25.8 Stable: Bump to 25.8.23, BRANCH CHANGED!!!

.gitmodules

@@ -154,7 +154,7 @@
 	url = https://github.com/ClickHouse/rocksdb
 [submodule "contrib/xz"]
 	path = contrib/xz
-	url = https://github.com/xz-mirror/xz
+	url = https://github.com/tukaani-project/xz
 [submodule "contrib/abseil-cpp"]
 	path = contrib/abseil-cpp
 	url = https://github.com/ClickHouse/abseil-cpp.git

ci/jobs/scripts/docker_server/config.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+# Get current file directory
+currentDir="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
+
+# iterate over all directories in current path
+clickhouseTests=$( find "$currentDir"/tests/ -maxdepth 1 -name 'clickhouse-*' -not -name 'clickhouse-distroless-*' -type d -exec basename {} \; )
+clickhouseDistrolessTests=$( find "$currentDir"/tests/ -maxdepth 1 -name 'clickhouse-distroless-*' -type d -exec basename {} \; )
+keeperTests=$( find "$currentDir"/tests/ -maxdepth 1 -name 'keeper-*' -type d -exec basename {} \; )
+
+imageTests+=(
+	['clickhouse/clickhouse-server']="${clickhouseTests}"
+	['clickhouse/clickhouse-server:distroless']="${clickhouseTests} ${clickhouseDistrolessTests}"
+	['clickhouse/clickhouse-keeper']="${keeperTests}"
+	['clickhouse/clickhouse-keeper:distroless']="${keeperTests}"
+)

ci/jobs/scripts/docker_server/tests/clickhouse-distroless-initdb/initdb.sql

@@ -0,0 +1,3 @@
+CREATE DATABASE IF NOT EXISTS test_db;
+CREATE TABLE IF NOT EXISTS test_db.test_table (id UInt32, value UInt32) ENGINE = MergeTree ORDER BY id;
+INSERT INTO test_db.test_table VALUES (1, 100), (2, 200);

ci/jobs/scripts/docker_server/tests/clickhouse-distroless-initdb/run.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+# Verify that clickhouse docker-init executes SQL initdb scripts correctly.
+# The distroless image has no shell so initdb scripts must be handled
+# by the compiled docker-init entrypoint, not by entrypoint.sh.
+set -eo pipefail
+
+dir="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
+source "$dir/../lib.sh"
+
+image="$1"
+
+export CLICKHOUSE_USER='init_test_user'
+export CLICKHOUSE_PASSWORD='init_test_password'
+
+cid="$(
+  docker run -d \
+    -e CLICKHOUSE_USER \
+    -e CLICKHOUSE_PASSWORD \
+    -v "$dir/initdb.sql":/docker-entrypoint-initdb.d/initdb.sql:ro \
+    --name "$(cname)" \
+    "$image"
+)"
+trap 'docker rm -vf $cid > /dev/null' EXIT
+
+chCli() {
+  docker run --rm -i \
+    --link "$cid":clickhouse \
+    -e CLICKHOUSE_USER \
+    -e CLICKHOUSE_PASSWORD \
+    "$image" \
+    clickhouse-client \
+    --host clickhouse \
+    --user "$CLICKHOUSE_USER" \
+    --password "$CLICKHOUSE_PASSWORD" \
+    --query "$*"
+}
+
+# shellcheck source=../../../../../tmp/docker-library/official-images/test/retry.sh
+. "$TESTS_LIB_DIR/retry.sh" \
+  --tries "$CLICKHOUSE_TEST_TRIES" \
+  --sleep "$CLICKHOUSE_TEST_SLEEP" \
+  chCli SELECT 1
+
+# Verify the initdb script ran and created the table with the expected data
+chCli SHOW TABLES IN test_db | grep '^test_table$' >/dev/null
+[ "$(chCli 'SELECT SUM(value) FROM test_db.test_table')" = 300 ]

