Antalya 26.3: Bump to 26.3.10

.gitmodules

@@ -142,7 +142,7 @@
 	url = https://github.com/ClickHouse/rocksdb
 [submodule "contrib/xz"]
 	path = contrib/xz
-	url = https://github.com/xz-mirror/xz
+	url = https://github.com/tukaani-project/xz
 [submodule "contrib/abseil-cpp"]
 	path = contrib/abseil-cpp
 	url = https://github.com/ClickHouse/abseil-cpp.git

base/poco/Foundation/include/Poco/BufferedBidirectionalStreamBuf.h

@@ -136,12 +136,16 @@ class BasicBufferedBidirectionalStreamBuf : public std::basic_streambuf<ch, tr>
     int flushBuffer()
     {
         int n = int(this->pptr() - this->pbase());
-        if (writeToDevice(this->pbase(), n) == n)
+        int offset = 0;
+        while (offset < n)
         {
-            this->pbump(-n);
-            return n;
+            int written = writeToDevice(this->pbase() + offset, n - offset);
+            if (written <= 0)
+                return -1;
+            offset += written;
         }
-        return -1;
+        this->pbump(-n);
+        return n;
     }
 
     std::streamsize _bufsize;

base/poco/Foundation/include/Poco/BufferedStreamBuf.h

@@ -134,12 +134,16 @@ class BasicBufferedStreamBuf : public std::basic_streambuf<ch, tr>
     int flushBuffer()
     {
         int n = int(this->pptr() - this->pbase());
-        if (writeToDevice(this->pbase(), n) == n)
+        int offset = 0;
+        while (offset < n)
         {
-            this->pbump(-n);
-            return n;
+            int written = writeToDevice(this->pbase() + offset, n - offset);
+            if (written <= 0)
+                return -1;
+            offset += written;
         }
-        return -1;
+        this->pbump(-n);
+        return n;
     }
 
     std::streamsize _bufsize;

base/poco/Net/src/HTTPChunkedStream.cpp

@@ -52,8 +52,8 @@ void HTTPChunkedStreamBuf::close()
 	if (_mode & std::ios::out && _chunk != std::char_traits<char>::eof())
 	{
 		sync();
-		_session.write("0\r\n\r\n", 5);
-
+		if (writeToDevice("", 0) < 0)
+			throw MessageException("Failed to write terminating chunk");
 		_chunk = std::char_traits<char>::eof();
 	}
 }
@@ -167,7 +167,16 @@ int HTTPChunkedStreamBuf::writeToDevice(const char* buffer, std::streamsize leng
 	_chunkBuffer.append("\r\n", 2);
 	_chunkBuffer.append(buffer, static_cast<std::string::size_type>(length));
 	_chunkBuffer.append("\r\n", 2);
-	_session.write(_chunkBuffer.data(), static_cast<std::streamsize>(_chunkBuffer.size()));
+
+	std::streamsize chunkSize = static_cast<std::streamsize>(_chunkBuffer.size());
+	std::streamsize offset = 0;
+	while (offset < chunkSize)
+	{
+		int written = _session.write(_chunkBuffer.data() + offset, chunkSize - offset);
+		if (written <= 0)
+			return -1;
+		offset += written;
+	}
 	return static_cast<int>(length);
 }
 

base/poco/Net/src/HTTPFixedLengthStream.cpp

@@ -68,14 +68,11 @@ int HTTPFixedLengthStreamBuf::readFromDevice(char* buffer, std::streamsize lengt
 
 int HTTPFixedLengthStreamBuf::writeToDevice(const char* buffer, std::streamsize length)
 {
-	int n = 0;
-	if (_count < _length)
-	{
-		if (_count + length > _length)
-			length = static_cast<std::streamsize>(_length - _count);
-		n = _session.write(buffer, length);
-		if (n > 0) _count += n;
-	}
+	if (_count + length > _length)
+		throw MessageException("Write past Content-Length");
+
+	int n = _session.write(buffer, length);
+	if (n > 0) _count += n;
 	return n;
 }
 

base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp

@@ -322,6 +322,8 @@ int SecureSocketImpl::sendBytes(const void* buffer, int length, int flags)
 
 		rc = handleError(rc);
 		if (rc == 0) throw SSLConnectionUnexpectedlyClosedException();
+		if (rc < 0 && _pSocket->getBlocking())
+			throw Poco::TimeoutException("SSL_write timed out");
 	}
 
