rebuild with libarrow-23.0.1, cmake-4-isms, lua-5.5

cmake-4-isms, use system zstd
again
2026-02-17 12:52:35 -05:00 · 2026-02-17 09:26:54 -05:00 · 2026-02-16 19:59:06 -05:00 · 2026-01-28 17:45:31 -05:00 · 2026-01-28 10:22:29 -05:00 · 2026-01-16 08:52:11 +00:00
34 changed files with 1849 additions and 3385 deletions
@@ -1,11 +0,0 @@
--- ceph-16.1.0-43-g6b74fb5c/cmake/modules/Finduring.cmake.orig	2021-02-01 08:45:39.316108287 -0500
-+++ ceph-16.1.0-43-g6b74fb5c/cmake/modules/Finduring.cmake	2021-02-01 08:45:59.813665378 -0500
-@@ -5,7 +5,7 @@
- # uring_FOUND - True if uring found.
- 
- find_path(URING_INCLUDE_DIR liburing.h)
-find_library(URING_LIBRARIES liburing.a liburing)
-+find_library(URING_LIBRARIES liburing.so liburing)
- 
- include(FindPackageHandleStandardArgs)
- find_package_handle_standard_args(uring DEFAULT_MSG URING_LIBRARIES URING_INCLUDE_DIR)
@@ -1,63 +0,0 @@
--- ceph-16.2.7/src/include/buffer.h.orig	2022-01-17 12:17:19.193356237 -0500
-+++ ceph-16.2.7/src/include/buffer.h	2022-01-17 12:17:58.599639592 -0500
-@@ -38,6 +38,7 @@
- # include <sys/mman.h>
- #endif
- 
-+#include <memory>
- #include <iosfwd>
- #include <iomanip>
- #include <list>
--- ceph-16.2.7/src/common/LogEntry.cc.orig	2022-01-17 13:52:10.799134159 -0500
-+++ ceph-16.2.7/src/common/LogEntry.cc	2022-01-17 13:52:47.244469274 -0500
-@@ -183,7 +183,7 @@
-       return "crit";
-     default:
-       ceph_abort();
-      return 0;
-+      return "";
-   }
- }
- 
--- ceph-16.2.7/src/test/librados/tier_cxx.cc.orig	2022-01-19 09:30:47.209459506 -0500
-+++ ceph-16.2.7/src/test/librados/tier_cxx.cc	2022-01-19 10:02:47.783240298 -0500
-@@ -114,7 +114,7 @@
- #include "rgw/rgw_common.h"
- 
- void check_fp_oid_refcount(librados::IoCtx& ioctx, std::string foid, uint64_t count,
-			   std::string fp_algo = NULL)
-+			   std::string fp_algo = "")
- {
-   bufferlist t;
-   int size = foid.length();
-@@ -142,7 +142,7 @@
-   ASSERT_LE(count, refs.count());
- }
- 
-string get_fp_oid(string oid, std::string fp_algo = NULL)
-+string get_fp_oid(string oid, std::string fp_algo = "")
- {
-   if (fp_algo == "sha1") {
-     unsigned char fingerprint[CEPH_CRYPTO_SHA1_DIGESTSIZE + 1];
--- ceph-16.2.7/src/test/test_trans.cc.orig	2022-01-19 13:24:33.460008897 -0500
-+++ ceph-16.2.7/src/test/test_trans.cc	2022-01-19 13:24:58.211554005 -0500
-@@ -51,7 +51,7 @@
-   cout << "#dev " << filename << std::endl;
-   cout << "#mb " << mb << std::endl;
- 
-  ObjectStore *fs = new FileStore(cct.get(), filename, NULL);
-+  ObjectStore *fs = new FileStore(cct.get(), filename, "");
-   if (fs->mount() < 0) {
-     cout << "mount failed" << std::endl;
-     return -1;
--- ceph-17.0.0-10335-gfd206722/src/s3select/include/s3select_functions.h.orig	2022-02-11 17:21:40.268627997 -0500
-+++ ceph-17.0.0-10335-gfd206722/src/s3select/include/s3select_functions.h	2022-02-11 17:21:57.155325437 -0500
-@@ -466,7 +466,7 @@
- 
-   std::string  print(int ident) override
-   {
-    return std::string(0);
-+    return std::string("");
-   }
- 
-   void push_argument(base_statement* arg)
@@ -1,24 +1,15 @@
--- ceph-17.1.0/src/rgw/store/dbstore/sqlite/CMakeLists.txt.orig	2022-03-01 08:19:04.974902872 -0500
-+++ ceph-17.1.0/src/rgw/store/dbstore/sqlite/CMakeLists.txt	2022-03-11 07:55:16.236261471 -0500
-@@ -12,5 +12,5 @@
- set(SQLITE_COMPILE_FLAGS "-DSQLITE_THREADSAFE=1")
- set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SQLITE_COMPILE_FLAGS}")
- 
-add_library(sqlite_db ${sqlite_db_srcs})
-+add_library(sqlite_db STATIC ${sqlite_db_srcs})
- target_link_libraries(sqlite_db sqlite3 dbstore_lib rgw_common)
--- ceph-17.1.0/src/rgw/store/dbstore/CMakeLists.txt.orig	2022-02-28 14:11:49.987077811 -0500
-+++ ceph-17.1.0/src/rgw/store/dbstore/CMakeLists.txt	2022-03-11 08:40:13.409682698 -0500
-@@ -16,7 +16,7 @@
+--- ceph-18.0.0-3078-gc4847bf8/src/rgw/driver/dbstore/CMakeLists.txt.orig	2023-05-10 08:23:50.000000000 -0400
+++ ceph-18.0.0-3078-gc4847bf8/src/rgw/driver/dbstore/CMakeLists.txt	2023-05-11 08:21:13.794152904 -0400
+@@ -24,7 +24,7 @@
     dbstore_mgr.cc
     )
 
 -add_library(dbstore_lib ${dbstore_srcs})
 +add_library(dbstore_lib STATIC ${dbstore_srcs})
- target_include_directories(dbstore_lib PUBLIC "${CMAKE_SOURCE_DIR}/src/fmt/include")
- target_include_directories(dbstore_lib PUBLIC "${CMAKE_SOURCE_DIR}/src/rgw")
- set(link_targets spawn)
-@@ -38,6 +38,7 @@
+ target_include_directories(dbstore_lib
+     PUBLIC "${CMAKE_SOURCE_DIR}/src/rgw"
+     PUBLIC "${CMAKE_SOURCE_DIR}/src/rgw/store/rados"
+@@ -49,6 +49,7 @@
 
 # add pthread library
 set (CMAKE_LINK_LIBRARIES ${CMAKE_LINK_LIBRARIES} pthread)
@@ -26,12 +17,3 @@
 
 find_package(gtest QUIET)
 if(WITH_TESTS)
-@@ -47,7 +48,7 @@
- endif()
- 
- include_directories(${CMAKE_INCLUDE_DIR})
-add_library(dbstore ${dbstore_mgr_srcs})
-+add_library(dbstore STATIC ${dbstore_mgr_srcs})
- target_link_libraries(dbstore ${CMAKE_LINK_LIBRARIES})
- 
- # testing purpose
@@ -1,43 +0,0 @@
--- ceph-17.2.0-359-gb2fe9ec8/cmake/modules/CheckCxxAtomic.cmake.orig	2022-06-03 08:45:32.341075140 -0400
-+++ ceph-17.2.0-359-gb2fe9ec8/cmake/modules/CheckCxxAtomic.cmake	2022-06-03 08:46:47.195775813 -0400
-@@ -10,8 +10,9 @@
-     check_cxx_source_compiles("
- #include <atomic>
- #include <cstdint>
-+#include <cstddef>
- 
-#if defined(__s390x__) || defined(__mips__)
-+#if defined(__SIZEOF_INT128__)
- // Boost needs 16-byte atomics for tagged pointers.
- // These are implemented via inline instructions on the platform
- // if 16-byte alignment can be proven, and are delegated to libatomic
-@@ -21,13 +22,27 @@
- // We specifically test access via an otherwise unknown pointer here
- // to ensure we get the most complex case.  If this access can be
- // done without libatomic, then all accesses can be done.
-bool atomic16(std::atomic<unsigned __int128> *ptr)
-+struct tagged_ptr {
-+  int* ptr;
-+  std::size_t tag;
-+};
-+
-+void atomic16(std::atomic<tagged_ptr> *ptr) __attribute__ ((used));
-+void atomic16(std::atomic<tagged_ptr> *ptr)
- {
-  return *ptr != 0;
-+  tagged_ptr p{nullptr, 1};
-+  ptr->store(p);
-+  tagged_ptr f = ptr->load();
-+  tagged_ptr new_tag{nullptr, 0};
-+  ptr->compare_exchange_strong(f, new_tag);
- }
- #endif
- 
- int main() {
-+#if defined(__SIZEOF_INT128__)
-+  std::atomic<tagged_ptr> ptr;
-+  atomic16(&ptr);
-+#endif
-   std::atomic<uint8_t> w1;
-   std::atomic<uint16_t> w2;
-   std::atomic<uint32_t> w4;
@@ -1,11 +0,0 @@
--- ceph-17.1.0-175-g086c8f84/src/arrow/cpp/cmake_modules/ThirdpartyToolchain.cmake.orig	2022-04-08 11:27:53.593570634 -0400
-+++ ceph-17.1.0-175-g086c8f84/src/arrow/cpp/cmake_modules/ThirdpartyToolchain.cmake	2022-04-08 11:28:20.778087653 -0400
-@@ -1991,7 +1991,7 @@
- 
- if((NOT ARROW_SIMD_LEVEL STREQUAL "NONE") OR (NOT ARROW_RUNTIME_SIMD_LEVEL STREQUAL "NONE"
-                                              ))
-  set(xsimd_SOURCE "BUNDLED")
-+  set(xsimd_SOURCE "SYSTEM")
-   resolve_dependency(xsimd)
-   # TODO: Don't use global includes but rather target_include_directories
-   include_directories(SYSTEM ${XSIMD_INCLUDE_DIR})
@@ -1,28 +0,0 @@
-From fff72cd14c58d06774cbd0274e6144b42448af03 Mon Sep 17 00:00:00 2001
-From: "Adam C. Emerson" <aemerson@redhat.com>
-Date: Mon, 7 Mar 2022 18:54:30 -0500
-Subject: [PATCH] mon: Replace deprecated use of format_to
-
-The non-deprecated version takes an explicit OutputIterator.
