Fin pr duckdb check 1

d/duckdb/build_info.json

@@ -5,13 +5,13 @@
   "version": "v1.5.4",
   "default_branch": "main",
   "package_dir": "d/duckdb",
-  "build_script": "duckdb_1.5.4_ubi_9.6.sh",
+  "build_script": "duckdb_1.5.4_ubi_10.2.sh",
   "docker_build": false,
   "validate_build_script": true,
   "wheel_build" : true,
   "use_non_root_user": false,
   "1.5.4": {
-     "build_script": "duckdb_1.5.4_ubi_9.6.sh"
+     "build_script": "duckdb_1.5.4_ubi_10.2.sh"
   },
   "*": {
      "build_script": "duckdb_ubi_9.6.sh"

d/duckdb/duckdb_1.5.4_ubi_9.6.sh → d/duckdb/duckdb_1.5.4_ubi_10.2.sh

@@ -4,7 +4,7 @@
 # Package       : duckdb
 # Version       : v1.5.4
 # Source repo   : https://github.com/duckdb/duckdb-python.git
-# Tested on     : UBI:9.6
+# Tested on     : UBI:10.2
 # Language      : Python, C++
 # Ci-Check  : True
 # Script License: Apache License, Version 2 or later
@@ -23,42 +23,41 @@ PACKAGE_VERSION=${1:-v1.5.4}
 PACKAGE_DIR=duckdb-python
 PACKAGE_URL=https://github.com/duckdb/duckdb-python.git
 PYTHON_VERSION=3.12
+SOURCE_ROOT="$(pwd)"
 
 # Install necessary system packages
-dnf install -y gcc-toolset-13 make cmake ninja-build libomp-devel git python${PYTHON_VERSION} python${PYTHON_VERSION}-pip python${PYTHON_VERSION}-devel
+dnf install -y \
+    gcc-toolset-15 \
+    cmake \
+    ninja-build \
+    python3.12 \
+    python3.12-devel \
+    python3.12-pip
 
-# Enable GCC toolset
-source /opt/rh/gcc-toolset-13/enable
-export CXX=/opt/rh/gcc-toolset-13/root/usr/bin/g++
+export PATH="/opt/rh/gcc-toolset-15/root/usr/bin:$PATH"
+gcc --version
 
+python3.12 -m pip install --upgrade pip setuptools
 
-python${PYTHON_VERSION} -m pip install build wheel setuptools ninja pybind11
+# -- Build wheel --------------------------------------------------------------
+python3.12 -m pip wheel . --no-deps -w "${CURRENT_DIR}/dist/"
 
-# Clone the repository
-git clone ${PACKAGE_URL}
-cd ${PACKAGE_NAME}
-git checkout ${PACKAGE_VERSION}
-
-git submodule update --init --recursive
-
-export DUCKDB_BUILD_PYTHON=1
-export DUCKDB_BUILD_STATIC=1
-
-echo "Building duckdb wheel..."
-if ! python${PYTHON_VERSION} -m build --wheel; then
-    echo "------------------$PACKAGE_NAME: build_fail------------------"
-    echo "$PACKAGE_NAME | $PACKAGE_URL | $PACKAGE_VERSION | GitHub | Fail | Build_Fail"
+WHEEL=$(find "${CURRENT_DIR}/dist" -name "duckdb-*.whl" | head -1)
+if [ -z "$WHEEL" ]; then
+    echo "ERROR: wheel not found after build"
     exit 1
 fi
+echo "Wheel: $WHEEL"
 
-echo "Installing duckdb wheel..."
-WHEEL_FILE=$(find dist -name "*.whl" | head -n1)
-if [ -n "$WHEEL_FILE" ]; then
-    python${PYTHON_VERSION} -m pip install "$WHEEL_FILE"
+# Copy wheel to /home/tester so the wrapper script can locate it without rebuilding
+if [ -d /home/tester ]; then
+    cp "${WHEEL}" /home/tester/
 fi
 
-# Run tests
-cd /
+cd "${SOURCE_ROOT}"
+
+# -- Install ------------------------------------------------------------------
+pip3.12 install "$WHEEL"
 
 if ! python${PYTHON_VERSION} - <<EOF
 import duckdb
@@ -89,4 +88,3 @@ else
     echo "$PACKAGE_NAME | $PACKAGE_URL | $PACKAGE_VERSION | GitHub | Pass | Both_Install_and_Test_Success"
     exit 0
 fi
-

gha-script/build_package.sh

@@ -10,44 +10,81 @@ echo "**************************************************************************
 
 docker_image=""
 