 	_pSocket->useSendThrottlerBudget(rc);
@@ -364,7 +366,10 @@ int SecureSocketImpl::receiveBytes(void* buffer, int length, int flags)
 	while (mustRetry(rc, remaining_time));
 	if (rc <= 0)
 	{
-		return handleError(rc);
+		rc = handleError(rc);
+		if (rc < 0 && _pSocket->getBlocking())
+			throw Poco::TimeoutException("SSL_read timed out");
+		return rc;
 	}
 
 	_pSocket->useRecvThrottlerBudget(rc);
@@ -398,7 +403,10 @@ int SecureSocketImpl::completeHandshake()
 	while (mustRetry(rc, remaining_time));
 	if (rc <= 0)
 	{
-		return handleError(rc);
+		rc = handleError(rc);
+		if (rc < 0 && _pSocket->getBlocking())
+			throw Poco::TimeoutException("SSL handshake timed out");
+		return rc;
 	}
 	_needHandshake = false;
 	return rc;

ci/jobs/docker_server.py

@@ -101,7 +101,7 @@ def parse_args() -> argparse.Namespace:
     )
     parser.add_argument("--reports", default=True, help=argparse.SUPPRESS)
     parser.add_argument("--push", action="store_true", help=argparse.SUPPRESS)
-    parser.add_argument("--os", default=["ubuntu", "alpine"], help=argparse.SUPPRESS)
+    parser.add_argument("--os", default=["ubuntu", "alpine", "distroless"], help=argparse.SUPPRESS)
     parser.add_argument(
         "--no-ubuntu",
         action=DelOS,
@@ -116,6 +116,13 @@ def parse_args() -> argparse.Namespace:
         default=argparse.SUPPRESS,
         help="don't build alpine image",
     )
+    parser.add_argument(
+        "--no-distroless",
+        action=DelOS,
+        nargs=0,
+        default=argparse.SUPPRESS,
+        help="don't build distroless image",
+    )
     parser.add_argument(
         "--allow-build-reuse",
         action="store_true",
@@ -215,10 +222,25 @@ def build_and_push_image(
         cmd_args = list(init_args)
         urls = []
         if direct_urls:
-            if os == "ubuntu" and "clickhouse-server" in image.name:
-                urls = [url for url in direct_urls[arch] if ".deb" in url]
+            # distroless and ubuntu-server use an Ubuntu builder with dpkg, so they
+            # need .deb packages. alpine and ubuntu-keeper use .tgz packages.
+            uses_deb = os == "distroless" or (
+                os == "ubuntu" and "clickhouse-server" in image.name
+            )
+            if uses_deb:
+                urls = [
+                    url
+                    for url in direct_urls[arch]
+                    if ".deb" in url and "-dbg" not in url
+                ]
             else:
-                urls = [url for url in direct_urls[arch] if ".tgz" in url]
+                # For keeper/alpine tgz builds, only pass the keeper tgz.
+                # Excluding clickhouse-common-static.tgz avoids a large unnecessary download.
+                tgz_urls = [url for url in direct_urls[arch] if ".tgz" in url]
+                if "keeper" in image.name:
+                    urls = [url for url in tgz_urls if "clickhouse-keeper" in url]
+                else:
+                    urls = tgz_urls
         cmd_args.extend(
             buildx_args(
                 repo_urls,
@@ -386,7 +408,16 @@ def main():
                     "clickhouse-common-static",
                 ]
             elif "clickhouse-keeper" in image_repo:
-                PACKAGES = ["clickhouse-keeper"]
+                # Both packages are needed to cover all three keeper image variants:
+                #   distroless: installs from .deb via dpkg; clickhouse-common-static
+                #               provides the clickhouse multi-tool binary (clickhouse-keeper
+                #               is a symlink to it). clickhouse-keeper .deb is not published
+                #               separately, so the common-static .deb is the only source.
+                #   alpine/ubuntu: installs from .tgz; clickhouse-keeper provides the
+                #               standalone keeper binary and its symlinks. The common-static
+                #               .tgz is implicitly excluded because the url filter below
+                #               keeps only urls containing "clickhouse-keeper" in the name.
+                PACKAGES = ["clickhouse-common-static", "clickhouse-keeper"]
             else:
                 assert False, "BUG"
             urls = read_build_urls(build_name)