-
-Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
- src/mon/LogMonitor.cc | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/mon/LogMonitor.cc b/src/mon/LogMonitor.cc
-index 9103ddf7c5b..c196e8429fb 100644
--- a/src/mon/LogMonitor.cc
-+++ b/src/mon/LogMonitor.cc
-@@ -411,7 +411,7 @@ void LogMonitor::log_external(const LogEntry& le)
-     }
- 
-     if (fd >= 0) {
-      fmt::format_to(file_log_buffer, "{}\n", le);
-+      fmt::format_to(std::back_inserter(file_log_buffer), "{}\n", le);
-       int err = safe_write(fd, file_log_buffer.data(), file_log_buffer.size());
-       file_log_buffer.clear();
-       if (err < 0) {
-- 
-2.36.1
-
@@ -1,218 +0,0 @@
--- ceph-17.2.3/src/s3select/include/s3select_parquet_intrf.h.orig	2022-01-11 15:47:52.000000000 -0500
-+++ ceph-17.2.3/src/s3select/include/s3select_parquet_intrf.h	2022-08-22 10:26:06.738082924 -0400
-@@ -26,6 +26,14 @@
- #include "internal_file_decryptor.h"
- #include "encryption_internal.h"
- 
-+#if ARROW_VERSION_MAJOR < 9                                                           
-+#define _ARROW_FD fd_
-+#define _ARROW_FD_TYPE int
-+#else
-+#define _ARROW_FD fd_.fd()
-+#define _ARROW_FD_TYPE arrow::internal::FileDescriptor
-+#endif
-+
- /******************************************/
- /******************************************/
- class optional_yield;
-@@ -164,7 +172,7 @@
-   std::mutex lock_;
- 
-   // File descriptor
-  int fd_;
-+  _ARROW_FD_TYPE fd_;
- 
-   FileMode::type mode_;
- 
-@@ -202,7 +210,7 @@
-     mode_ = write_only ? FileMode::WRITE : FileMode::READWRITE;
- 
-     if (!truncate) {
-      ARROW_ASSIGN_OR_RAISE(size_, ::arrow::internal::FileGetSize(fd_));
-+      ARROW_ASSIGN_OR_RAISE(size_, ::arrow::internal::FileGetSize(_ARROW_FD));
-     } else {
-       size_ = 0;
-     }
-@@ -222,7 +230,11 @@
-     RETURN_NOT_OK(SetFileName(fd));
-     is_open_ = true;
-     mode_ = FileMode::WRITE;
-+    #if ARROW_VERSION_MAJOR < 9
-     fd_ = fd;
-+    #else
-+    fd_ = arrow::internal::FileDescriptor{fd};
-+    #endif
-     return Status::OK();
-   }
- 
-@@ -230,7 +242,7 @@
-     RETURN_NOT_OK(SetFileName(path));
- 
-     ARROW_ASSIGN_OR_RAISE(fd_, ::arrow::internal::FileOpenReadable(file_name_));
-    ARROW_ASSIGN_OR_RAISE(size_, ::arrow::internal::FileGetSize(fd_));
-+    ARROW_ASSIGN_OR_RAISE(size_, ::arrow::internal::FileGetSize(_ARROW_FD));
- 
-     is_open_ = true;
-     mode_ = FileMode::READ;
-@@ -242,7 +254,11 @@
-     RETURN_NOT_OK(SetFileName(fd));
-     is_open_ = true;
-     mode_ = FileMode::READ;
-+    #if ARROW_VERSION_MAJOR < 9
-     fd_ = fd;
-+    #else
-+    fd_ = arrow::internal::FileDescriptor{fd};
-+    #endif
-     return Status::OK();
-   }
- 
-@@ -258,9 +274,13 @@
-       // Even if closing fails, the fd will likely be closed (perhaps it's
-       // already closed).
-       is_open_ = false;
-+      #if ARROW_VERSION_MAJOR < 9
-       int fd = fd_;
-       fd_ = -1;
-       RETURN_NOT_OK(::arrow::internal::FileClose(fd));
-+      #else
-+      RETURN_NOT_OK(fd_.Close());
-+      #endif
-     }
-     return Status::OK();
-   }
-@@ -268,7 +288,7 @@
-   Result<int64_t> Read(int64_t nbytes, void* out) override {
-     RETURN_NOT_OK(CheckClosed());
-     RETURN_NOT_OK(CheckPositioned());
-    return ::arrow::internal::FileRead(fd_, reinterpret_cast<uint8_t*>(out), nbytes);
-+    return ::arrow::internal::FileRead(_ARROW_FD, reinterpret_cast<uint8_t*>(out), nbytes);
-   }
- 
-   Result<int64_t> ReadAt(int64_t position, int64_t nbytes, void* out) override {
-@@ -277,7 +297,7 @@
-     // ReadAt() leaves the file position undefined, so require that we seek
-     // before calling Read() or Write().
-     need_seeking_.store(true);
-    return ::arrow::internal::FileReadAt(fd_, reinterpret_cast<uint8_t*>(out), position,
-+    return ::arrow::internal::FileReadAt(_ARROW_FD, reinterpret_cast<uint8_t*>(out), position,
-                                          nbytes);
-   }
- 
-@@ -286,7 +306,7 @@
-     if (pos < 0) {
-       return Status::Invalid("Invalid position");
-     }
-    Status st = ::arrow::internal::FileSeek(fd_, pos);
-+    Status st = ::arrow::internal::FileSeek(_ARROW_FD, pos);
-     if (st.ok()) {
-       need_seeking_.store(false);
-     }
-@@ -295,7 +315,7 @@
- 
-   Result<int64_t> Tell() const override {
-     RETURN_NOT_OK(CheckClosed());
-    return ::arrow::internal::FileTell(fd_);
-+    return ::arrow::internal::FileTell(_ARROW_FD);
-   }
- 
-   Status Write(const void* data, int64_t length) override {
-@@ -306,11 +326,11 @@
-     if (length < 0) {
-       return Status::IOError("Length must be non-negative");
-     }
-    return ::arrow::internal::FileWrite(fd_, reinterpret_cast<const uint8_t*>(data),
-+    return ::arrow::internal::FileWrite(_ARROW_FD, reinterpret_cast<const uint8_t*>(data),
-                                         length);
-   }
- 
-  int fd() const override { return fd_; }
-+  int fd() const override { return _ARROW_FD; }
- 
-   bool is_open() const override { return is_open_; }
- 
-@@ -345,7 +365,7 @@
-   std::mutex lock_;
- 
-   // File descriptor
-  int fd_;
-+  _ARROW_FD_TYPE fd_;
- 
-   FileMode::type mode_;
- 
-@@ -411,7 +431,11 @@
-       // already closed).
-       is_open_ = false;
-       //int fd = fd_;
-+      #if ARROW_VERSION_MAJOR < 9
-       fd_ = -1;
-+      #else
-+      fd_.Close();
-+      #endif
-       //RETURN_NOT_OK(::arrow::internal::FileClose(fd));
-     }
-     return Status::OK();
-@@ -421,7 +445,7 @@
-     NOT_IMPLEMENT;
-     RETURN_NOT_OK(CheckClosed());
-     RETURN_NOT_OK(CheckPositioned());
-    return ::arrow::internal::FileRead(fd_, reinterpret_cast<uint8_t*>(out), nbytes);
-+    return ::arrow::internal::FileRead(_ARROW_FD, reinterpret_cast<uint8_t*>(out), nbytes);
-   }
- 
-   Result<int64_t> ReadAt(int64_t position, int64_t nbytes, void* out) {
-@@ -443,7 +467,7 @@
-     return Status::OK();
-   }
- 
-  int fd() const { return fd_; }
-+  int fd() const { return _ARROW_FD; }
- 
-   bool is_open() const { return is_open_; }
- 
-@@ -467,7 +491,7 @@
-   std::mutex lock_;
- 
-   // File descriptor
-  int fd_;
-+  _ARROW_FD_TYPE fd_;
- 
-   FileMode::type mode_;
- 
-@@ -609,7 +633,7 @@
-     for (const auto& range : ranges) {
-       RETURN_NOT_OK(internal::ValidateRange(range.offset, range.length));
- #if defined(POSIX_FADV_WILLNEED)
-      if (posix_fadvise(fd_, range.offset, range.length, POSIX_FADV_WILLNEED)) {
-+      if (posix_fadvise(_ARROW_FD, range.offset, range.length, POSIX_FADV_WILLNEED)) {
-         return IOErrorFromErrno(errno, "posix_fadvise failed");
-       }
- #elif defined(F_RDADVISE)  // macOS, BSD?
-@@ -617,7 +641,7 @@
-         off_t ra_offset;
-         int ra_count;
-       } radvisory{range.offset, static_cast<int>(range.length)};
-      if (radvisory.ra_count > 0 && fcntl(fd_, F_RDADVISE, &radvisory) == -1) {
-+      if (radvisory.ra_count > 0 && fcntl(_ARROW_FD, F_RDADVISE, &radvisory) == -1) {
-         return IOErrorFromErrno(errno, "fcntl(fd, F_RDADVISE, ...) failed");
-       }
- #endif
-@@ -970,6 +994,9 @@
-       CryptoContext ctx(col->has_dictionary_page(), row_group_ordinal_,
-                         static_cast<int16_t>(i), meta_decryptor, data_decryptor);
-       return PageReader::Open(stream, col->num_values(), col->compression(),
-+      #if ARROW_VERSION_MAJOR > 8
-+                              false,
-+      #endif
-                               properties_.memory_pool(), &ctx);
-     }
- 
-@@ -985,6 +1012,9 @@
-     CryptoContext ctx(col->has_dictionary_page(), row_group_ordinal_,
-                       static_cast<int16_t>(i), meta_decryptor, data_decryptor);
-     return PageReader::Open(stream, col->num_values(), col->compression(),
-+    #if ARROW_VERSION_MAJOR > 8
-+                            false,
-+    #endif
-                             properties_.memory_pool(), &ctx);
-   }
- 
@@ -0,0 +1,42 @@
+--- ceph-18.1.2/src/common/subsys_types.h.orig	2023-06-27 15:59:59.000000000 -0400
+++ ceph-18.1.2/src/common/subsys_types.h	2023-07-04 19:36:55.941238973 -0400
+@@ -54,7 +54,7 @@
+ #undef DEFAULT_SUBSYS
+ }
+ 
+-constexpr static std::uint8_t
+constexpr static uint8_t
+ ceph_subsys_get_max_default_level(const std::size_t subidx) {
+   const auto item = ceph_subsys_get_as_array()[subidx];
+   return std::max(item.log_level, item.gather_level);
+--- ceph-18.1.2/src/msg/async/crypto_onwire.h.orig	2023-06-27 15:59:59.000000000 -0400
+++ ceph-18.1.2/src/msg/async/crypto_onwire.h	2023-07-04 19:36:55.957238704 -0400
+@@ -95,7 +95,7 @@
+   // Transmitter can append extra bytes of ciphertext at the -final step.