-# the below function is used for building a custom docker image, it will be called only when non root user build is set to true.
-# function accepts one argument, which is the base image value.
+# Builds a custom non-root wrapper image on top of the given base image.
+# Sets docker_image to "docker_non_root_image" on success.
 docker_build_non_root() {
   echo "building docker image for non root user build"
   docker build --build-arg BASE_IMAGE="$1" -t docker_non_root_image -f gha-script/dockerfile_non_root .
   docker_image="docker_non_root_image"
 }
 
-#Below conditions are used to select the base image based on the 2 flags, tested_on and non_root_build.
-#A docker_build_non_root function is called when non root build is true.
-if [[ "$TESTED_ON" == UBI:9* || "$TESTED_ON" == UBI9* ]];
-then
-    ubi_version=$(echo "$TESTED_ON" | grep -oE '[0-9]+\.[0-9]+')
-    docker pull registry.access.redhat.com/ubi9/ubi:$ubi_version
-    docker_image="registry.access.redhat.com/ubi9/ubi:$ubi_version"
-    if [[ "$NON_ROOT_BUILD" == "true" ]];
-    then
-        docker_build_non_root "registry.access.redhat.com/ubi9/ubi:$ubi_version"
-    fi
-elif [[ "$TESTED_ON" == UBI:10* || "$TESTED_ON" == UBI10* ]];
-then
-    ubi_version=$(echo "$TESTED_ON" | grep -oE '[0-9]+\.[0-9]+')
-    # Fallback to 10.0 if no minor version found
-    ubi_version=${ubi_version:-10.0}
-    docker pull registry.access.redhat.com/ubi10/ubi:$ubi_version
-    docker_image="registry.access.redhat.com/ubi10/ubi:$ubi_version"
-    if [[ "$NON_ROOT_BUILD" == "true" ]];
-    then
-        docker_build_non_root "registry.access.redhat.com/ubi10/ubi:$ubi_version"
-    fi
-else
-    docker pull registry.access.redhat.com/ubi8/ubi:8.7
-    docker_image="registry.access.redhat.com/ubi8/ubi:8.7"
-    if [[ "$NON_ROOT_BUILD" == "true" ]];
-    then
-        docker_build_non_root "registry.access.redhat.com/ubi8/ubi:8.7"
-    fi  
-fi
+# Resolves the correct UBI registry image from the TESTED_ON string and
+# sets the global docker_image variable.  Supports UBI8, UBI9, UBI10+.
+# The TESTED_ON value is normalised before parsing so all of the following
+# formats work:  "UBI:9.3"  "UBI 9.3"  "ubi9.3"  "UBI: 9.3"  "UBI 10"
+resolve_docker_image() {
+  local raw="$1"
+  local upper
+  upper=$(echo "$raw" | tr '[:lower:]' '[:upper:]')
+
+  # Collapse "UBI : 9.3" / "UBI:9.3" / "UBI 9.3" / "UBI9.3" -> "UBI9.3"
+  # Uses sed only  -  no grep -P (absent on ppc64le runners).
+  local norm
+  norm=$(echo "$upper" | sed 's/UBI[[:space:]]*[: ][[:space:]]*/UBI/g')
+
+  # Extract the major UBI version integer immediately after "UBI"
+  local major
+  major=$(echo "$norm" | sed 's/.*UBI\([0-9][0-9]*\).*/\1/')
+  case "$major" in
+    ''|*[!0-9]*) major="" ;;
+  esac
+
+  if [ -z "$major" ]; then
+    echo "ERROR: Cannot determine UBI major version from TESTED_ON='$raw'"
+    exit 1
+  fi
+
+  # Extract the full version string e.g. "9.3", "10.3" (first X.Y found)
+  local full
+  full=$(echo "$upper" | grep -oE '[0-9]+\.[0-9]+' | head -1)
+
+  if [ -z "$full" ]; then
+    # No minor version supplied  -  use per-major defaults
+    case "$major" in
+      8)  full="8.7"  ;;
+      9)  full="9.3"  ;;
+      10) full="10.0" ;;
+      *)  full="${major}.0" ;;
+    esac
+    echo "WARNING: No minor version in TESTED_ON='$raw', defaulting to UBI ${full}"
+  fi
+
+  # Select the registry image by major version
+  case "$major" in
+    8)
+      docker_image="registry.access.redhat.com/ubi8/ubi:${full}"
+      ;;
+    9)
+      docker_image="registry.access.redhat.com/ubi9/ubi:${full}"
+      ;;
+    10)
+      docker_image="registry.access.redhat.com/ubi10/ubi:${full}"
+      ;;
+    *)
+      echo "ERROR: Unsupported UBI major version '${major}' in TESTED_ON='$raw'"
+      exit 1
+      ;;
+  esac
+
+  echo " Resolved Docker image: $docker_image  (TESTED_ON='$raw')"
+
+  if [[ "$NON_ROOT_BUILD" == "true" ]]; then
+    docker_build_non_root "$docker_image"
+  fi
+}
+
+resolve_docker_image "$TESTED_ON"
+docker pull "$docker_image"
 
