Convert Druid 31.0.1 patches to patchable

druid/stackable/patches/31.0.1/01-remove-ranger-security.patch → druid/stackable/patches/31.0.1/0001-Removes-all-traces-of-the-druid-ranger-extension.patch

@@ -1,13 +1,15 @@
-Removes all traces of the druid ranger extension
-
+From ac257969aaf853835a5a410bb3d432c2b8d9f390 Mon Sep 17 00:00:00 2001
 From: Lars Francke <[email protected]>
-
+Date: Wed, 10 Jul 2024 17:07:13 +0200
+Subject: Removes all traces of the druid ranger extension
 
 ---
- 0 files changed
+ distribution/pom.xml | 2 --
+ pom.xml              | 1 -
+ 2 files changed, 3 deletions(-)
 
 diff --git a/distribution/pom.xml b/distribution/pom.xml
-index 0f17a8c877..d7cd645767 100644
+index dcb01abceb..1a4f7df716 100644
 --- a/distribution/pom.xml
 +++ b/distribution/pom.xml
 @@ -252,8 +252,6 @@
@@ -20,10 +22,10 @@ index 0f17a8c877..d7cd645767 100644
                                          <argument>-c</argument>
                                          <argument>org.apache.druid.extensions:druid-catalog</argument>
 diff --git a/pom.xml b/pom.xml
-index cfca79dc6e..2acb812cbe 100644
+index e5bcfafacb..807f9f11df 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -199,7 +199,6 @@
+@@ -198,7 +198,6 @@
          <module>extensions-core/simple-client-sslcontext</module>
          <module>extensions-core/druid-basic-security</module>
          <module>extensions-core/google-extensions</module>

druid/stackable/patches/31.0.1/02-prometheus-emitter-from-source.patch → druid/stackable/patches/31.0.1/0002-Include-Prometheus-emitter-in-distribution.patch

@@ -1,13 +1,14 @@
-Include Prometheus emitter in distribution
-
+From 484bd7f13890823fdfdcbec5bd21b046ac885015 Mon Sep 17 00:00:00 2001
 From: Lars Francke <[email protected]>
-
+Date: Mon, 17 Feb 2025 16:42:34 +0100
+Subject: Include Prometheus emitter in distribution
 
 ---
- 0 files changed
+ distribution/pom.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
 
 diff --git a/distribution/pom.xml b/distribution/pom.xml
-index d7cd645767..eda1ddcfab 100644
+index 1a4f7df716..a28e34bb6a 100644
 --- a/distribution/pom.xml
 +++ b/distribution/pom.xml
 @@ -464,6 +464,52 @@

druid/stackable/patches/31.0.1/03-stop-building-unused-extensions.patch → druid/stackable/patches/31.0.1/0003-Stop-building-unused-extensions.patch

@@ -1,18 +1,20 @@
-Stop building unused extensions.
-
+From 540182e6a1169103cb77ff37d963186f23204800 Mon Sep 17 00:00:00 2001
 From: Lars Francke <[email protected]>
+Date: Mon, 17 Feb 2025 16:42:34 +0100
+Subject: Stop building unused extensions.
 
 By default Druid builds all community extensions and then discards them
 while assembling the final distribution. This patch removes unused
 extensions from the build.
 ---
- 0 files changed
+ pom.xml | 32 +-------------------------------
+ 1 file changed, 1 insertion(+), 31 deletions(-)
 
 diff --git a/pom.xml b/pom.xml
-index 2acb812cbe..38e0ddc61a 100644
+index 807f9f11df..e9e19f7920 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -201,39 +201,9 @@
+@@ -200,39 +200,9 @@
          <module>extensions-core/google-extensions</module>
          <module>extensions-core/druid-catalog</module>
          <module>extensions-core/testing-tools</module>

druid/stackable/patches/31.0.1/04-update-patch-dependencies.patch → druid/stackable/patches/31.0.1/0004-Updates-all-dependencies-that-have-a-new-patch-relea.patch

@@ -1,11 +1,19 @@
-Updates all dependencies that have a new patch release available.
-
-From: Lukas Krug <[email protected]>
-
+From 14918ed4cad073b1e62ba26111352dafd2da3ae0 Mon Sep 17 00:00:00 2001
+From: Lars Francke <[email protected]>
+Date: Mon, 17 Feb 2025 16:42:49 +0100
+Subject: Updates all dependencies that have a new patch release available.
 