ci/jobs/scripts/docker_server/tests/clickhouse-distroless-no-shell/run.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Verify the distroless production image contains no shell.
+# This is the key property of a distroless image: /bin/sh, /bin/bash,
+# and other shells must be absent to reduce the attack surface.
+set -eo pipefail
+
+image="$1"
+
+if docker run --rm --entrypoint /bin/sh "$image" -c "echo bad" 2>/dev/null; then
+    echo "FAIL: /bin/sh should not exist in the distroless image" >&2
+    exit 1
+fi
+
+if docker run --rm --entrypoint /bin/bash "$image" -c "echo bad" 2>/dev/null; then
+    echo "FAIL: /bin/bash should not exist in the distroless image" >&2
+    exit 1
+fi

ci/jobs/scripts/workflow_hooks/filter_job.py

@@ -54,6 +54,15 @@ def should_skip_job(job_name):
     if _info_cache is None:
         _info_cache = Info()
 
+    # There is no way to prevent GitHub Actions from running the PR workflow on
+    # release branches, so we skip all jobs here. The ReleaseCI workflow is used
+    # for testing on release branches instead.
+    if (
+        Labels.RELEASE in _info_cache.pr_labels
+        or Labels.RELEASE_LTS in _info_cache.pr_labels
+    ):
+        return True, "Skipped for release PR"
+
     changed_files = _info_cache.get_kv_data("changed_files")
     if not changed_files:
         print("WARNING: no changed files found for PR - do not filter jobs")

ci/workflows/backport_branches.py

@@ -49,7 +49,7 @@
     enable_job_filtering_by_changes=True,
     enable_cache=True,
     enable_report=True,
-    enable_automerge=True,
+    enable_automerge=False,
     enable_cidb=True,
     enable_commit_status_on_failure=True,
     pre_hooks=[

cmake/autogenerated_versions.txt

@@ -2,15 +2,15 @@
 
 # NOTE: VERSION_REVISION has nothing common with DBMS_TCP_PROTOCOL_VERSION,
 # only DBMS_TCP_PROTOCOL_VERSION should be incremented on protocol changes.
-SET(VERSION_REVISION 54516)
+SET(VERSION_REVISION 54523)
 SET(VERSION_MAJOR 25)
 SET(VERSION_MINOR 8)
-SET(VERSION_PATCH 16)
-SET(VERSION_GITHASH 7a0b36cf8934881236312e9fea094baaf5c709a4)
-SET(VERSION_DESCRIBE v25.8.16.10002.altinitytest)
-SET(VERSION_STRING 25.8.16.10002.altinitytest)
+SET(VERSION_PATCH 23)
+SET(VERSION_GITHASH 6d29497525664acca46a1d1cd0d5787e9ad0857d)
+SET(VERSION_DESCRIBE v25.8.23.10001.altinitytest)
+SET(VERSION_STRING 25.8.23.10001.altinitytest)
 # end of autochange
 
-SET(VERSION_TWEAK 10002)
+SET(VERSION_TWEAK 10001)
 SET(VERSION_FLAVOUR altinitytest)
 

contrib/aws-cmake/AwsGetVersion.cmake

@@ -0,0 +1,24 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0.
+
+function(aws_get_version var_version_major var_version_minor var_version_patch var_version_full var_git_hash)
+    # Simple version is "MAJOR.MINOR.PATCH" from VERSION file
+    file(READ "${AWS_CRT_DIR}/VERSION" version_simple)
+    string(STRIP ${version_simple} version_simple)
+    set(${var_version_simple} ${version_simple} PARENT_SCOPE)
+
+    string(REPLACE "." ";" VERSION_LIST ${version_simple})
+    list(GET VERSION_LIST 0 version_major)
+    list(GET VERSION_LIST 1 version_minor)
+    list(GET VERSION_LIST 2 version_patch)
+    set(${var_version_major} ${version_major} PARENT_SCOPE)
+    set(${var_version_minor} ${version_minor} PARENT_SCOPE)
+    set(${var_version_patch} ${version_patch} PARENT_SCOPE)
+
+    # By default, full version is same as simple version.
+    # But we'll make it more specific later, if we determine that we're not at an exact tagged commit.
+    set(${var_version_full} ${version_simple} PARENT_SCOPE)
+
+    # Don't include the hash of HEAD in a config file. It's just terrible for build caching and useless
+    set(var_git_hash "" PARENT_SCOPE)
+endfunction()

