GH-32292: [R][Packaging] Use binaries built on CentOS 7 for Ubuntu < 22.04 by kou · Pull Request #34048 · apache/arrow

kou · 2023-02-06T08:19:01Z

Rationale for this change

Binaries built on CentOS 7 uses _GLIBCXX_USE_CXX11_ABI=0. So we can't use them on Ubuntu 20.04 because
Ubuntu 20.04 uses _GLIBCXX_USE_CXX11_ABI=1. If we use them on Ubuntu 20.04, our R package must use
_GLIBCXX_USE_CXX11_ABI=0 too.

There is another problem for Ubuntu 20.04. CentOS 7 uses OpenSSL 1.0 but Ubuntu 20.04 uses OpenSSL 1.1.
OpenSSL 1.0 and 1.1 are incompatible. So we can't use binaries built on CentOS 7. We need binaries for OpenSSL
1.0 and OpenSSL 1.1. We can't use the same binaries on CentOS 7 (OpenSSL 1.0) and Ubuntu 20.04 (OpenSSL 1.1).

What changes are included in this PR?

This changes add -D_GLIBCXX_USE_CXX11_ABI=0 to Cflags in arrow.pc. Our R package uses Cflags in
arrow.pc. So users don't need to specify -D_GLIBCXX_USE_CXX11_ABI=0 explicitly.

This changes replace binaries built on Ubuntu 18.04 with binaries built on CentOS 7 with OpenSSL 1.1.
(The "ubuntu-18.04" binaries are replaced with the "linux-openssl-1.1" binaries.)

The "centos-7" binaries are renamed to the "linux-openssl-1.0" binaries.

The "ubuntu-22.04" binaries are renamed to the "linux-openssl-3.0" binaries.

Are these changes tested?

Yes.

Are there any user-facing changes?

No.

kou · 2023-02-06T08:19:21Z

@github-actions crossbow submit r-binary-packages

github-actions · 2023-02-06T08:19:27Z

Closes: [R] Build linux binaries on older image (like manylinux2014) #32292

github-actions · 2023-02-06T08:19:30Z

⚠️ GitHub issue #32292 has been automatically assigned in GitHub to PR creator.

cpp/src/arrow/CMakeLists.txt

kou · 2023-02-06T12:16:30Z

@github-actions crossbow submit r-binary-packages

kou · 2023-02-06T13:01:12Z

@github-actions crossbow submit r-binary-packages

nealrichardson · 2023-02-06T15:36:22Z

ci/scripts/r_install_system_dependencies.sh

How common is it to be on ubuntu and not have pkg-config installed? Does this mean we would require pkg-config in order for the binary to be used?

How common is it to be on ubuntu and not have pkg-config installed?

Hmm. I'm not sure preference of R users on Ubuntu but I think that users who have GCC also have pkg-config.

But rocker/r-ver:4.0.0 and rocker/r-ver:3.6.3 doesn't have pkg-config. So we need this.

Does this mean we would require pkg-config in order for the binary to be used?

Yes.

We can fallback to source build when a user doesn't have pkg-config:

diff --git a/r/configure b/r/configure index ff6a9dacc4..08fa58d327 100755 --- a/r/configure +++ b/r/configure @@ -176,6 +176,7 @@ else if [ "${ARROW_DEPENDENCY_SOURCE}" = "AUTO" ] && \ [ "${PKG_CONFIG_AVAILABLE}" = "false" ]; then export ARROW_DEPENDENCY_SOURCE=BUNDLED + export LIBARROW_BINARY=false echo "**** pkg-config not installed, setting ARROW_DEPENDENCY_SOURCE=BUNDLED" fi

Do you want me to add this change to this PR?

I'd rather ship a binary that just works. Would it be terrible to grep for the CXX11_ABI in arrow.pc and add it to PKG_CFLAGS?

If we were to set LIBARROW_BINARY=false if no pkg-config, it should be in its own "${PKG_CONFIG_AVAILABLE}" = "false" check, not connected to whatever the value of ARROW_DEPENDENCY_SOURCE is since that's about building libarrow from source.

I'd rather ship a binary that just works. Would it be terrible to grep for the CXX11_ABI in arrow.pc and add it to PKG_CFLAGS?

It will work. I've added the logic but I'm afraid of increasing ad-hoc logics again.