 
 python3 gha-script/validate_builds_currency.py "$PKG_DIR_PATH$BUILD_SCRIPT" "$VERSION" "$docker_image" 2>&1 | tee build_log

gha-script/build_wheels.py

@@ -43,6 +43,15 @@ def trigger_build_wheel(wrapper_file, python_version, image_name, file_name, ver
                "GHA_CURRENCY_SERVICE_ID_API_KEY": os.getenv("GHA_CURRENCY_SERVICE_ID_API_KEY"),
                "GHA_CURRENCY_SERVICE_ID": os.getenv("GHA_CURRENCY_SERVICE_ID"),
                "AUDITWHEEL_EXCLUDE": os.getenv("AUDITWHEEL_EXCLUDE", ""),
+               # Grype is installed on the host runner at scan-tools-bin/grype.
+               # The workspace is volume-mounted at /home/tester/ inside the
+               # container, so the binary is reachable at that in-container path.
+               # Passing GRYPE_BIN lets generalized_wheel_scanner.py find it via
+               # os.environ without relying on $PATH (which is host-only).
+               "GRYPE_BIN": "/home/tester/scan-tools-bin/grype",
+               # Set to "false" by pr-build.yaml to skip the CVE scan in PR builds.
+               # Defaults to "true" (scan runs) when unset (currency-build.yaml).
+               "ENABLE_CVE_SCAN": os.getenv("ENABLE_CVE_SCAN", "true"),
             }
         )
 

gha-script/build_wheels.sh

@@ -10,61 +10,83 @@ echo "**************************************************************************
 
 docker_image=""
 
-# the below function is used for building a custom docker image, it will be called only when non root user build is set to true.
-# function accepts one argument, which is the base image value.
+# Builds a custom non-root wrapper image on top of the given base image.
+# Sets docker_image to "docker_non_root_image" on success.
 docker_build_non_root() {
   echo "building docker image for non root user build"
   docker build --build-arg BASE_IMAGE="$1" -t docker_non_root_image -f gha-script/dockerfile_non_root .
   docker_image="docker_non_root_image"
 }
 
-#Below conditions are used to select the base image based on the 2 flags, tested_on and non_root_build.
-#A docker_build_non_root function is called when non root build is true.
-if [[ "$TESTED_ON" == UBI:9* || "$TESTED_ON" == UBI9* ]];
-then
-    ubi_version=$(echo "$TESTED_ON" | grep -oE '[0-9]+\.[0-9]+')
-    docker pull registry.access.redhat.com/ubi9/ubi:$ubi_version
-    docker_image="registry.access.redhat.com/ubi9/ubi:$ubi_version"
-    if [[ "$NON_ROOT_BUILD" == "true" ]];
-    then
-        docker_build_non_root "registry.access.redhat.com/ubi9/ubi:$ubi_version"
-    fi
-elif [[ "$TESTED_ON" == UBI:10* || "$TESTED_ON" == UBI10* ]];
-then
-    ubi_version=$(echo "$TESTED_ON" | grep -oE '[0-9]+\.[0-9]+')
-    # Fallback to 10.0 if no minor version found
-    ubi_version=${ubi_version:-10.0}
-    docker pull registry.access.redhat.com/ubi10/ubi:$ubi_version
-    docker_image="registry.access.redhat.com/ubi10/ubi:$ubi_version"
-    if [[ "$NON_ROOT_BUILD" == "true" ]];
-    then
-        docker_build_non_root "registry.access.redhat.com/ubi10/ubi:$ubi_version"
-    fi
-else
-    docker pull registry.access.redhat.com/ubi8/ubi:8.7
-    docker_image="registry.access.redhat.com/ubi8/ubi:8.7"
-    if [[ "$NON_ROOT_BUILD" == "true" ]];
-    then
-        docker_build_non_root "registry.access.redhat.com/ubi8/ubi:8.7"
-    fi  
-fi
+# Resolves the correct UBI registry image from the TESTED_ON string and
+# sets the global docker_image variable.  Supports UBI8, UBI9, UBI10+.
+# The TESTED_ON value is normalised before parsing so all of the following
+# formats work:  "UBI:9.3"  "UBI 9.3"  "ubi9.3"  "UBI: 9.3"  "UBI 10"
+resolve_docker_image() {
+  local raw="$1"
+  local upper
+  upper=$(echo "$raw" | tr '[:lower:]' '[:upper:]')
 