contrib/aws-cmake/CMakeLists.txt

@@ -25,7 +25,7 @@ include("${ClickHouse_SOURCE_DIR}/contrib/aws-cmake/AwsFeatureTests.cmake")
 include("${ClickHouse_SOURCE_DIR}/contrib/aws-cmake/AwsThreadAffinity.cmake")
 include("${ClickHouse_SOURCE_DIR}/contrib/aws-cmake/AwsThreadName.cmake")
 include("${ClickHouse_SOURCE_DIR}/contrib/aws-cmake/AwsSIMD.cmake")
-include("${ClickHouse_SOURCE_DIR}/contrib/aws-crt-cpp/cmake/AwsGetVersion.cmake")
+include("${ClickHouse_SOURCE_DIR}/contrib/aws-cmake/AwsGetVersion.cmake")
 
 set (AWS_STUBS "${ClickHouse_SOURCE_DIR}/contrib/aws-cmake/aws_stubs.cpp")
 
@@ -44,6 +44,12 @@ if (CMAKE_BUILD_TYPE_UC STREQUAL "DEBUG")
     list(APPEND AWS_PRIVATE_COMPILE_DEFS "-DDEBUG_BUILD")
 endif()
 
+if (OS_LINUX)
+    list(APPEND AWS_PRIVATE_COMPILE_DEFS "-DAWS_ENABLE_EPOLL")
+elseif (OS_DARWIN)
+    list(APPEND AWS_PRIVATE_COMPILE_DEFS "-DAWS_ENABLE_KQUEUE")
+endif()
+
 set(ENABLE_OPENSSL_ENCRYPTION ON)
 if (ENABLE_OPENSSL_ENCRYPTION)
     list(APPEND AWS_PRIVATE_COMPILE_DEFS "-DENABLE_OPENSSL_ENCRYPTION")
@@ -76,8 +82,8 @@ file(GLOB AWS_SDK_CORE_SRC
     "${AWS_SDK_CORE_DIR}/source/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/auth/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/auth/bearer-token-provider/*.cpp"
-    "${AWS_SDK_CORE_DIR}/source/auth/signer/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/auth/signer-provider/*.cpp"
+    "${AWS_SDK_CORE_DIR}/source/auth/signer/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/client/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/config/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/config/defaults/*.cpp"
@@ -96,8 +102,11 @@ file(GLOB AWS_SDK_CORE_SRC
     "${AWS_SDK_CORE_DIR}/source/smithy/tracing/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/utils/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/utils/base64/*.cpp"
+    "${AWS_SDK_CORE_DIR}/source/utils/cbor/*.cpp"
+    "${AWS_SDK_CORE_DIR}/source/utils/checksum/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/utils/component-registry/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/utils/crypto/*.cpp"
+    "${AWS_SDK_CORE_DIR}/source/utils/crypto/crt/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/utils/crypto/factory/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/utils/crypto/openssl/*.cpp"
     "${AWS_SDK_CORE_DIR}/source/utils/event/*.cpp"
@@ -123,8 +132,6 @@ configure_file("${AWS_SDK_CORE_DIR}/include/aws/core/SDKConfig.h.in"
     "${CMAKE_CURRENT_BINARY_DIR}/include/aws/core/SDKConfig.h" @ONLY)
 
