arrow: Enable encrypted Parquet support (#14358)

Efficiently fuzzing encrypted Parquet reading will probably require more
work for proper decryption keys to be configured. This is just a
preparatory step (and it might surface basic issues already).

Author: pitrou

projects/arrow/Dockerfile

@@ -23,13 +23,17 @@ RUN apt-get update -y -q && \
         flex \
         ninja-build
 
-RUN wget https://github.com/boostorg/boost/releases/download/boost-1.87.0/boost-1.87.0-cmake.tar.gz && \
-    tar -xvf boost-1.87.0-cmake.tar.gz && \
-    cd boost-1.87.0/ && \
-    CFLAGS="" CXXFLAGS="" ./bootstrap.sh && \
-    CFLAGS="" CXXFLAGS="" ./b2 headers && \
-    CFLAGS="" CXXFLAGS="" ./b2 --with-process runtime-link=static link=static variant=release install -j 10 && \
-    cp -R -f boost/ /usr/include/
+ARG boost_version=1.89.0
+# uuid and locale needed for Thrift source build
+ARG boost_components=filesystem;system;process;multiprecision;crc;uuid;locale
+
+RUN wget https://github.com/boostorg/boost/releases/download/boost-${boost_version}/boost-${boost_version}-cmake.tar.gz && \
+    tar -xf boost-${boost_version}-cmake.tar.gz && \
+    cd boost-${boost_version}/ && \
+    mkdir -p build / && \
+    cd build/ && \
+    cmake .. -GNinja -DBOOST_INCLUDE_LIBRARIES="${boost_components}" -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF && \
+    cmake --build . --target install
 
 RUN git clone --depth=1 --recurse-submodules \
     https://github.com/apache/arrow.git $SRC/arrow

projects/arrow/build.sh

@@ -15,21 +15,31 @@
 #
 ################################################################################
 
+# 1. Build instrumented OpenSSL
+
+OPENSSL_VERSION=3.5.4
+
+cd /root
+wget https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz
+tar -xf openssl-${OPENSSL_VERSION}.tar.gz
+cd openssl-${OPENSSL_VERSION}
+./Configure no-apps no-docs no-tests no-shared
+make -j
+make install
+
+# 2. Build Arrow C++ proper
+
 ARROW=${SRC}/arrow/cpp
 
 BUILD_DIR=${SRC}/build-dir
 mkdir -p ${BUILD_DIR}
 cd ${BUILD_DIR}
 
-# The CMake build setup compiles and runs the Thrift compiler, but ASAN
-# would report leaks and error out.
-export ASAN_OPTIONS="detect_leaks=0"
-
 cmake ${ARROW} -GNinja \
     -DCMAKE_BUILD_TYPE=Release \
     -DARROW_DEPENDENCY_SOURCE=BUNDLED \
+    -DARROW_OPENSSL_USE_SHARED=off \
     -DBOOST_SOURCE=SYSTEM \
-    -DBoost_USE_STATIC_RUNTIME=on \
     -DARROW_BOOST_USE_SHARED=off \
     -DCMAKE_C_FLAGS="${CFLAGS}" \
     -DCMAKE_CXX_FLAGS="${CXXFLAGS}" \
@@ -45,7 +55,7 @@ cmake ${ARROW} -GNinja \
     -DARROW_TEST_LINKAGE=static \
     -DPARQUET_BUILD_EXAMPLES=off \
     -DPARQUET_BUILD_EXECUTABLES=off \
-    -DPARQUET_REQUIRE_ENCRYPTION=off \
+    -DPARQUET_REQUIRE_ENCRYPTION=on \
     \
     -DARROW_CSV=on \
     -DARROW_JEMALLOC=off \
@@ -71,4 +81,3 @@ ${ARROW}/build-support/fuzzing/generate_corpuses.sh ${BUILD_DIR}/release
 find . -executable -name "*-fuzz" -exec cp -a -v '{}' ${OUT} \;
 # Copy seed corpuses
 find . -name "*-fuzz_seed_corpus.zip" -exec cp -a -v '{}' ${OUT} \;
-

projects/arrow/replay_build.sh

@@ -20,10 +20,6 @@ ARROW=${SRC}/arrow/cpp
 BUILD_DIR=${SRC}/build-dir
 cd ${BUILD_DIR}
 
-# The CMake build setup compiles and runs the Thrift compiler, but ASAN
-# would report leaks and error out.
-export ASAN_OPTIONS="detect_leaks=0"
-
 cmake --build . -j$(nproc)
 
 # Copy fuzz targets