If we were to set LIBARROW_BINARY=false if no pkg-config, it should be in its own "${PKG_CONFIG_AVAILABLE}" = "false" check, not connected to whatever the value of ARROW_DEPENDENCY_SOURCE is since that's about building libarrow from source.

It makes sense.

kou · 2023-02-07T09:21:25Z

We can't use the centos-7 binary on Ubuntu 20.04 because centos-7 binary built with OpenSSL 1.0 and Ubuntu 20.04 uses OpenSSL 1.1.

https://github.com/ursacomputing/crossbow/actions/runs/4103886242/jobs/7078891973#step:12:266

  /opt/R/4.1.3/lib/R/library/00LOCK-arrow/00new/arrow/libs/arrow.so: undefined symbol: HMAC_CTX_cleanup

FYI: HMAC_CTX_cleanup() is referred by aws-sdk-cpp.

Here are solution candidates:

Add centos-7-openssl-1.1 binary (We can use OpenSSL 1.1 on CentOS 7 because EPEL provides `openssl11-devel)
Add ubuntu-20.04 binary
Updating aws-sdk-cpp (GH-20272: [C++] Bump version of bundled AWS SDK #33808) may resolve this because OpenSSL related code is changed in the latest aws-sdk-cpp (hint: s2n-tls)

I'll try 3. first but is there any preference?

nealrichardson · 2023-02-07T16:48:58Z

If upgrading aws-sdk-cpp solves it, great, but doesn't google-cloud also require openssl?

Could we bundle openssl rather than require it from the system? I think the answer from last time I asked this was "no because security", but also as I understand it, the python wheels include openssl in them.

kou · 2023-02-09T06:32:28Z

@github-actions crossbow submit r-binary-packages

kou · 2023-02-09T06:59:59Z

Upgrading aws-sdk-cpp doesn't solve the problem.

Could we bundle openssl rather than require it from the system? I think the answer from last time I asked this was "no because security", but also as I understand it, the python wheels include openssl in them.

Hmm. I want to stop bundling OpenSSL in wheel because we can't release a fixed version in a timely manner for now.
For example, we released 10.0.1 for https://nvd.nist.gov/vuln/detail/CVE-2022-3786 .
CVE-2022-3786 was published on 2022-11-01,
the 10.0.1 vote https://lists.apache.org/thread/rlkrj9lnfmwgn7kq8hvmzf06l5z6w30k was started on 2022-11-17 and
the vote was carried on 2022-11-23 https://lists.apache.org/thread/ozo2k7l7jhc0wj3wsrpqgsvy4fosprv8 .

Anyway, I try bundling OpenSSL.

kou · 2023-02-09T07:05:45Z

@github-actions crossbow submit r-binary-packages

kou · 2023-02-10T03:54:00Z

@github-actions crossbow submit r-binary-packages

kou · 2023-02-10T04:44:23Z

@github-actions crossbow submit r-binary-packages

kou · 2023-02-10T05:48:58Z

We can't use static linking for OpenSSL:

https://github.com/ursacomputing/crossbow/actions/runs/4140935566/jobs/7160057196#step:6:1857

/arrow/r/libarrow/dist/s2n_tls_ep-prefix/src/s2n_tls_ep/crypto/s2n_fips.c:21:6: error: #error "Interning with OpenSSL fips-validated libcrypto is not currently supported. See https://github.com/aws/s2n-tls/issues/2741"
     #error "Interning with OpenSSL fips-validated libcrypto is not currently supported. See https://github.com/aws/s2n-tls/issues/2741"
      ^~~~~

This reverts commit 2f8b11d2c93b777883ff1214e4fd5bc2ee7e6367.

This reverts commit ed561d53b0e03a71bcf100af4e52f216fc6f157a.