 aws_get_version(AWS_CRT_CPP_VERSION_MAJOR AWS_CRT_CPP_VERSION_MINOR AWS_CRT_CPP_VERSION_PATCH FULL_VERSION GIT_HASH)
-# Don't include the hash of HEAD in a config file. It's just terrible for build caching and useless
-set(GIT_HASH "")
 set(FULL_VERSION "${AWS_CRT_CPP_VERSION_MAJOR}.${AWS_CRT_CPP_VERSION_MINOR}.${AWS_CRT_CPP_VERSION_PATCH}-clickhouse")
 configure_file("${AWS_CRT_DIR}/include/aws/crt/Config.h.in" "${CMAKE_CURRENT_BINARY_DIR}/include/aws/crt/Config.h" @ONLY)
 
@@ -168,12 +175,19 @@ list(APPEND AWS_PUBLIC_INCLUDES "${AWS_AUTH_DIR}/include/")
 # aws-c-cal
 file(GLOB AWS_CAL_SRC
     "${AWS_CAL_DIR}/source/*.c"
+    "${AWS_CAL_DIR}/source/shared/*.c"
 )
 
 if (ENABLE_OPENSSL_ENCRYPTION)
-    file(GLOB AWS_CAL_OS_SRC
-        "${AWS_CAL_DIR}/source/unix/*.c"
-    )
+    if (OS_LINUX)
+        file(GLOB AWS_CAL_OS_SRC
+            "${AWS_CAL_DIR}/source/unix/*.c"
+        )
+    else (OS_DARWIN)
+        file(GLOB AWS_CAL_OS_SRC
+            "${AWS_CAL_DIR}/source/darwin/*.c"
+        )
+    endif()
     list(APPEND AWS_PRIVATE_LIBS OpenSSL::Crypto)
 endif()
 
@@ -196,6 +210,9 @@ file(GLOB AWS_COMMON_SRC
     "${AWS_COMMON_DIR}/source/external/*.c"
     "${AWS_COMMON_DIR}/source/posix/*.c"
     "${AWS_COMMON_DIR}/source/linux/*.c"
+    "${AWS_COMMON_DIR}/source/external/libcbor/*.c"
+    "${AWS_COMMON_DIR}/source/external/libcbor/cbor/*.c"
+    "${AWS_COMMON_DIR}/source/external/libcbor/cbor/internal/*.c"
 )
 
 file(GLOB AWS_COMMON_ARCH_SRC
@@ -208,9 +225,13 @@ if (AWS_ARCH_INTEL)
         "${AWS_COMMON_DIR}/source/arch/intel/asm/*.c"
     )
 elseif (AWS_ARCH_ARM64 OR AWS_ARCH_ARM32)
-    if (AWS_HAVE_AUXV)
+    if (OS_LINUX)
+        file(GLOB AWS_COMMON_ARCH_SRC
+            "${AWS_COMMON_DIR}/source/arch/arm/auxv/cpuid.c"
+        )
+    elseif(OS_DARWIN)
         file(GLOB AWS_COMMON_ARCH_SRC
-            "${AWS_COMMON_DIR}/source/arch/arm/asm/*.c"
+            "${AWS_COMMON_DIR}/source/arch/arm/darwin/cpuid.c"
         )
     endif()
 endif()
@@ -232,17 +253,20 @@ list(APPEND AWS_PUBLIC_INCLUDES
     "${CMAKE_CURRENT_BINARY_DIR}/include"
 )
 
+list(APPEND AWS_PRIVATE_INCLUDES
+    "${AWS_COMMON_DIR}/source/external/libcbor/cbor/"
+    "${AWS_COMMON_DIR}/source/external/libcbor/"
+)
+
 
