fix(ci): align ToplingDB CI setup

Author: WaterWhisperer

.github/workflows/codeql-analysis.yml

@@ -20,6 +20,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      packages: read
       security-events: write
 
     strategy:

docs/toplingdb/toplingdb.md

@@ -37,6 +37,11 @@ By supporting ToplingDB, HugeGraph empowers users with greater control over stor
 
 Enable users to select ToplingDB via configuration, allowing tuning parameters through YAML files without recompilation and real-time monitoring via Web Server—without sacrificing compatibility with existing RocksDB APIs.
 
+## Platform Scope
+
+The current ToplingDB native integration supports Linux x86_64 only.
+On macOS, Linux arm64/aarch64, and other non-x86_64 platforms, HugeGraph should continue to use the standard RocksDB `rocksdbjni` dependency instead of preloading ToplingDB native libraries.
+
 ## Design
 
 ### Provider Selection

hugegraph-server/hugegraph-dist/src/assembly/static/bin/common-topling.sh

@@ -153,35 +153,36 @@ function ensure_libaio_symlink() {
 function download_and_verify() {
     local url=$1
     local filepath=$2
-    local expected_md5=$3
+    local expected_sha256=$3
+    local actual_sha256
 
-    if [[ -f $filepath ]]; then
-        echo "File $filepath exists. Verifying MD5 checksum..."
-        actual_md5=$(md5sum $filepath | awk '{ print $1 }')
-        if [[ $actual_md5 != $expected_md5 ]]; then
-            echo "MD5 checksum verification failed for $filepath. Expected: $expected_md5, but got: $actual_md5"
+    if [[ -f "$filepath" ]]; then
+        echo "File $filepath exists. Verifying SHA-256 checksum..."
+        actual_sha256=$(sha256sum "$filepath" | awk '{ print $1 }')
+        if [[ "$actual_sha256" != "$expected_sha256" ]]; then
+            echo "SHA-256 checksum verification failed for $filepath. Expected: $expected_sha256, but got: $actual_sha256"
             echo "Deleting $filepath..."
-            rm -f $filepath
+            rm -f "$filepath"
         else
-            echo "MD5 checksum verification succeeded for $filepath."
+            echo "SHA-256 checksum verification succeeded for $filepath."
             return 0
         fi
     fi
 
     echo "Downloading $filepath..."
-    curl -L -o $filepath $url
+    curl -fL -o "$filepath" "$url"
 
-    actual_md5=$(md5sum $filepath | awk '{ print $1 }')
-    if [[ $actual_md5 != $expected_md5 ]]; then
-        echo "MD5 checksum verification failed for $filepath after download. Expected: $expected_md5, but got: $actual_md5"
+    actual_sha256=$(sha256sum "$filepath" | awk '{ print $1 }')
+    if [[ "$actual_sha256" != "$expected_sha256" ]]; then
+        echo "SHA-256 checksum verification failed for $filepath after download. Expected: $expected_sha256, but got: $actual_sha256"
         return 1
     fi
 
     return 0
 }
 
 function download_and_setup_jemalloc() {
-    local arch lib_file download_url expected_md5 system_lib top
+    local arch lib_file download_url expected_sha256 system_lib top
     top=$1
 
     # Prefer system-installed jemalloc if available
@@ -224,19 +225,19 @@ function download_and_setup_jemalloc() {
     if [[ $arch == "aarch64" || $arch == "arm64" ]]; then
         lib_file="$top/bin/libjemalloc_aarch64.so"
         download_url="${GITHUB}/apache/hugegraph-doc/raw/binary-1.5/dist/server/libjemalloc_aarch64.so"
-        expected_md5="2a631d2f81837f9d5864586761c5e380"
+        expected_sha256="6b7e6099b6da798829c6ce6fcb55a787508841edd52446332a73300889dcd1dc"
     elif [[ $arch == "x86_64" ]]; then
         lib_file="$top/bin/libjemalloc.so"
         download_url="${GITHUB}/apache/hugegraph-doc/raw/binary-1.5/dist/server/libjemalloc.so"
-        expected_md5="fd61765eec3bfea961b646c269f298df"
+        expected_sha256="53b25e8626e1605cbd8b60befb3431cabc1b8851a54285e0dda412796feab67d"
     else
         echo "Unsupported architecture: $arch"
         return 1
     fi
 
