This is an automated email from the ASF dual-hosted git repository.
thisisnic pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow.git
The following commit(s) were added to refs/heads/main by this push:
new c988d17c9c GH-45449: [R][CI] Remove OpenSSL 1.x builds (#48297)
c988d17c9c is described below
commit c988d17c9c5049626d5b27886dd29760adb72aa0
Author: Nic Crane <[email protected]>
AuthorDate: Wed Dec 17 17:24:03 2025 +0000
GH-45449: [R][CI] Remove OpenSSL 1.x builds (#48297)
### Rationale for this change
We support old OpenSSL versions which are now deprecated. It complicates
our CI by having unnecessary things running too.
### What changes are included in this PR?
Stop supporting OpenSSL < 3.0
### Are these changes tested?
Will trigger CI
### Are there any user-facing changes?
Not unless they're using deprecated versions of OpenSSL, which isn't
something we should support anyway
* GitHub Issue: #45449
Authored-by: Nic Crane <[email protected]>
Signed-off-by: Nic Crane <[email protected]>
---
.github/workflows/r_nightly.yml | 10 ++--
dev/tasks/macros.jinja | 14 ++----
dev/tasks/r/github.packages.yml | 35 ++++---------
dev/tasks/tasks.yml | 10 ++--
r/tools/nixlibs.R | 84 +++++++++++++------------------
r/tools/test-nixlibs.R | 106 ++++++++++++++++++++--------------------
6 files changed, 110 insertions(+), 149 deletions(-)
diff --git a/.github/workflows/r_nightly.yml b/.github/workflows/r_nightly.yml
index b8415e7bb8..6036507a78 100644
--- a/.github/workflows/r_nightly.yml
+++ b/.github/workflows/r_nightly.yml
@@ -172,13 +172,9 @@ jobs:
done
# New packages: repo/libarrow/${TARGET}-arrow-${VERSION}.zip
- prune repo/libarrow/r-libarrow-darwin-arm64-openssl-1.1-* || :
- prune repo/libarrow/r-libarrow-darwin-arm64-openssl-3.0-* || :
- prune repo/libarrow/r-libarrow-darwin-x86_64-openssl-1.1-* || :
- prune repo/libarrow/r-libarrow-darwin-x86_64-openssl-3.0-* || :
- prune repo/libarrow/r-libarrow-linux-x86_64-openssl-1.0-* || :
- prune repo/libarrow/r-libarrow-linux-x86_64-openssl-1.1-* || :
- prune repo/libarrow/r-libarrow-linux-x86_64-openssl-3.0-* || :
+ prune repo/libarrow/r-libarrow-darwin-arm64-* || :
+ prune repo/libarrow/r-libarrow-darwin-x86_64-* || :
+ prune repo/libarrow/r-libarrow-linux-x86_64-* || :
prune repo/libarrow/r-libarrow-windows-x86_64-* || :
- name: Update Repository Index
shell: Rscript {0}
diff --git a/dev/tasks/macros.jinja b/dev/tasks/macros.jinja
index 68dc745edd..6c17eecabb 100644
--- a/dev/tasks/macros.jinja
+++ b/dev/tasks/macros.jinja
@@ -247,23 +247,19 @@ env:
path: repo/libarrow
{% endif %}
{% if get_nix %}
- {% for openssl_version in ["1.0", "1.1", "3.0"] %}
- - name: Get Linux OpenSSL {{ openssl_version }} binary
+ - name: Get Linux binary
uses: actions/download-artifact@v4
with:
- name: r-libarrow-linux-x86_64-openssl-{{ openssl_version }}
+ name: r-libarrow-linux-x86_64
path: repo/libarrow
- {% endfor %}
{% endif %}
{% if get_mac %}
- {% for openssl_version in ["1.1", "3.0"] %}
