[MINOR] Update Xerces source URL to use HTTPS#1625
[MINOR] Update Xerces source URL to use HTTPS#1625pjfanning wants to merge 1 commit intoapache:mainfrom
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hi, @pjfanning welcome!🎊 Thanks for taking the effort to make our project better! 🙌 Keep making such awesome contributions!
leborchuk
left a comment
leborchuk
left a comment
There was a problem hiding this comment.
LGTM
I also checked - there are no other files with "archive.apache.org" address without https
| import urllib.request, urllib.error, urllib.parse | ||
| import hashlib | ||
|
|
||
| XERCES_SOURCE_URL = "http://archive.apache.org/dist/xerces/c/3/sources/xerces-c-3.1.2.tar.gz" | ||
| XERCES_SOURCE_URL = "https://archive.apache.org/dist/xerces/c/3/sources/xerces-c-3.1.2.tar.gz" | ||
| XERCES_SOURCE_DIR = "xerces-c-3.1.2" | ||
|
|
There was a problem hiding this comment.
Thanks for the security-conscious intent.
However, this file (src/backend/gporca/concourse/xerces-c/build_xerces.py) is actually dead code — it's a leftover from
the old Concourse CI pipeline that was removed in commit 4dfbcb5 (Feb 2025). The entire src/backend/gporca/concourse/
directory is no longer referenced by any Makefile, CMakeLists, CI workflow, or build script.
The xerces-c library is now built inside Docker containers (see devops/deploy/docker/build/), which already use HTTPS and
a newer version (xerces-c 3.3.0 vs the 3.1.2 referenced here).
So the right fix here would be to remove the src/backend/gporca/concourse/ directory entirely rather than patching it.
Would you like to update this PR to do that instead, or shall we close this and handle it separately?
5 participants
What does this PR do?
It is always a good idea to avoid non TLS endpoints in builds. There might be more instances like this in your repos and I would suggest that a PMC member has a look.
Type of Change
Breaking Changes
Test Plan
make installcheckmake -C src/test installcheck-cbdb-parallelImpact
Performance:
User-facing changes:
Dependencies:
Checklist
Additional Context
CI Skip Instructions