+   // This method return how much was added, and thus let client translate
+   // plaintext size into ciphertext size to grab from wire.
+-  virtual std::uint32_t get_extra_size_at_final() = 0;
+  virtual uint32_t get_extra_size_at_final() = 0;
+ 
+   // Instance of RxHandler must be reset before doing any decrypt-update
+   // step. This applies also to situation when decrypt-final was already
+--- ceph-18.1.2/src/rocksdb/table/block_based/data_block_hash_index.h.orig	2023-05-24 15:55:23.000000000 -0400
+++ ceph-18.1.2/src/rocksdb/table/block_based/data_block_hash_index.h	2023-07-04 19:36:55.971238469 -0400
+@@ -8,6 +8,7 @@
+ #include <cstdint>
+ #include <string>
+ #include <vector>
+#include <cstdint>
+ 
+ #include "rocksdb/slice.h"
+ 
+--- ceph-18.1.2/src/rocksdb/util/string_util.h.orig	2023-05-24 15:55:23.000000000 -0400
+++ ceph-18.1.2/src/rocksdb/util/string_util.h	2023-07-04 19:36:55.991238133 -0400
+@@ -11,6 +11,7 @@
+ #include <string>
+ #include <unordered_map>
+ #include <vector>
+#include <cstdint>
+ 
+ #include "rocksdb/rocksdb_namespace.h"
+ 
@@ -0,0 +1,17 @@
+--- ceph-18.0.0-2726-g7cea3740/src/rgw/rgw_amqp.cc.orig	2023-03-14 18:22:35.636864260 -0400
+++ ceph-18.0.0-2726-g7cea3740/src/rgw/rgw_amqp.cc	2023-03-14 18:24:36.362756771 -0400
+@@ -2,10 +2,10 @@
+ // vim: ts=8 sw=2 smarttab ft=cpp
+ 
+ #include "rgw_amqp.h"
+-#include <amqp.h>
+-#include <amqp_ssl_socket.h>
+-#include <amqp_tcp_socket.h>
+-#include <amqp_framing.h>
+#include <rabbitmq-c/amqp.h>
+#include <rabbitmq-c/ssl_socket.h>
+#include <rabbitmq-c/tcp_socket.h>
+#include <rabbitmq-c/framing.h>
+ #include "include/ceph_assert.h"
+ #include <sstream>
+ #include <cstring>
@@ -0,0 +1,24 @@
+--- ceph-18.0.0-2950-g1c931bc4/cmake/modules/BuildBoost.cmake.orig	2023-04-28 18:30:19.133064577 -0400
+++ ceph-18.0.0-2950-g1c931bc4/cmake/modules/BuildBoost.cmake	2023-04-28 18:31:55.290354383 -0400
+@@ -104,12 +104,21 @@
+   set(user_config ${CMAKE_BINARY_DIR}/user-config.jam)
+   # edit the user-config.jam so b2 will be able to use the specified
+   # toolset and python
+if(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64")
+  file(WRITE ${user_config}
+    "using ${toolset}"
+    " : "
+    " : ${CMAKE_CXX_COMPILER}"
+    " : <compileflags>-fPIC <compileflags>-w <compileflags>-fcf-protection <compileflags>-Wno-everything" 
+    " ;\n")
+else()
+   file(WRITE ${user_config}
+     "using ${toolset}"
+     " : "
+     " : ${CMAKE_CXX_COMPILER}"
+     " : <compileflags>-fPIC <compileflags>-w <compileflags>-Wno-everything"
+     " ;\n")
+endif()
+   if(with_python_version)
+     find_package(Python3 ${with_python_version} QUIET REQUIRED
+       COMPONENTS Development)
@@ -0,0 +1,62 @@
+--- ceph-20.0.0-1954-g77a7c83d/src/boost/libs/context/src/asm/jump_x86_64_sysv_elf_gas.S.orig	2025-05-19 18:28:37.137194693 -0400
+++ ceph-20.0.0-1954-g77a7c83d/src/boost/libs/context/src/asm/jump_x86_64_sysv_elf_gas.S	2025-05-19 18:30:54.292857720 -0400
+@@ -144,4 +144,18 @@
+ 
+ /* Mark that we don't need executable stack.  */
+ .section .note.GNU-stack,"",%progbits
+
+.section .note.gnu.property
+.align=8
+
+        .byte 0x04, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x00, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x01, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x04, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x02, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+ # endif
+--- ceph-20.0.0-1954-g77a7c83d/src/boost/libs/context/src/asm/make_x86_64_sysv_elf_gas.S.orig	2025-05-19 18:28:22.611442193 -0400
+++ ceph-20.0.0-1954-g77a7c83d/src/boost/libs/context/src/asm/make_x86_64_sysv_elf_gas.S	2025-05-19 18:31:01.037742795 -0400
+@@ -159,4 +159,18 @@
+ 
+ /* Mark that we don't need executable stack. */
+ .section .note.GNU-stack,"",%progbits
+
+.section .note.gnu.property
+.align=8
+
+        .byte 0x04, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x00, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x01, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x04, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x02, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+ # endif
+--- ceph-20.0.0-1954-g77a7c83d/src/boost/libs/context/src/asm/ontop_x86_64_sysv_elf_gas.S.orig	2025-05-19 18:29:35.836194529 -0400
+++ ceph-20.0.0-1954-g77a7c83d/src/boost/libs/context/src/asm/ontop_x86_64_sysv_elf_gas.S	2025-05-19 18:31:15.172501956 -0400
+@@ -137,3 +137,17 @@
+ 
+ /* Mark that we don't need executable stack.  */
+ .section .note.GNU-stack,"",%progbits
+
+.section .note.gnu.property
+.align=8
+
+        .byte 0x04, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x00, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x01, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x04, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x02, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
@@ -0,0 +1,24 @@
+--- ceph-18.1.2/src/pybind/rbd/rbd.pyx.orig	2023-07-21 13:30:08.156825317 -0400
+++ ceph-18.1.2/src/pybind/rbd/rbd.pyx	2023-07-24 09:09:27.930137117 -0400
+@@ -371,10 +371,10 @@
+     cdef rados_ioctx_t convert_ioctx(rados.Ioctx ioctx) except? NULL:
+         return <rados_ioctx_t>ioctx.io
+ 
+-cdef int progress_callback(uint64_t offset, uint64_t total, void* ptr) with gil:
+cdef int progress_callback(uint64_t offset, uint64_t total, void* ptr) noexcept with gil:
+     return (<object>ptr)(offset, total)
+ 
+-cdef int no_op_progress_callback(uint64_t offset, uint64_t total, void* ptr):
+cdef int no_op_progress_callback(uint64_t offset, uint64_t total, void* ptr) noexcept:
+     return 0
+ 
+ def cstr(val, name, encoding="utf-8", opt=False):
+@@ -426,7 +426,7 @@
+ 
+ cdef class Completion
+ 
+-cdef void __aio_complete_cb(rbd_completion_t completion, void *args) with gil:
+cdef void __aio_complete_cb(rbd_completion_t completion, void *args) noexcept with gil:
+     """
+     Callback to oncomplete() for asynchronous operations
+     """
@@ -0,0 +1,11 @@
+--- ceph-18.2.3/src/boost/boost/python/call_method.hpp.orig	2024-06-07 11:14:58.579734749 -0400
+++ ceph-18.2.3/src/boost/boost/python/call_method.hpp	2024-06-07 11:19:06.754520504 -0400
+@@ -59,7 +59,7 @@
+     )
+ {
+     PyObject* const result = 
+-        PyEval_CallMethod(
+        PyObject_CallMethod(
+             self
+             , const_cast<char*>(name)
+             , const_cast<char*>("(" BOOST_PP_REPEAT_1ST(N, BOOST_PYTHON_FIXED, "O") ")")
@@ -0,0 +1,19 @@
+--- ceph-18.2.3/src/mgr/PyModule.cc.orig	2024-06-06 16:31:10.340731851 -0400
+++ ceph-18.2.3/src/mgr/PyModule.cc	2024-06-07 12:58:49.913571410 -0400
+@@ -342,6 +342,16 @@
+   return ceph_module;
+ }
+ 
+// FIXME
+// Removed in Python 3.13 API, but kept for the stable ABI
+#ifdef __cplusplus
+extern "C" {
+#endif
+PyAPI_FUNC(void) PySys_SetPath(const wchar_t *);
+#ifdef __cplusplus
+}
+#endif
+
+ int PyModule::load(PyThreadState *pMainThreadState)
+ {
+   ceph_assert(pMainThreadState != nullptr);
@@ -0,0 +1,15 @@
+--- ceph-19.1.0/src/common/crc32c_ppc_asm.S.orig	2024-07-10 10:55:06.255480790 -0400
+++ ceph-19.1.0/src/common/crc32c_ppc_asm.S	2024-07-10 12:53:42.844075490 -0400
+@@ -54,11 +54,8 @@
+ 	/* byte reverse permute constant */
+ 	.octa 0x0F0E0D0C0B0A09080706050403020100
+ 
+-#ifdef CRC32_CONSTANTS_HEADER
+-#include CRC32_CONSTANTS_HEADER
+-#else
+#define __ASSEMBLY__
+ #include "crc32c_ppc_constants.h"
+-#endif
+ 
+ 	.text
+ 
@@ -0,0 +1,14 @@
+diff --git a/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/civetweb.c b/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/civetweb.c
+index fea9e6f98..c7eddb20b 100644
+--- a/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/civetweb.c
+++ b/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/civetweb.c
+@@ -1744,7 +1744,9 @@ typedef struct SSL_CTX SSL_CTX;
+ #include <openssl/conf.h>
+ #include <openssl/crypto.h>
+ #include <openssl/dh.h>
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L)
+ #include <openssl/engine.h>
+#endif
+ #include <openssl/err.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/pem.h>
@@ -0,0 +1,20 @@
+--- ceph-19.2.0/src/rocksdb/db/blob/blob_file_meta.h.orig	2025-01-16 08:16:41.762758595 -0500
+++ ceph-19.2.0/src/rocksdb/db/blob/blob_file_meta.h	2025-01-16 08:17:37.172784779 -0500
+@@ -10,6 +10,7 @@
+ #include <memory>
+ #include <string>
+ #include <unordered_set>
+#include <cstdint>
+ 
+ #include "rocksdb/rocksdb_namespace.h"
+ 
+--- ceph-19.2.0/src/rocksdb/include/rocksdb/trace_record.h.orig	2025-01-16 09:04:19.196962397 -0500
+++ ceph-19.2.0/src/rocksdb/include/rocksdb/trace_record.h	2025-01-16 09:04:33.885701684 -0500
+@@ -8,6 +8,7 @@
+ #include <memory>
+ #include <string>
+ #include <vector>
+#include <cstdint>
+ 
+ #include "rocksdb/rocksdb_namespace.h"
+ #include "rocksdb/slice.h"
@@ -0,0 +1,63 @@
+--- ceph-20.1.0/src/googletest/googletest/CMakeLists.txt.orig	2025-02-07 11:04:56.000000000 -0500
+++ ceph-20.1.0/src/googletest/googletest/CMakeLists.txt	2025-09-16 08:11:59.341951770 -0400
+@@ -53,6 +53,8 @@
+   set_up_hermetic_build()
+ endif()
+ 
+option(BUILD_SHARED_LIBS "Build shared libraries (DLLs)." OFF)
+
+ # These commands only run if this is the main project.