 ---
+ extensions-core/druid-pac4j/pom.xml           |  2 +-
+ extensions-core/kubernetes-extensions/pom.xml |  2 +-
+ extensions-core/orc-extensions/pom.xml        |  2 +-
+ extensions-core/parquet-extensions/pom.xml    |  2 +-
+ pom.xml                                       | 31 ++++++++++---------
+ processing/pom.xml                            |  2 +-
+ 6 files changed, 22 insertions(+), 19 deletions(-)
+
 diff --git a/extensions-core/druid-pac4j/pom.xml b/extensions-core/druid-pac4j/pom.xml
-index 3693d28..8be5e4c 100644
+index 3693d28d67..8be5e4c355 100644
 --- a/extensions-core/druid-pac4j/pom.xml
 +++ b/extensions-core/druid-pac4j/pom.xml
 @@ -34,7 +34,7 @@
@@ -18,7 +26,7 @@ index 3693d28..8be5e4c 100644
      <!-- Following must be updated along with any updates to pac4j version. One can find the compatible version of nimbus libraries in org.pac4j:pac4j-oidc dependencies-->
      <nimbus.lang.tag.version>1.7</nimbus.lang.tag.version>
 diff --git a/extensions-core/kubernetes-extensions/pom.xml b/extensions-core/kubernetes-extensions/pom.xml
-index 1e513ec..7f43fdd 100644
+index 1e513ec8eb..7f43fdd108 100644
 --- a/extensions-core/kubernetes-extensions/pom.xml
 +++ b/extensions-core/kubernetes-extensions/pom.xml
 @@ -34,7 +34,7 @@
@@ -31,7 +39,7 @@ index 1e513ec..7f43fdd 100644
 
 
 diff --git a/extensions-core/orc-extensions/pom.xml b/extensions-core/orc-extensions/pom.xml
-index 1b6a394..bb4a9be 100644
+index 1b6a394728..bb4a9be716 100644
 --- a/extensions-core/orc-extensions/pom.xml
 +++ b/extensions-core/orc-extensions/pom.xml
 @@ -31,7 +31,7 @@
@@ -44,7 +52,7 @@ index 1b6a394..bb4a9be 100644
      <dependencies>
          <dependency>
 diff --git a/extensions-core/parquet-extensions/pom.xml b/extensions-core/parquet-extensions/pom.xml
-index 0d18d91..a8f9e7d 100644
+index 0d18d9162d..a8f9e7d52e 100644
 --- a/extensions-core/parquet-extensions/pom.xml
 +++ b/extensions-core/parquet-extensions/pom.xml
 @@ -201,7 +201,7 @@
@@ -57,7 +65,7 @@ index 0d18d91..a8f9e7d 100644
      </profile>
    </profiles>
 diff --git a/pom.xml b/pom.xml
-index e5bcfaf..80861bc 100644
+index e9e19f7920..4408e55b9c 100644
 --- a/pom.xml
 +++ b/pom.xml
 @@ -74,7 +74,7 @@
@@ -105,7 +113,7 @@ index e5bcfaf..80861bc 100644
          <protobuf.version>3.25.5</protobuf.version>
          <resilience4j.version>1.3.1</resilience4j.version>
          <slf4j.version>1.7.36</slf4j.version>
-@@ -118,17 +118,17 @@
+@@ -118,17 +121,17 @@
          <!-- mockito-inline artifact was removed in mockito 5.3 (mockito 5.x is required for Java >17),
               however it is required in some cases when running against mockito 4.x (mockito 4.x is required for Java <11. We use the following property to pick the proper artifact based on Java version (see pre-java-11 profile) -->
          <mockito.inline.artifact>core</mockito.inline.artifact>
@@ -129,10 +137,10 @@ index e5bcfaf..80861bc 100644
          <jdk.strong.encapsulation.argLine><!-- empty placeholder --></jdk.strong.encapsulation.argLine>
          <jdk.security.manager.allow.argLine><!-- empty placeholder --></jdk.security.manager.allow.argLine>
 diff --git a/processing/pom.xml b/processing/pom.xml
-index affd900fe6..0daad4fa56 100644
+index d5418dce93..716c1299f4 100644
 --- a/processing/pom.xml
 +++ b/processing/pom.xml
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
      <sigar.base.version>1.6.5</sigar.base.version>
      <sigar.version>${sigar.base.version}.132</sigar.version>
      <ipaddress.version>5.3.4</ipaddress.version>

