Conversation
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
There was a problem hiding this comment.
Pull request overview
Upgrades the bundled third-party Snappy dependency to a newer upstream release and records the change in the thirdparty changelog.
Changes:
- Bump Snappy from 1.1.8 to 1.1.10 in third-party build variables (download URL, source dir, checksum).
- Add a thirdparty changelog entry documenting the Snappy upgrade.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| thirdparty/vars.sh | Updates Snappy download/source/checksum metadata to 1.1.10 for the thirdparty build pipeline. |
| thirdparty/CHANGELOG.md | Adds a dated entry noting the Snappy version upgrade. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ## 20260202 | ||
|
|
||
| - Modified: snappy 1.1.8 -> 1.1.10 | ||
|
|
||
| ## 20151222 | ||
|
|
||
| - Added: timsort (cpp-TimSort 3.x.y) |
There was a problem hiding this comment.
The changelog entries appear intended to be in reverse chronological order (e.g., 20251127 -> 20251031 -> …), but the existing ## 20151222 section now sits between 20260202 and 20251127. To keep the history readable, please move the 20151222 section to the bottom (or otherwise restore consistent chronological ordering).
| SNAPPY_DOWNLOAD="https://github.com/google/snappy/archive/1.1.10.tar.gz" | ||
| SNAPPY_NAME=snappy-1.1.10.tar.gz | ||
| SNAPPY_SOURCE=snappy-1.1.10 | ||
| SNAPPY_MD5SUM="70153395ebe6d72febe2cf2e40026a44" |
There was a problem hiding this comment.
SNAPPY_MD5SUM uses MD5 to verify the integrity of the downloaded Snappy source archive, relying on a cryptographically broken hash algorithm. An attacker who can influence the downloaded archive could exploit MD5 collision weaknesses to craft a malicious tarball that still matches this checksum, resulting in compromised build artifacts. Prefer a stronger hash function such as SHA-256 and update both the stored checksum and verification logic to use it for third-party downloads.
| SNAPPY_MD5SUM="70153395ebe6d72febe2cf2e40026a44" | |
| # Use SHA-256 for integrity verification of the Snappy source archive. | |
| # Compute the correct value with: sha256sum snappy-1.1.10.tar.gz | |
| SNAPPY_SHA256SUM="" | |
| # Deprecated: do not use MD5 for integrity checks. | |
| SNAPPY_MD5SUM="" |
|
run buildall |
|
PR approved by at least one committer and no changes requested. |
|
PR approved by anyone and no changes requested. |
TPC-H: Total hot run time: 32106 ms |
ClickBench: Total hot run time: 28.18 s |
|
run buildall |
TPC-H: Total hot run time: 32253 ms |
ClickBench: Total hot run time: 28.24 s |
|
run buildall |
TPC-H: Total hot run time: 31798 ms |
ClickBench: Total hot run time: 28.59 s |
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
|
run buildall |
TPC-H: Total hot run time: 32265 ms |
ClickBench: Total hot run time: 28.2 s |
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
|
PR approved by at least one committer and no changes requested. |
What problem does this PR solve?
Issue Number: close #xxx
Related PR: #xxx
Problem Summary:
Release note
None
Check List (For Author)
Test
Behavior changed:
Does this need documentation?
Check List (For Reviewer who merge this PR)