build: upgrade to openssl@3 (#13746)

ci/docker-compose.yml

@@ -117,6 +117,16 @@ services:
       - ..:/risingwave
 
   release-env:
+    # build binaries on a earlier Linux distribution (therefore with earlier version GLIBC)
+    # See https://github.com/risingwavelabs/risingwave/issues/4556 for more details.
+    #
+    # GLIBC versions on some systems:
+    # Amazon Linux 2: 2.26 (EOL 2025-06-30) (We will definitely want to support this)
+    # AL2023: 2.34
+    # Ubuntu 18.04: 2.27 (Already EOL 2023-05-31)
+    # Ubuntu 20.04: 2.31
+    #
+    # manylinux2014: CentOS 7 (EOL 2024-06-30), GLIBC 2.17
     image: quay.io/pypa/manylinux2014_x86_64
     working_dir: /mnt
     volumes:

ci/scripts/release.sh

@@ -10,6 +10,21 @@ if [ "${BUILDKITE_SOURCE}" != "schedule" ] && [ "${BUILDKITE_SOURCE}" != "webhoo
   exit 0
 fi
 
+echo "--- Install aws cli"
+curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+unzip -q awscliv2.zip && ./aws/install && mv /usr/local/bin/aws /bin/aws
+
+echo "--- Install lld"
+# The lld in the CentOS 7 repository is too old and contains a bug that causes a linker error.
+# So we install a newer version here. (17.0.6, latest version at the time of writing)
+# It is manually built in the same environent and uploaded to S3.
+aws s3 cp s3://ci-deps-dist/llvm-lld-manylinux2014_x86_64.tar.gz .
+tar -zxvf llvm-lld-manylinux2014_x86_64.tar.gz --directory=/usr/local
+ld.lld --version
+
+echo "--- Install dependencies for openssl"
+yum install -y perl-core
+
 echo "--- Install java and maven"
 yum install -y java-11-openjdk java-11-openjdk-devel wget python3 cyrus-sasl-devel
 pip3 install toml-cli
@@ -30,15 +45,6 @@ unzip -o protoc-3.15.8-linux-x86_64.zip -d protoc
 mv ./protoc/bin/protoc /usr/local/bin/
 mv ./protoc/include/* /usr/local/include/
 
-echo "--- Install lld"
-yum install -y centos-release-scl-rh
-yum install -y llvm-toolset-7.0-lld
-source /opt/rh/llvm-toolset-7.0/enable
-
-echo "--- Install aws cli"
-curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-unzip -q awscliv2.zip && ./aws/install && mv /usr/local/bin/aws /bin/aws
-
 echo "--- Check risingwave release version"
 if [[ -n "${BUILDKITE_TAG}" ]]; then
   CARGO_PKG_VERSION="$(toml get --toml-path Cargo.toml workspace.package.version)"

src/utils/pgwire/Cargo.toml

@@ -21,7 +21,7 @@ byteorder = "1.5"
 bytes = "1"
 futures = { version = "0.3", default-features = false, features = ["alloc"] }
 itertools = "0.12"
-openssl = "0.10.57"
+openssl = "0.10.60"
 panic-message = "0.3"
 risingwave_common = { workspace = true }
 risingwave_sqlparser = { workspace = true }

src/utils/workspace-config/Cargo.toml

@@ -16,9 +16,7 @@ rw-dynamic-link = ["zstd-sys"]
 
 [dependencies]
 log = { version = "0.4", features = ["release_max_level_debug"] }
-# FIXME: 0.9.93 upgrades openssl-src to openssl@3, but we failed to build it.
-# fix it later https://github.com/risingwavelabs/risingwave/pull/12198
-openssl-sys = { version = "=0.9.92", optional = true, features = ["vendored"] }
+openssl-sys = { version = "0.9.96", optional = true, features = ["vendored"] }
 sasl2-sys = { version = "0.1", optional = true, features = ["gssapi-vendored"] }
 tracing = { version = "0.1", features = ["release_max_level_debug"] }
 zstd-sys = { version = "2", optional = true, default-features = false, features = ["pkg-config"] }
@@ -28,7 +26,7 @@ zstd-sys = { version = "2", optional = true, default-features = false, features
 # FIXME(xxchan): This is a temporary fix due to how cargo and hakari works. See related PR for more details.
 # We will revisit how to handle workspace-hack and build-dependency issues later.
 [build-dependencies]
-openssl-sys = { version = "=0.9.92", optional = true, features = ["vendored"] }
+openssl-sys = { version = "0.9.96", optional = true, features = ["vendored"] }
 
 [lints]
 workspace = true