ci/jobs/scripts/docker_server/config.sh

@@ -3,11 +3,14 @@
 # Get current file directory
 currentDir="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
 
-# interate over all directories in current path
-clickhouseTests=$( find "$currentDir"/tests/ -maxdepth 1 -name 'clickhouse-*' -type d -exec basename {} \; )
+# iterate over all directories in current path
+clickhouseTests=$( find "$currentDir"/tests/ -maxdepth 1 -name 'clickhouse-*' -not -name 'clickhouse-distroless-*' -type d -exec basename {} \; )
+clickhouseDistrolessTests=$( find "$currentDir"/tests/ -maxdepth 1 -name 'clickhouse-distroless-*' -type d -exec basename {} \; )
 keeperTests=$( find "$currentDir"/tests/ -maxdepth 1 -name 'keeper-*' -type d -exec basename {} \; )
 
 imageTests+=(
 	['clickhouse/clickhouse-server']="${clickhouseTests}"
+	['clickhouse/clickhouse-server:distroless']="${clickhouseTests} ${clickhouseDistrolessTests}"
 	['clickhouse/clickhouse-keeper']="${keeperTests}"
+	['clickhouse/clickhouse-keeper:distroless']="${keeperTests}"
 )

ci/jobs/scripts/docker_server/tests/clickhouse-distroless-initdb/initdb.sql

@@ -0,0 +1,3 @@
+CREATE DATABASE IF NOT EXISTS test_db;
+CREATE TABLE IF NOT EXISTS test_db.test_table (id UInt32, value UInt32) ENGINE = MergeTree ORDER BY id;
+INSERT INTO test_db.test_table VALUES (1, 100), (2, 200);

ci/jobs/scripts/docker_server/tests/clickhouse-distroless-initdb/run.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+# Verify that clickhouse docker-init executes SQL initdb scripts correctly.
+# The distroless image has no shell so initdb scripts must be handled
+# by the compiled docker-init entrypoint, not by entrypoint.sh.
+set -eo pipefail
+
+dir="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
+source "$dir/../lib.sh"
+
+image="$1"
+
+export CLICKHOUSE_USER='init_test_user'
+export CLICKHOUSE_PASSWORD='init_test_password'
+
+cid="$(
+  docker run -d \
+    -e CLICKHOUSE_USER \
+    -e CLICKHOUSE_PASSWORD \
+    -v "$dir/initdb.sql":/docker-entrypoint-initdb.d/initdb.sql:ro \
+    --name "$(cname)" \
+    "$image"
+)"
+trap 'docker rm -vf $cid > /dev/null' EXIT
+
+chCli() {
+  docker run --rm -i \
+    --link "$cid":clickhouse \
+    -e CLICKHOUSE_USER \
+    -e CLICKHOUSE_PASSWORD \
+    "$image" \
+    clickhouse-client \
+    --host clickhouse \
+    --user "$CLICKHOUSE_USER" \
+    --password "$CLICKHOUSE_PASSWORD" \
+    --query "$*"
+}
+
+# shellcheck source=../../../../../tmp/docker-library/official-images/test/retry.sh
+. "$TESTS_LIB_DIR/retry.sh" \
+  --tries "$CLICKHOUSE_TEST_TRIES" \
+  --sleep "$CLICKHOUSE_TEST_SLEEP" \
+  chCli SELECT 1
+
+# Verify the initdb script ran and created the table with the expected data
+chCli SHOW TABLES IN test_db | grep '^test_table$' >/dev/null
+[ "$(chCli 'SELECT SUM(value) FROM test_db.test_table')" = 300 ]

