Merge 95b8d80318 into 3eb5bc1a0f

Filtering for hive partitioning

.github/actions/debug/action.yml

@@ -4,15 +4,31 @@ description: Prints workflow debug info
 runs:
   using: "composite"
   steps:
-    - name: Print envs
+    - name: Envs, event.json and contexts
       shell: bash
       run: |
-          echo "::group::Envs"
+          echo '::group::Environment variables'
-          env
+          env | sort
-          echo "::endgroup::"
+          echo '::endgroup::'
-    - name: Print Event.json
+
-      shell: bash
+          echo '::group::event.json'
-      run: |
-          echo "::group::Event.json"
           python3 -m json.tool "$GITHUB_EVENT_PATH"
-          echo "::endgroup::"
+          echo '::endgroup::'
+
+          cat << 'EOF'
+          ::group::github context
+          ${{ toJSON(github) }}
+          ::endgroup::
+
+          ::group::env context
+          ${{ toJSON(env) }}
+          ::endgroup::
+
+          ::group::runner context
+          ${{ toJSON(runner) }}
+          ::endgroup::
+
+          ::group::job context
+          ${{ toJSON(job) }}
+          ::endgroup::
+          EOF

.github/workflows/backport_branches.yml

@@ -27,6 +27,8 @@ jobs:
           clear-repository: true # to ensure correct digests
           fetch-depth: 0 # to get version
           filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: Labels check
         run: |
           cd "$GITHUB_WORKSPACE/tests/ci"

.github/workflows/cherry_pick.yml

@@ -33,6 +33,8 @@ jobs:
           clear-repository: true
           token: ${{secrets.ROBOT_CLICKHOUSE_COMMIT_TOKEN}}
           fetch-depth: 0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: Cherry pick
         run: |
           cd "$GITHUB_WORKSPACE/tests/ci"

.github/workflows/create_release.yml

@@ -56,13 +56,13 @@ jobs:
       GH_TOKEN: ${{ secrets.ROBOT_CLICKHOUSE_COMMIT_TOKEN }}
     runs-on: [self-hosted, release-maker]
     steps:
-      - name: DebugInfo
-        uses: hmarr/debug-action@f7318c783045ac39ed9bb497e22ce835fdafbfe6
       - name: Check out repository code
         uses: ClickHouse/checkout@v1
         with:
           token: ${{secrets.ROBOT_CLICKHOUSE_COMMIT_TOKEN}}
           fetch-depth: 0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: Prepare Release Info
         shell: bash
         run: |

.github/workflows/docker_test_images.yml

@@ -11,6 +11,7 @@ name: Build docker images
         required: false
         type: boolean
         default: false
+
 jobs:
   DockerBuildAarch64:
     runs-on: [self-hosted, style-checker-aarch64]

.github/workflows/jepsen.yml

@@ -8,27 +8,28 @@ on: # yamllint disable-line rule:truthy
   schedule:
     - cron: '0 */6 * * *'
   workflow_dispatch:
+
 jobs:
   RunConfig:
     runs-on: [self-hosted, style-checker-aarch64]
     outputs:
       data: ${{ steps.runconfig.outputs.CI_DATA }}
     steps:
-      - name: DebugInfo
-        uses: hmarr/debug-action@f7318c783045ac39ed9bb497e22ce835fdafbfe6
       - name: Check out repository code
         uses: ClickHouse/checkout@v1
         with:
           clear-repository: true # to ensure correct digests
           fetch-depth: 0 # to get version
           filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: PrepareRunConfig
         id: runconfig
         run: |
           echo "::group::configure CI run"
           python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --configure --workflow "$GITHUB_WORKFLOW" --outfile ${{ runner.temp }}/ci_run_data.json
           echo "::endgroup::"
-          
+
           echo "::group::CI run configure results"
           python3 -m json.tool ${{ runner.temp }}/ci_run_data.json
           echo "::endgroup::"

.github/workflows/master.yml

@@ -15,14 +15,14 @@ jobs:
     outputs:
       data: ${{ steps.runconfig.outputs.CI_DATA }}
     steps:
-      - name: DebugInfo
-        uses: hmarr/debug-action@f7318c783045ac39ed9bb497e22ce835fdafbfe6
       - name: Check out repository code
         uses: ClickHouse/checkout@v1
         with:
           clear-repository: true # to ensure correct digests
           fetch-depth: 0 # to get version
           filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: Merge sync PR
         run: |
           cd "$GITHUB_WORKSPACE/tests/ci"

.github/workflows/merge_queue.yml

@@ -14,14 +14,14 @@ jobs:
     outputs:
       data: ${{ steps.runconfig.outputs.CI_DATA }}
     steps:
-      - name: DebugInfo
-        uses: hmarr/debug-action@f7318c783045ac39ed9bb497e22ce835fdafbfe6
       - name: Check out repository code
         uses: ClickHouse/checkout@v1
         with:
           clear-repository: true # to ensure correct digests
           fetch-depth: 0 # to get a version
           filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: Cancel PR workflow
         run: |
           python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --cancel-previous-run

.github/workflows/nightly.yml

@@ -15,14 +15,14 @@ jobs:
     outputs:
       data: ${{ steps.runconfig.outputs.CI_DATA }}
     steps:
-      - name: DebugInfo
-        uses: hmarr/debug-action@f7318c783045ac39ed9bb497e22ce835fdafbfe6
       - name: Check out repository code
         uses: ClickHouse/checkout@v1
         with:
           clear-repository: true # to ensure correct digests
           fetch-depth: 0 # to get version
           filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: PrepareRunConfig
         id: runconfig
         run: |

.github/workflows/pull_request.yml

@@ -25,14 +25,14 @@ jobs:
     outputs:
       data: ${{ steps.runconfig.outputs.CI_DATA }}
     steps:
-      - name: DebugInfo
-        uses: hmarr/debug-action@f7318c783045ac39ed9bb497e22ce835fdafbfe6
       - name: Check out repository code
         uses: ClickHouse/checkout@v1
         with:
           clear-repository: true # to ensure correct digests
           fetch-depth: 0 # to get a version
           filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: Cancel previous Sync PR workflow
         run: |
           python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --cancel-previous-run