- {% for arch in ["x86_64", "arm64"] %}
- - name: Get macOS {{ arch }} OpenSSL {{ openssl_version }} binary
+ {% for arch in ["x86_64", "arm64"] %}
+ - name: Get macOS {{ arch }} binary
uses: actions/download-artifact@v4
with:
- name: r-libarrow-darwin-{{ arch }}-openssl-{{ openssl_version }}
+ name: r-libarrow-darwin-{{ arch }}
path: repo/libarrow
- {% endfor %}
{% endfor %}
{% endif %}
- name: Get src pkg
diff --git a/dev/tasks/r/github.packages.yml b/dev/tasks/r/github.packages.yml
index bbe306ab7c..f57901371b 100644
--- a/dev/tasks/r/github.packages.yml
+++ b/dev/tasks/r/github.packages.yml
@@ -57,7 +57,7 @@ jobs:
path: arrow/r/arrow_*.tar.gz
macos-cpp:
- name: C++ Binary macOS OpenSSL {{ '${{ matrix.openssl }}' }} {{ '${{
matrix.platform.arch }}' }}
+ name: C++ Binary macOS {{ '${{ matrix.platform.arch }}' }}
runs-on: {{ '${{ matrix.platform.runs_on }}' }}
needs: source
strategy:
@@ -66,17 +66,16 @@ jobs:
platform:
- { runs_on: macos-15-intel, arch: "x86_64" }
- { runs_on: macos-14, arch: "arm64" }
- openssl: ['3.0', '1.1']
env:
- PKG_ID: r-libarrow-darwin-{{ '${{ matrix.platform.arch }}' }}-openssl-{{
'${{ matrix.openssl }}' }}
- PKG_FILE: r-libarrow-darwin-{{ '${{ matrix.platform.arch }}'
}}-openssl-{{ '${{ matrix.openssl }}' }}-{{ '${{
needs.source.outputs.pkg_version }}' }}.zip
+ PKG_ID: r-libarrow-darwin-{{ '${{ matrix.platform.arch }}' }}
+ PKG_FILE: r-libarrow-darwin-{{ '${{ matrix.platform.arch }}' }}-{{ '${{
needs.source.outputs.pkg_version }}' }}.zip
steps:
{{ macros.github_checkout_arrow(action_v="3")|indent }}
{{ macros.github_change_r_pkg_version(is_fork, '${{
needs.source.outputs.pkg_version }}')|indent }}
- name: Install Deps
run: |
brew install sccache ninja
- brew install openssl@{{ '${{ matrix.openssl }}' }}
+ brew install [email protected]
- name: Build libarrow
shell: bash
env:
@@ -89,7 +88,7 @@ jobs:
LIBARROW_MINIMAL: false
run: |
sccache --start-server
- export EXTRA_CMAKE_FLAGS="-DOPENSSL_ROOT_DIR=$(brew --prefix
openssl@{{ '${{ matrix.openssl }}' }})"
+ export EXTRA_CMAKE_FLAGS="-DOPENSSL_ROOT_DIR=$(brew --prefix
[email protected])"
cd arrow
r/inst/build_arrow_static.sh
- name: Bundle libarrow
@@ -112,26 +111,14 @@ jobs:
{{ '${{ env.PKG_FILE }}' }}.sha512
linux-cpp:
- name: C++ Binary Linux OpenSSL {{ '${{ matrix.openssl }}' }}
+ name: C++ Binary Linux
runs-on: ubuntu-latest
needs: source
strategy:
fail-fast: false
- matrix:
- include:
- - openssl: "3.0"
- os: ubuntu
- ubuntu: "22.04"
- - extra-cmake-flags: >-
- -DCMAKE_INCLUDE_PATH=/usr/include/openssl11
- -DCMAKE_LIBRARY_PATH=/usr/lib64/openssl11
- openssl: "1.1"
- os: centos
- - openssl: "1.0"
- os: centos
env:
- PKG_ID: r-libarrow-linux-x86_64-openssl-{{ '${{ matrix.openssl }}' }}
- PKG_FILE: r-libarrow-linux-x86_64-openssl-{{ '${{ matrix.openssl }}'
}}-{{ '${{ needs.source.outputs.pkg_version }}' }}.zip
+ PKG_ID: r-libarrow-linux-x86_64
+ PKG_FILE: r-libarrow-linux-x86_64-{{ '${{
needs.source.outputs.pkg_version }}' }}.zip
steps:
{{ macros.github_checkout_arrow()|indent }}
{{ macros.github_change_r_pkg_version(is_fork, '${{
needs.source.outputs.pkg_version }}')|indent }}
@@ -139,13 +126,11 @@ jobs:
- name: Build libarrow
shell: bash
env:
- UBUNTU: {{ '"${{ matrix.ubuntu }}"' }}
+ UBUNTU: "22.04"
{{ macros.github_set_sccache_envvars()|indent(8) }}
run: |
source arrow/ci/scripts/util_enable_core_dumps.sh
- archery docker run \
- -e EXTRA_CMAKE_FLAGS="{{ '${{ matrix.extra-cmake-flags }}' }}" \
- {{ '${{ matrix.os }}' }}-cpp-static
+ archery docker run ubuntu-cpp-static
- name: Bundle libarrow
shell: bash
run: |
diff --git a/dev/tasks/tasks.yml b/dev/tasks/tasks.yml
index e2bd5c6d8e..5c7d3d5b90 100644
--- a/dev/tasks/tasks.yml
+++ b/dev/tasks/tasks.yml
@@ -283,13 +283,9 @@ tasks:
custom_version: Unset
artifacts:
- r-libarrow-windows-x86_64-{no_rc_r_version}\.zip
- - r-libarrow-linux-x86_64-openssl-1.0-{no_rc_r_version}\.zip
- - r-libarrow-linux-x86_64-openssl-1.1-{no_rc_r_version}\.zip
- - r-libarrow-linux-x86_64-openssl-3.0-{no_rc_r_version}\.zip
- - r-libarrow-darwin-arm64-openssl-1.1-{no_rc_r_version}\.zip
- - r-libarrow-darwin-arm64-openssl-3.0-{no_rc_r_version}\.zip
- - r-libarrow-darwin-x86_64-openssl-1.1-{no_rc_r_version}\.zip
- - r-libarrow-darwin-x86_64-openssl-3.0-{no_rc_r_version}\.zip
+ - r-libarrow-linux-x86_64-{no_rc_r_version}\.zip
+ - r-libarrow-darwin-arm64-{no_rc_r_version}\.zip
+ - r-libarrow-darwin-x86_64-{no_rc_r_version}\.zip
- r-pkg__bin__windows__contrib__4.5__arrow_{no_rc_r_version}\.zip
- r-pkg__bin__windows__contrib__4.4__arrow_{no_rc_r_version}\.zip
-
r-pkg__bin__macosx__big-sur-x86_64__contrib__4.5__arrow_{no_rc_r_version}\.tgz
diff --git a/r/tools/nixlibs.R b/r/tools/nixlibs.R
index cace64b8e9..9d0a260468 100644
--- a/r/tools/nixlibs.R
+++ b/r/tools/nixlibs.R
@@ -192,17 +192,12 @@ download_binary <- function(lib) {
# of action based on the current system. Other values you can set it to:
# * "FALSE" (not case-sensitive), to skip this option altogether
# * "TRUE" (not case-sensitive), to try to discover your current OS, or
-# * Some other string: a "linux-openssl-${OPENSSL_VERSION}" that corresponds to
-# a binary that is available, to override what this function may discover by
-# default.
+# * Some other string: a binary identifier that corresponds to a binary that is
+# available, to override what this function may discover by default.
# Possible values are:
-# * "linux-x86_64-openssl-1.0" (OpenSSL 1.0)
-# * "linux-x86_64-openssl-1.1" (OpenSSL 1.1)
-# * "linux-x86_64-openssl-3.0" (OpenSSL 3.0)
-# * "macos-arm64-openssl-1.1" (OpenSSL 1.1)
-# * "macos-arm64-openssl-3.0" (OpenSSL 3.0)
-# * "macos-x86_64-openssl-1.1" (OpenSSL 1.1)
-# * "macos-x86_64-openssl-3.0" (OpenSSL 3.0)
+# * "linux-x86_64"
+# * "darwin-arm64"
+# * "darwin-x86_64"
# * "windows-x86_64"
# These string values, along with `NULL`, are the potential return values of
# this function.
@@ -228,6 +223,17 @@ identify_binary <- function(lib =
Sys.getenv("LIBARROW_BINARY"), info = distro()
