Repository navigation
THRIFT-2208: Package the Windows Thrift compiler for Chocolatey - #3898
Merged
Merged
Conversation
mergeable
Bot
added
build and general CI
Jens-G
force-pushed
the
THRIFT-2208
branch
3 times, most recently
from
September 20, 2026 12:00
d79d5a6 to
4d157e5
Compare
fishy
approved these changes
Sep 20, 2026
Jens-G
force-pushed
the
THRIFT-2208
branch
4 times, most recently
from
September 20, 2026 17:21
8b967d8 to
4e09de1
Compare
Client: build Open since 2013. Windows developers who use Chocolatey have no supported way to get the Thrift compiler through it. The package downloads the Windows installer published with the release and runs it silently for all users, rather than carrying a copy of the compiler. So what gets installed is what was voted on and signed, the package stays small, and no binary is redistributed through a third party CDN. The URL is archive.apache.org, which keeps every release; downloads.apache.org only carries the current one, so a package naming it would stop installing at the next release. The checksum is computed from the file at that very URL, so the package cannot record a checksum the published file does not have. The package depends on vcredist140. The compiler links the shared runtime and needs the Visual C++ redistributable, which the ASF cannot ship; Chocolatey installs it first, so a "choco install thrift" does not end in a compiler that will not start. That makes this a post release step, like the WinGet submission: it cannot run until the archive has the release. The workflow runs when the release is published and can be run again from the Actions tab. Nothing is pushed yet, and that is deliberate. The thrift id on the Chocolatey community repository belongs to a third party package that last shipped 0.12.0 in February 2019 - thirteen releases behind - maintained by chaliy and Lite. Publishing under it needs a maintainer takeover request under Chocolatey's process for abandoned packages. Until the id has been handed over and a CHOCO_API_KEY secret exists, the workflow builds and checks the package, attaches it to the run, and says in its summary that it did not push. ReleaseManagement.md describes the takeover, and names the free fallback ids should it be refused. test-chocolatey-package.ps1 checks that the URL, the checksum and the silent install arguments reach the install script, that no placeholder survives into a file that would be published verbatim, that LICENSE and NOTICE are staged and are not empty, and that a malformed version or checksum is refused. Given a packed .nupkg it also looks inside it, and checks it carries no executable - the compiler is downloaded at install time, and a package that had one would be shipping an unsigned copy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
@Jens-G is this correct that you would like to take over of thift chocolatey package? |
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
THRIFT-2208 has been open since 2013.
The package downloads, it does not carry
The package fetches the Windows installer published with the release and runs it silently for all users. It does not embed the compiler. So:
The URL is
archive.apache.org, for the same reason as the WinGet manifest:downloads.apache.orgonly carries the current release, so a package naming it stops installing at the next one — and Chocolatey keeps old versions installable. The checksum is computed from the file at that exact URL, so the package cannot record a checksum the published file does not have.That makes it a post-release step: it cannot be built until the archive has the release. The workflow runs when the release is published and can be re-run from the Actions tab.
Nothing is pushed yet — on purpose
The
thriftid is taken. It belongs to a third-party package, not an ASF one:chaliy,Lite(Its "last updated" field on chocolatey.org moves with Chocolatey's automated re-verification, not with any maintainer action — it looks recent and is not.)
Per our discussion the plan is to request a maintainer takeover under Chocolatey's process for abandoned packages, so that
choco install thriftkeeps meaning what people expect. So this PR builds and tests the package but pushes nothing: the push step needs aCHOCO_API_KEYsecret that does not exist, and when it is absent the workflow attaches the package to the run and says in its summary that it did not push.doc/ReleaseManagement.mddocuments the takeover steps.If the takeover is refused,
apache-thriftandthrift-compilerare both free — I verified there is exactly one package matching "thrift" on the whole community feed. Switching is an id change inthrift.nuspec.inplus the package file name.The Visual C++ redistributable
The package depends on
vcredist140. The compiler links the shared runtime and the ASF cannot ship the redistributable, so Chocolatey installs it first — achoco install thriftdoes not end in a compiler that will not start.Testing
chocolatey/test-chocolatey-package.ps1, 19 checks: the URL, checksum and silent-install arguments reach the install script; no placeholder survives into a file that would be published verbatim; the nuspec parses and carries the right id, version and licence;LICENSEandNOTICEare staged and non-empty; a malformed version or checksum is refused.Given
-Package, it also looks inside the packed.nupkg— including asserting it carries no executable, since a package that did would be shipping an unsigned copy of the compiler.It runs anywhere PowerShell does (
-StageOnlyskips thechoco packstep), so I developed and ran it on Linux; CI runs it on Windows both before and after packing. It already earned its keep — it caught an over-broad assertion of mine that matched an explanatory comment rather than the URL value.Notes
/ALLUSERSand/TASKS="modifypath"are what make Chocolatey's machine-wide install putthrift.exeon the systemPATH; both are asserted.zizmoris clean on the new workflow.JIRA: THRIFT-2208
Merge note. #3897 (WinGet) and #3898 (Chocolatey) are siblings off #3895 and both append a subsection to
doc/ReleaseManagement.mdat the same anchor. Whichever merges second will conflict there; the resolution is to keep both subsections. Nothing else overlaps.🤖 Generated with Claude Code