.github/workflows/release_branches.yml

@@ -24,6 +24,8 @@ jobs:
           clear-repository: true # to ensure correct digests
           fetch-depth: 0 # to get version
           filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: Labels check
         run: |
           cd "$GITHUB_WORKSPACE/tests/ci"

.github/workflows/reusable_simple_job.yml

@@ -62,8 +62,6 @@ jobs:
     env:
       GITHUB_JOB_OVERRIDDEN: ${{inputs.test_name}}
     steps:
-      - name: DebugInfo
-        uses: hmarr/debug-action@f7318c783045ac39ed9bb497e22ce835fdafbfe6
       - name: Check out repository code
         uses: ClickHouse/checkout@v1
         with:
@@ -72,6 +70,8 @@ jobs:
           submodules: ${{inputs.submodules}}
           fetch-depth: ${{inputs.checkout_depth}}
           filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
       - name: Set build envs
         run: |
           cat >> "$GITHUB_ENV" << 'EOF'

.gitmodules

@@ -170,9 +170,6 @@
 [submodule "contrib/fast_float"]
 	path = contrib/fast_float
 	url = https://github.com/fastfloat/fast_float
-[submodule "contrib/libpq"]
-	path = contrib/libpq
-	url = https://github.com/ClickHouse/libpq
 [submodule "contrib/NuRaft"]
 	path = contrib/NuRaft
 	url = https://github.com/ClickHouse/NuRaft
@@ -369,3 +366,6 @@
 [submodule "contrib/numactl"]
 	path = contrib/numactl
 	url = https://github.com/ClickHouse/numactl.git
+[submodule "contrib/postgres"]
+	path = contrib/postgres
+	url = https://github.com/ClickHouse/postgres.git

README.md

@@ -40,17 +40,8 @@ Every month we get together with the community (users, contributors, customers,
 
 Keep an eye out for upcoming meetups and events around the world. Somewhere else you want us to be? Please feel free to reach out to tyler `<at>` clickhouse `<dot>` com. You can also peruse [ClickHouse Events](https://clickhouse.com/company/news-events) for a list of all upcoming trainings, meetups, speaking engagements, etc.
 
-The following upcoming meetups are featuring creator of ClickHouse & CTO, Alexey Milovidov:
+Upcoming meetups
 
-* [Raleigh Meetup (Deutsche Bank)](https://www.meetup.com/triangletechtalks/events/302723486/) - September 9
-* [New York Meetup (Rokt)](https://www.meetup.com/clickhouse-new-york-user-group/events/302575342) - September 10
-* [Chicago Meetup (Jump Capital)](https://lu.ma/43tvmrfw) - September 12
-
-Other upcoming meetups
-
-* [Toronto Meetup (Shopify)](https://www.meetup.com/clickhouse-toronto-user-group/events/301490855/) - September 10
-* [Austin Meetup](https://www.meetup.com/clickhouse-austin-user-group/events/302558689/) - September 17
-* [London Meetup](https://www.meetup.com/clickhouse-london-user-group/events/302977267) - September 17
 * [Bangalore Meetup](https://www.meetup.com/clickhouse-bangalore-user-group/events/303208274/) - September 18
 * [Tel Aviv Meetup](https://www.meetup.com/clickhouse-meetup-israel/events/303095121) - September 22
 * [Jakarta Meetup](https://www.meetup.com/clickhouse-indonesia-user-group/events/303191359/) - October 1
@@ -62,13 +53,20 @@ Other upcoming meetups
 * [Dubai Meetup](https://www.meetup.com/clickhouse-dubai-meetup-group/events/303096989/) - November 21
 * [Paris Meetup](https://www.meetup.com/clickhouse-france-user-group/events/303096434) - November 26
 
-Recently completed events
+Recently completed meetups
+
 * [ClickHouse Guangzhou User Group Meetup](https://mp.weixin.qq.com/s/GSvo-7xUoVzCsuUvlLTpCw) - August 25
 * [Seattle Meetup (Statsig)](https://www.meetup.com/clickhouse-seattle-user-group/events/302518075/) - August 27
 * [Melbourne Meetup](https://www.meetup.com/clickhouse-australia-user-group/events/302732666/) - August 27
 * [Sydney Meetup](https://www.meetup.com/clickhouse-australia-user-group/events/302862966/) - September 5
 * [Zurich Meetup](https://www.meetup.com/clickhouse-switzerland-meetup-group/events/302267429/) - September 5
 * [San Francisco Meetup (Cloudflare)](https://www.meetup.com/clickhouse-silicon-valley-meetup-group/events/302540575) - September 5
+* [Raleigh Meetup (Deutsche Bank)](https://www.meetup.com/triangletechtalks/events/302723486/) - September 9
+* [New York Meetup (Rokt)](https://www.meetup.com/clickhouse-new-york-user-group/events/302575342) - September 10
+* [Toronto Meetup (Shopify)](https://www.meetup.com/clickhouse-toronto-user-group/events/301490855/) - September 10
+* [Chicago Meetup (Jump Capital)](https://lu.ma/43tvmrfw) - September 12
+* [London Meetup](https://www.meetup.com/clickhouse-london-user-group/events/302977267) - September 17
+* [Austin Meetup](https://www.meetup.com/clickhouse-austin-user-group/events/302558689/) - September 17
 
 ## Recent Recordings
 * **Recent Meetup Videos**: [Meetup Playlist](https://www.youtube.com/playlist?list=PL0Z2YDlm0b3iNDUzpY1S3L_iV4nARda_U) Whenever possible recordings of the ClickHouse Community Meetups are edited and presented as individual talks. Current featuring "Modern SQL in 2023", "Fast, Concurrent, and Consistent Asynchronous INSERTS in ClickHouse", and "Full-Text Indices: Design and Experiments"

base/poco/Crypto/include/Poco/Crypto/EVPPKey.h

@@ -188,8 +188,9 @@ namespace Crypto
                     pFile = fopen(keyFile.c_str(), "r");
                     if (pFile)
                     {
-                        pem_password_cb * pCB = pass.empty() ? (pem_password_cb *)0 : &passCB;
+                        pem_password_cb * pCB = &passCB;
-                        void * pPassword = pass.empty() ? (void *)0 : (void *)pass.c_str();
+                        static constexpr char * no_password = "";
+                        void * pPassword = pass.empty() ? (void *)no_password : (void *)pass.c_str();
                         if (readFunc(pFile, &pKey, pCB, pPassword))
                         {
                             fclose(pFile);
@@ -225,6 +226,13 @@ namespace Crypto
         error:
             if (pFile)
                 fclose(pFile);
+            if (*ppKey)
+            {
+                if constexpr (std::is_same_v<K, EVP_PKEY>)
+                    EVP_PKEY_free(*ppKey);
+                else
+                    EC_KEY_free(*ppKey);
+            }
             throw OpenSSLException("EVPKey::loadKey(string)");
         }
 
