:memo: Publish kyuubi-spark-authz Spark 4.0 binary to Maven Central

[hit2024]

Code of Conduct

• I agree to follow this project's Code of Conduct

Search before asking

• I have searched in the issues and found no similar issues.

What type of changes will we make to the documentation?

Showcase

Affects Version(s)

master,1.11.1

Improving the documentation

TL;DR — Spark 4 compile support landed in #7256 (v1.10.3 / v1.11.x), but no Spark-4 artifact is published to Maven Central (https://mvnrepository.com/artifact/org.apache.kyuubi/kyuubi-spark-authz). Requesting it be added to the release matrix.

Use case
We run Spark 4.0 with Ranger-based authz. v1.11.1 builds cleanly from source against Spark 4.0 / Scala 2.13 / Java 21 using -Pspark-4.0, so we're currently building and hosting the jar on an internal repo. A published artifact on Central would let us — and other Spark 4 users — consume it directly.

Ask
Add a Spark 4 variant of kyuubi-spark-authz to the release matrix so future releases publish it to Maven Central. Happy to open a PR if a committer can point me at how the existing Spark 3.5 release is wired.

Related: #7256

Are you willing to submit PR?

• Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve.
• No. I cannot submit a PR at this time.

[github-actions]

Hello @hit2024,
Thanks for finding the time to report the issue!
We really appreciate the community's efforts to improve Apache Kyuubi.

[pan3793]

the spark/scala/ranger version combination matrix will be extremely large, so we currently leave it to the user to compile with their own dependency version.

[hit2024]

Understood — the full matrix would be large. But would it be feasible to publish just the most common combinations (e.g., Spark 4.0 + Scala 2.13 + latest Ranger) to Maven Central.
Most users aren't customizing all three dimensions — they just want a standard artifact they can drop into their build without needing to clone the repo and compile locally. Self-hosting jars creates friction for teams that rely on dependency management for reproducibility and security scanning.
Even publishing one or two community-requested combos per release would significantly lower the barrier to adoption.

[acruise]

I've been working on getting the authz tests to run in Spark4 over in master...acruise:kyuubi:master

Some findings:

1. a great many Kyuubi-authz tests require ANSI mode to be turned off
2. after that, there are 9-10 remaining authz tests that fail for interesting reasons; a couple just don't make sense in Spark 4.x but the rest have no obvious fix yet!