# Env var provided an os-version to use, to override our logic.
# We don't validate that this exists. If it doesn't, the download will fail
# and the build will fall back to building from source
+ if (grepl("openssl-1", lib)) {
+ stop(
+ "OpenSSL 1.x binaries are no longer provided. Use LIBARROW_BINARY='",
+ sub("-openssl-1.*$", "", lib),
+ "'"
+ )
+ }
+ if (grepl("openssl-3", lib)) {
+ lib <- sub("-openssl-3.*$", "", lib)
+ lg("OpenSSL suffix deprecated in LIBARROW_BINARY, using '%s'", lib)
+ }
} else {
# See if we can find a suitable binary
lib <- select_binary()
@@ -261,11 +267,10 @@ select_binary <- function(
# so globally handle the possibility that this could fail
{
errs <- compile_test_program(test_program)
- openssl_version <- determine_binary_from_stderr(errs)
- if (is.null(openssl_version)) {
- NULL
+ if (has_binary_sysreqs(errs)) {
+ paste0(os, "-", arch)
} else {
- paste0(os, "-", arch, "-", openssl_version)
+ NULL
}
},
error = function(e) {
@@ -293,14 +298,8 @@ test_for_curl_and_openssl <- "
#include <curl/curl.h>
#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER < 0x10002000L
-#error OpenSSL version too old
-#endif
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#error Using OpenSSL version 1.0
-#endif
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#error Using OpenSSL version 3
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+#error OpenSSL version must be 3.0 or greater
#endif
"
@@ -339,40 +338,27 @@ get_macos_openssl_dir <- function() {
openssl_root_dir
}
-# (built with newer devtoolset but older glibc (2.17) for broader
compatibility, like manylinux2014)
-determine_binary_from_stderr <- function(errs) {
- if (is.null(attr(errs, "status"))) {
- # There was no error in compiling: so we found libcurl and OpenSSL >= 1.1,
- # openssl is < 3.0
- lg("Found libcurl and OpenSSL >= 1.1")
- return("openssl-1.1")
- # Else, check for dealbreakers:
- } else if (!on_macos && any(grepl("Using libc++", errs, fixed = TRUE))) {
+has_binary_sysreqs <- function(errs) {
+ # Check for dealbreakers:
+ if (!on_macos && any(grepl("Using libc++", errs, fixed = TRUE))) {
# Our linux binaries are all built with GNU stdlib so they fail with libc++
lg("Linux binaries incompatible with libc++")
- return(NULL)
+ return(FALSE)
} else if (header_not_found("curl/curl", errs)) {
lg("libcurl not found")
- return(NULL)
+ return(FALSE)
} else if (header_not_found("openssl/opensslv", errs)) {
lg("OpenSSL not found")
- return(NULL)
- } else if (any(grepl("OpenSSL version too old", errs))) {
- lg("OpenSSL found but version >= 1.0.2 is required for some features")
- return(NULL)
- # Else, determine which other binary will work
- } else if (any(grepl("Using OpenSSL version 1.0", errs))) {
- if (on_macos) {
- lg("OpenSSL 1.0 is not supported on macOS")
- return(NULL)
- }
- lg("Found libcurl and OpenSSL < 1.1")
- return("openssl-1.0")
- } else if (any(grepl("Using OpenSSL version 3", errs))) {
- lg("Found libcurl and OpenSSL >= 3.0.0")
- return("openssl-3.0")
+ return(FALSE)
+ } else if (any(grepl("OpenSSL version must be 3.0 or greater", errs))) {
+ lg("OpenSSL found but version >= 3.0 is required")
+ return(FALSE)
+ } else if (is.null(attr(errs, "status"))) {
+ # Successful compile = OpenSSL >= 3.0 found
+ lg("Found libcurl and OpenSSL >= 3.0")
+ return(TRUE)
}
- NULL
+ FALSE
}
header_not_found <- function(header, errs) {
diff --git a/r/tools/test-nixlibs.R b/r/tools/test-nixlibs.R
index 213c1fc57f..b1d6214fd8 100644
--- a/r/tools/test-nixlibs.R
+++ b/r/tools/test-nixlibs.R
@@ -29,10 +29,25 @@ capture.output(source("nixlibs.R", local = nixlibs_env))
test_that("identify_binary() based on LIBARROW_BINARY", {
expect_null(identify_binary("FALSE"))
expect_identical(
- identify_binary("linux-x86_64-openssl-1.0"),
- "linux-x86_64-openssl-1.0"
+ identify_binary("linux-x86_64"),
+ "linux-x86_64"
)
expect_null(identify_binary("", info = list(id = "debian")))
+
+ expect_output(
+ expect_identical(
+ identify_binary("linux-x86_64-openssl-3.0"),
+ "linux-x86_64"
+ ),