+ if(CMAKE_PROJECT_NAME STREQUAL "gtest" OR CMAKE_PROJECT_NAME STREQUAL "googletest-distribution")
+ 
+@@ -121,7 +123,7 @@
+ # are used for other targets, to ensure that gtest can be compiled by a user
+ # aggressive about warnings.
+ cxx_library(gtest "${cxx_strict}" src/gtest-all.cc)
+-set_target_properties(gtest PROPERTIES VERSION ${GOOGLETEST_VERSION})
+#set_target_properties(gtest PROPERTIES VERSION ${GOOGLETEST_VERSION})
+ if(GTEST_HAS_ABSL)
+   target_compile_definitions(gtest PUBLIC GTEST_HAS_ABSL=1)
+   target_link_libraries(gtest PUBLIC
+@@ -139,7 +141,7 @@
+   )
+ endif()
+ cxx_library(gtest_main "${cxx_strict}" src/gtest_main.cc)
+-set_target_properties(gtest_main PROPERTIES VERSION ${GOOGLETEST_VERSION})
+#set_target_properties(gtest_main PROPERTIES VERSION ${GOOGLETEST_VERSION})
+ string(REPLACE ";" "$<SEMICOLON>" dirs "${gtest_build_include_dirs}")
+ target_include_directories(gtest SYSTEM INTERFACE
+   "$<BUILD_INTERFACE:${dirs}>"
+--- ceph-20.1.0/src/googletest/googlemock/CMakeLists.txt.orig	2025-02-07 11:04:56.000000000 -0500
+++ ceph-20.1.0/src/googletest/googlemock/CMakeLists.txt	2025-09-16 08:12:18.121641875 -0400
+@@ -49,6 +49,7 @@
+ # if they are the same (the default).
+ add_subdirectory("${gtest_dir}" "${gmock_BINARY_DIR}/${gtest_dir}")
+ 
+option(BUILD_SHARED_LIBS "Build shared libraries (DLLs)." OFF)
+ 
+ # These commands only run if this is the main project
+ if(CMAKE_PROJECT_NAME STREQUAL "gmock" OR CMAKE_PROJECT_NAME STREQUAL "googletest-distribution")
+@@ -96,10 +97,10 @@
+ else()
+   cxx_library(gmock "${cxx_strict}" src/gmock-all.cc)
+   target_link_libraries(gmock PUBLIC gtest)
+-  set_target_properties(gmock PROPERTIES VERSION ${GOOGLETEST_VERSION})
+  # set_target_properties(gmock PROPERTIES VERSION ${GOOGLETEST_VERSION})
+   cxx_library(gmock_main "${cxx_strict}" src/gmock_main.cc)
+   target_link_libraries(gmock_main PUBLIC gmock)
+-  set_target_properties(gmock_main PROPERTIES VERSION ${GOOGLETEST_VERSION})
+  # set_target_properties(gmock_main PROPERTIES VERSION ${GOOGLETEST_VERSION})
+ endif()
+ 
+ string(REPLACE ";" "$<SEMICOLON>" dirs "${gmock_build_include_dirs}")
+--- ceph-20.1.0/src/googletest/googletest/cmake/internal_utils.cmake.orig	2025-09-22 10:12:18.037349494 -0400
+++ ceph-20.1.0/src/googletest/googletest/cmake/internal_utils.cmake	2025-09-22 10:13:13.729590249 -0400
+@@ -207,7 +207,7 @@
+ endfunction()
+ 
+ function(cxx_library name cxx_flags)
+-  cxx_library_with_type(${name} "" "${cxx_flags}" ${ARGN})
+  cxx_library_with_type(${name} STATIC "${cxx_flags}" ${ARGN})
+ endfunction()
+ 
+ # cxx_executable_with_flags(name cxx_flags libs srcs...)
@@ -0,0 +1,11 @@
+--- ceph-19.2.0/src/tracing/CMakeLists.txt.orig	2025-01-23 17:51:43.874162594 -0500
+++ ceph-19.2.0/src/tracing/CMakeLists.txt	2025-01-23 17:54:21.877186735 -0500
+@@ -6,6 +6,8 @@
+ set(header_dir ${working_dir}/tracing)
+ file(MAKE_DIRECTORY ${header_dir})
+ 
+set(CMAKE_C99_EXTENSION_COMPILE_OPTION "-std=gnu23")
+
+ add_custom_target(tracepoint_libraries)
+ 
+ file(GLOB tps "*.tp")
@@ -0,0 +1,21 @@
+--- ceph-20.1.0/src/test/neorados/common_tests.h.orig	2025-09-04 15:35:40.000000000 -0400
+++ ceph-20.1.0/src/test/neorados/common_tests.h	2025-09-16 08:13:03.274896767 -0400
+@@ -47,6 +47,18 @@
+ 
+ #include "gtest/gtest.h"
+ 
+#if !defined(GTEST_DISALLOW_COPY_AND_ASSIGN_)
+#define GTEST_DISALLOW_COPY_AND_ASSIGN_(type) \
+  type(type const&) = delete;                 \
+  type& operator=(type const&) = delete
+#endif
+
+#if !defined(GTEST_DISALLOW_MOVE_AND_ASSIGN_)
+#define GTEST_DISALLOW_MOVE_AND_ASSIGN_(type) \
+  type(type&&) noexcept = delete;             \
+  type& operator=(type&&) noexcept = delete
+#endif
+
+ /// \file test/neorados/common_tests.h
+ ///
+ /// \brief Tools for testing neorados code
@@ -0,0 +1,838 @@
+--- ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/encryption_internal_19.h.orig	2025-07-08 07:40:29.811814549 -0400
+++ ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/encryption_internal_19.h	2025-07-08 07:40:29.811739290 -0400
+@@ -0,0 +1,114 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "parquet/properties.h"
+#include "parquet/types.h"
+
+using parquet::ParquetCipher;
+
+namespace parquet {
+namespace encryption {
+
+constexpr int kGcmTagLength = 16;
+constexpr int kNonceLength = 12;
+
+// Module types
+constexpr int8_t kFooter = 0;
+constexpr int8_t kColumnMetaData = 1;
+constexpr int8_t kDataPage = 2;
+constexpr int8_t kDictionaryPage = 3;
+constexpr int8_t kDataPageHeader = 4;
+constexpr int8_t kDictionaryPageHeader = 5;
+constexpr int8_t kColumnIndex = 6;
+constexpr int8_t kOffsetIndex = 7;
+
+/// Performs AES encryption operations with GCM or CTR ciphers.
+class AesEncryptor {
+ public:
+  static AesEncryptor* Make(ParquetCipher::type alg_id, int key_len, bool metadata,
+                            std::vector<AesEncryptor*>* all_encryptors);
+
+  ~AesEncryptor();
+
+  /// Size difference between plaintext and ciphertext, for this cipher.
+  int CiphertextSizeDelta();
+
+  /// Encrypts plaintext with the key and aad. Key length is passed only for validation.
+  /// If different from value in constructor, exception will be thrown.
+  int Encrypt(const uint8_t* plaintext, int plaintext_len, const uint8_t* key,
+              int key_len, const uint8_t* aad, int aad_len, uint8_t* ciphertext);
+
+  /// Encrypts plaintext footer, in order to compute footer signature (tag).
+  int SignedFooterEncrypt(const uint8_t* footer, int footer_len, const uint8_t* key,
+                          int key_len, const uint8_t* aad, int aad_len,
+                          const uint8_t* nonce, uint8_t* encrypted_footer);
+
+  void WipeOut();
+
+ private:
+  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+  explicit AesEncryptor(ParquetCipher::type alg_id, int key_len, bool metadata);
+  // PIMPL Idiom
+  class AesEncryptorImpl;
+  std::unique_ptr<AesEncryptorImpl> impl_;
+};
+
+/// Performs AES decryption operations with GCM or CTR ciphers.
+class AesDecryptor {
+ public:
+  static AesDecryptor* Make(ParquetCipher::type alg_id, int key_len, bool metadata,
+                            std::vector<AesDecryptor*>* all_decryptors);
+
+  ~AesDecryptor();
+  void WipeOut();
+
+  /// Size difference between plaintext and ciphertext, for this cipher.
