Remove CentOS 6 and CentOS 7 binaries

.semaphore/semaphore.yml

@@ -152,33 +152,19 @@ blocks:
         commands:
           - '[[ -z $SEMAPHORE_GIT_TAG_NAME ]] || artifact push workflow artifacts/ --destination artifacts/${ARTIFACT_KEY}/'
       jobs:
-        - name: 'Build: centos6 glibc +gssapi'
+        - name: 'Build: centos8 glibc +gssapi'
           env_vars:
             - name: ARTIFACT_KEY
-              value: p-librdkafka__plat-linux__dist-centos6__arch-x64__lnk-std__extra-gssapi
+              value: p-librdkafka__plat-linux__dist-centos8__arch-x64__lnk-std__extra-gssapi
           commands:
-            - packaging/tools/build-release-artifacts.sh quay.io/pypa/manylinux2010_x86_64:2022-08-05-4535177 artifacts/librdkafka.tgz
+            - packaging/tools/build-release-artifacts.sh quay.io/pypa/manylinux_2_28_x86_64:2024.07.01-1 artifacts/librdkafka.tgz
 
-        - name: 'Build: centos6 glibc'
+        - name: 'Build: centos8 glibc'
           env_vars:
             - name: ARTIFACT_KEY
-              value: p-librdkafka__plat-linux__dist-centos6__arch-x64__lnk-all
+              value: p-librdkafka__plat-linux__dist-centos8__arch-x64__lnk-all
           commands:
-            - packaging/tools/build-release-artifacts.sh --disable-gssapi quay.io/pypa/manylinux2010_x86_64:2022-08-05-4535177 artifacts/librdkafka.tgz
-
-        - name: 'Build: centos7 glibc +gssapi'
-          env_vars:
-            - name: ARTIFACT_KEY
-              value: p-librdkafka__plat-linux__dist-centos7__arch-x64__lnk-std__extra-gssapi
-          commands:
-            - packaging/tools/build-release-artifacts.sh quay.io/pypa/manylinux2014_x86_64:2024-05-13-0983f6f artifacts/librdkafka.tgz
-
-        - name: 'Build: centos7 glibc'
-          env_vars:
-            - name: ARTIFACT_KEY
-              value: p-librdkafka__plat-linux__dist-centos7__arch-x64__lnk-all
-          commands:
-            - packaging/tools/build-release-artifacts.sh --disable-gssapi quay.io/pypa/manylinux2014_x86_64:2024-05-13-0983f6f artifacts/librdkafka.tgz
+            - packaging/tools/build-release-artifacts.sh --disable-gssapi quay.io/pypa/manylinux_2_28_x86_64:2024.07.01-1 artifacts/librdkafka.tgz
 
         - name: 'Build: alpine musl +gssapi'
           env_vars:
@@ -208,19 +194,19 @@ blocks:
         commands:
           - '[[ -z $SEMAPHORE_GIT_TAG_NAME ]] || artifact push workflow artifacts/ --destination artifacts/${ARTIFACT_KEY}/'
       jobs:
-        - name: 'Build: centos7 glibc +gssapi'
+        - name: 'Build: centos8 glibc +gssapi'
           env_vars:
             - name: ARTIFACT_KEY
-              value: p-librdkafka__plat-linux__dist-centos7__arch-arm64__lnk-std__extra-gssapi
+              value: p-librdkafka__plat-linux__dist-centos8__arch-arm64__lnk-std__extra-gssapi
           commands:
-            - packaging/tools/build-release-artifacts.sh quay.io/pypa/manylinux2014_aarch64:2024-05-13-0983f6f artifacts/librdkafka.tgz
+            - packaging/tools/build-release-artifacts.sh quay.io/pypa/manylinux_2_28_aarch64:2024.07.01-1 artifacts/librdkafka.tgz
 
-        - name: 'Build: centos7 glibc'
+        - name: 'Build: centos8 glibc'
           env_vars:
             - name: ARTIFACT_KEY
-              value: p-librdkafka__plat-linux__dist-centos7__arch-arm64__lnk-all
+              value: p-librdkafka__plat-linux__dist-centos8__arch-arm64__lnk-all
           commands:
-            - packaging/tools/build-release-artifacts.sh --disable-gssapi quay.io/pypa/manylinux2014_aarch64:2024-05-13-0983f6f artifacts/librdkafka.tgz
+            - packaging/tools/build-release-artifacts.sh --disable-gssapi quay.io/pypa/manylinux_2_28_aarch64:2024.07.01-1 artifacts/librdkafka.tgz
 
         - name: 'Build: alpine musl +gssapi'
           env_vars:

CHANGELOG.md

@@ -7,7 +7,15 @@ librdkafka v2.5.0 is a feature release.
 * Fix segfault when using long client id because of erased segment when using flexver. (#4689)
 * Fix for an idempotent producer error, with a message batch not reconstructed
   identically when retried (#4750)
+* Removed support for CentOS 6 and CentOS 7 (#4775).
 
