.bosch.bdps.hms3-${HIVE_VERSION}-${HADOOP_VERSION}-${AUTHORIZER_VERSION}.jar /stackable/opa-authorizer-bin/hms3-${HIVE_VERSION}-${HADOOP_VERSION}-${AUTHORIZER_VERSION}.jar
56-
# Hive 4.0.1 only works with the shaded jar
57-
elif [[ "${HIVE_VERSION}" == "4.0.1" ]]; then
56+
# Hive 4.0.* only works with the shaded jar
57+
elif [[ "${HIVE_VERSION}" == "4.0.*" ]]; then
5858
mvn clean package -DskipTests -Dhive.version=${HIVE_VERSION} -Dhadoop.version=${HADOOP_VERSION} -f hms-v4/pom.xml
5959
mv hms-v4/target/com.bosch.bdps.hms4-${HIVE_VERSION}-${HADOOP_VERSION}-${AUTHORIZER_VERSION}.jar /stackable/opa-authorizer-bin/hms4-${HIVE_VERSION}-${HADOOP_VERSION}-${AUTHORIZER_VERSION}.jar
6060
# Hive 4.1.0 only works with the non shaded jar

‎hive/hive-metastore-opa-authorizer/boil-config.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,15 @@ authorizer-version = "v1.0.0"
77
hive-version = "3.1.3"
88
delete-caches = "true"
99

10+
[versions."v1.0.0-hive-4.0.0-hadoop-3.3.6".local-images]
11+
"java-devel" = "11"
12+
"hadoop/hadoop" = "3.3.6"
13+
14+
[versions."v1.0.0-hive-4.0.0-hadoop-3.3.6".build-arguments]
15+
authorizer-version = "v1.0.0"
16+
hive-version = "4.0.0"
17+
delete-caches = "true"
18+
1019
[versions."v1.0.0-hive-4.0.1-hadoop-3.3.6".local-images]
1120
"java-devel" = "11"
1221
"hadoop/hadoop" = "3.3.6"

‎hive/stackable/patches/4.0.0/0001-Include-Postgres-driver.patch‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From c5eb86648fe96b048723372024fa7278c9e108db Mon Sep 17 00:00:00 2001
2+
From: Sebastian Bernauer <sebastian.bernauer@stackable.de>
3+
Date: Tue, 3 Sep 2024 11:13:24 +0200
4+
Subject: Include Postgres driver
5+
6+
---
7+
standalone-metastore/metastore-server/pom.xml | 1 -
8+
standalone-metastore/pom.xml | 1 -
9+
2 files changed, 2 deletions(-)
10+
11+
diff --git a/standalone-metastore/metastore-server/pom.xml b/standalone-metastore/metastore-server/pom.xml
12+
index a8f680928c..7102f1b5ca 100644
13+
--- a/standalone-metastore/metastore-server/pom.xml
14+
+++ b/standalone-metastore/metastore-server/pom.xml
15+
@@ -334,7 +334,6 @@
16+
<dependency>
17+
<groupId>org.postgresql</groupId>
18+
<artifactId>postgresql</artifactId>
19+
- <optional>true</optional>
20+
</dependency>
21+
<dependency>
22+
<groupId>org.eclipse.jetty</groupId>
23+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
24+
index 28ac5ceb65..e3cbd821bd 100644
25+
--- a/standalone-metastore/pom.xml
26+
+++ b/standalone-metastore/pom.xml
27+
@@ -397,7 +397,6 @@
28+
<groupId>org.postgresql</groupId>
29+
<artifactId>postgresql</artifactId>
30+
<version>${postgres.version}</version>
31+
- <scope>runtime</scope>
32+
</dependency>
33+
<dependency>
34+
<groupId>org.apache.httpcomponents</groupId>