+  int CiphertextSizeDelta();
+
+  /// Decrypts ciphertext with the key and aad. Key length is passed only for
+  /// validation. If different from value in constructor, exception will be thrown.
+  int Decrypt(const uint8_t* ciphertext, int ciphertext_len, const uint8_t* key,
+              int key_len, const uint8_t* aad, int aad_len, uint8_t* plaintext);
+
+ private:
+  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+  explicit AesDecryptor(ParquetCipher::type alg_id, int key_len, bool metadata);
+  // PIMPL Idiom
+  class AesDecryptorImpl;
+  std::unique_ptr<AesDecryptorImpl> impl_;
+};
+
+std::string CreateModuleAad(const std::string& file_aad, int8_t module_type,
+                            int16_t row_group_ordinal, int16_t column_ordinal,
+                            int16_t page_ordinal);
+
+std::string CreateFooterAad(const std::string& aad_prefix_bytes);
+
+// Update last two bytes of page (or page header) module AAD
+void QuickUpdatePageAad(const std::string& AAD, int16_t new_page_ordinal);
+
+// Wraps OpenSSL RAND_bytes function
+void RandBytes(unsigned char* buf, int num);
+
+}  // namespace encryption
+}  // namespace parquet
+--- ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/encryption_internal_20.h.orig	2025-07-08 07:40:29.812759948 -0400
+++ ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/encryption_internal_20.h	2025-07-08 07:40:29.812687536 -0400
+@@ -0,0 +1,141 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "arrow/util/span.h"
+#include "parquet/properties.h"
+#include "parquet/types.h"
+
+using parquet::ParquetCipher;
+
+namespace parquet::encryption {
+
+constexpr int32_t kGcmTagLength = 16;
+constexpr int32_t kNonceLength = 12;
+
+// Module types
+constexpr int8_t kFooter = 0;
+constexpr int8_t kColumnMetaData = 1;
+constexpr int8_t kDataPage = 2;
+constexpr int8_t kDictionaryPage = 3;
+constexpr int8_t kDataPageHeader = 4;
+constexpr int8_t kDictionaryPageHeader = 5;
+constexpr int8_t kColumnIndex = 6;
+constexpr int8_t kOffsetIndex = 7;
+constexpr int8_t kBloomFilterHeader = 8;
+constexpr int8_t kBloomFilterBitset = 9;
+
+/// Performs AES encryption operations with GCM or CTR ciphers.
+class PARQUET_EXPORT AesEncryptor {
+ public:
+  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+  /// If write_length is true, prepend ciphertext length to the ciphertext
+  explicit AesEncryptor(ParquetCipher::type alg_id, int32_t key_len, bool metadata,
+                        bool write_length = true);
+
+  static std::unique_ptr<AesEncryptor> Make(ParquetCipher::type alg_id, int32_t key_len,
+                                            bool metadata, bool write_length = true);
+
+  ~AesEncryptor();
+
+  /// The size of the ciphertext, for this cipher and the specified plaintext length.
+  [[nodiscard]] int32_t CiphertextLength(int64_t plaintext_len) const;
+
+  /// Encrypts plaintext with the key and aad. Key length is passed only for validation.
+  /// If different from value in constructor, exception will be thrown.
+  int32_t Encrypt(::arrow::util::span<const uint8_t> plaintext,
+                  ::arrow::util::span<const uint8_t> key,
+                  ::arrow::util::span<const uint8_t> aad,
+                  ::arrow::util::span<uint8_t> ciphertext);
+
+  /// Encrypts plaintext footer, in order to compute footer signature (tag).
+  int32_t SignedFooterEncrypt(::arrow::util::span<const uint8_t> footer,
+                              ::arrow::util::span<const uint8_t> key,
+                              ::arrow::util::span<const uint8_t> aad,
+                              ::arrow::util::span<const uint8_t> nonce,
+                              ::arrow::util::span<uint8_t> encrypted_footer);
+
+ private:
+  // PIMPL Idiom
+  class AesEncryptorImpl;
+  std::unique_ptr<AesEncryptorImpl> impl_;
+};
+
+/// Performs AES decryption operations with GCM or CTR ciphers.
+class PARQUET_EXPORT AesDecryptor {
+ public:
+  /// \brief Construct an AesDecryptor
+  ///
+  /// \param alg_id the encryption algorithm to use
+  /// \param key_len key length. Possible values: 16, 24, 32 bytes.
+  /// \param metadata if true then this is a metadata decryptor
+  /// \param contains_length if true, expect ciphertext length prepended to the ciphertext
+  explicit AesDecryptor(ParquetCipher::type alg_id, int32_t key_len, bool metadata,
+                        bool contains_length = true);
+
+  static std::unique_ptr<AesDecryptor> Make(ParquetCipher::type alg_id, int32_t key_len,
+                                            bool metadata);
+
+  ~AesDecryptor();
+
+  /// The size of the plaintext, for this cipher and the specified ciphertext length.
+  [[nodiscard]] int32_t PlaintextLength(int32_t ciphertext_len) const;
+
+  /// The size of the ciphertext, for this cipher and the specified plaintext length.
+  [[nodiscard]] int32_t CiphertextLength(int32_t plaintext_len) const;
+
+  /// Decrypts ciphertext with the key and aad. Key length is passed only for
+  /// validation. If different from value in constructor, exception will be thrown.
+  /// The caller is responsible for ensuring that the plaintext buffer is at least as
+  /// large as PlaintextLength(ciphertext_len).
+  int32_t Decrypt(::arrow::util::span<const uint8_t> ciphertext,
+                  ::arrow::util::span<const uint8_t> key,
+                  ::arrow::util::span<const uint8_t> aad,
+                  ::arrow::util::span<uint8_t> plaintext);
+
+ private:
+  // PIMPL Idiom
+  class AesDecryptorImpl;
+  std::unique_ptr<AesDecryptorImpl> impl_;
+};
+
+std::string CreateModuleAad(const std::string& file_aad, int8_t module_type,
+                            int16_t row_group_ordinal, int16_t column_ordinal,
+                            int32_t page_ordinal);
+
+std::string CreateFooterAad(const std::string& aad_prefix_bytes);
+
+// Update last two bytes of page (or page header) module AAD
+void QuickUpdatePageAad(int32_t new_page_ordinal, std::string* AAD);
+
+// Wraps OpenSSL RAND_bytes function
+void RandBytes(unsigned char* buf, size_t num);
+
+// Ensure OpenSSL is initialized.
+//
+// This is only necessary in specific situations since OpenSSL otherwise
+// initializes itself automatically. For example, under Valgrind, a memory
+// leak will be reported if OpenSSL is initialized for the first time from
+// a worker thread; calling this function from the main thread prevents this.
+void EnsureBackendInitialized();
+
+}  // namespace parquet::encryption
+--- ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/encryption_internal.h.orig	2024-10-06 07:18:41.000000000 -0400
+++ ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/encryption_internal.h	2025-07-08 07:40:29.809908891 -0400
+@@ -17,98 +17,8 @@
+ 
+ #pragma once
+ 
+-#include <memory>
+-#include <string>
+-#include <vector>
+-
+-#include "parquet/properties.h"
+-#include "parquet/types.h"
+-
+-using parquet::ParquetCipher;
+-
+-namespace parquet {
+-namespace encryption {
+-
+-constexpr int kGcmTagLength = 16;
+-constexpr int kNonceLength = 12;
+-
+-// Module types
+-constexpr int8_t kFooter = 0;
+-constexpr int8_t kColumnMetaData = 1;
+-constexpr int8_t kDataPage = 2;
+-constexpr int8_t kDictionaryPage = 3;
+-constexpr int8_t kDataPageHeader = 4;
+-constexpr int8_t kDictionaryPageHeader = 5;
+-constexpr int8_t kColumnIndex = 6;
+-constexpr int8_t kOffsetIndex = 7;
+-
+-/// Performs AES encryption operations with GCM or CTR ciphers.
+-class AesEncryptor {
+- public:
+-  static AesEncryptor* Make(ParquetCipher::type alg_id, int key_len, bool metadata,
+-                            std::vector<AesEncryptor*>* all_encryptors);
+-
+-  ~AesEncryptor();
+-
+-  /// Size difference between plaintext and ciphertext, for this cipher.
+-  int CiphertextSizeDelta();
+-
+-  /// Encrypts plaintext with the key and aad. Key length is passed only for validation.
+-  /// If different from value in constructor, exception will be thrown.
+-  int Encrypt(const uint8_t* plaintext, int plaintext_len, const uint8_t* key,
+-              int key_len, const uint8_t* aad, int aad_len, uint8_t* ciphertext);
+-
+-  /// Encrypts plaintext footer, in order to compute footer signature (tag).
+-  int SignedFooterEncrypt(const uint8_t* footer, int footer_len, const uint8_t* key,
+-                          int key_len, const uint8_t* aad, int aad_len,
+-                          const uint8_t* nonce, uint8_t* encrypted_footer);
+-
+-  void WipeOut();
+-
+- private:
+-  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+-  explicit AesEncryptor(ParquetCipher::type alg_id, int key_len, bool metadata);
+-  // PIMPL Idiom
+-  class AesEncryptorImpl;
+-  std::unique_ptr<AesEncryptorImpl> impl_;
+-};
+-
+-/// Performs AES decryption operations with GCM or CTR ciphers.
+-class AesDecryptor {
+- public:
+-  static AesDecryptor* Make(ParquetCipher::type alg_id, int key_len, bool metadata,
+-                            std::vector<AesDecryptor*>* all_decryptors);
+-
+-  ~AesDecryptor();
+-  void WipeOut();
+-
+-  /// Size difference between plaintext and ciphertext, for this cipher.
+-  int CiphertextSizeDelta();
+-
+-  /// Decrypts ciphertext with the key and aad. Key length is passed only for
+-  /// validation. If different from value in constructor, exception will be thrown.
