404 librdkafka not found incident / FIXED

[mensfeld]

404 librdkafka not found incident / FIXED

[mensfeld]

JUST PLEASE GIVE ME SOME TIME.

[mensfeld]

Since I'm fixing that (testing now ;) ) let me use this time for a bit of marketing:

IF YOUR COMPANY RELIES ON MY WORK SO MUCH THAT YOU CANNOT DEPLOY ANYMORE AND YOU ARE NOT ABLE TO DO YOUR WORK, PLEASE 🙏 CONSIDER SUPPORTING ME: https://karafka.io/#become-pro

This time, I am able to work fast (PR is already done, testing), but I, like many other OSS maintainers, need systematic support.

Please consider supporting me in a systematic way: https://karafka.io/#become-pro if you rely on my software.

[mensfeld]

Yeah, that may be. Though I had planned to move this to offline a while ago already (there's a card for this for a while). I AM WORKING HARD TO FIX THIS!

[mensfeld]

PR is running in the CI. Once green, will merge and start releasing backports.

[mensfeld]

https://github.com/karafka/karafka-rdkafka has been released with 2.4.0 librdkafka. I am now backporting it to rdkafka + older versoins.

[mensfeld]

Merged. Preparing 0.16.1 release...

[rsanheim]

Thanks for your quick work here @mensfeld !

[spajic]

@mensfeld this URL returns 404 for me

https://github.com/confluentinc/librdkafka/releases/tag/v2.4.0 returns 404 too

And because of that I can't install rdkafka-ruby gem now

[mensfeld]

Ok. Backporting karafka-rdkafka. Once that is done, I will backport 0.15 and 0.14 at least.

[mensfeld]

0.16.1 of rdkafka has been released: https://rubygems.org/gems/rdkafka

Please bundle update karafka-rdkafka OR bundle update rdkafka depending on which one you use.

I will be backporting older versions soon. If you value my work, please convince your business to support me, so I can support you when something like this happens again ;)

[rafer]

Thank you so much. +1 for a 0.13 backport (running zendesk/racecar 2.10 which depends on librdkafka ~> 0.13.0).

[vrmontes]

Thanks! a 0.13 backport would be greatly appreciated

[mensfeld]

Ok closing this issue. I will backport 0.12 - 0.14 without a rush since both 015 and 0.16 has been released.

Once again: if you rely on my work, please consider supporting me.

[mensfeld]

@ankit-tangoe no. Since confluent restored the repo, I will release only:

• 0.16.1
• 0.15.2
• 0.14.1
• 0.13.1
• 0.12.1

everything else will stay as it is.

[mensfeld]

uuuu not good.

[mensfeld]

013 and 012 will be backported tomorrow. From now on all releases will be fully rubygems dependent. no more GH reliance.

[mensfeld]

@ecbrodie it's already being worked on.

[mensfeld]

Ok compiling with local source...

[mensfeld]

@Senjai I don't need a fork. I have a plan and I am working on it. It just takes time.

[mensfeld]

All planned backports has been released. No more GH dependence for rdkafka in the future.

[mensfeld]

postmortem: https://mensfeld.pl/2024/07/the-librdkafka-supply-chain-breakdown-rdkafka-rubys-darkest-hour/

[ecbrodie]

If we somehow have the latest tarball from librdkafka stored somewhere (seems to be downloaded here), maybe could we temporarily vendor that tarball into this repo and then allow the maintainers of this gem to explore a more permanent approach?

[lfrancke]

I tried reaching out to a few people at Confluent and asked in the ASF Slack #kafka Channel.
I am going to assume that this just vanishing from "the Internet" is a mistake and/or temporary.

Maybe there was a security issue in the latest release so they had to pull it.

[mensfeld]

closing #384 which foresaw this incident.

[Senjai]

@mensfeld We're hard locked to 0.15.1, I copied this backport here but for librdkafka 2.3.0, same sha, here is the fork https://github.com/Senjai/rdkafka-ruby, HEAD is 0.15.1 if you want me to PR it somehow or cherry pick

[ankit-tangoe]

@mensfeld A backport of version 0.8.1 would be greatly appreciated. Thank you!