@@ -286,6 +294,13 @@ namespace Crypto
         error:
             if (pBIO)
                 BIO_free(pBIO);
+            if (*ppKey)
+            {
+                if constexpr (std::is_same_v<K, EVP_PKEY>)
+                    EVP_PKEY_free(*ppKey);
+                else
+                    EC_KEY_free(*ppKey);
+            }
             throw OpenSSLException("EVPKey::loadKey(stream)");
         }
 

base/poco/NetSSL_OpenSSL/include/Poco/Net/Context.h

@@ -248,6 +248,9 @@ namespace Net
         SSL_CTX * sslContext() const;
         /// Returns the underlying OpenSSL SSL Context object.
 
+        SSL_CTX * takeSslContext();
+        /// Takes ownership of the underlying OpenSSL SSL Context object.
+
         Usage usage() const;
         /// Returns whether the context is for use by a client or by a server
         /// and whether TLSv1 is required.
@@ -401,6 +404,13 @@ namespace Net
         return _pSSLContext;
     }
 
+    inline SSL_CTX * Context::takeSslContext()
+    {
+        auto * result = _pSSLContext;
+        _pSSLContext = nullptr;
+        return result;
+    }
+
 
     inline bool Context::extendedCertificateVerificationEnabled() const
     {

base/poco/NetSSL_OpenSSL/src/Context.cpp

@@ -106,6 +106,11 @@ Context::Context(
 
 Context::~Context()
 {
+    if (_pSSLContext == nullptr)
+    {
+        return;
+    }
+
 	try
 	{
 		SSL_CTX_free(_pSSLContext);

contrib/CMakeLists.txt

@@ -145,8 +145,13 @@ add_contrib (isa-l-cmake isa-l)
 add_contrib (libhdfs3-cmake libhdfs3) # requires: google-protobuf, krb5, isa-l
 add_contrib (hive-metastore-cmake hive-metastore) # requires: thrift, avro, arrow, libhdfs3
 add_contrib (cppkafka-cmake cppkafka)
-add_contrib (libpqxx-cmake libpqxx)
+
-add_contrib (libpq-cmake libpq)
+option(ENABLE_LIBPQXX "Enable PostgreSQL" ${ENABLE_LIBRARIES})
+if (ENABLE_LIBPQXX)
+    add_contrib (postgres-cmake postgres)
+    add_contrib (libpqxx-cmake libpqxx)
+endif()
+
 add_contrib (rocksdb-cmake rocksdb) # requires: jemalloc, snappy, zlib, lz4, zstd, liburing
 add_contrib (nuraft-cmake NuRaft)
 add_contrib (fast_float-cmake fast_float)

contrib/icu-cmake/CMakeLists.txt

@@ -15,162 +15,64 @@ set(ICUDATA_SOURCE_DIR "${ClickHouse_SOURCE_DIR}/contrib/icudata/")
 # These lists of sources were generated from build log of the original ICU build system (configure + make).
 