+## Upgrade considerations
+
+ * CentOS 6 and CentOS 7 support was removed as they reached EOL
+   and security patches aren't publicly available anymore.
+   ABI compatibility from CentOS 8 on is maintained through pypa/manylinux,
+   AlmaLinux based.
+   See also [Confluent supported OSs page](https://docs.confluent.io/platform/current/installation/versions-interoperability.html#operating-systems) (#4775).
 
 ## Enhancements
 

mklove/modules/configure.libzstd

@@ -53,11 +53,6 @@ function install_source {
             $checksum || return 1
     fi
 
-    local ldlibs=""
-    if [[ $MKL_DISTRO == centos ]]; then
-        ldlibs="-lrt"
-    fi
-
-    time LDLIBS="$ldlibs" make -j DESTDIR="${destdir}" prefix=/usr install
+    time make -j DESTDIR="${destdir}" prefix=/usr install
     return $?
 }

packaging/cp/README.md

@@ -7,8 +7,7 @@ The base_url is the http S3 bucket path to the a PR job, or similar.
 
 ## How to use
 
-    $ ./verify-packages.sh 5.3 https://thes3bucketpath/X/Y
-
+    $ ./verify-packages.sh 7.6 https://packages.confluent.io
 
 Requires docker and patience.
 

packaging/cp/verify-deb.sh

@@ -12,13 +12,13 @@ if [[ -z $base_url ]]; then
 fi
 
 apt-get update
-apt-get install -y apt-transport-https wget
+apt-get install -y apt-transport-https wget gnupg2 lsb-release
 
 wget -qO - ${base_url}/deb/${cpver}/archive.key | apt-key add -
 
-
+release=$(lsb_release -cs)
 cat >/etc/apt/sources.list.d/Confluent.list <<EOF
-deb [arch=amd64] $base_url/deb/${cpver} stable main
+deb [arch=amd64] $base_url/clients/deb ${release} main
 EOF
 
 apt-get update
@@ -28,7 +28,6 @@ gcc /v/check_features.c -o /tmp/check_features -lrdkafka
 
 /tmp/check_features
 
-# Verify plugins
-apt-get install -y confluent-librdkafka-plugins
-
-/tmp/check_features plugin.library.paths monitoring-interceptor
+# FIXME: publish plugins in newer versions
+# apt-get install -y confluent-librdkafka-plugins
+#/tmp/check_features plugin.library.paths monitoring-interceptor

packaging/cp/verify-packages.sh

@@ -17,11 +17,16 @@ fi
 thisdir="$( cd "$(dirname "$0")" ; pwd -P )"
 
 echo "#### Verifying RPM packages ####"
-docker run -v $thisdir:/v centos:7 /v/verify-rpm.sh $cpver $base_url
+docker run -v $thisdir:/v rockylinux:8 /v/verify-rpm.sh $cpver $base_url
+docker run -v $thisdir:/v rockylinux:9 /v/verify-rpm.sh $cpver $base_url
 rpm_status=$?
 
 echo "#### Verifying Debian packages ####"
-docker run -v $thisdir:/v ubuntu:16.04 /v/verify-deb.sh $cpver $base_url
+docker run -v $thisdir:/v debian:10 /v/verify-deb.sh $cpver $base_url
+docker run -v $thisdir:/v debian:11 /v/verify-deb.sh $cpver $base_url
+docker run -v $thisdir:/v debian:12 /v/verify-deb.sh $cpver $base_url
+docker run -v $thisdir:/v ubuntu:20.04 /v/verify-deb.sh $cpver $base_url
+docker run -v $thisdir:/v ubuntu:22.04 /v/verify-deb.sh $cpver $base_url
 deb_status=$?
 
 

packaging/cp/verify-rpm.sh

@@ -12,18 +12,19 @@ if [[ -z $base_url ]]; then
 fi
 
 cat >/etc/yum.repos.d/Confluent.repo <<EOF
-[Confluent.dist]
-name=Confluent repository (dist)
-baseurl=$base_url/rpm/${cpver}/7
-gpgcheck=0
-gpgkey=$base_url/rpm/${cpver}/archive.key
-enabled=1
 [Confluent]
 name=Confluent repository
 baseurl=$base_url/rpm/${cpver}
 gpgcheck=1
 gpgkey=$base_url/rpm/${cpver}/archive.key
 enabled=1
+
+[Confluent-Clients]
+name=Confluent Clients repository
+baseurl=$base_url/clients/rpm/centos/\$releasever/\$basearch
+gpgcheck=1
+gpgkey=$base_url/clients/rpm/archive.key
+enabled=1
 EOF
 
 yum install -y librdkafka-devel gcc

packaging/nuget/nugetpackage.py

@@ -67,34 +67,26 @@ class NugetPackage (Package):
                 './usr/local/lib/librdkafka.1.dylib',
                 'runtimes/osx-arm64/native/librdkafka.dylib'),
 