druid/stackable/patches/31.0.1/05-xmllayout-dependencies.patch → druid/stackable/patches/31.0.1/0005-Include-jackson-dataformat-xml-dependency.patch

@@ -1,16 +1,18 @@
-Include jackson-dataformat-xml dependency.
-
+From bb1dd6ace9f6112532e5c4ad7158f0703b5baf9a Mon Sep 17 00:00:00 2001
 From: Lars Francke <[email protected]>
+Date: Mon, 17 Feb 2025 16:42:49 +0100
+Subject: Include jackson-dataformat-xml dependency.
 
 This allows us to use XmlLayout for Log4jV2.
 By including it here as a dependency we can make sure that we always have
 the matching version and we don't need to include it manually later in the
 build.
 ---
- 0 files changed
+ server/pom.xml | 5 +++++
+ 1 file changed, 5 insertions(+)
 
 diff --git a/server/pom.xml b/server/pom.xml
-index 410b51480e..b7dcf46111 100644
+index 8f1bb2bd72..4c443f9ac4 100644
 --- a/server/pom.xml
 +++ b/server/pom.xml
 @@ -205,6 +205,11 @@

druid/stackable/patches/31.0.1/06-dont-build-targz.patch → druid/stackable/patches/31.0.1/0006-Stop-building-the-tar.gz-distribution.patch

@@ -1,11 +1,12 @@
-Stop building the tar.gz distribution.
-
+From e91413a596de7c72e659a0da45522f8d84a6372b Mon Sep 17 00:00:00 2001
 From: Lars Francke <[email protected]>
+Date: Mon, 17 Feb 2025 16:42:49 +0100
+Subject: Stop building the tar.gz distribution.
 
 All we do is build Druid tar and gzip it only to immediately uncompress it
 again. So, instead we just skip the compression step entirely.
 ---
- distribution/src/assembly/assembly.xml |    2 +-
+ distribution/src/assembly/assembly.xml | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/distribution/src/assembly/assembly.xml b/distribution/src/assembly/assembly.xml

druid/stackable/patches/31.0.1/07-cyclonedx-plugin.patch → druid/stackable/patches/31.0.1/0007-Update-CycloneDX-plugin.patch

@@ -1,8 +1,17 @@
+From 245dbf0bff4e386db6b27d079fe5baff6180732c Mon Sep 17 00:00:00 2001
+From: Lukas Voetmand <[email protected]>
+Date: Fri, 6 Sep 2024 17:53:52 +0200
+Subject: Update CycloneDX plugin
+
+---
+ pom.xml | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
 diff --git a/pom.xml b/pom.xml
-index 9051ed2..10a2c85 100644
+index 4408e55b9c..5c99e69381 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -1728,7 +1728,11 @@
+@@ -1707,7 +1707,11 @@
              <plugin>
                  <groupId>org.cyclonedx</groupId>
                  <artifactId>cyclonedx-maven-plugin</artifactId>

druid/stackable/patches/31.0.1/08-CVE-2024-36114-bump-aircompressor-0-27.patch → druid/stackable/patches/31.0.1/0008-Fix-CVE-2024-36114.patch