 set(ICUUC_SOURCES
-"${ICU_SOURCE_DIR}/common/errorcode.cpp"
-"${ICU_SOURCE_DIR}/common/putil.cpp"
-"${ICU_SOURCE_DIR}/common/umath.cpp"
-"${ICU_SOURCE_DIR}/common/utypes.cpp"
-"${ICU_SOURCE_DIR}/common/uinvchar.cpp"
-"${ICU_SOURCE_DIR}/common/umutex.cpp"
-"${ICU_SOURCE_DIR}/common/ucln_cmn.cpp"
-"${ICU_SOURCE_DIR}/common/uinit.cpp"
-"${ICU_SOURCE_DIR}/common/uobject.cpp"
-"${ICU_SOURCE_DIR}/common/cmemory.cpp"
-"${ICU_SOURCE_DIR}/common/charstr.cpp"
-"${ICU_SOURCE_DIR}/common/cstr.cpp"
-"${ICU_SOURCE_DIR}/common/udata.cpp"
-"${ICU_SOURCE_DIR}/common/ucmndata.cpp"
-"${ICU_SOURCE_DIR}/common/udatamem.cpp"
-"${ICU_SOURCE_DIR}/common/umapfile.cpp"
-"${ICU_SOURCE_DIR}/common/udataswp.cpp"
-"${ICU_SOURCE_DIR}/common/utrie_swap.cpp"
-"${ICU_SOURCE_DIR}/common/ucol_swp.cpp"
-"${ICU_SOURCE_DIR}/common/utrace.cpp"
-"${ICU_SOURCE_DIR}/common/uhash.cpp"
-"${ICU_SOURCE_DIR}/common/uhash_us.cpp"
-"${ICU_SOURCE_DIR}/common/uenum.cpp"
-"${ICU_SOURCE_DIR}/common/ustrenum.cpp"
-"${ICU_SOURCE_DIR}/common/uvector.cpp"
-"${ICU_SOURCE_DIR}/common/ustack.cpp"
-"${ICU_SOURCE_DIR}/common/uvectr32.cpp"
-"${ICU_SOURCE_DIR}/common/uvectr64.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_bld.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_cnv.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_io.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_cb.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_err.cpp"
-"${ICU_SOURCE_DIR}/common/ucnvlat1.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_u7.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_u8.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_u16.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_u32.cpp"
-"${ICU_SOURCE_DIR}/common/ucnvscsu.cpp"
-"${ICU_SOURCE_DIR}/common/ucnvbocu.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_ext.cpp"
-"${ICU_SOURCE_DIR}/common/ucnvmbcs.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv2022.cpp"
-"${ICU_SOURCE_DIR}/common/ucnvhz.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_lmb.cpp"
-"${ICU_SOURCE_DIR}/common/ucnvisci.cpp"
-"${ICU_SOURCE_DIR}/common/ucnvdisp.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_set.cpp"
-"${ICU_SOURCE_DIR}/common/ucnv_ct.cpp"
-"${ICU_SOURCE_DIR}/common/resource.cpp"
-"${ICU_SOURCE_DIR}/common/uresbund.cpp"
-"${ICU_SOURCE_DIR}/common/ures_cnv.cpp"
-"${ICU_SOURCE_DIR}/common/uresdata.cpp"
-"${ICU_SOURCE_DIR}/common/resbund.cpp"
-"${ICU_SOURCE_DIR}/common/resbund_cnv.cpp"
-"${ICU_SOURCE_DIR}/common/ucurr.cpp"
-"${ICU_SOURCE_DIR}/common/localebuilder.cpp"
-"${ICU_SOURCE_DIR}/common/localeprioritylist.cpp"
-"${ICU_SOURCE_DIR}/common/messagepattern.cpp"
-"${ICU_SOURCE_DIR}/common/ucat.cpp"
-"${ICU_SOURCE_DIR}/common/locmap.cpp"
-"${ICU_SOURCE_DIR}/common/uloc.cpp"
-"${ICU_SOURCE_DIR}/common/locid.cpp"
-"${ICU_SOURCE_DIR}/common/locutil.cpp"
-"${ICU_SOURCE_DIR}/common/locavailable.cpp"
-"${ICU_SOURCE_DIR}/common/locdispnames.cpp"
-"${ICU_SOURCE_DIR}/common/locdspnm.cpp"
-"${ICU_SOURCE_DIR}/common/loclikely.cpp"
-"${ICU_SOURCE_DIR}/common/locresdata.cpp"
-"${ICU_SOURCE_DIR}/common/lsr.cpp"
-"${ICU_SOURCE_DIR}/common/loclikelysubtags.cpp"
-"${ICU_SOURCE_DIR}/common/locdistance.cpp"
-"${ICU_SOURCE_DIR}/common/localematcher.cpp"
-"${ICU_SOURCE_DIR}/common/bytestream.cpp"
-"${ICU_SOURCE_DIR}/common/stringpiece.cpp"
-"${ICU_SOURCE_DIR}/common/bytesinkutil.cpp"
-"${ICU_SOURCE_DIR}/common/stringtriebuilder.cpp"
-"${ICU_SOURCE_DIR}/common/bytestriebuilder.cpp"
-"${ICU_SOURCE_DIR}/common/bytestrie.cpp"
-"${ICU_SOURCE_DIR}/common/bytestrieiterator.cpp"
-"${ICU_SOURCE_DIR}/common/ucharstrie.cpp"
-"${ICU_SOURCE_DIR}/common/ucharstriebuilder.cpp"
-"${ICU_SOURCE_DIR}/common/ucharstrieiterator.cpp"
-"${ICU_SOURCE_DIR}/common/dictionarydata.cpp"
-"${ICU_SOURCE_DIR}/common/edits.cpp"
 "${ICU_SOURCE_DIR}/common/appendable.cpp"
-"${ICU_SOURCE_DIR}/common/ustr_cnv.cpp"
-"${ICU_SOURCE_DIR}/common/unistr_cnv.cpp"
-"${ICU_SOURCE_DIR}/common/unistr.cpp"
-"${ICU_SOURCE_DIR}/common/unistr_case.cpp"
-"${ICU_SOURCE_DIR}/common/unistr_props.cpp"