     # Download and verify jemalloc library (fallback when system lib not found)
-    if download_and_verify "$download_url" "$lib_file" "$expected_md5"; then
-        if [[ ":${LD_PRELOAD:-}:" != *"libjemalloc.so:"* ]]; then
+    if download_and_verify "$download_url" "$lib_file" "$expected_sha256"; then
+        if [[ ":${LD_PRELOAD:-}:" != *":${lib_file}:"* ]]; then
             export LD_PRELOAD="${lib_file}${LD_PRELOAD:+:$LD_PRELOAD}"
         fi
     else
@@ -248,6 +249,16 @@ function download_and_setup_jemalloc() {
 function preload_toplingdb() {
     local lib_dir="$1"
     local dest_dir="$2"
+    local os_name
+
+    # NOTE: The current ToplingDB rocksdbjni snapshot bundles Linux x86_64 native libraries.
+    # Linux arm64/aarch64 support requires a matching native rocksdbjni artifact.
+    os_name="$(uname -s)"
+    if [ "$os_name" != "Linux" ]; then
+        echo "[common-topling] Skip ToplingDB native preload on non-Linux platform: $os_name" >&2
+        return 0
+    fi
+
     local top="$(cd "$lib_dir"/../ && pwd)"
 
     local jar_file
@@ -275,7 +286,9 @@ function preload_toplingdb() {
             {
                 echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH"
                 echo "LD_PRELOAD=$LD_PRELOAD"
-                echo "SERVER_VERSION_DIR=$SERVER_VERSION_DIR"
+                if [ -n "${SERVER_VERSION_DIR:-}" ]; then
+                    echo "SERVER_VERSION_DIR=$SERVER_VERSION_DIR"
+                fi
             } >> "$GITHUB_ENV" || true
             echo "[common-topling] Exported LD_LIBRARY_PATH and LD_PRELOAD to GITHUB_ENV" >&2 || true
         fi

hugegraph-server/hugegraph-dist/src/assembly/travis/install-rocksdb.sh

@@ -16,15 +16,23 @@
 # limitations under the License.
 #
 
-set -Eeuo pipefail
+if [ "$(uname -s)" != "Linux" ]; then
+    echo "[install-rocksdb] Skip ToplingDB native preload on non-Linux platform: $(uname -s)"
+    return 0 2>/dev/null || exit 0
+fi
+
+ORIG_SHELL_FLAGS="$-"
+ORIG_PIPEFAIL="$(set -o | awk '$1 == "pipefail" { print $2 }')"
+ORIG_ERR_TRAP="$(trap -p ERR || true)"
 # Save original IFS to avoid leaking into parent shell when sourced
 ORIG_IFS="${IFS}"
+set -Eeuo pipefail
 IFS=$'\n\t'
 # Unified error capture for easy positioning
 trap 'echo "[install-rocksdb] error at line ${LINENO}: ${BASH_COMMAND}" >&2' ERR
 
 VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
-SERVER_VERSION_DIR="$(pwd)/hugegraph-server/apache-hugegraph-server-incubating-$VERSION"
+SERVER_VERSION_DIR="$(pwd)/hugegraph-server/apache-hugegraph-server-$VERSION"
 SERVER_BIN="$SERVER_VERSION_DIR/bin"
 SERVER_LIB="$SERVER_VERSION_DIR/lib"
 INSTALL_DEST_DIR="$SERVER_VERSION_DIR/library"
@@ -46,8 +54,19 @@ source "$SERVER_BIN/common-topling.sh"
 type preload_toplingdb >/dev/null 2>&1 || { echo "Error: function preload_toplingdb not found" >&2; exit 1; }
 preload_toplingdb "$SERVER_LIB" "$INSTALL_DEST_DIR"
 
-# Reset shell options to prevent affecting the parent shell when sourced
-set +Eeuo pipefail
-trap - ERR
 # Restore original IFS
 IFS="$ORIG_IFS"
+if [ -n "$ORIG_ERR_TRAP" ]; then
+    eval "$ORIG_ERR_TRAP"
+else
+    trap - ERR
+fi
+# Reset shell options to prevent affecting the parent shell when sourced
+case "$ORIG_SHELL_FLAGS" in *e*) set -e ;; *) set +e ;; esac
+case "$ORIG_SHELL_FLAGS" in *u*) set -u ;; *) set +u ;; esac
+case "$ORIG_SHELL_FLAGS" in *E*) set -E ;; *) set +E ;; esac
+if [ "$ORIG_PIPEFAIL" = "on" ]; then
+    set -o pipefail
+else
+    set +o pipefail
+fi

install-dist/scripts/dependency/known-dependencies.txt

@@ -318,8 +318,6 @@ jnr-ffi-2.1.7.jar
 jnr-x86asm-1.0.2.jar
 joda-time-2.10.8.jar
 joni-2.2.1.jar
-jraft-core-1.3.11.jar
-jraft-core-1.3.13.jar
 jraft-core-1.3.14.jar
 jraft-core-1.3.9.jar
 json-path-2.5.0.jar
@@ -512,7 +510,7 @@ psjava-0.1.19.jar
 reporter-config-base-3.0.3.jar
 reporter-config3-3.0.3.jar
 rewriting-9.0-9.0.20190305.jar
-rocksdbjni-8.10.2-SNAPSHOT.jar
+rocksdbjni-8.10.2.jar
 scala-java8-compat_2.12-0.8.0.jar
 scala-library-2.12.7.jar
 scala-reflect-2.12.7.jar