@@ -1,3 +1,8 @@
+From f36f1491c4d3658a8ebdc74e90fdbfa949546abe Mon Sep 17 00:00:00 2001
+From: Malte Sander <[email protected]>
+Date: Thu, 12 Dec 2024 17:59:17 +0100
+Subject: Fix CVE-2024-36114
+
 Fix CVE-2024-36114
 see https://github.com/stackabletech/vulnerabilities/issues/834
 
@@ -17,12 +22,15 @@ have been fixed. When decompressing data from untrusted users, this can
 be exploited for a denial-of-service attack by crashing the JVM, or to
 leak other sensitive information from the Java process. There are no
 known workarounds for this issue.
+---
+ pom.xml | 6 ++++++
+ 1 file changed, 6 insertions(+)
 
 diff --git a/pom.xml b/pom.xml
-index 9051ed24c5..e839295b61 100644
+index 5c99e69381..88fdfcb09a 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -283,6 +283,12 @@
+@@ -256,6 +256,12 @@
      </pluginRepositories>
      <dependencyManagement>
          <dependencies>

druid/stackable/patches/31.0.1/09-update-fmpp.patch → druid/stackable/patches/31.0.1/0009-Update-FMPP-version.patch

@@ -1,11 +1,26 @@
+From 15f604cc0c9f953df95be8a4c38d5dcc0b595051 Mon Sep 17 00:00:00 2001
+From: Lars Francke <[email protected]>
+Date: Thu, 12 Dec 2024 06:35:21 +0100
+Subject: Update FMPP version
+
+This is because FMPP Maven Plugin depends on FMPP in version 0.9.14
+which itself depends on a Freemarker version that has not been pinned.
+Instead it specifies a "range" which resolves to a SNAPSHOT version
+which we don't want.
+---
+ 10-update-fmpp.patch | 0
+ sql/pom.xml          | 7 +++++++
+ 2 files changed, 7 insertions(+)
+ create mode 100644 10-update-fmpp.patch
+
 diff --git a/10-update-fmpp.patch b/10-update-fmpp.patch
 new file mode 100644
 index 0000000000..e69de29bb2
 diff --git a/sql/pom.xml b/sql/pom.xml
-index bdd29f3f91..e5ba89f655 100644
+index 56ed03f5c2..d0d19dd854 100644
 --- a/sql/pom.xml
 +++ b/sql/pom.xml
-@@ -322,6 +322,13 @@
+@@ -365,6 +365,13 @@
        <plugin>
          <groupId>com.googlecode.fmpp-maven-plugin</groupId>
          <artifactId>fmpp-maven-plugin</artifactId>

druid/stackable/patches/31.0.1/10-cve-2023-34455-rm-snappy.patch → druid/stackable/patches/31.0.1/0010-Fix-CVE-2023-34455.patch

@@ -1,4 +1,8 @@
-Fix CVE-2023-34455
+From 90f6dd1211a4d4ced8b3a75b7549b1e68e4b6ee6 Mon Sep 17 00:00:00 2001
+From: Razvan-Daniel Mihai <[email protected]>
+Date: Tue, 28 Jan 2025 17:29:59 +0100
+Subject: Fix CVE-2023-34455
+
 see https://github.com/stackabletech/vulnerabilities/issues/558
 
 At the end of build process, Druid downloads dependencies directly from a remote
@@ -8,9 +12,12 @@ The hadoop client depends on a vulnerable version of the snappy library which
 is then also downloaded even though a newer version is already on the system.
 
 This patch removes the vulnerable jars.
+---
+ distribution/pom.xml | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
 
 diff --git a/distribution/pom.xml b/distribution/pom.xml
-index d5918710ef..2d5bfc6ab4 100644
+index a28e34bb6a..4ab7837538 100644
 --- a/distribution/pom.xml
 +++ b/distribution/pom.xml
 @@ -259,6 +259,20 @@

druid/stackable/patches/31.0.1/patchable.toml

@@ -0,0 +1,2 @@
+upstream = "https://github.com/apache/druid.git"
+base = "520482cb9638e452b0553595b4f29bb397a63758"