-"${ICU_SOURCE_DIR}/common/utf_impl.cpp"
-"${ICU_SOURCE_DIR}/common/ustring.cpp"
-"${ICU_SOURCE_DIR}/common/ustrcase.cpp"
-"${ICU_SOURCE_DIR}/common/ucasemap.cpp"
-"${ICU_SOURCE_DIR}/common/ucasemap_titlecase_brkiter.cpp"
-"${ICU_SOURCE_DIR}/common/cstring.cpp"
-"${ICU_SOURCE_DIR}/common/ustrfmt.cpp"
-"${ICU_SOURCE_DIR}/common/ustrtrns.cpp"
-"${ICU_SOURCE_DIR}/common/ustr_wcs.cpp"
-"${ICU_SOURCE_DIR}/common/utext.cpp"
-"${ICU_SOURCE_DIR}/common/unistr_case_locale.cpp"
-"${ICU_SOURCE_DIR}/common/ustrcase_locale.cpp"
-"${ICU_SOURCE_DIR}/common/unistr_titlecase_brkiter.cpp"
-"${ICU_SOURCE_DIR}/common/ustr_titlecase_brkiter.cpp"
-"${ICU_SOURCE_DIR}/common/normalizer2impl.cpp"
-"${ICU_SOURCE_DIR}/common/normalizer2.cpp"
-"${ICU_SOURCE_DIR}/common/filterednormalizer2.cpp"
-"${ICU_SOURCE_DIR}/common/normlzr.cpp"
-"${ICU_SOURCE_DIR}/common/unorm.cpp"
-"${ICU_SOURCE_DIR}/common/unormcmp.cpp"
-"${ICU_SOURCE_DIR}/common/loadednormalizer2impl.cpp"
-"${ICU_SOURCE_DIR}/common/chariter.cpp"
-"${ICU_SOURCE_DIR}/common/schriter.cpp"
-"${ICU_SOURCE_DIR}/common/uchriter.cpp"
-"${ICU_SOURCE_DIR}/common/uiter.cpp"
-"${ICU_SOURCE_DIR}/common/patternprops.cpp"
-"${ICU_SOURCE_DIR}/common/uchar.cpp"
-"${ICU_SOURCE_DIR}/common/uprops.cpp"
-"${ICU_SOURCE_DIR}/common/ucase.cpp"
-"${ICU_SOURCE_DIR}/common/propname.cpp"
-"${ICU_SOURCE_DIR}/common/ubidi_props.cpp"
-"${ICU_SOURCE_DIR}/common/characterproperties.cpp"
-"${ICU_SOURCE_DIR}/common/ubidi.cpp"
-"${ICU_SOURCE_DIR}/common/ubidiwrt.cpp"
-"${ICU_SOURCE_DIR}/common/ubidiln.cpp"
-"${ICU_SOURCE_DIR}/common/ushape.cpp"
-"${ICU_SOURCE_DIR}/common/uscript.cpp"
-"${ICU_SOURCE_DIR}/common/uscript_props.cpp"
-"${ICU_SOURCE_DIR}/common/usc_impl.cpp"
-"${ICU_SOURCE_DIR}/common/unames.cpp"
-"${ICU_SOURCE_DIR}/common/utrie.cpp"
-"${ICU_SOURCE_DIR}/common/utrie2.cpp"
-"${ICU_SOURCE_DIR}/common/utrie2_builder.cpp"
-"${ICU_SOURCE_DIR}/common/ucptrie.cpp"
-"${ICU_SOURCE_DIR}/common/umutablecptrie.cpp"
 "${ICU_SOURCE_DIR}/common/bmpset.cpp"
-"${ICU_SOURCE_DIR}/common/unisetspan.cpp"
-"${ICU_SOURCE_DIR}/common/uset_props.cpp"
-"${ICU_SOURCE_DIR}/common/uniset_props.cpp"
-"${ICU_SOURCE_DIR}/common/uniset_closure.cpp"
-"${ICU_SOURCE_DIR}/common/uset.cpp"
-"${ICU_SOURCE_DIR}/common/uniset.cpp"
-"${ICU_SOURCE_DIR}/common/usetiter.cpp"
-"${ICU_SOURCE_DIR}/common/ruleiter.cpp"
-"${ICU_SOURCE_DIR}/common/caniter.cpp"
-"${ICU_SOURCE_DIR}/common/unifilt.cpp"
-"${ICU_SOURCE_DIR}/common/unifunct.cpp"
-"${ICU_SOURCE_DIR}/common/uarrsort.cpp"
-"${ICU_SOURCE_DIR}/common/brkiter.cpp"
-"${ICU_SOURCE_DIR}/common/ubrk.cpp"
 "${ICU_SOURCE_DIR}/common/brkeng.cpp"
+"${ICU_SOURCE_DIR}/common/brkiter.cpp"
+"${ICU_SOURCE_DIR}/common/bytesinkutil.cpp"
+"${ICU_SOURCE_DIR}/common/bytestream.cpp"
+"${ICU_SOURCE_DIR}/common/bytestrie.cpp"
+"${ICU_SOURCE_DIR}/common/bytestriebuilder.cpp"
+"${ICU_SOURCE_DIR}/common/bytestrieiterator.cpp"
+"${ICU_SOURCE_DIR}/common/caniter.cpp"
+"${ICU_SOURCE_DIR}/common/characterproperties.cpp"
+"${ICU_SOURCE_DIR}/common/chariter.cpp"
+"${ICU_SOURCE_DIR}/common/charstr.cpp"
+"${ICU_SOURCE_DIR}/common/cmemory.cpp"
+"${ICU_SOURCE_DIR}/common/cstr.cpp"
+"${ICU_SOURCE_DIR}/common/cstring.cpp"
+"${ICU_SOURCE_DIR}/common/cwchar.cpp"
 "${ICU_SOURCE_DIR}/common/dictbe.cpp"
+"${ICU_SOURCE_DIR}/common/dictionarydata.cpp"
+"${ICU_SOURCE_DIR}/common/dtintrv.cpp"
+"${ICU_SOURCE_DIR}/common/edits.cpp"
+"${ICU_SOURCE_DIR}/common/emojiprops.cpp"
+"${ICU_SOURCE_DIR}/common/errorcode.cpp"
 "${ICU_SOURCE_DIR}/common/filteredbrk.cpp"
+"${ICU_SOURCE_DIR}/common/filterednormalizer2.cpp"
+"${ICU_SOURCE_DIR}/common/icudataver.cpp"
+"${ICU_SOURCE_DIR}/common/icuplug.cpp"
+"${ICU_SOURCE_DIR}/common/loadednormalizer2impl.cpp"
+"${ICU_SOURCE_DIR}/common/localebuilder.cpp"
+"${ICU_SOURCE_DIR}/common/localematcher.cpp"
+"${ICU_SOURCE_DIR}/common/localeprioritylist.cpp"
+"${ICU_SOURCE_DIR}/common/locavailable.cpp"
+"${ICU_SOURCE_DIR}/common/locbased.cpp"
+"${ICU_SOURCE_DIR}/common/locdispnames.cpp"
+"${ICU_SOURCE_DIR}/common/locdistance.cpp"
+"${ICU_SOURCE_DIR}/common/locdspnm.cpp"
+"${ICU_SOURCE_DIR}/common/locid.cpp"