 # aws-checksums
 file(GLOB AWS_CHECKSUMS_SRC
     "${AWS_CHECKSUMS_DIR}/source/*.c"
-    "${AWS_CHECKSUMS_DIR}/source/intel/*.c"
-    "${AWS_CHECKSUMS_DIR}/source/intel/asm/*.c"
-    "${AWS_CHECKSUMS_DIR}/source/arm/*.c"
 )
 
 if(AWS_ARCH_INTEL AND AWS_HAVE_GCC_INLINE_ASM)
     file(GLOB AWS_CHECKSUMS_ARCH_SRC
+            "${AWS_CHECKSUMS_DIR}/source/intel/*.c"
             "${AWS_CHECKSUMS_DIR}/source/intel/asm/*.c"
     )
 endif()
@@ -296,6 +320,8 @@ file(GLOB AWS_CRT_SRC
     "${AWS_CRT_DIR}/source/external/*.cpp"
     "${AWS_CRT_DIR}/source/http/*.cpp"
     "${AWS_CRT_DIR}/source/io/*.cpp"
+    "${AWS_CRT_DIR}/source/cbor/*.cpp"
+    "${AWS_CRT_DIR}/source/checksum/*.cpp"
 )
 
 list(APPEND AWS_SOURCES ${AWS_CRT_SRC})
@@ -359,14 +385,20 @@ target_include_directories(_aws SYSTEM BEFORE PUBLIC ${AWS_PUBLIC_INCLUDES})
 target_include_directories(_aws SYSTEM BEFORE PRIVATE ${AWS_PRIVATE_INCLUDES})
 target_compile_definitions(_aws PUBLIC ${AWS_PUBLIC_COMPILE_DEFS})
 target_compile_definitions(_aws PRIVATE ${AWS_PRIVATE_COMPILE_DEFS})
+
+if (OS_DARWIN)
+    target_link_libraries(_aws PRIVATE "-framework CoreFoundation")
+    target_link_libraries(_aws PRIVATE "-framework Security")
+endif()
+
 target_link_libraries(_aws PRIVATE ${AWS_PRIVATE_LIBS})
 
 aws_set_thread_affinity_method(_aws)
 aws_set_thread_name_method(_aws)
 
 # The library is large - avoid bloat.
 if (OMIT_HEAVY_DEBUG_SYMBOLS)
-    target_compile_options (_aws PRIVATE -g0)
+    target_compile_options (_aws PRIVATE -g1)
 endif()
 
 add_library(ch_contrib::aws_s3 ALIAS _aws)

contrib/curl-cmake/CMakeLists.txt

@@ -118,7 +118,6 @@ set (SRCS
     "${LIBRARY_DIR}/lib/socks_sspi.c"
     "${LIBRARY_DIR}/lib/splay.c"
     "${LIBRARY_DIR}/lib/strcase.c"
-    "${LIBRARY_DIR}/lib/strdup.c"
     "${LIBRARY_DIR}/lib/strequal.c"
     "${LIBRARY_DIR}/lib/strerror.c"
     "${LIBRARY_DIR}/lib/system_win32.c"
@@ -166,13 +165,15 @@ set (SRCS
     "${LIBRARY_DIR}/lib/vtls/wolfssl.c"
     "${LIBRARY_DIR}/lib/vtls/x509asn1.c"
     "${LIBRARY_DIR}/lib/curlx/base64.c"
+    "${LIBRARY_DIR}/lib/curlx/basename.c"
     "${LIBRARY_DIR}/lib/curlx/dynbuf.c"
     "${LIBRARY_DIR}/lib/curlx/fopen.c"
     "${LIBRARY_DIR}/lib/curlx/inet_ntop.c"
     "${LIBRARY_DIR}/lib/curlx/inet_pton.c"
     "${LIBRARY_DIR}/lib/curlx/multibyte.c"
     "${LIBRARY_DIR}/lib/curlx/nonblock.c"
     "${LIBRARY_DIR}/lib/curlx/strcopy.c"
+    "${LIBRARY_DIR}/lib/curlx/strdup.c"
     "${LIBRARY_DIR}/lib/curlx/strerr.c"
     "${LIBRARY_DIR}/lib/curlx/strparse.c"
     "${LIBRARY_DIR}/lib/curlx/timediff.c"