+-  int Decrypt(const uint8_t* ciphertext, int ciphertext_len, const uint8_t* key,
+-              int key_len, const uint8_t* aad, int aad_len, uint8_t* plaintext);
+-
+- private:
+-  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+-  explicit AesDecryptor(ParquetCipher::type alg_id, int key_len, bool metadata);
+-  // PIMPL Idiom
+-  class AesDecryptorImpl;
+-  std::unique_ptr<AesDecryptorImpl> impl_;
+-};
+-
+-std::string CreateModuleAad(const std::string& file_aad, int8_t module_type,
+-                            int16_t row_group_ordinal, int16_t column_ordinal,
+-                            int16_t page_ordinal);
+-
+-std::string CreateFooterAad(const std::string& aad_prefix_bytes);
+-
+-// Update last two bytes of page (or page header) module AAD
+-void QuickUpdatePageAad(const std::string& AAD, int16_t new_page_ordinal);
+-
+-// Wraps OpenSSL RAND_bytes function
+-void RandBytes(unsigned char* buf, int num);
+-
+-}  // namespace encryption
+-}  // namespace parquet
+#if ARROW_VERSION_MAJOR < 20
+#include "encryption_internal_19.h"
+#else
+#include "encryption_internal_20.h"
+#endif
+--- ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/internal_file_decryptor_19.h.orig	2025-07-08 07:40:29.814292389 -0400
+++ ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/internal_file_decryptor_19.h	2025-07-08 07:40:29.813727465 -0400
+@@ -0,0 +1,121 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#pragma once
+
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "parquet/schema.h"
+
+namespace parquet {
+
+namespace encryption {
+class AesDecryptor;
+class AesEncryptor;
+}  // namespace encryption
+
+class FileDecryptionProperties;
+
+class PARQUET_EXPORT Decryptor {
+ public:
+  Decryptor(encryption::AesDecryptor* decryptor, const std::string& key,
+            const std::string& file_aad, const std::string& aad,
+            ::arrow::MemoryPool* pool);
+
+  const std::string& file_aad() const { return file_aad_; }
+  void UpdateAad(const std::string& aad) { aad_ = aad; }
+  ::arrow::MemoryPool* pool() { return pool_; }
+
+  int CiphertextSizeDelta();
+  int Decrypt(const uint8_t* ciphertext, int ciphertext_len, uint8_t* plaintext);
+
+ private:
+  encryption::AesDecryptor* aes_decryptor_;
+  std::string key_;
+  std::string file_aad_;
+  std::string aad_;
+  ::arrow::MemoryPool* pool_;
+};
+
+class InternalFileDecryptor {
+ public:
+  explicit InternalFileDecryptor(FileDecryptionProperties* properties,
+                                 const std::string& file_aad,
+                                 ParquetCipher::type algorithm,
+                                 const std::string& footer_key_metadata,
+                                 ::arrow::MemoryPool* pool);
+
+  std::string& file_aad() { return file_aad_; }
+
+  std::string GetFooterKey();
+
+  ParquetCipher::type algorithm() { return algorithm_; }
+
+  std::string& footer_key_metadata() { return footer_key_metadata_; }
+
+  FileDecryptionProperties* properties() { return properties_; }
+
+  void WipeOutDecryptionKeys();
+
+  ::arrow::MemoryPool* pool() { return pool_; }
+
+  std::shared_ptr<Decryptor> GetFooterDecryptor();
+  std::shared_ptr<Decryptor> GetFooterDecryptorForColumnMeta(const std::string& aad = "");
+  std::shared_ptr<Decryptor> GetFooterDecryptorForColumnData(const std::string& aad = "");
+  std::shared_ptr<Decryptor> GetColumnMetaDecryptor(
+      const std::string& column_path, const std::string& column_key_metadata,
+      const std::string& aad = "");
+  std::shared_ptr<Decryptor> GetColumnDataDecryptor(
+      const std::string& column_path, const std::string& column_key_metadata,
+      const std::string& aad = "");
+
+ private:
+  FileDecryptionProperties* properties_;
+  // Concatenation of aad_prefix (if exists) and aad_file_unique
+  std::string file_aad_;
+  std::map<std::string, std::shared_ptr<Decryptor>> column_data_map_;
+  std::map<std::string, std::shared_ptr<Decryptor>> column_metadata_map_;
+
+  std::shared_ptr<Decryptor> footer_metadata_decryptor_;
+  std::shared_ptr<Decryptor> footer_data_decryptor_;
+  ParquetCipher::type algorithm_;
+  std::string footer_key_metadata_;
+  std::vector<encryption::AesDecryptor*> all_decryptors_;
+
+  /// Key must be 16, 24 or 32 bytes in length. Thus there could be up to three
+  // types of meta_decryptors and data_decryptors.
+  std::unique_ptr<encryption::AesDecryptor> meta_decryptor_[3];
+  std::unique_ptr<encryption::AesDecryptor> data_decryptor_[3];
+
+  ::arrow::MemoryPool* pool_;
+
+  std::shared_ptr<Decryptor> GetFooterDecryptor(const std::string& aad, bool metadata);
+  std::shared_ptr<Decryptor> GetColumnDecryptor(const std::string& column_path,
+                                                const std::string& column_key_metadata,
+                                                const std::string& aad,
+                                                bool metadata = false);
+
+  encryption::AesDecryptor* GetMetaAesDecryptor(size_t key_size);
+  encryption::AesDecryptor* GetDataAesDecryptor(size_t key_size);
+
+  int MapKeyLenToDecryptorArrayIndex(int key_len);
+};
+
+}  // namespace parquet
+--- ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/internal_file_decryptor_20.h.orig	2025-07-08 07:40:29.815411998 -0400
+++ ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/internal_file_decryptor_20.h	2025-07-08 07:40:29.815245155 -0400
+@@ -0,0 +1,148 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#pragma once
+
+#include <memory>
+#include <mutex>
+#include <string>
+#include <vector>
+
+#include "parquet/schema.h"
+
+namespace parquet {
+
+namespace encryption {
+class AesDecryptor;
+class AesEncryptor;
+}  // namespace encryption
+
+class ColumnCryptoMetaData;
+class FileDecryptionProperties;
+
+// An object handling decryption using well-known encryption parameters
+//
+// CAUTION: Decryptor objects are not thread-safe.
+class PARQUET_EXPORT Decryptor {
+ public:
+  Decryptor(std::unique_ptr<encryption::AesDecryptor> decryptor, const std::string& key,
+            const std::string& file_aad, const std::string& aad,
+            ::arrow::MemoryPool* pool);
+  ~Decryptor();
+
+  const std::string& file_aad() const { return file_aad_; }
+  void UpdateAad(const std::string& aad) { aad_ = aad; }
+  ::arrow::MemoryPool* pool() { return pool_; }
+
+  [[nodiscard]] int32_t PlaintextLength(int32_t ciphertext_len) const;
+  [[nodiscard]] int32_t CiphertextLength(int32_t plaintext_len) const;
+  int32_t Decrypt(::arrow::util::span<const uint8_t> ciphertext,
+                  ::arrow::util::span<uint8_t> plaintext);
+
+ private:
+  std::unique_ptr<encryption::AesDecryptor> aes_decryptor_;
+  std::string key_;
+  std::string file_aad_;
+  std::string aad_;
+  ::arrow::MemoryPool* pool_;
+};
+
+class InternalFileDecryptor {
+ public:
+  explicit InternalFileDecryptor(std::shared_ptr<FileDecryptionProperties> properties,
+                                 const std::string& file_aad,
+                                 ParquetCipher::type algorithm,
+                                 const std::string& footer_key_metadata,
+                                 ::arrow::MemoryPool* pool);
+
+  const std::string& file_aad() const { return file_aad_; }
+
+  std::string GetFooterKey();
+
+  ParquetCipher::type algorithm() const { return algorithm_; }
+
+  const std::string& footer_key_metadata() const { return footer_key_metadata_; }
+
+  const std::shared_ptr<FileDecryptionProperties>& properties() const {
+    return properties_;
+  }
+
+  ::arrow::MemoryPool* pool() const { return pool_; }
+
+  // Get a Decryptor instance for the Parquet footer
+  std::unique_ptr<Decryptor> GetFooterDecryptor();
+
+  // Get a Decryptor instance for column chunk metadata.
+  std::unique_ptr<Decryptor> GetColumnMetaDecryptor(
+      const std::string& column_path, const std::string& column_key_metadata,
+      const std::string& aad = "") {
+    return GetColumnDecryptor(column_path, column_key_metadata, aad, /*metadata=*/true);
+  }
+
+  // Get a Decryptor instance for column chunk data.
+  std::unique_ptr<Decryptor> GetColumnDataDecryptor(
+      const std::string& column_path, const std::string& column_key_metadata,
+      const std::string& aad = "") {
+    return GetColumnDecryptor(column_path, column_key_metadata, aad, /*metadata=*/false);
+  }
+
+  // Get a Decryptor factory for column chunk metadata.
+  //
+  // This is typically useful if multi-threaded decryption is expected.
+  // This is a static function as it accepts a null `InternalFileDecryptor*`
+  // argument if the column is not encrypted.
+  static std::function<std::unique_ptr<Decryptor>()> GetColumnMetaDecryptorFactory(
+      InternalFileDecryptor*, const ColumnCryptoMetaData* crypto_metadata,
+      const std::string& aad = "");
+  // Get a Decryptor factory for column chunk data.
+  //
+  // This is typically useful if multi-threaded decryption is expected.
+  // This is a static function as it accepts a null `InternalFileDecryptor*`
+  // argument if the column is not encrypted.