+"${ICU_SOURCE_DIR}/common/loclikely.cpp"
+"${ICU_SOURCE_DIR}/common/loclikelysubtags.cpp"
+"${ICU_SOURCE_DIR}/common/locmap.cpp"
+"${ICU_SOURCE_DIR}/common/locresdata.cpp"
+"${ICU_SOURCE_DIR}/common/locutil.cpp"
+"${ICU_SOURCE_DIR}/common/lsr.cpp"
+"${ICU_SOURCE_DIR}/common/lstmbe.cpp"
+"${ICU_SOURCE_DIR}/common/messagepattern.cpp"
+"${ICU_SOURCE_DIR}/common/mlbe.cpp"
+"${ICU_SOURCE_DIR}/common/normalizer2.cpp"
+"${ICU_SOURCE_DIR}/common/normalizer2impl.cpp"
+"${ICU_SOURCE_DIR}/common/normlzr.cpp"
+"${ICU_SOURCE_DIR}/common/parsepos.cpp"
+"${ICU_SOURCE_DIR}/common/patternprops.cpp"
+"${ICU_SOURCE_DIR}/common/pluralmap.cpp"
+"${ICU_SOURCE_DIR}/common/propname.cpp"
+"${ICU_SOURCE_DIR}/common/propsvec.cpp"
+"${ICU_SOURCE_DIR}/common/punycode.cpp"
+"${ICU_SOURCE_DIR}/common/putil.cpp"
 "${ICU_SOURCE_DIR}/common/rbbi.cpp"
+"${ICU_SOURCE_DIR}/common/rbbi_cache.cpp"
 "${ICU_SOURCE_DIR}/common/rbbidata.cpp"
 "${ICU_SOURCE_DIR}/common/rbbinode.cpp"
 "${ICU_SOURCE_DIR}/common/rbbirb.cpp"
@@ -178,166 +80,180 @@ set(ICUUC_SOURCES
 "${ICU_SOURCE_DIR}/common/rbbisetb.cpp"
 "${ICU_SOURCE_DIR}/common/rbbistbl.cpp"
 "${ICU_SOURCE_DIR}/common/rbbitblb.cpp"
-"${ICU_SOURCE_DIR}/common/rbbi_cache.cpp"
+"${ICU_SOURCE_DIR}/common/resbund.cpp"
+"${ICU_SOURCE_DIR}/common/resbund_cnv.cpp"
+"${ICU_SOURCE_DIR}/common/resource.cpp"
+"${ICU_SOURCE_DIR}/common/restrace.cpp"
+"${ICU_SOURCE_DIR}/common/ruleiter.cpp"
+"${ICU_SOURCE_DIR}/common/schriter.cpp"
 "${ICU_SOURCE_DIR}/common/serv.cpp"
-"${ICU_SOURCE_DIR}/common/servnotf.cpp"
-"${ICU_SOURCE_DIR}/common/servls.cpp"
 "${ICU_SOURCE_DIR}/common/servlk.cpp"
 "${ICU_SOURCE_DIR}/common/servlkf.cpp"
+"${ICU_SOURCE_DIR}/common/servls.cpp"
+"${ICU_SOURCE_DIR}/common/servnotf.cpp"
 "${ICU_SOURCE_DIR}/common/servrbf.cpp"
 "${ICU_SOURCE_DIR}/common/servslkf.cpp"
-"${ICU_SOURCE_DIR}/common/uidna.cpp"
-"${ICU_SOURCE_DIR}/common/usprep.cpp"
-"${ICU_SOURCE_DIR}/common/uts46.cpp"
-"${ICU_SOURCE_DIR}/common/punycode.cpp"
-"${ICU_SOURCE_DIR}/common/util.cpp"
-"${ICU_SOURCE_DIR}/common/util_props.cpp"
-"${ICU_SOURCE_DIR}/common/parsepos.cpp"
-"${ICU_SOURCE_DIR}/common/locbased.cpp"
-"${ICU_SOURCE_DIR}/common/cwchar.cpp"
-"${ICU_SOURCE_DIR}/common/wintz.cpp"
-"${ICU_SOURCE_DIR}/common/dtintrv.cpp"
-"${ICU_SOURCE_DIR}/common/ucnvsel.cpp"
-"${ICU_SOURCE_DIR}/common/propsvec.cpp"
-"${ICU_SOURCE_DIR}/common/ulist.cpp"
-"${ICU_SOURCE_DIR}/common/uloc_tag.cpp"
-"${ICU_SOURCE_DIR}/common/icudataver.cpp"
-"${ICU_SOURCE_DIR}/common/icuplug.cpp"
 "${ICU_SOURCE_DIR}/common/sharedobject.cpp"
 "${ICU_SOURCE_DIR}/common/simpleformatter.cpp"
-"${ICU_SOURCE_DIR}/common/unifiedcache.cpp"
-"${ICU_SOURCE_DIR}/common/uloc_keytype.cpp"
-"${ICU_SOURCE_DIR}/common/ubiditransform.cpp"
-"${ICU_SOURCE_DIR}/common/pluralmap.cpp"
 "${ICU_SOURCE_DIR}/common/static_unicode_sets.cpp"
-"${ICU_SOURCE_DIR}/common/restrace.cpp"
+"${ICU_SOURCE_DIR}/common/stringpiece.cpp"
-"${ICU_SOURCE_DIR}/common/emojiprops.cpp"
+"${ICU_SOURCE_DIR}/common/stringtriebuilder.cpp"
-"${ICU_SOURCE_DIR}/common/lstmbe.cpp")
+"${ICU_SOURCE_DIR}/common/uarrsort.cpp"
+"${ICU_SOURCE_DIR}/common/ubidi.cpp"
+"${ICU_SOURCE_DIR}/common/ubidi_props.cpp"
+"${ICU_SOURCE_DIR}/common/ubidiln.cpp"
+"${ICU_SOURCE_DIR}/common/ubiditransform.cpp"
+"${ICU_SOURCE_DIR}/common/ubidiwrt.cpp"
+"${ICU_SOURCE_DIR}/common/ubrk.cpp"
+"${ICU_SOURCE_DIR}/common/ucase.cpp"
+"${ICU_SOURCE_DIR}/common/ucasemap.cpp"
+"${ICU_SOURCE_DIR}/common/ucasemap_titlecase_brkiter.cpp"
+"${ICU_SOURCE_DIR}/common/ucat.cpp"
+"${ICU_SOURCE_DIR}/common/uchar.cpp"
+"${ICU_SOURCE_DIR}/common/ucharstrie.cpp"
+"${ICU_SOURCE_DIR}/common/ucharstriebuilder.cpp"
+"${ICU_SOURCE_DIR}/common/ucharstrieiterator.cpp"
+"${ICU_SOURCE_DIR}/common/uchriter.cpp"
+"${ICU_SOURCE_DIR}/common/ucln_cmn.cpp"