‎hive/stackable/patches/4.0.0/0002-Include-logging-dependencies.patch‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 69071d4d4525a8ceb27cbefa9a093d0678a1f3dd Mon Sep 17 00:00:00 2001
2+
From: Lars Francke <lars.francke@stackable.tech>
3+
Date: Tue, 13 Aug 2024 13:38:12 +0200
4+
Subject: Include logging dependencies
5+
6+
This adds dependencies required for use of the XmlLayout for logging
7+
---
8+
standalone-metastore/pom.xml | 5 +++++
9+
1 file changed, 5 insertions(+)
10+
11+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
12+
index e3cbd821bd..205fc31ec7 100644
13+
--- a/standalone-metastore/pom.xml
14+
+++ b/standalone-metastore/pom.xml
15+
@@ -493,6 +493,11 @@
16+
<groupId>com.fasterxml.jackson.core</groupId>
17+
<artifactId>jackson-databind</artifactId>
18+
</dependency>
19+
+ <dependency>
20+
+ <!-- Optional log4j dependency to be able to use the XmlLayout -->
21+
+ <groupId>com.fasterxml.jackson.dataformat</groupId>
22+
+ <artifactId>jackson-dataformat-xml</artifactId>
23+
+ </dependency>
24+
</dependencies>
25+
<build>
26+
<pluginManagement>

‎hive/stackable/patches/4.0.0/0003-Add-CycloneDX-plugin.patch‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
From 23995b6c1ef70e4e119ce0493e63ff3a75ea1378 Mon Sep 17 00:00:00 2001
2+
From: Lukas Voetmand <lukas.voetmand@stackable.tech>
3+
Date: Fri, 6 Sep 2024 17:53:52 +0200
4+
Subject: Add CycloneDX plugin
5+
6+
---
7+
standalone-metastore/pom.xml | 18 ++++++++++++++++++
8+
1 file changed, 18 insertions(+)
9+
10+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
11+
index 205fc31ec7..2982a45ca0 100644
12+
--- a/standalone-metastore/pom.xml
13+
+++ b/standalone-metastore/pom.xml
14+
@@ -41,6 +41,7 @@
15+
<maven.compiler.useIncrementalCompilation>false</maven.compiler.useIncrementalCompilation>
16+
<maven.repo.local>${settings.localRepository}</maven.repo.local>
17+
<maven.exec.plugin.version>3.1.0</maven.exec.plugin.version>
18+
+ <maven.cyclonedx.plugin.version>2.8.0</maven.cyclonedx.plugin.version>
19+
<checkstyle.conf.dir>${basedir}/${standalone.metastore.path.to.root}/checkstyle</checkstyle.conf.dir>
20+
<!-- Test Properties -->
21+
<log4j.conf.dir>${project.basedir}/src/test/resources</log4j.conf.dir>
22+
@@ -594,6 +595,23 @@
23+
</excludes>
24+
</configuration>
25+
</plugin>
26+
+ <plugin>
27+
+ <groupId>org.cyclonedx</groupId>
28+
+ <artifactId>cyclonedx-maven-plugin</artifactId>
29+
+ <version>${maven.cyclonedx.plugin.version}</version>
30+
+ <configuration>
31+
+ <projectType>application</projectType>
32+
+ <schemaVersion>1.5</schemaVersion>
33+
+ </configuration>
34+
+ <executions>
35+
+ <execution>
36+
+ <phase>package</phase>
37+
+ <goals>
38+
+ <goal>makeBom</goal>
39+
+ </goals>
40+
+ </execution>
41+
+ </executions>
42+
+ </plugin>
43+
</plugins>
44+
</build>
45+
<profiles>

