Skip to content

Fix OAuthBearer OIDC preprocessor directive when using CMake without CURL - #5136

Merged
Emanuele Sabellico (emasab) merged 9 commits into
masterfrom
dev_fix_oauthbearer_oidc_check
Jun 25, 2026
Merged

Emanuele Sabellico (emasab) merged 9 commits into
masterfrom
dev_fix_oauthbearer_oidc_check

Conversation

@emasab

@emasab Emanuele Sabellico (emasab) commented Jul 4, 2025

Copy link
Copy Markdown
Contributor

Summary

Fixes several issues that surface when building librdkafka with CMake and a reduced
feature set, and adds CI coverage so these build-configuration regressions are caught
going forward.

Closes #5135, #5282

Changes

  • Fix OAuthBearer OIDC preprocessor directive when building with CMake without CURL
    (librdkafka v2.11.0 can not build without curl #5135) — corrects the conditional so compilation succeeds when CURL is disabled.
  • Add build-configuration CI checks that build with CMake on Alpine and manylinux
    images with the optional features disabled, to catch compile/runtime breakage in
    minimal builds. Adds packaging/tools/build-configurations-checks.sh,
    run-in-docker.sh, Dockerfile.alpine, Dockerfile.manylinux, and a Semaphore job.
  • Skip test 0066 (plugins) when dlopen is unsupported, so the broker-less quick
    suite passes in builds without dynamic loading.
  • Fix rd_atomic{32,64}_set returning the new value instead of the previous one in
    CMake builds.
    CMake defined HAVE_ATOMICS_{32,64} (and optionally _SYNC) but never
    HAVE_ATOMICS_{32,64}_ATOMIC, so the setters fell through to a non-atomic fallback that
    returned the new value. This broke the planned-disconnection all-brokers-down handling,
    which relies on rd_atomic32_set(&rkb_down_reported, 1) returning the previous value to
    detect the 0 -> 1 transition — so ALL_BROKERS_DOWN was never raised and test 0095
    timed out under CMake. CMake now detects/defines HAVE_ATOMICS_*_ATOMIC (mirroring
    mklove's configure.atomics), and both setters select the __atomic / __sync
    implementation from the flags with the mutex path as a correct fallback.
  • Pin specific tool/image versions for reproducible build-configuration checks.

Testing

The new build-configuration checks run tests 0095 and 0121 under CMake/manylinux with all
optional features disabled; both pass (0095 previously timed out before the atomics fix).

Copilot AI review requested due to automatic review settings July 4, 2025 13:20
@emasab
Emanuele Sabellico (emasab) requested a review from a team as a code owner July 4, 2025 13:20
@confluent-cla-assistant

Copy link
Copy Markdown

🎉 All Contributor License Agreements have been signed. Ready to merge.
Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a faster “quick” test runner configuration, updates plugin support detection in tests, fixes the OAuthBearer OIDC include guard, and extends the build‐configuration checks script to support both Make and CMake inside Docker.

  • Added a new quick brokerless test case in tests/CMakeLists.txt
  • Introduced runtime skip logic for unsupported plugin.library.paths tests in tests/0066-plugins.cpp
  • Switched #ifdef WITH_OAUTHBEARER_OIDC to #if WITH_OAUTHBEARER_OIDC in src/rdkafka_conf.c
  • Enhanced build-configurations-checks.sh to accept a build tool and optional Docker image, with corresponding updates in .semaphore/semaphore.yml

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
tests/CMakeLists.txt Added RdKafkaTestBrokerLessQuick test target
tests/0066-plugins.cpp Wrapped plugin.path set in a skip condition for unsupported builds
src/rdkafka_conf.c Changed OIDC preprocessor to #if for proper zero/one testing
packaging/tools/build-configurations-checks.sh Generalized to handle make or cmake modes and Docker images
.semaphore/semaphore.yml Invokes the updated script with explicit tool/image combinations

Comment thread tests/0066-plugins.cpp
Comment thread tests/0066-plugins.cpp
@cailyoung

Copy link
Copy Markdown

Hi there, is there anything we can do to help get this merged?

@airlock-confluentinc
airlock-confluentinc Bot force-pushed the dev_fix_oauthbearer_oidc_check branch 2 times, most recently from 8740d6a to b9a0618 Compare May 7, 2026 16:14
@airlock-confluentinc
airlock-confluentinc Bot force-pushed the dev_fix_oauthbearer_oidc_check branch from 49d4a35 to ce8959a Compare June 4, 2026 13:42
Comment thread src/rdatomic.h
#elif !HAVE_ATOMICS_32
#elif HAVE_ATOMICS_32 && HAVE_ATOMICS_32_ATOMIC
return __atomic_exchange_n(&ra->val, v, __ATOMIC_SEQ_CST);
#elif HAVE_ATOMICS_32 && HAVE_ATOMICS_32_SYNC

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this branch a dead code in case of CMake and eventually ending up using #else branch which is safe though because lock would be defined given HAVE_ATOMICS_32 is 0?