+"${ICU_SOURCE_DIR}/common/ucmndata.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv2022.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_bld.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_cb.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_cnv.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_ct.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_err.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_ext.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_io.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_lmb.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_set.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_u16.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_u32.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_u7.cpp"
+"${ICU_SOURCE_DIR}/common/ucnv_u8.cpp"
+"${ICU_SOURCE_DIR}/common/ucnvbocu.cpp"
+"${ICU_SOURCE_DIR}/common/ucnvdisp.cpp"
+"${ICU_SOURCE_DIR}/common/ucnvhz.cpp"
+"${ICU_SOURCE_DIR}/common/ucnvisci.cpp"
+"${ICU_SOURCE_DIR}/common/ucnvlat1.cpp"
+"${ICU_SOURCE_DIR}/common/ucnvmbcs.cpp"
+"${ICU_SOURCE_DIR}/common/ucnvscsu.cpp"
+"${ICU_SOURCE_DIR}/common/ucnvsel.cpp"
+"${ICU_SOURCE_DIR}/common/ucol_swp.cpp"
+"${ICU_SOURCE_DIR}/common/ucptrie.cpp"
+"${ICU_SOURCE_DIR}/common/ucurr.cpp"
+"${ICU_SOURCE_DIR}/common/udata.cpp"
+"${ICU_SOURCE_DIR}/common/udatamem.cpp"
+"${ICU_SOURCE_DIR}/common/udataswp.cpp"
+"${ICU_SOURCE_DIR}/common/uenum.cpp"
+"${ICU_SOURCE_DIR}/common/uhash.cpp"
+"${ICU_SOURCE_DIR}/common/uhash_us.cpp"
+"${ICU_SOURCE_DIR}/common/uidna.cpp"
+"${ICU_SOURCE_DIR}/common/uinit.cpp"
+"${ICU_SOURCE_DIR}/common/uinvchar.cpp"
+"${ICU_SOURCE_DIR}/common/uiter.cpp"
+"${ICU_SOURCE_DIR}/common/ulist.cpp"
+"${ICU_SOURCE_DIR}/common/uloc.cpp"
+"${ICU_SOURCE_DIR}/common/uloc_keytype.cpp"
+"${ICU_SOURCE_DIR}/common/uloc_tag.cpp"
+"${ICU_SOURCE_DIR}/common/ulocale.cpp"
+"${ICU_SOURCE_DIR}/common/ulocbuilder.cpp"
+"${ICU_SOURCE_DIR}/common/umapfile.cpp"
+"${ICU_SOURCE_DIR}/common/umath.cpp"
+"${ICU_SOURCE_DIR}/common/umutablecptrie.cpp"
+"${ICU_SOURCE_DIR}/common/umutex.cpp"
+"${ICU_SOURCE_DIR}/common/unames.cpp"
+"${ICU_SOURCE_DIR}/common/unifiedcache.cpp"
+"${ICU_SOURCE_DIR}/common/unifilt.cpp"
+"${ICU_SOURCE_DIR}/common/unifunct.cpp"
+"${ICU_SOURCE_DIR}/common/uniset.cpp"
+"${ICU_SOURCE_DIR}/common/uniset_closure.cpp"
+"${ICU_SOURCE_DIR}/common/uniset_props.cpp"
+"${ICU_SOURCE_DIR}/common/unisetspan.cpp"
+"${ICU_SOURCE_DIR}/common/unistr.cpp"
+"${ICU_SOURCE_DIR}/common/unistr_case.cpp"
+"${ICU_SOURCE_DIR}/common/unistr_case_locale.cpp"
+"${ICU_SOURCE_DIR}/common/unistr_cnv.cpp"
+"${ICU_SOURCE_DIR}/common/unistr_props.cpp"
+"${ICU_SOURCE_DIR}/common/unistr_titlecase_brkiter.cpp"
+"${ICU_SOURCE_DIR}/common/unorm.cpp"
+"${ICU_SOURCE_DIR}/common/unormcmp.cpp"
+"${ICU_SOURCE_DIR}/common/uobject.cpp"
+"${ICU_SOURCE_DIR}/common/uprops.cpp"
+"${ICU_SOURCE_DIR}/common/ures_cnv.cpp"
+"${ICU_SOURCE_DIR}/common/uresbund.cpp"
+"${ICU_SOURCE_DIR}/common/uresdata.cpp"
+"${ICU_SOURCE_DIR}/common/usc_impl.cpp"
+"${ICU_SOURCE_DIR}/common/uscript.cpp"
+"${ICU_SOURCE_DIR}/common/uscript_props.cpp"
+"${ICU_SOURCE_DIR}/common/uset.cpp"
+"${ICU_SOURCE_DIR}/common/uset_props.cpp"
+"${ICU_SOURCE_DIR}/common/usetiter.cpp"
+"${ICU_SOURCE_DIR}/common/ushape.cpp"
+"${ICU_SOURCE_DIR}/common/usprep.cpp"
+"${ICU_SOURCE_DIR}/common/ustack.cpp"
+"${ICU_SOURCE_DIR}/common/ustr_cnv.cpp"
+"${ICU_SOURCE_DIR}/common/ustr_titlecase_brkiter.cpp"
+"${ICU_SOURCE_DIR}/common/ustr_wcs.cpp"
+"${ICU_SOURCE_DIR}/common/ustrcase.cpp"
+"${ICU_SOURCE_DIR}/common/ustrcase_locale.cpp"
+"${ICU_SOURCE_DIR}/common/ustrenum.cpp"
+"${ICU_SOURCE_DIR}/common/ustrfmt.cpp"
+"${ICU_SOURCE_DIR}/common/ustring.cpp"
+"${ICU_SOURCE_DIR}/common/ustrtrns.cpp"
+"${ICU_SOURCE_DIR}/common/utext.cpp"
+"${ICU_SOURCE_DIR}/common/utf_impl.cpp"
+"${ICU_SOURCE_DIR}/common/util.cpp"
+"${ICU_SOURCE_DIR}/common/util_props.cpp"
+"${ICU_SOURCE_DIR}/common/utrace.cpp"
+"${ICU_SOURCE_DIR}/common/utrie.cpp"
+"${ICU_SOURCE_DIR}/common/utrie2.cpp"
+"${ICU_SOURCE_DIR}/common/utrie2_builder.cpp"
+"${ICU_SOURCE_DIR}/common/utrie_swap.cpp"
+"${ICU_SOURCE_DIR}/common/uts46.cpp"
+"${ICU_SOURCE_DIR}/common/utypes.cpp"
+"${ICU_SOURCE_DIR}/common/uvector.cpp"
+"${ICU_SOURCE_DIR}/common/uvectr32.cpp"
+"${ICU_SOURCE_DIR}/common/uvectr64.cpp"
+"${ICU_SOURCE_DIR}/common/wintz.cpp")
 