kou · 2023-03-21T14:22:41Z

@github-actions crossbow submit -g cpp r-binary-packages

kou · 2023-03-21T14:56:22Z

@github-actions crossbow submit -g cpp r-binary-packages

github-actions · 2023-03-21T15:00:11Z

Revision: b7dd9a4

Submitted crossbow builds: ursacomputing/crossbow @ actions-ce74ddcb8c

Task	Status
r-binary-packages
test-alpine-linux-cpp
test-build-cpp-fuzz
test-conda-cpp
test-conda-cpp-valgrind
test-cuda-cpp
test-debian-10-cpp-amd64
test-debian-10-cpp-i386
test-debian-11-cpp-amd64
test-debian-11-cpp-i386
test-fedora-35-cpp
test-ubuntu-18.04-cpp
test-ubuntu-18.04-cpp-release
test-ubuntu-18.04-cpp-static
test-ubuntu-20.04-cpp
test-ubuntu-20.04-cpp-20
test-ubuntu-20.04-cpp-bundled
test-ubuntu-20.04-cpp-thread-sanitizer
test-ubuntu-22.04-cpp

kou · 2023-03-21T22:10:52Z

@github-actions crossbow submit r-binary-packages

github-actions · 2023-03-21T22:13:21Z

Revision: 955aa34

Submitted crossbow builds: ursacomputing/crossbow @ actions-0f2d95fc8a

Task	Status
r-binary-packages

kou · 2023-03-22T02:40:55Z

I'll merge this tomorrow if nobody objects it.

assignUser

+1

assignUser · 2023-03-22T03:43:18Z

(I merged now so the change affects the next packaging-nightly run)

ursabot · 2023-03-22T11:04:49Z

Benchmark runs are scheduled for baseline = 5b49d0f and contender = 9288275. 9288275 is a master commit associated with this PR. Results will be available as each benchmark for each run completes.
Conbench compare runs links:
[Finished ⬇️0.0% ⬆️0.0%] ec2-t3-xlarge-us-east-2
[Failed ⬇️0.36% ⬆️0.0%] test-mac-arm
[Finished ⬇️0.0% ⬆️0.0%] ursa-i9-9960x
[Finished ⬇️0.03% ⬆️0.0%] ursa-thinkcentre-m75q
Buildkite builds:
[Finished] 92882751 ec2-t3-xlarge-us-east-2
[Finished] 92882751 test-mac-arm
[Finished] 92882751 ursa-i9-9960x
[Finished] 92882751 ursa-thinkcentre-m75q
[Finished] 5b49d0f1 ec2-t3-xlarge-us-east-2
[Failed] 5b49d0f1 test-mac-arm
[Finished] 5b49d0f1 ursa-i9-9960x
[Finished] 5b49d0f1 ursa-thinkcentre-m75q
Supported benchmarks:
ec2-t3-xlarge-us-east-2: Supported benchmark langs: Python, R. Runs only benchmarks with cloud = True
test-mac-arm: Supported benchmark langs: C++, Python, R
ursa-i9-9960x: Supported benchmark langs: Python, R, JavaScript
ursa-thinkcentre-m75q: Supported benchmark langs: C++, Java

…ntu < 22.04 (apache#34048) ### Rationale for this change Binaries built on CentOS 7 uses `_GLIBCXX_USE_CXX11_ABI=0`. So we can't use them on Ubuntu 20.04 because Ubuntu 20.04 uses `_GLIBCXX_USE_CXX11_ABI=1`. If we use them on Ubuntu 20.04, our R package must use `_GLIBCXX_USE_CXX11_ABI=0` too. There is another problem for Ubuntu 20.04. CentOS 7 uses OpenSSL 1.0 but Ubuntu 20.04 uses OpenSSL 1.1. OpenSSL 1.0 and 1.1 are incompatible. So we can't use binaries built on CentOS 7. We need binaries for OpenSSL 1.0 and OpenSSL 1.1. We can't use the same binaries on CentOS 7 (OpenSSL 1.0) and Ubuntu 20.04 (OpenSSL 1.1). ### What changes are included in this PR? This changes add `-D_GLIBCXX_USE_CXX11_ABI=0` to `Cflags` in `arrow.pc`. Our R package uses `Cflags` in `arrow.pc`. So users don't need to specify `-D_GLIBCXX_USE_CXX11_ABI=0` explicitly. This changes replace binaries built on Ubuntu 18.04 with binaries built on CentOS 7 with OpenSSL 1.1. (The "ubuntu-18.04" binaries are replaced with the "linux-openssl-1.1" binaries.) The "centos-7" binaries are renamed to the "linux-openssl-1.0" binaries. The "ubuntu-22.04" binaries are renamed to the "linux-openssl-3.0" binaries. ### Are these changes tested? Yes. ### Are there any user-facing changes? No. * Closes: apacheGH-33091 * Closes: apache#32292 Authored-by: Sutou Kouhei <kou@clear-code.com> Signed-off-by: Jacob Wujciak-Jens <jacob@wujciak.de>

kou requested review from assignUser, paleolimbot, raulcd and thisisnic as code owners February 6, 2023 08:19

github-actions bot added Component: C++ Component: R labels Feb 6, 2023

kou mentioned this pull request Feb 6, 2023

GH-33800: [Packaging] Drop support for Ubuntu 18.04 #34020

Merged

This comment was marked as outdated.