-# UBI 10 does not ship Python 3.10 or 3.11 in its repos.
-# Building 3.10 from source is not supported for UBI 10 wheel builds.
-# Skip those Python versions early to avoid false-positive successes.
-if [[ "$TESTED_ON" == UBI:10* || "$TESTED_ON" == UBI10* ]]; then
-    if [[ "$PYTHON_VERSION" == "3.10" || "$PYTHON_VERSION" == "3.11" ]]; then
-        echo "Skipping wheel build for Python $PYTHON_VERSION — not supported on UBI 10"
-        exit 0
-    fi
-fi
+  # Collapse "UBI : 9.3" / "UBI:9.3" / "UBI 9.3" / "UBI9.3" -> "UBI9.3"
+  # Uses sed only  -  no grep -P (absent on ppc64le runners).
+  local norm
+  norm=$(echo "$upper" | sed 's/UBI[[:space:]]*[: ][[:space:]]*/UBI/g')
 
-WHEEL_SCRIPT=gha-script/create_wheel_wrapper.sh
+  # Extract the major UBI version integer immediately after "UBI"
+  local major
+  major=$(echo "$norm" | sed 's/.*UBI\([0-9][0-9]*\).*/\1/')
+  case "$major" in
+    ''|*[!0-9]*) major="" ;;
+  esac
+
+  if [ -z "$major" ]; then
+    echo "ERROR: Cannot determine UBI major version from TESTED_ON='$raw'"
+    exit 1
+  fi
 
-# Ensure the wrapper script is readable and executable by all users.
-# Required for non-root container builds where the mounted volume is owned
-# by the host runner user but executed as test_user inside the container.
-chmod a+rx "$WHEEL_SCRIPT"
+  # Extract the full version string e.g. "9.3", "10.3" (first X.Y found)
+  local full
+  full=$(echo "$upper" | grep -oE '[0-9]+\.[0-9]+' | head -1)
+
+  if [ -z "$full" ]; then
+    # No minor version supplied  -  use per-major defaults
+    case "$major" in
+      8)  full="8.7"  ;;
+      9)  full="9.3"  ;;
+      10) full="10.0" ;;
+      *)  full="${major}.0" ;;
+    esac
+    echo "WARNING: No minor version in TESTED_ON='$raw', defaulting to UBI ${full}"
+  fi
+
+  # Select the registry image by major version
+  case "$major" in
+    8)
+      docker_image="registry.access.redhat.com/ubi8/ubi:${full}"
+      ;;
+    9)
+      docker_image="registry.access.redhat.com/ubi9/ubi:${full}"
+      ;;
+    10)
+      docker_image="registry.access.redhat.com/ubi10/ubi:${full}"
+      ;;
+    *)
+      echo "ERROR: Unsupported UBI major version '${major}' in TESTED_ON='$raw'"
+      exit 1
+      ;;
+  esac
+
+  echo " Resolved Docker image: $docker_image  (TESTED_ON='$raw')"
+
+  if [[ "$NON_ROOT_BUILD" == "true" ]]; then
+    docker_build_non_root "$docker_image"
+  fi
+}
+
+resolve_docker_image "$TESTED_ON"
+docker pull "$docker_image"
+
+WHEEL_SCRIPT=gha-script/create_wheel_wrapper.sh
 
 # path to post_process_wheel script (suffix addition, license addition, metadata addition)
 POST_PROCESS_SCRIPT_PATH=gha-script/post_process_wheel.py