-        # Linux glibc centos6 x64 with GSSAPI
+        # Linux glibc centos8 x64 with GSSAPI
         Mapping({'arch': 'x64',
                  'plat': 'linux',
-                 'dist': 'centos6',
+                 'dist': 'centos8',
                  'lnk': 'std'},
                 'librdkafka.tgz',
                 './usr/local/lib/librdkafka.so.1',
                 'runtimes/linux-x64/native/librdkafka.so'),
-        # Linux glibc centos6 x64 without GSSAPI (no external deps)
+        # Linux glibc centos8 x64 without GSSAPI (no external deps)
         Mapping({'arch': 'x64',
                  'plat': 'linux',
-                 'dist': 'centos6',
+                 'dist': 'centos8',
                  'lnk': 'all'},
                 'librdkafka.tgz',
                 './usr/local/lib/librdkafka.so.1',
-                'runtimes/linux-x64/native/centos6-librdkafka.so'),
-        # Linux glibc centos7 x64 with GSSAPI
-        Mapping({'arch': 'x64',
-                 'plat': 'linux',
-                 'dist': 'centos7',
-                 'lnk': 'std'},
-                'librdkafka.tgz',
-                './usr/local/lib/librdkafka.so.1',
-                'runtimes/linux-x64/native/centos7-librdkafka.so'),
-        # Linux glibc centos7 arm64 without GSSAPI (no external deps)
+                'runtimes/linux-x64/native/centos8-librdkafka.so'),
+        # Linux glibc centos8 arm64 without GSSAPI (no external deps)
         Mapping({'arch': 'arm64',
                  'plat': 'linux',
-                 'dist': 'centos7',
+                 'dist': 'centos8',
                  'lnk': 'all'},
                 'librdkafka.tgz',
                 './usr/local/lib/librdkafka.so.1',

packaging/nuget/packaging.py

@@ -84,7 +84,7 @@ def magic_mismatch(path, a):
 #  p       - project (e.g., "confluent-kafka-python")
 #  bld     - builder (e.g., "travis")
 #  plat    - platform ("osx", "linux", ..)
-#  dist    - distro or runtime ("centos6", "mingw", "msvcr", "alpine", ..).
+#  dist    - distro or runtime ("centos8", "mingw", "msvcr", "alpine", ..).
 #  arch    - arch ("x64", ..)
 #  tag     - git tag
 #  sha     - git sha

packaging/nuget/staticpackage.py

@@ -23,14 +23,14 @@ class StaticPackage (Package):
     mappings = [
         Mapping({'arch': 'x64',
                  'plat': 'linux',
-                 'dist': 'centos6',
+                 'dist': 'centos8',
                  '!extra': 'gssapi'},
                 'librdkafka.tgz',
                 './usr/local/include/librdkafka/rdkafka.h',
                 'rdkafka.h'),
         Mapping({'arch': 'x64',
                  'plat': 'linux',
-                 'dist': 'centos6',
+                 'dist': 'centos8',
                  '!extra': 'gssapi'},
                 'librdkafka.tgz',
                 './usr/local/share/doc/librdkafka/LICENSES.txt',
@@ -39,15 +39,15 @@ class StaticPackage (Package):
         # glibc linux static lib and pkg-config file
         Mapping({'arch': 'x64',
                  'plat': 'linux',
-                 'dist': 'centos6',
+                 'dist': 'centos8',
                  'lnk': 'all',
                  '!extra': 'gssapi'},
                 'librdkafka.tgz',
                 './usr/local/lib/librdkafka-static.a',
                 'librdkafka_glibc_linux_amd64.a'),
         Mapping({'arch': 'x64',
                  'plat': 'linux',
-                 'dist': 'centos6',
+                 'dist': 'centos8',
                  'lnk': 'all',
                  '!extra': 'gssapi'},
                 'librdkafka.tgz',
@@ -57,15 +57,15 @@ class StaticPackage (Package):
         # glibc linux arm64 static lib and pkg-config file
         Mapping({'arch': 'arm64',
                  'plat': 'linux',
-                 'dist': 'centos7',
+                 'dist': 'centos8',
                  'lnk': 'all',
                  '!extra': 'gssapi'},
                 'librdkafka.tgz',
                 './usr/local/lib/librdkafka-static.a',
                 'librdkafka_glibc_linux_arm64.a'),
         Mapping({'arch': 'arm64',
                  'plat': 'linux',
-                 'dist': 'centos7',
+                 'dist': 'centos8',
                  'lnk': 'all',
                  '!extra': 'gssapi'},
                 'librdkafka.tgz',

