[Chore](thirdparty) upgrade snappy #60425
Open
+24
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
There was a problem hiding this comment.
Pull request overview
Upgrades the bundled third-party Snappy dependency to a newer upstream release and records the change in the thirdparty changelog.
Changes:
- Bump Snappy from 1.1.8 to 1.1.10 in third-party build variables (download URL, source dir, checksum).
- Add a thirdparty changelog entry documenting the Snappy upgrade.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| thirdparty/vars.sh | Updates Snappy download/source/checksum metadata to 1.1.10 for the thirdparty build pipeline. |
| thirdparty/CHANGELOG.md | Adds a dated entry noting the Snappy version upgrade. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+5
to
11
| ## 20260202 | ||
|
|
||
| - Modified: snappy 1.1.8 -> 1.1.10 | ||
|
|
||
| ## 20151222 | ||
|
|
||
| - Added: timsort (cpp-TimSort 3.x.y) |
There was a problem hiding this comment.
The changelog entries appear intended to be in reverse chronological order (e.g., 20251127 -> 20251031 -> …), but the existing ## 20151222 section now sits between 20260202 and 20251127. To keep the history readable, please move the 20151222 section to the bottom (or otherwise restore consistent chronological ordering).
| SNAPPY_DOWNLOAD="https://github.com/google/snappy/archive/1.1.10.tar.gz" | ||
| SNAPPY_NAME=snappy-1.1.10.tar.gz | ||
| SNAPPY_SOURCE=snappy-1.1.10 | ||
| SNAPPY_MD5SUM="70153395ebe6d72febe2cf2e40026a44" |
There was a problem hiding this comment.
SNAPPY_MD5SUM uses MD5 to verify the integrity of the downloaded Snappy source archive, relying on a cryptographically broken hash algorithm. An attacker who can influence the downloaded archive could exploit MD5 collision weaknesses to craft a malicious tarball that still matches this checksum, resulting in compromised build artifacts. Prefer a stronger hash function such as SHA-256 and update both the stored checksum and verification logic to use it for third-party downloads.
Suggested change
| SNAPPY_MD5SUM="70153395ebe6d72febe2cf2e40026a44" | |
| # Use SHA-256 for integrity verification of the Snappy source archive. | |
| # Compute the correct value with: sha256sum snappy-1.1.10.tar.gz | |
| SNAPPY_SHA256SUM="" | |
| # Deprecated: do not use MD5 for integrity checks. | |
| SNAPPY_MD5SUM="" |
Contributor
|
run buildall |
github-actions
bot
added
the
approved
Contributor
|
PR approved by at least one committer and no changes requested. |
Contributor
|
PR approved by anyone and no changes requested. |
TPC-H: Total hot run time: 32106 ms |
ClickBench: Total hot run time: 28.18 s |
Contributor
Author
|
run buildall |
github-actions
bot
removed
the
approved
TPC-H: Total hot run time: 32253 ms |
ClickBench: Total hot run time: 28.24 s |
Contributor
Author
|
run buildall |
TPC-H: Total hot run time: 31798 ms |
ClickBench: Total hot run time: 28.59 s |
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
Contributor
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What problem does this PR solve?
Issue Number: close #xxx
Related PR: #xxx
Problem Summary:
Release note
None
Check List (For Author)
Test
Behavior changed:
Does this need documentation?
Check List (For Reviewer who merge this PR)