Sign in to view

assignUser reviewed Feb 6, 2023

View reviewed changes

cpp/src/arrow/CMakeLists.txt Outdated Show resolved Hide resolved

This comment was marked as outdated.

Sign in to view

nealrichardson reviewed Feb 6, 2023

View reviewed changes

kou force-pushed the r-binaries-centos-7 branch from 0b8afc6 to 34c5ec7 Compare February 9, 2023 06:28

This comment was marked as outdated.

Sign in to view

kou added 10 commits March 21, 2023 23:22

Follow changes

685e8e2

Use Ubuntu 20.04

24c8566

Revert more

ba6ed43

Revert "Revert more"

f93cf3a

This reverts commit 2f8b11d2c93b777883ff1214e4fd5bc2ee7e6367.

Revert "Use Ubuntu 20.04"

df57c94

This reverts commit ed561d53b0e03a71bcf100af4e52f216fc6f157a.

Use the same OpenSSL

1777858

Ensure using the same OpenSSL

cc526e1

Clean

f86e69c

Don't use OpenSSL for s2n-tls

c408a2e

Rename binaries to "linux-openssl-X.Y"

514f27c

kou force-pushed the r-binaries-centos-7 branch from 07452f9 to 514f27c Compare March 21, 2023 14:22

github-actions bot added awaiting change review Awaiting change review and removed awaiting changes Awaiting changes labels Mar 21, 2023

This comment was marked as outdated.

Sign in to view

Follow changes

b7dd9a4

Change openssl to OpenSSL

955aa34

assignUser approved these changes Mar 22, 2023

View reviewed changes

assignUser merged commit 9288275 into apache:main Mar 22, 2023

kou deleted the r-binaries-centos-7 branch March 22, 2023 04:07

assignUser mentioned this pull request Apr 18, 2023

[R] Update NEWS for R component #35218

Closed

Conversation

kou commented Feb 6, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rationale for this change

What changes are included in this PR?

Are these changes tested?

Are there any user-facing changes?

Uh oh!

kou commented Feb 6, 2023

Uh oh!

github-actions bot commented Feb 6, 2023

Uh oh!

github-actions bot commented Feb 6, 2023

Uh oh!

This comment was marked as outdated.

Uh oh!

kou commented Feb 6, 2023

Uh oh!

This comment was marked as outdated.

kou commented Feb 6, 2023

Uh oh!

This comment was marked as outdated.

nealrichardson Feb 6, 2023

Choose a reason for hiding this comment

Uh oh!

kou Feb 7, 2023

Choose a reason for hiding this comment

Uh oh!

nealrichardson Feb 7, 2023

Choose a reason for hiding this comment

Uh oh!

kou Feb 9, 2023

Choose a reason for hiding this comment

Uh oh!

kou commented Feb 7, 2023

Uh oh!

nealrichardson commented Feb 7, 2023

Uh oh!

kou commented Feb 9, 2023

Uh oh!

This comment was marked as outdated.

kou commented Feb 9, 2023

Uh oh!

kou commented Feb 9, 2023

Uh oh!

This comment was marked as outdated.

kou commented Feb 10, 2023

Uh oh!

This comment was marked as outdated.

kou commented Feb 10, 2023

Uh oh!

This comment was marked as outdated.

kou commented Feb 10, 2023

Uh oh!

kou commented Mar 21, 2023

Uh oh!

This comment was marked as outdated.

kou commented Mar 21, 2023

Uh oh!

github-actions bot commented Mar 21, 2023

Uh oh!

kou commented Mar 21, 2023

Uh oh!

github-actions bot commented Mar 21, 2023

Uh oh!

kou commented Mar 22, 2023

Uh oh!

assignUser left a comment

Choose a reason for hiding this comment

Uh oh!

assignUser commented Mar 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ursabot commented Mar 22, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

kou commented Feb 6, 2023 •

edited

Loading

assignUser commented Mar 22, 2023 •

edited

Loading