packaging/rpm/mock-on-docker.sh

@@ -10,8 +10,8 @@
 
 set -ex
 
-_DOCKER_IMAGE=fedora:35
-_MOCK_CONFIGS="centos+epel-7-x86_64 centos-stream+epel-8-x86_64"
+_DOCKER_IMAGE=rockylinux:9
+_MOCK_CONFIGS="rocky+epel-8-x86_64 rocky+epel-9-x86_64"
 
 if [[ $1 == "--build" ]]; then
     on_builder=1
@@ -59,7 +59,8 @@ else
     # Running in docker container.
     #
 
-    dnf install -y -q mock mock-core-configs make git
+    dnf install -y -q epel-release make git
+    dnf install -y -q mock mock-core-configs
 
     echo "%_netsharedpath /sys:/proc" >> /etc/rpm/macros.netshared
 
@@ -93,5 +94,3 @@ else
     popd
     echo "Done"
 fi
-
-exit 0

packaging/rpm/tests/Makefile

@@ -7,7 +7,7 @@ test: test.c
 	$(CC) -O2 -Werror -Wall $^ -o $@ $$(pkg-config --libs rdkafka)
 
 test-static: test.c
-	$(CC) -O2 -Werror -Wall $^ -o $@ $$(pkg-config --libs --static rdkafka-static)
+	$(CC) -O2 -Werror -Wall $^ -o $@ $$(pkg-config --libs rdkafka-static)
 
 testcpp: test.cpp
 	$(CXX) -O2 -Werror -Wall $^ -o $@ $$(pkg-config --libs rdkafka++)

packaging/rpm/tests/run-test.sh

@@ -16,19 +16,12 @@ _IMG=$1
 
 echo "Testing on $_IMG"
 
-if [[ $_IMG == "centos:6" ]]; then
-    _EL=6
-    _INST="yum install -y -q"
-elif [[ $_IMG == "centos:7" ]]; then
-    _EL=7
-    _INST="yum install -y -q"
-    # centos:7 ships with openssl-libs 1.0.1 which is outdated and not
-    # ABI-compatible with 1.0.2 (which we build with).
-    # Upgrade openssl-libs, as users would, to prevent missing symbols.
-    _UPG="yum upgrade -y openssl-libs"
-else
+if [[ $_IMG == "rockylinux:8" ]]; then
     _EL=8
     _INST="dnf install -y -q"
+else
+    _EL=9
+    _INST="dnf install -y -q"
 fi
 
 $_INST gcc gcc-c++ make pkg-config

packaging/rpm/tests/test-on-docker.sh

@@ -14,7 +14,7 @@ if [[ ! -f configure.self ]]; then
     exit 1
 fi
 
-_DOCKER_IMAGES="centos:7 redhat/ubi8:8.5-226"
+_DOCKER_IMAGES="rockylinux:8 rockylinux:9"
 _RPMDIR=artifacts
 
 if [[ -n $1 ]]; then

packaging/tools/build-release-artifacts.sh

@@ -9,9 +9,8 @@
 # Requires docker.
 # Supported docker images:
 #   alpine:3.16
-#   quay.io/pypa/manylinux2014_aarch64 (centos7)
-#   quay.io/pypa/manylinux2014_x86_64  (centos7)
-#   quay.io/pypa/manylinux2010_x86_64  (centos6)
+#   quay.io/pypa/manylinux_2_28_aarch64 (centos8)
+#   quay.io/pypa/manylinux_2_28_x86_64  (centos8)
 #
 # Usage:
 # packaging/tools/build-release-artifacts.sh [--disable-gssapi] <docker-image> <relative-output-tarball-path.tgz>
@@ -77,12 +76,14 @@ if grep -q alpine /etc/os-release 2>/dev/null ; then
 
 else
     # CentOS
-    yum install -y libstdc++-devel gcc gcc-c++ python3 git perl-IPC-Cmd $extra_pkgs_rpm
+    yum install -y libstdc++-devel gcc gcc-c++ python3 git perl-IPC-Cmd perl-Pod-Html $extra_pkgs_rpm
 fi
 
 
 # Clone the repo so other builds are unaffected of what we're doing
 # and we get a pristine build tree.
+git config --system --add safe.directory '/v/.git'
+git config --system --add safe.directory '/librdkafka/.git'
 git clone /v /librdkafka
 
 cd /librdkafka