feat: Build on UBI 10 and fix the Hadoop native build against OpenSSL 3

CHANGELOG.md

@@ -37,6 +37,9 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
+- stackable-base, stackable-devel: Build on UBI 10 instead of UBI 9, which affects every image. java-base installs gzip, which UBI 9 pulled in through krb5-workstation and UBI 10 does not ([#1534]).
+- hadoop: Build the native code against OpenSSL 3 without the ENGINE API in `3.3.6`, `3.4.3` and `3.5.0`, by applying apache/hadoop#8550 ([HADOOP-19872](https://issues.apache.org/jira/browse/HADOOP-19872)) and two patches of our own that guard the remaining ENGINE calls ([#1534]).
+- hadoop: Backport [HADOOP-19551](https://issues.apache.org/jira/browse/HADOOP-19551) and [HDFS-17226](https://issues.apache.org/jira/browse/HDFS-17226) into `3.3.6`, so its native code compiles with GCC 14 ([#1534]).
 - krb5: Bump base image ([#1721]).
 - testing-tools: Bump various tools and Python dependencies ([#1720]).
 - ubi-rust-builders: Bump protoc to `36.2` ([#1717]).
@@ -131,6 +134,7 @@ All notable changes to this project will be documented in this file.
 - opa: Remove 1.12.3 ([#1697]).
 - spark: Remove 3.5.8 and 4.1.1 ([#1710]).
 
+[#1534]: https://github.com/stackabletech/docker-images/pull/1534
 [#1593]: https://github.com/stackabletech/docker-images/pull/1593
 [#1595]: https://github.com/stackabletech/docker-images/pull/1595
 [#1596]: https://github.com/stackabletech/docker-images/pull/1596

hadoop/hadoop/stackable/patches/3.3.6/0014-HADOOP-19551.-Fix-compilation-error-of-native-librar.patch

@@ -0,0 +1,26 @@
+From 26af6e62c84f24ce7d81c5c27f5fcae0a4edfd2b Mon Sep 17 00:00:00 2001
+From: Masatake Iwasaki <iwasakims@apache.org>
+Date: Wed, 7 May 2025 15:01:01 +0900
+Subject: HADOOP-19551. Fix compilation error of native libraries on newer GCC.
+ (#7644)
+
+Reviewed-by: Chris Nauroth <cnauroth@apache.org>
+(cherry picked from commit 7ea3f51287c54ac563ef19d42c5bc102699ea025)
+---
+ hadoop-common-project/hadoop-common/HadoopCommon.cmake | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hadoop-common-project/hadoop-common/HadoopCommon.cmake b/hadoop-common-project/hadoop-common/HadoopCommon.cmake
+index 4de70ac3f78e2de5128e1ac48b9c1a20f1f4d18b..ade701675ad79915d29258e4be9c23ca02be4ffa 100644
+--- a/hadoop-common-project/hadoop-common/HadoopCommon.cmake
++++ b/hadoop-common-project/hadoop-common/HadoopCommon.cmake
+@@ -145,6 +145,9 @@ if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+     # Make GNU extensions available.
+     hadoop_add_compiler_flags("-D_GNU_SOURCE")
+
++    # using old default behavior on GCC >= 14.0
++    hadoop_add_compiler_flags("-Wno-error=implicit-function-declaration")
++
+     # If JVM_ARCH_DATA_MODEL is 32, compile all binaries as 32-bit.
+     if(JVM_ARCH_DATA_MODEL EQUAL 32)
+         # Force 32-bit code generation on amd64/x86_64, ppc64, sparc64

hadoop/hadoop/stackable/patches/3.3.6/0015-HDFS-17226.-Building-native-libraries-fails-on-Fedor.patch