‎hive/stackable/patches/4.0.0/0004-Fix-CVE-2024-36114.patch‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From 4a85ad5ec7b0dbfb9f2c4524531ae0198a352b3d Mon Sep 17 00:00:00 2001
2+
From: Malte Sander <malte.sander.it@gmail.com>
3+
Date: Tue, 12 Nov 2024 11:49:57 +0100
4+
Subject: Fix CVE-2024-36114
5+
6+
see https://github.com/stackabletech/vulnerabilities/issues/834
7+
8+
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and
9+
Zstandard compression algorithms to Java. All decompressor
10+
implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash
11+
the JVM for certain input, and in some cases also leak the content of
12+
other memory of the Java process (which could contain sensitive
13+
information). When decompressing certain data, the decompressors try to
14+
access memory outside the bounds of the given byte arrays or byte
15+
buffers. Because Aircompressor uses the JDK class sun.misc.Unsafe to
16+
speed up memory access, no additional bounds checks are performed and
17+
this has similar security consequences as out-of-bounds access in C or
18+
C++, namely it can lead to non-deterministic behavior or crash the JVM.
19+
Users should update to Aircompressor 0.27 or newer where these issues
20+
have been fixed. When decompressing data from untrusted users, this can
21+
be exploited for a denial-of-service attack by crashing the JVM, or to
22+
leak other sensitive information from the Java process. There are no
23+
known workarounds for this issue.
24+
---
25+
standalone-metastore/pom.xml | 6 ++++++
26+
1 file changed, 6 insertions(+)
27+
28+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
29+
index 2982a45ca0..cd34884e3b 100644
30+
--- a/standalone-metastore/pom.xml
31+
+++ b/standalone-metastore/pom.xml
32+
@@ -121,6 +121,12 @@
33+
</properties>
34+
<dependencyManagement>
35+
<dependencies>
36+
+ <!-- Mitigate CVE-2024-36114: See https://github.com/stackabletech/vulnerabilities/issues/834 -->
37+
+ <dependency>
38+
+ <groupId>io.airlift</groupId>
39+
+ <artifactId>aircompressor</artifactId>
40+
+ <version>0.27</version>
41+
+ </dependency>
42+
<dependency>
43+
<groupId>org.apache.orc</groupId>
44+
<artifactId>orc-core</artifactId>

‎hive/stackable/patches/4.0.0/0005-Fix-CVE-2024-1597.patch‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 85fab788520b73e514e52e0753d36dafdf513e5b Mon Sep 17 00:00:00 2001
2+
From: Nick Larsen <nick.larsen@stackable.tech>
3+
Date: Thu, 15 May 2025 14:14:28 +0200
4+
Subject: Fix CVE-2024-1597
5+
6+
See https://github.com/stackabletech/vulnerabilities/issues/681
7+
8+
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using
9+
PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there
10+
is no vulnerability. A placeholder for a numeric value must be immediately
11+
preceded by a minus. There must be a second placeholder for a string value after
12+
the first placeholder; both must be on the same line. By constructing a matching
13+
string payload, the attacker can inject SQL to alter the query,bypassing the
14+
protections that parameterized queries bring against SQL Injection attacks.
15+
Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are
16+
affected.
17+
---
18+
pom.xml | 2 +-
19+
standalone-metastore/pom.xml | 2 +-
20+
2 files changed, 2 insertions(+), 2 deletions(-)
21+
22+
diff --git a/pom.xml b/pom.xml
23+
index a4dfc8d1e4..699228cba3 100644
24+
--- a/pom.xml
25+
+++ b/pom.xml
26+
@@ -178,7 +178,7 @@
27+
<mariadb.version>2.5.0</mariadb.version>
28+
<mssql.version>6.2.1.jre8</mssql.version>
29+
<mysql.version>8.0.31</mysql.version>
30+
- <postgres.version>42.5.1</postgres.version>
31+
+ <postgres.version>42.5.6</postgres.version>
32+
<oracle.version>21.3.0.0</oracle.version>
33+
<opencsv.version>2.3</opencsv.version>
34+
<orc.version>1.8.5</orc.version>
35+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
36+
index cd34884e3b..da84c8928e 100644
37+
--- a/standalone-metastore/pom.xml
38+
+++ b/standalone-metastore/pom.xml
39+
@@ -72,7 +72,7 @@
40+
<mariadb.version>2.5.0</mariadb.version>
41+
<mssql.version>6.2.1.jre8</mssql.version>
42+
<mysql.version>8.0.31</mysql.version>
43+
- <postgres.version>42.5.1</postgres.version>
44+
+ <postgres.version>42.5.6</postgres.version>
45+
<oracle.version>21.3.0.0</oracle.version>
46+
<dropwizard-metrics-hadoop-metrics2-reporter.version>0.1.2
47+
</dropwizard-metrics-hadoop-metrics2-reporter.version>

‎hive/stackable/patches/4.0.0/patchable.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
base = "183f8cb41d3dbed961ffd27999876468ff06690c"
2+
mirror = "https://github.com/stackabletech/hive.git"

0 commit comments

Comments
 (0)