This is an automated email from the ASF dual-hosted git repository.
hello-stephen pushed a commit to branch branch-4.2
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.2 by this push:
new b8042d8976d [fix](regression) branch-4.2: Reuse pinned Kerberos
dependencies without host build networking (#68955)
b8042d8976d is described below
commit b8042d8976d67682b8ddaccfa129095b014c8836
Author: Dongyang Li <[email protected]>
AuthorDate: Tue Oct 13 20:14:55 2026 +0800
[fix](regression) branch-4.2: Reuse pinned Kerberos dependencies without
host build networking (#68955)
### What problem does this PR solve?
Issue Number: None
Related PR: #68440
Kerberos regression is blocked before cases execute: the fixture
installs packages from mutable Debian Bullseye repositories that can
return 404, and Compose Bake rejects its host build network without an
explicit entitlement.
Use the existing Hive 3.1.3/Kerberos image by immutable digest as a
dependency layer, then COPY this branch's entrypoint and health scripts
as before. Remove only the Compose build network setting; the remaining
Dockerfile needs no network, while runtime host networking, generated
keytabs, fixture data, and readiness checks stay unchanged. This
preserves this branch's service scripts. The invalid-HMS-principal test
also explicitly maps its client principal with auth_to_local, keeping
the invalid service principal and original GSS-error assertion.
Branch-4.1 live validation exposed an earlier NoMatchingRule failure in
this setup; branch-4.2 has the same authenticator implementation that
resets UGI configuration for each login.
Base image:
`doristhirdpartydocker/hive@sha256:b094fbc1a61c65116fbe2f0bca562687a10af418e7a0b2865f8d7b70cd8ad03e`,
published by #68440's pinned build recipe from source
`63e413b47aba101fe67a862dc13f9bc75d88652c`; linux/amd64, Hive 3.1.3,
krb5 packages `1.18.3-6+deb11u8`.
### Release note
None
### Check List (For Author)
- Test: Manual test
- Anonymous registry lookup verified the manifest digest, linux/amd64
configuration, and source revision label.
- All three branch fixtures built successfully on a Linux worker with
`docker build --network=none`; package versions and copied
entrypoint/health hashes were verified.
- `git diff --check` passed; independent review found no additional code
defects.
- Branch-4.2 [Compile
215911](http://172.20.48.17:8111/buildConfiguration/Doris_Doris_x64_Master_Compile/215911)
finished SUCCESS, producing ASAN binary source
609dabb2ac6ce0fed88132b4edc541d3091f8a7b. [Kerberos build
215915](http://172.20.48.17:8111/buildConfiguration/Doris_Doris_x64_Master_External_Kerberos/215915),
with test_branch=branch-4.2, finished SUCCESS: all four functional
suites and the final health check passed (ignored=0, muted=0). Its
matching case archive includes only the subsequent one-line test setup
change from 7425361aec02f322ab66383ecb9cf228fc73f1e4. The Dockerfile,
compose template, entrypoint, health script and changed test file in the
validation archive match this PR byte for byte. The original one-hour
stress suite and default External/S3/HDFS coverage are not restored by
this validation.
- Behavior changed: Yes. Kerberos fixture builds no longer install APT
packages or require host build networking.
- Does this need documentation: No
- Community External: [TeamCity build
1067504](http://43.132.222.7:8111/viewLog.html?buildId=1067504&buildTypeId=Doris_External_Regression)
finished SUCCESS on PR head `7425361aec02f322ab66383ecb9cf228fc73f1e4`;
709 passed, failed=0, ignored=0, muted=0. The four Kerberos suites
(`test_iceberg_hadoop_catalog_kerberos`, `test_non_catalog_kerberos`,
`test_single_hive_kerberos`, `test_two_hive_kerberos`) all executed and
succeeded.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