+  static std::function<std::unique_ptr<Decryptor>()> GetColumnDataDecryptorFactory(
+      InternalFileDecryptor*, const ColumnCryptoMetaData* crypto_metadata,
+      const std::string& aad = "");
+
+ private:
+  std::shared_ptr<FileDecryptionProperties> properties_;
+  // Concatenation of aad_prefix (if exists) and aad_file_unique
+  std::string file_aad_;
+  ParquetCipher::type algorithm_;
+  std::string footer_key_metadata_;
+  ::arrow::MemoryPool* pool_;
+
+  // Protects footer_key_ updates
+  std::mutex mutex_;
+  std::string footer_key_;
+
+  std::string GetColumnKey(const std::string& column_path,
+                           const std::string& column_key_metadata);
+
+  std::unique_ptr<Decryptor> GetFooterDecryptor(const std::string& aad, bool metadata);
+
+  std::unique_ptr<Decryptor> GetColumnDecryptor(const std::string& column_path,
+                                                const std::string& column_key_metadata,
+                                                const std::string& aad, bool metadata);
+
+  std::function<std::unique_ptr<Decryptor>()> GetColumnDecryptorFactory(
+      const ColumnCryptoMetaData* crypto_metadata, const std::string& aad, bool metadata);
+};
+
+void UpdateDecryptor(Decryptor* decryptor, int16_t row_group_ordinal,
+                     int16_t column_ordinal, int8_t module_type);
+
+}  // namespace parquet
+--- ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/internal_file_decryptor.h.orig	2024-10-06 07:18:41.000000000 -0400
+++ ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/internal_file_decryptor.h	2025-07-08 07:40:29.813623143 -0400
+@@ -17,105 +17,8 @@
+ 
+ #pragma once
+ 
+-#include <map>
+-#include <memory>
+-#include <string>
+-#include <vector>
+-
+-#include "parquet/schema.h"
+-
+-namespace parquet {
+-
+-namespace encryption {
+-class AesDecryptor;
+-class AesEncryptor;
+-}  // namespace encryption
+-
+-class FileDecryptionProperties;
+-
+-class PARQUET_EXPORT Decryptor {
+- public:
+-  Decryptor(encryption::AesDecryptor* decryptor, const std::string& key,
+-            const std::string& file_aad, const std::string& aad,
+-            ::arrow::MemoryPool* pool);
+-
+-  const std::string& file_aad() const { return file_aad_; }
+-  void UpdateAad(const std::string& aad) { aad_ = aad; }
+-  ::arrow::MemoryPool* pool() { return pool_; }
+-
+-  int CiphertextSizeDelta();
+-  int Decrypt(const uint8_t* ciphertext, int ciphertext_len, uint8_t* plaintext);
+-
+- private:
+-  encryption::AesDecryptor* aes_decryptor_;
+-  std::string key_;
+-  std::string file_aad_;
+-  std::string aad_;
+-  ::arrow::MemoryPool* pool_;
+-};
+-
+-class InternalFileDecryptor {
+- public:
+-  explicit InternalFileDecryptor(FileDecryptionProperties* properties,
+-                                 const std::string& file_aad,
+-                                 ParquetCipher::type algorithm,
+-                                 const std::string& footer_key_metadata,
+-                                 ::arrow::MemoryPool* pool);
+-
+-  std::string& file_aad() { return file_aad_; }
+-
+-  std::string GetFooterKey();
+-
+-  ParquetCipher::type algorithm() { return algorithm_; }
+-
+-  std::string& footer_key_metadata() { return footer_key_metadata_; }
+-
+-  FileDecryptionProperties* properties() { return properties_; }
+-
+-  void WipeOutDecryptionKeys();
+-
+-  ::arrow::MemoryPool* pool() { return pool_; }
+-
+-  std::shared_ptr<Decryptor> GetFooterDecryptor();
+-  std::shared_ptr<Decryptor> GetFooterDecryptorForColumnMeta(const std::string& aad = "");
+-  std::shared_ptr<Decryptor> GetFooterDecryptorForColumnData(const std::string& aad = "");
+-  std::shared_ptr<Decryptor> GetColumnMetaDecryptor(
+-      const std::string& column_path, const std::string& column_key_metadata,
+-      const std::string& aad = "");
+-  std::shared_ptr<Decryptor> GetColumnDataDecryptor(
+-      const std::string& column_path, const std::string& column_key_metadata,
+-      const std::string& aad = "");
+-
+- private:
+-  FileDecryptionProperties* properties_;
+-  // Concatenation of aad_prefix (if exists) and aad_file_unique
+-  std::string file_aad_;
+-  std::map<std::string, std::shared_ptr<Decryptor>> column_data_map_;
+-  std::map<std::string, std::shared_ptr<Decryptor>> column_metadata_map_;
+-
+-  std::shared_ptr<Decryptor> footer_metadata_decryptor_;
+-  std::shared_ptr<Decryptor> footer_data_decryptor_;
+-  ParquetCipher::type algorithm_;
+-  std::string footer_key_metadata_;
+-  std::vector<encryption::AesDecryptor*> all_decryptors_;
+-
+-  /// Key must be 16, 24 or 32 bytes in length. Thus there could be up to three
+-  // types of meta_decryptors and data_decryptors.
+-  std::unique_ptr<encryption::AesDecryptor> meta_decryptor_[3];
+-  std::unique_ptr<encryption::AesDecryptor> data_decryptor_[3];
+-
+-  ::arrow::MemoryPool* pool_;
+-
+-  std::shared_ptr<Decryptor> GetFooterDecryptor(const std::string& aad, bool metadata);
+-  std::shared_ptr<Decryptor> GetColumnDecryptor(const std::string& column_path,
+-                                                const std::string& column_key_metadata,
+-                                                const std::string& aad,
+-                                                bool metadata = false);
+-
+-  encryption::AesDecryptor* GetMetaAesDecryptor(size_t key_size);
+-  encryption::AesDecryptor* GetDataAesDecryptor(size_t key_size);
+-
+-  int MapKeyLenToDecryptorArrayIndex(int key_len);
+-};
+-
+-}  // namespace parquet
+#if ARROW_VERSION_MAJOR < 20
+#include "internal_file_decryptor_19.h"
+#else
+#include "internal_file_decryptor_20.h"
+#endif
+--- ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/s3select_parquet_intrf.h.orig	2024-10-06 07:18:41.000000000 -0400
+++ ceph-20.0.0-2362-ga9d20fc0/src/s3select/include/s3select_parquet_intrf.h	2025-07-08 07:40:29.816727417 -0400
+@@ -1002,6 +1002,7 @@
+       throw ParquetException("Encrypted files cannot contain more than 32767 row groups");
+     }
+ 
+#if ARROW_VERSION_MAJOR < 20
+     // The column is encrypted
+     std::shared_ptr<::parquet::Decryptor> meta_decryptor;
+     std::shared_ptr<Decryptor> data_decryptor;
+@@ -1035,6 +1036,25 @@
+                             false,
+     #endif
+                             properties_.memory_pool(), &ctx);
+#else
+    // Arrow 20+ version uses factory functions instead of shared_ptr for decryptors
+    std::function<std::unique_ptr<Decryptor>()> meta_decryptor_factory =
+        InternalFileDecryptor::GetColumnMetaDecryptorFactory(file_decryptor_.get(), crypto_metadata.get());
+    std::function<std::unique_ptr<Decryptor>()> data_decryptor_factory =
+        InternalFileDecryptor::GetColumnDataDecryptorFactory(file_decryptor_.get(), crypto_metadata.get());
+
+    const CryptoContext ctx {
+        col->has_dictionary_page(),
+        row_group_ordinal_,
+        static_cast<int16_t>(i),
+        meta_decryptor_factory,
+        data_decryptor_factory,
+    };
+
+    return PageReader::Open(stream, col->num_values(), col->compression(),
+                            false,
+                            properties_.memory_pool(), &ctx);
+#endif
+   }
+ 
+  private:
+@@ -1071,7 +1091,9 @@
+   }
+ 
+   void Close() override {
+#if ARROW_VERSION_MAJOR < 20
+     if (file_decryptor_) file_decryptor_->WipeOutDecryptionKeys();
+#endif
+   }
+ 
+   std::shared_ptr<RowGroupReader> GetRowGroup(int i) override {
+@@ -1249,9 +1271,17 @@
+   // Handle AAD prefix
+   EncryptionAlgorithm algo = file_crypto_metadata->encryption_algorithm();
+   std::string file_aad = HandleAadPrefix(file_decryption_properties, algo);
+#if ARROW_VERSION_MAJOR < 20
+   file_decryptor_ = std::make_shared<::parquet::InternalFileDecryptor>(
+       file_decryption_properties, file_aad, algo.algorithm,
+       file_crypto_metadata->key_metadata(), properties_.memory_pool());
+#else
+  // Arrow 20+ takes a shared_ptr to FileDecryptionProperties
+  file_decryptor_ = std::make_shared<::parquet::InternalFileDecryptor>(
+      std::shared_ptr<FileDecryptionProperties>(file_decryption_properties),
+      file_aad, algo.algorithm,
+      file_crypto_metadata->key_metadata(), properties_.memory_pool());
+#endif
+ 
+   int64_t metadata_offset = source_size_ - kFooterSize - footer_len + crypto_metadata_len;
+   uint32_t metadata_len = footer_len - crypto_metadata_len;
+@@ -1282,9 +1312,18 @@
+     EncryptionAlgorithm algo = file_metadata_->encryption_algorithm();
+     // Handle AAD prefix
+     std::string file_aad = HandleAadPrefix(file_decryption_properties, algo);
+#if ARROW_VERSION_MAJOR < 20
+     file_decryptor_ = std::make_shared<::parquet::InternalFileDecryptor>(
+         file_decryption_properties, file_aad, algo.algorithm,
+         file_metadata_->footer_signing_key_metadata(), properties_.memory_pool());
+#else
+    // Arrow 20+ takes a shared_ptr to FileDecryptionProperties
+    file_decryptor_ = std::make_shared<::parquet::InternalFileDecryptor>(
+        std::shared_ptr<FileDecryptionProperties>(file_decryption_properties),
+        file_aad, algo.algorithm,
+        file_metadata_->footer_signing_key_metadata(), properties_.memory_pool());
+    // In Arrow 20+, no need to set file_decryptor in metadata
+#endif
+     // set the InternalFileDecryptor in the metadata as well, as it's used
+     // for signature verification and for ColumnChunkMetaData creation.