@@ -0,0 +1,61 @@
+From 4e739baadfd68b94abd45fe9e2df1c8bfa2bc880 Mon Sep 17 00:00:00 2001
+From: Kengo Seki <sekikn@apache.org>
+Date: Wed, 23 Apr 2025 00:12:22 +0900
+Subject: HDFS-17226. Building native libraries fails on Fedora 38. (#6191)
+
+(cherry picked from commit a47df85360bfebbb7dfd658630b7c66d982a49cf)
+---
+ .../src/main/native/libhdfspp/include/hdfspp/content_summary.h   | 1 +
+ .../src/main/native/libhdfspp/include/hdfspp/fsinfo.h            | 1 +
+ .../src/main/native/libhdfspp/include/hdfspp/statinfo.h          | 1 +
+ .../src/main/native/libhdfspp/include/hdfspp/uri.h               | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/content_summary.h b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/content_summary.h
+index 6762a65ca908b513a8fdea0a117a52835af126b7..d9809bab59291b6aec68b72dcba798606b5ad3ee 100644
+--- a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/content_summary.h
++++ b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/content_summary.h
+@@ -19,6 +19,7 @@
+ #define HDFSPP_CONTENT_SUMMARY_H_
+
+ #include <string>
++#include <cstdint>
+
+ namespace hdfs {
+
+diff --git a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/fsinfo.h b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/fsinfo.h
+index 103cf133bec221e9450c38fbc33eec035d73e767..156ed445181a331760df3e245201df1ec84f5da5 100644
+--- a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/fsinfo.h
++++ b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/fsinfo.h
+@@ -19,6 +19,7 @@
+ #define HDFSPP_FSINFO_H_
+
+ #include <string>
++#include <cstdint>
+
+ namespace hdfs {
+
+diff --git a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/statinfo.h b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/statinfo.h
+index 1da1f18a592bdcc6173443b6418694fdf8c1c361..5924d1db005870c5beb26a881db9a30702039e2d 100644
+--- a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/statinfo.h
++++ b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/statinfo.h
+@@ -19,6 +19,7 @@
+ #define HDFSPP_STATINFO_H_
+
+ #include <string>
++#include <cstdint>
+
+ namespace hdfs {
+
+diff --git a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/uri.h b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/uri.h
+index bc3d8b96d3f66e7b8904d19f69a9006441f8f647..a7f735afb5dbc1c1bc7c80621d5cebc38ea95927 100644
+--- a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/uri.h
++++ b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/include/hdfspp/uri.h
+@@ -22,6 +22,7 @@
+ #include <iostream>
+ #include <string>
+ #include <vector>
++#include <cstdint>
+ #include <stdexcept>
+
+ namespace hdfs

hadoop/hadoop/stackable/patches/3.3.6/0016-HADOOP-19872-Exclude-Engine-API-when-building-with-O.patch

@@ -0,0 +1,71 @@
+From 463b8032e9e396cdbe1afab84153055644a4b2a3 Mon Sep 17 00:00:00 2001
+From: Rohit Kumar <rohit.kumar@cloudera.com>
+Date: Mon, 15 Jun 2026 15:54:13 +0530
+Subject: HADOOP-19872: Exclude Engine API when building with OpenSSL 3.x
+
+---
+ .../org/apache/hadoop/crypto/random/OpensslSecureRandom.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c b/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
+index 3f141be05b54930e45b092671d02e33396cd4a98..d4351c1a5d70da0a73cfb64f2937b4bd04dcd541 100644
+--- a/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
++++ b/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
+@@ -49,11 +49,13 @@ static void (*dlsym_CRYPTO_set_id_callback) (unsigned long (*)());
+ static void (*dlsym_ENGINE_load_rdrand) (void);
+ static void (*dlsym_ENGINE_cleanup) (void);
+ #endif
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ static ENGINE * (*dlsym_ENGINE_by_id) (const char *);
+ static int (*dlsym_ENGINE_init) (ENGINE *);
+ static int (*dlsym_ENGINE_set_default) (ENGINE *, unsigned int);
+ static int (*dlsym_ENGINE_finish) (ENGINE *);
+ static int (*dlsym_ENGINE_free) (ENGINE *);
++#endif
+ static int (*dlsym_RAND_bytes) (unsigned char *, int);
+ static unsigned long (*dlsym_ERR_get_error) (void);
+ #endif
+@@ -126,12 +128,14 @@ JNIEXPORT void JNICALL Java_org_apache_hadoop_crypto_random_OpensslSecureRandom_
+                       openssl, "ENGINE_load_rdrand");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_cleanup, env, openssl, "ENGINE_cleanup");
+ #endif
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_by_id, env, openssl, "ENGINE_by_id");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_init, env, openssl, "ENGINE_init");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_set_default, env,  \
+                       openssl, "ENGINE_set_default");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_finish, env, openssl, "ENGINE_finish");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_free, env, openssl, "ENGINE_free");
++#endif
+   LOAD_DYNAMIC_SYMBOL(dlsym_RAND_bytes, env, openssl, "RAND_bytes");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ERR_get_error, env, openssl, "ERR_get_error");
+ #endif
+@@ -308,6 +312,7 @@ static unsigned long pthreads_thread_id(void)
+  */
+ static ENGINE * openssl_rand_init(void)
+ {
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L
+   locks_setup();
+
+@@ -339,10 +344,12 @@ static ENGINE * openssl_rand_init(void)
+   }
+
+   return eng;
++#endif
+ }
+
+ static void openssl_rand_clean(ENGINE *eng, int clean_locks)
+ {
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+   if (NULL != eng) {
+     dlsym_ENGINE_finish(eng);
+     dlsym_ENGINE_free(eng);
+@@ -353,6 +360,7 @@ static void openssl_rand_clean(ENGINE *eng, int clean_locks)
+     locks_cleanup();
+   }
+ #endif
++#endif
+ }
+
+ static int openssl_rand_bytes(unsigned char *buf, int num)

hadoop/hadoop/stackable/patches/3.3.6/0017-HADOOP-19872.-Guard-OpenSSL-ENGINE-code-paths-as-a-w.patch