+ "OpenSSL suffix deprecated in LIBARROW_BINARY, using 'linux-x86_64'",
+ fixed = TRUE
+ )
+
+ expect_error(
+ identify_binary("linux-x86_64-openssl-1.0"),
+ "OpenSSL 1.x binaries are no longer provided. Use
LIBARROW_BINARY='linux-x86_64'",
+ fixed = TRUE
+ )
})
test_that("select_binary() based on system", {
@@ -49,42 +64,22 @@ test_that("compile_test_program()", {
expect_true(header_not_found("wrong/NOTAHEADER", fail))
})
-test_that("determine_binary_from_stderr", {
+test_that("has_binary_sysreqs", {
expect_output(
- expect_identical(
- determine_binary_from_stderr(compile_test_program("int a;")),
- "openssl-1.1"
+ expect_true(
+ has_binary_sysreqs(compile_test_program("int a;"))
),
- "Found libcurl and OpenSSL >= 1.1"
+ "Found libcurl and OpenSSL >= 3.0",
)
nixlibs_env$on_macos <- FALSE
expect_output(
- expect_identical(
- determine_binary_from_stderr(compile_test_program("#error Using OpenSSL
version 1.0")),
- "openssl-1.0"
- ),
- "Found libcurl and OpenSSL < 1.1"
- )
- nixlibs_env$on_macos <- TRUE
- expect_output(
- expect_null(
- determine_binary_from_stderr(compile_test_program("#error Using OpenSSL
version 1.0"))
- ),
- "OpenSSL 1.0 is not supported on macOS"
- )
- expect_output(
- expect_identical(
- determine_binary_from_stderr(compile_test_program("#error Using OpenSSL
version 3")),
- "openssl-3.0"
+ expect_false(
+ has_binary_sysreqs(compile_test_program(
+ "#error OpenSSL version must be 3.0 or greater"
+ ))
),
- "Found libcurl and OpenSSL >= 3.0.0"
- )
- expect_output(
- expect_null(
- determine_binary_from_stderr(compile_test_program("#error OpenSSL
version too old"))
- ),
- "OpenSSL found but version >= 1.0.2 is required for some features"
+ "OpenSSL found but version >= 3.0 is required"
)
})
@@ -93,58 +88,65 @@ test_that("select_binary() with test program", {
expect_output(
expect_identical(
select_binary("linux", "x86_64", "int a;"),
- "linux-x86_64-openssl-1.1"
+ "linux-x86_64"
),
- "Found libcurl and OpenSSL >= 1.1"
+ "Found libcurl and OpenSSL >= 3.0"
)
expect_output(
- expect_identical(
- select_binary("linux", "x86_64", "#error Using OpenSSL version 1.0"),
- "linux-x86_64-openssl-1.0"
+ expect_null(
+ select_binary(
+ "linux",
+ "x86_64",
+ "#error OpenSSL version must be 3.0 or greater"
+ )
),
- "Found libcurl and OpenSSL < 1.1"
+ "OpenSSL found but version >= 3.0 is required"
)
expect_output(
expect_identical(
- select_binary("linux", "x86_64", "#error Using OpenSSL version 3"),
- "linux-x86_64-openssl-3.0"
+ select_binary("linux", "x86_64", character(0)), # Successful compile =
OpenSSL >= 3.0
+ "linux-x86_64"
),
- "Found libcurl and OpenSSL >= 3.0.0"
+ "Found libcurl and OpenSSL >= 3.0"
)
nixlibs_env$on_macos <- TRUE
expect_output(
expect_identical(
select_binary("darwin", "x86_64", "int a;"),
- "darwin-x86_64-openssl-1.1"
+ "darwin-x86_64"
),
- "Found libcurl and OpenSSL >= 1.1"
+ "Found libcurl and OpenSSL >= 3.0"
)
expect_output(
expect_identical(
- select_binary("darwin", "x86_64", "#error Using OpenSSL version 3"),
- "darwin-x86_64-openssl-3.0"
+ select_binary("darwin", "x86_64", character(0)), # Successful compile =
OpenSSL >= 3.0
+ "darwin-x86_64"
),
- "Found libcurl and OpenSSL >= 3.0.0"
+ "Found libcurl and OpenSSL >= 3.0"
)
expect_output(
expect_identical(
select_binary("darwin", "arm64", "int a;"),
- "darwin-arm64-openssl-1.1"
+ "darwin-arm64"
),
- "Found libcurl and OpenSSL >= 1.1"
+ "Found libcurl and OpenSSL >= 3.0"
)
expect_output(
expect_identical(
- select_binary("darwin", "arm64", "#error Using OpenSSL version 3"),
- "darwin-arm64-openssl-3.0"
+ select_binary("darwin", "arm64", character(0)), # Successful compile =
OpenSSL >= 3.0
+ "darwin-arm64"
),
- "Found libcurl and OpenSSL >= 3.0.0"
+ "Found libcurl and OpenSSL >= 3.0"
)
expect_output(
expect_null(
- select_binary("darwin", "x86_64", "#error Using OpenSSL version 1.0")
+ select_binary(
+ "darwin",
+ "x86_64",
+ "#error OpenSSL version must be 3.0 or greater"
+ )
),
- "OpenSSL 1.0 is not supported on macOS"
+ "OpenSSL found but version >= 3.0 is required"
)
})