CMake ends up setting only HAVE_ATOMICS_32_SYNC reference and not HAVE_ATOMICS_32. They both seem mutually exclusive in case of CMake. So this branch would never be entered right?

Should we change to something like below which seems to handle all scenarios and isn't based on the invariant HAVE_ATOMICS_32_ATOMIC

static RD_INLINE int32_t RD_UNUSED rd_atomic32_set(rd_atomic32_t *ra,
                                                   int32_t v) {
#ifdef _WIN32
        return InterlockedExchange((LONG *)&ra->val, v);
#elif HAVE_ATOMICS_32_SYNC
        return __sync_lock_test_and_set(&ra->val, v);
#elif !HAVE_ATOMICS_32
        int32_t r;
        mtx_lock(&ra->lock);
        r       = ra->val;
        ra->val = v;
        mtx_unlock(&ra->lock);
        return r;
#else
        return __atomic_exchange_n(&ra->val, v, __ATOMIC_SEQ_CST);
#endif
}

The only tradeoff I see is that default assumes __atomic is available.

@emasab Emanuele Sabellico (emasab) Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was uniforming cmake in this PR to set the same values as mklove, so HAVE_ATOMICS_32 for example is set to 1 in both cases and then either HAVE_ATOMICS_32_ATOMIC or HAVE_ATOMICS_32_SYNC is set to 1.
Just there's a case when using try_compile(HAVE_ATOMICS_32_SYNC where HAVE_ATOMICS_32 isn't set to true. I've pushed the cmake change. In mklove instead there are cases where HAVE_ATOMICS_32_SYNC or HAVE_ATOMICS_32_ATOMIC aren't defined if HAVE_ATOMICS_32 is false.

CMake builds defined HAVE_ATOMICS_{32,64} (and optionally _SYNC) but never
HAVE_ATOMICS_{32,64}_ATOMIC, so rd_atomic32_set()/rd_atomic64_set() fell
through to a non-atomic fallback that returned the new value instead of the
previous one.

This broke the planned-disconnection all-brokers-down handling, which relies
on rd_atomic32_set(&rkb_down_reported, 1) returning the previous value to
detect the 0 -> 1 transition. As a result the ALL_BROKERS_DOWN event was never
raised in CMake builds (test 0095 timed out).

- Detect and define HAVE_ATOMICS_{32,64}_ATOMIC in the CMake build when the
  __atomic builtins are available, mirroring mklove's configure.atomics.
- Rework rd_atomic{32,64}_set to select the __atomic / __sync implementation
  from the HAVE_ATOMICS_* flags and use the mutex path as fallback instead of
  a non-atomic store.
Document the OAuthBearer OIDC/CURL CMake compilation fix (#5135) and the
rd_atomic{32,64}_set previous-value fix that restores ALL_BROKERS_DOWN under
CMake (#5282).
The #elif chain placed the mutex fallback (!HAVE_ATOMICS_64) before the
__atomic and __sync implementations, so the native atomic CAS branches were
never reachable and an incorrect non-atomic fallback was used. Reorder the
branches so HAVE_ATOMICS_64_ATOMIC and HAVE_ATOMICS_64_SYNC are selected
first, with the mutex-based path as the final fallback.

Also ignore the new share_consumer_commit_async and share_consumer_commit_sync
example binaries.
…tolerance

Variation 1 (retries) of do_test_fast_metadata_refresh expects ~7 Metadata
requests but could occasionally observe more, causing intermittent failures
with the previous expected+1 (8) upper bound.

The count comes from two independent, timing-dependent sources:
- The fast-leader-query loop ("partition leader query"), driven by an
  exponential backoff timer with +/-20% jitter (rd_kafka_timer_exp_backoff),
  normally fires 6 times within the ~3s window but jitter can let a 7th fire
  land inside it.
- A "connected" metadata request issued when a broker connection transitions
  to UP (rd_kafka_broker_connect_up); with 3 mock brokers connecting at
  slightly different times a second one can land within the window.

These variances can stack, so the count can legitimately reach 9. Widen the
upper bound from expected+1 to expected+2 to account for it.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM !! Thanks a lot Emanuele Sabellico (@emasab)

@emasab
Emanuele Sabellico (emasab) enabled auto-merge (squash) June 25, 2026 17:07
@emasab
Emanuele Sabellico (emasab) merged commit 26d17ca into master Jun 25, 2026
4 checks passed
@emasab
Emanuele Sabellico (emasab) deleted the dev_fix_oauthbearer_oidc_check branch June 25, 2026 17:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

librdkafka v2.11.0 can not build without curl

4 participants