@@ -0,0 +1,112 @@
+From a7337bec7474934a3fac0fc5b41e76123996b77c Mon Sep 17 00:00:00 2001
+From: Lars Francke <git@lars-francke.de>
+Date: Tue, 27 Oct 2026 16:12:48 +0100
+Subject: HADOOP-19872. Guard OpenSSL ENGINE code paths as a whole and update
+ RNG docs
+
+---
+ .../crypto/random/OpensslSecureRandom.java       |  9 ++++-----
+ .../hadoop/crypto/random/OpensslSecureRandom.c   | 16 ++++++++++------
+ .../random/org_apache_hadoop_crypto_random.h     |  2 ++
+ 3 files changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/random/OpensslSecureRandom.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/random/OpensslSecureRandom.java
+index a7a609ce440b61aabda0d856bcc16d6fef5e82a2..a25160a9a780246f8fab85dc70473af143057f69 100644
+--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/random/OpensslSecureRandom.java
++++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/random/OpensslSecureRandom.java
+@@ -32,11 +32,10 @@ import org.slf4j.LoggerFactory;
+  * This implementation is thread-safe.
+  * <p>
+  * 
+- * If using an Intel chipset with RDRAND, the high-performance hardware 
+- * random number generator will be used and it's much faster than
+- * {@link java.security.SecureRandom}. If RDRAND is unavailable, default
+- * OpenSSL secure random generator will be used. It's still faster
+- * and can generate strong random bytes.
++ * When built against OpenSSL older than 3.0 on a CPU with RDRAND, the
++ * hardware random number generator is used through OpenSSL's RDRAND engine.
++ * Otherwise, including every build against OpenSSL 3.0 or later, OpenSSL's
++ * default secure random generator is used.
+  * <p>
+  * See https://wiki.openssl.org/index.php/Random_Numbers
+  * See http://en.wikipedia.org/wiki/RdRand
+diff --git a/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c b/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
+index d4351c1a5d70da0a73cfb64f2937b4bd04dcd541..8fb88365f715ce95195c2596f21953177fab3219 100644
+--- a/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
++++ b/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
+@@ -90,8 +90,10 @@ static __dlsym_RAND_bytes dlsym_RAND_bytes;
+ static __dlsym_ERR_get_error dlsym_ERR_get_error;
+ #endif
+
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ static ENGINE * openssl_rand_init(void);
+ static void openssl_rand_clean(ENGINE *eng, int clean_locks);
++#endif
+ static int openssl_rand_bytes(unsigned char *buf, int num);
+
+ JNIEXPORT void JNICALL Java_org_apache_hadoop_crypto_random_OpensslSecureRandom_initSR
+@@ -170,7 +172,9 @@ JNIEXPORT void JNICALL Java_org_apache_hadoop_crypto_random_OpensslSecureRandom_
+                       env, openssl, "ERR_get_error");
+ #endif
+
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+   openssl_rand_init();
++#endif
+ }
+
+ JNIEXPORT jboolean JNICALL Java_org_apache_hadoop_crypto_random_OpensslSecureRandom_nextRandBytes___3B
+@@ -307,12 +311,14 @@ static unsigned long pthreads_thread_id(void)
+ #endif /* UNIX */
+
+ /**
+- * If using an Intel chipset with RDRAND, the high-performance hardware
+- * random number generator will be used.
++ * Before OpenSSL 3.0, the RDRAND engine is made the default RAND method if
++ * the CPU supports it. OpenSSL 3.0 deprecates the ENGINE API and some
++ * distributions build without it, so from 3.0 on RAND_bytes uses OpenSSL's
++ * default DRBG.
+  */
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ static ENGINE * openssl_rand_init(void)
+ {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L
+   locks_setup();
+
+@@ -344,12 +350,10 @@ static ENGINE * openssl_rand_init(void)
+   }
+
+   return eng;
+-#endif
+ }
+
+ static void openssl_rand_clean(ENGINE *eng, int clean_locks)
+ {
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
+   if (NULL != eng) {
+     dlsym_ENGINE_finish(eng);
+     dlsym_ENGINE_free(eng);
+@@ -360,8 +364,8 @@ static void openssl_rand_clean(ENGINE *eng, int clean_locks)
+     locks_cleanup();
+   }
+ #endif
+-#endif
+ }
++#endif
+
+ static int openssl_rand_bytes(unsigned char *buf, int num)
+ {
+diff --git a/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/org_apache_hadoop_crypto_random.h b/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/org_apache_hadoop_crypto_random.h
+index 1200718e69f301408e4aae92ef4e331f82a70fb4..8e2eb94e6149f4b26fb00cde7ead5dc609859051 100644
+--- a/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/org_apache_hadoop_crypto_random.h
++++ b/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/org_apache_hadoop_crypto_random.h
+@@ -33,7 +33,9 @@
+ #define UNUSED(x) ((void)(x))
+
+ #include <openssl/crypto.h>
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ #include <openssl/engine.h>
++#endif
+ #include <openssl/rand.h>
+ #include <openssl/err.h>
+