ci/jobs/scripts/docker_server/tests/clickhouse-distroless-no-shell/run.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Verify the distroless production image contains no shell.
+# This is the key property of a distroless image: /bin/sh, /bin/bash,
+# and other shells must be absent to reduce the attack surface.
+set -eo pipefail
+
+image="$1"
+
+if docker run --rm --entrypoint /bin/sh "$image" -c "echo bad" 2>/dev/null; then
+    echo "FAIL: /bin/sh should not exist in the distroless image" >&2
+    exit 1
+fi
+
+if docker run --rm --entrypoint /bin/bash "$image" -c "echo bad" 2>/dev/null; then
+    echo "FAIL: /bin/bash should not exist in the distroless image" >&2
+    exit 1
+fi

ci/workflows/backport_branches.py

@@ -50,7 +50,7 @@
     enable_job_filtering_by_changes=True,
     enable_cache=True,
     enable_report=True,
-    enable_automerge=True,
+    enable_automerge=False,
     enable_cidb=True,
     enable_commit_status_on_failure=True,
     enable_gh_summary_comment=True,

cmake/autogenerated_versions.txt

@@ -2,13 +2,13 @@
 
 # NOTE: VERSION_REVISION has nothing common with DBMS_TCP_PROTOCOL_VERSION,
 # only DBMS_TCP_PROTOCOL_VERSION should be incremented on protocol changes.
-SET(VERSION_REVISION 54516)
+SET(VERSION_REVISION 54517)
 SET(VERSION_MAJOR 26)
 SET(VERSION_MINOR 3)
-SET(VERSION_PATCH 9)
-SET(VERSION_GITHASH f3c6e5a4d27c3997b2a91174752e44acedc51f74)
-SET(VERSION_DESCRIBE v26.3.9.20001.altinityantalya)
-SET(VERSION_STRING 26.3.9.20001.altinityantalya)
+SET(VERSION_PATCH 10)
+SET(VERSION_GITHASH 0d82c1998e3b4d54e110dd8a77a64d247c4bff4a)
+SET(VERSION_DESCRIBE v26.3.10.20001.altinityantalya)
+SET(VERSION_STRING 26.3.10.20001.altinityantalya)
 # end of autochange
 
 SET(VERSION_TWEAK 20001)

contrib/jemalloc-cmake/CMakeLists.txt

@@ -191,6 +191,8 @@ target_compile_definitions(_jemalloc INTERFACE -DJEMALLOC_NO_RENAME)
 
 # Because our coverage callbacks call malloc, and recursive call of malloc could not work.
 target_compile_options(_jemalloc PRIVATE ${WITHOUT_COVERAGE_FLAGS_LIST})
+# Due to LTO there are some UB in tcache
+target_compile_options(_jemalloc PRIVATE -fno-lto -fno-whole-program-vtables)
 
 target_compile_definitions(_jemalloc PRIVATE -DJEMALLOC_PROF=1)
 

contrib/libarchive-cmake/config.h

@@ -1031,6 +1031,9 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the <stdint.h> header file. */
 #define HAVE_STDINT_H 1
 
+/* Define to 1 if you have the <stdio.h> header file. */
+#define HAVE_STDIO_H 1
+
 /* Define to 1 if you have the <stdlib.h> header file. */
 #define HAVE_STDLIB_H 1