+ #if GAL_set_file_decryptor_declare_private
@@ -0,0 +1,10 @@
+--- ceph-20.0.0-2099-gc62cbb7d/src/json_spirit/json_spirit_reader_template.h.orig	2025-06-09 11:56:21.534808695 -0400
+++ ceph-20.0.0-2099-gc62cbb7d/src/json_spirit/json_spirit_reader_template.h	2025-06-09 12:01:56.358334353 -0400
+@@ -136,6 +136,7 @@
+     {
+         typedef typename String_type::const_iterator Iter_type;
+ 
+        if( end - begin < 1 ) return String_type();
+         if( end - begin < 2 ) return String_type( begin, end );
+ 
+         String_type result;
@@ -0,0 +1,13 @@
+--- ceph-20.2.0/src/CMakeLists.txt.orig	2026-01-20 14:31:56.764231793 -0500
+++ ceph-20.2.0/src/CMakeLists.txt	2026-01-20 14:35:21.258787691 -0500
+@@ -1051,8 +1051,8 @@
+ if(WITH_RADOSGW)
+   if(WITH_RADOSGW_SELECT_PARQUET OR WITH_RADOSGW_ARROW_FLIGHT)
+     if(WITH_SYSTEM_ARROW)
+-      find_package(Arrow 4 REQUIRED QUIET)
+-      find_package(Parquet 4 REQUIRED QUIET)
+      find_package(Arrow REQUIRED QUIET)
+      find_package(Parquet REQUIRED QUIET)
+     else()
+       # find arrow's dependencies
+       if (WITH_SYSTEM_UTF8PROC)
@@ -0,0 +1,22 @@
+--- ceph-20.0.0-2787-g838ba95e/src/jaegertracing/opentelemetry-cpp/api/include/opentelemetry/nostd/internal/absl/base/options.h.orig	2025-07-31 10:18:56.636528168 -0400
+++ ceph-20.0.0-2787-g838ba95e/src/jaegertracing/opentelemetry-cpp/api/include/opentelemetry/nostd/internal/absl/base/options.h	2025-07-31 10:19:12.923329646 -0400
+@@ -70,7 +70,7 @@
+ // Include a standard library header to allow configuration based on the
+ // standard library in use.
+ #ifdef __cplusplus
+-#include <ciso646>
+#include <iso646.h>
+ #endif
+ 
+ // -----------------------------------------------------------------------------
+--- ceph-20.2.0/src/boost/boost/redis/adapter/detail/adapters.hpp.orig	2026-02-06 09:54:39.748078321 -0500
+++ ceph-20.2.0/src/boost/boost/redis/adapter/detail/adapters.hpp	2026-02-06 09:55:02.427664048 -0500
+@@ -29,7 +29,7 @@
+ #include <charconv>
+ 
+ // See https://stackoverflow.com/a/31658120/1077832
+-#include<ciso646>
+#include<iso646.h>
+ #ifdef _LIBCPP_VERSION
+ #else
+ #include <cstdlib>
@@ -0,0 +1,10 @@
+--- ceph-20.2.0/src/crimson/common/smp_helpers.h.orig	2025-12-04 10:38:34.906915674 -0500
+++ ceph-20.2.0/src/crimson/common/smp_helpers.h	2025-12-04 10:38:45.200845804 -0500
+@@ -8,6 +8,7 @@
+ #include <optional>
+ #include <type_traits>
+ #include <vector>
+#include <coroutine>
+ 
+ #include <seastar/core/shared_future.hh>
+ #include <seastar/core/smp.hh>
@@ -0,0 +1,70 @@
+--- ceph-20.2.0/src/common/Formatter.h.orig	2026-01-06 17:47:18.437014517 -0500
+++ ceph-20.2.0/src/common/Formatter.h	2026-01-06 17:47:53.015404074 -0500
+@@ -12,6 +12,7 @@
+ #include <memory>
+ #include <vector>
+ #include <stdarg.h>
+#include <cstdint>
+ #include <sstream>
+ #include <map>
+ #include <vector>
+--- ceph-20.2.0/src/mds/Locker.cc.orig	2026-01-07 10:34:12.731210930 -0500
+++ ceph-20.2.0/src/mds/Locker.cc	2026-01-07 10:34:35.627823155 -0500
+@@ -4489,7 +4489,7 @@
+       dout(7) << "handle_client_lease client." << client << " renew on " << *dn
+ 	      << (!dn->lock.can_lease(client)?", revoking lease":"") << dendl;
+       if (dn->lock.can_lease(client)) {
+-        auto reply = make_message<MClientLease>(*m);
+        auto reply = ceph::make_message<MClientLease>(*m);
+ 	int pool = 1;   // fixme.. do something smart!
+ 	reply->h.duration_ms = (int)(1000 * mdcache->client_lease_durations[pool]);
+ 	reply->h.seq = ++l->seq;
+--- ceph-20.2.0/src/mds/Server.cc.orig	2026-01-07 11:27:13.532097596 -0500
+++ ceph-20.2.0/src/mds/Server.cc	2026-01-07 11:28:42.411581266 -0500
+@@ -150,7 +150,7 @@
+       }
+     }
+     batch_reqs.clear();
+-    server->reply_client_request(mdr, make_message<MClientReply>(*mdr->client_request, r));
+    server->reply_client_request(mdr, ceph::make_message<MClientReply>(*mdr->client_request, r));
+   }
+   void print(std::ostream& o) const override {
+     o << "[batch front=" << *mdr << "]";
+@@ -2142,7 +2142,7 @@
+       dout(20) << __func__ << ": batch head " << *mdr << dendl;
+       mdr->release_batch_op()->respond(r);
+     } else {
+-     reply_client_request(mdr, make_message<MClientReply>(*mdr->client_request, r));
+     reply_client_request(mdr, ceph::make_message<MClientReply>(*mdr->client_request, r));
+     }
+   } else if (mdr->internal_op > -1) {
+     dout(10) << __func__ << ": completing with result " << cpp_strerror(r) << " on internal " << *mdr << dendl;
+@@ -2290,7 +2290,7 @@
+   }
+ 
+ 
+-  auto reply = make_message<MClientReply>(*req, 0);
+  auto reply = ceph::make_message<MClientReply>(*req, 0);
+   reply->set_unsafe();
+ 
+   // mark xlocks "done", indicating that we are exposing uncommitted changes.
+@@ -2632,7 +2632,7 @@
+ 	   req->get_op() != CEPH_MDS_OP_OPEN &&
+ 	   req->get_op() != CEPH_MDS_OP_CREATE)) {
+ 	dout(5) << "already completed " << req->get_reqid() << dendl;
+-        auto reply = make_message<MClientReply>(*req, 0);
+        auto reply = ceph::make_message<MClientReply>(*req, 0);
+ 	if (created != inodeno_t()) {
+ 	  bufferlist extra;
+ 	  set_reply_extra_bl(req, created, extra);
+--- ceph-20.2.0/src/mds/MDCache.cc.orig	2026-01-07 11:28:48.882470871 -0500
+++ ceph-20.2.0/src/mds/MDCache.cc	2026-01-07 11:29:12.405069562 -0500
+@@ -10535,7 +10535,7 @@
+ 
+ 
+   CInode *cur = 0;
+-  auto reply = make_message<MDiscoverReply>(*dis);
+  auto reply = ceph::make_message<MDiscoverReply>(*dis);
+ 
+   snapid_t snapid = dis->get_snapid();
+ 
@@ -0,0 +1,11 @@
+--- ceph-20.2.0/src/rgw/driver/dbstore/CMakeLists.txt.orig	2026-01-27 19:53:53.780108462 -0500
+++ ceph-20.2.0/src/rgw/driver/dbstore/CMakeLists.txt	2026-01-28 07:30:04.861741687 -0500
+@@ -34,7 +34,7 @@
+   list(APPEND link_targets jaeger_base)
+ endif()
+ list(APPEND link_targets rgw_common)
+-target_link_libraries(dbstore_lib PUBLIC ${link_targets})
+target_link_libraries(dbstore_lib PUBLIC ${link_targets} PRIVATE rgw_a)
+ 
+ set (CMAKE_LINK_LIBRARIES ${CMAKE_LINK_LIBRARIES} dbstore_lib)
+ 
@@ -0,0 +1,8 @@
+--- ceph-20.2.0/src/jaegertracing/opentelemetry-cpp/CMakeLists.txt.orig	2026-02-17 08:17:06.372917033 -0500
+++ ceph-20.2.0/src/jaegertracing/opentelemetry-cpp/CMakeLists.txt	2026-02-17 08:17:44.026323618 -0500
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 3.1)
+cmake_minimum_required(VERSION 3.5)
+ 
+ # See https://cmake.org/cmake/help/v3.3/policy/CMP0057.html required by certain
+ # versions of gtest
@@ -0,0 +1,14 @@
+--- ceph-20.2.0/src/rgw/rgw_lua_utils.cc.orig	2026-02-17 11:46:05.677894827 -0500
+++ ceph-20.2.0/src/rgw/rgw_lua_utils.cc	2026-02-17 11:50:06.106569226 -0500
+@@ -115,7 +115,11 @@
+ 
+ // create new lua state together with reference to the guard
+ lua_State* newstate(lua_state_guard* guard) {
+#if (LUA_VERSION_NUM < 505)
+   lua_State* L = lua_newstate(allocator, guard);
+#else
+  lua_State* L = lua_newstate(allocator, guard, 314159);
+#endif
+   if (L) {
+     lua_atpanic(L, [](lua_State* L) -> int {
+       const char* msg = lua_tostring(L, -1);
@@ -1,13 +0,0 @@
-diff --git a/cmake/modules/BuildBoost.cmake b/cmake/modules/BuildBoost.cmake
-index 2e92132366..3cb1e3d958 100644
--- a/cmake/modules/BuildBoost.cmake
-+++ b/cmake/modules/BuildBoost.cmake
-@@ -62,7 +62,7 @@ function(do_build_boost version)
-   else()
-     list(APPEND boost_features "address-model=32")
-   endif()
-  set(BOOST_CXXFLAGS "-fPIC -w") # check on arm, etc <---XXX
-+  set(BOOST_CXXFLAGS "-fPIC -w -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -ftemplate-depth-1024 -fno-new-ttp-matching -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-free") # check on arm, etc <---XXX
-   list(APPEND boost_features "cxxflags=${BOOST_CXXFLAGS}")
- 
-   set(boost_with_libs)
@@ -1 +1 @@
-SHA512 (ceph-17.2.5.tar.gz) = 10cd3d9eb01c91c148a92f1f7d040bbd78af5bb1ab15d071d93f54b37097dc9e1268eed9e788fe32794d137f6af81abd6a2aeaee39cef44d2c45234a15cc6020
+SHA512 (ceph-20.2.0.tar.gz) = 5678586fe663ddc3d8ca4ded7a2b811025784abc5f493164d2f1e590608a72176a722d5984d83400c501deeb526e0a108c2e7e3d969dea7bf6ce0d0b42190ea5