hadoop/hadoop/stackable/patches/3.4.3/0009-HADOOP-19872-Exclude-Engine-API-when-building-with-O.patch

@@ -0,0 +1,71 @@
+From 62b70efc20e8a619b73f553ca78ef9b85b025240 Mon Sep 17 00:00:00 2001
+From: Rohit Kumar <rohit.kumar@cloudera.com>
+Date: Mon, 15 Jun 2026 15:54:13 +0530
+Subject: HADOOP-19872: Exclude Engine API when building with OpenSSL 3.x
+
+---
+ .../org/apache/hadoop/crypto/random/OpensslSecureRandom.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c b/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
+index 3f141be05b54930e45b092671d02e33396cd4a98..d4351c1a5d70da0a73cfb64f2937b4bd04dcd541 100644
+--- a/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
++++ b/hadoop-common-project/hadoop-common/src/main/native/src/org/apache/hadoop/crypto/random/OpensslSecureRandom.c
+@@ -49,11 +49,13 @@ static void (*dlsym_CRYPTO_set_id_callback) (unsigned long (*)());
+ static void (*dlsym_ENGINE_load_rdrand) (void);
+ static void (*dlsym_ENGINE_cleanup) (void);
+ #endif
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ static ENGINE * (*dlsym_ENGINE_by_id) (const char *);
+ static int (*dlsym_ENGINE_init) (ENGINE *);
+ static int (*dlsym_ENGINE_set_default) (ENGINE *, unsigned int);
+ static int (*dlsym_ENGINE_finish) (ENGINE *);
+ static int (*dlsym_ENGINE_free) (ENGINE *);
++#endif
+ static int (*dlsym_RAND_bytes) (unsigned char *, int);
+ static unsigned long (*dlsym_ERR_get_error) (void);
+ #endif
+@@ -126,12 +128,14 @@ JNIEXPORT void JNICALL Java_org_apache_hadoop_crypto_random_OpensslSecureRandom_
+                       openssl, "ENGINE_load_rdrand");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_cleanup, env, openssl, "ENGINE_cleanup");
+ #endif
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_by_id, env, openssl, "ENGINE_by_id");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_init, env, openssl, "ENGINE_init");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_set_default, env,  \
+                       openssl, "ENGINE_set_default");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_finish, env, openssl, "ENGINE_finish");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ENGINE_free, env, openssl, "ENGINE_free");
++#endif
+   LOAD_DYNAMIC_SYMBOL(dlsym_RAND_bytes, env, openssl, "RAND_bytes");
+   LOAD_DYNAMIC_SYMBOL(dlsym_ERR_get_error, env, openssl, "ERR_get_error");
+ #endif
+@@ -308,6 +312,7 @@ static unsigned long pthreads_thread_id(void)
+  */
+ static ENGINE * openssl_rand_init(void)
+ {
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L
+   locks_setup();
+
+@@ -339,10 +344,12 @@ static ENGINE * openssl_rand_init(void)
+   }
+
+   return eng;
++#endif
+ }
+
+ static void openssl_rand_clean(ENGINE *eng, int clean_locks)
+ {
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+   if (NULL != eng) {
+     dlsym_ENGINE_finish(eng);
+     dlsym_ENGINE_free(eng);
+@@ -353,6 +360,7 @@ static void openssl_rand_clean(ENGINE *eng, int clean_locks)
+     locks_cleanup();
+   }
+ #endif
++#endif
+ }
+
+ static int openssl_rand_bytes(unsigned char *buf, int num)