 set(ICUI18N_SOURCES
-"${ICU_SOURCE_DIR}/i18n/ucln_in.cpp"
+"${ICU_SOURCE_DIR}/i18n/alphaindex.cpp"
-"${ICU_SOURCE_DIR}/i18n/fmtable.cpp"
+"${ICU_SOURCE_DIR}/i18n/anytrans.cpp"
-"${ICU_SOURCE_DIR}/i18n/format.cpp"
-"${ICU_SOURCE_DIR}/i18n/msgfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/umsg.cpp"
-"${ICU_SOURCE_DIR}/i18n/numfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/unum.cpp"
-"${ICU_SOURCE_DIR}/i18n/decimfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/dcfmtsym.cpp"
-"${ICU_SOURCE_DIR}/i18n/fmtable_cnv.cpp"
-"${ICU_SOURCE_DIR}/i18n/choicfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/datefmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/smpdtfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/reldtfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/dtfmtsym.cpp"
-"${ICU_SOURCE_DIR}/i18n/udat.cpp"
-"${ICU_SOURCE_DIR}/i18n/dtptngen.cpp"
-"${ICU_SOURCE_DIR}/i18n/udatpg.cpp"
-"${ICU_SOURCE_DIR}/i18n/nfrs.cpp"
-"${ICU_SOURCE_DIR}/i18n/nfrule.cpp"
-"${ICU_SOURCE_DIR}/i18n/nfsubs.cpp"
-"${ICU_SOURCE_DIR}/i18n/rbnf.cpp"
-"${ICU_SOURCE_DIR}/i18n/numsys.cpp"
-"${ICU_SOURCE_DIR}/i18n/unumsys.cpp"
-"${ICU_SOURCE_DIR}/i18n/ucsdet.cpp"
-"${ICU_SOURCE_DIR}/i18n/ucal.cpp"
-"${ICU_SOURCE_DIR}/i18n/calendar.cpp"
-"${ICU_SOURCE_DIR}/i18n/gregocal.cpp"
-"${ICU_SOURCE_DIR}/i18n/timezone.cpp"
-"${ICU_SOURCE_DIR}/i18n/simpletz.cpp"
-"${ICU_SOURCE_DIR}/i18n/olsontz.cpp"
 "${ICU_SOURCE_DIR}/i18n/astro.cpp"
-"${ICU_SOURCE_DIR}/i18n/taiwncal.cpp"
+"${ICU_SOURCE_DIR}/i18n/basictz.cpp"
+"${ICU_SOURCE_DIR}/i18n/bocsu.cpp"
+"${ICU_SOURCE_DIR}/i18n/brktrans.cpp"
 "${ICU_SOURCE_DIR}/i18n/buddhcal.cpp"
-"${ICU_SOURCE_DIR}/i18n/persncal.cpp"
+"${ICU_SOURCE_DIR}/i18n/calendar.cpp"
-"${ICU_SOURCE_DIR}/i18n/islamcal.cpp"
+"${ICU_SOURCE_DIR}/i18n/casetrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/japancal.cpp"
-"${ICU_SOURCE_DIR}/i18n/gregoimp.cpp"
-"${ICU_SOURCE_DIR}/i18n/hebrwcal.cpp"
-"${ICU_SOURCE_DIR}/i18n/indiancal.cpp"
-"${ICU_SOURCE_DIR}/i18n/chnsecal.cpp"
 "${ICU_SOURCE_DIR}/i18n/cecal.cpp"
-"${ICU_SOURCE_DIR}/i18n/coptccal.cpp"
+"${ICU_SOURCE_DIR}/i18n/chnsecal.cpp"
-"${ICU_SOURCE_DIR}/i18n/dangical.cpp"
+"${ICU_SOURCE_DIR}/i18n/choicfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/ethpccal.cpp"
 "${ICU_SOURCE_DIR}/i18n/coleitr.cpp"
 "${ICU_SOURCE_DIR}/i18n/coll.cpp"
-"${ICU_SOURCE_DIR}/i18n/sortkey.cpp"
-"${ICU_SOURCE_DIR}/i18n/bocsu.cpp"
-"${ICU_SOURCE_DIR}/i18n/ucoleitr.cpp"
-"${ICU_SOURCE_DIR}/i18n/ucol.cpp"
-"${ICU_SOURCE_DIR}/i18n/ucol_res.cpp"
-"${ICU_SOURCE_DIR}/i18n/ucol_sit.cpp"
 "${ICU_SOURCE_DIR}/i18n/collation.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationsettings.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationbuilder.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationcompare.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationdata.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationtailoring.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationdatabuilder.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationdatareader.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationdatawriter.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationfastlatin.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationfastlatinbuilder.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationfcd.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationiterator.cpp"
-"${ICU_SOURCE_DIR}/i18n/utf16collationiterator.cpp"
-"${ICU_SOURCE_DIR}/i18n/utf8collationiterator.cpp"
-"${ICU_SOURCE_DIR}/i18n/uitercollationiterator.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationsets.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationcompare.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationfastlatin.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationkeys.cpp"
-"${ICU_SOURCE_DIR}/i18n/rulebasedcollator.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationroot.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationrootelements.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationdatabuilder.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationweights.cpp"
 "${ICU_SOURCE_DIR}/i18n/collationruleparser.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationbuilder.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationsets.cpp"
-"${ICU_SOURCE_DIR}/i18n/collationfastlatinbuilder.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationsettings.cpp"
-"${ICU_SOURCE_DIR}/i18n/listformatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationtailoring.cpp"
-"${ICU_SOURCE_DIR}/i18n/ulistformatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/collationweights.cpp"
-"${ICU_SOURCE_DIR}/i18n/strmatch.cpp"
+"${ICU_SOURCE_DIR}/i18n/compactdecimalformat.cpp"
-"${ICU_SOURCE_DIR}/i18n/usearch.cpp"
+"${ICU_SOURCE_DIR}/i18n/coptccal.cpp"
-"${ICU_SOURCE_DIR}/i18n/search.cpp"
-"${ICU_SOURCE_DIR}/i18n/stsearch.cpp"
-"${ICU_SOURCE_DIR}/i18n/translit.cpp"
-"${ICU_SOURCE_DIR}/i18n/utrans.cpp"
-"${ICU_SOURCE_DIR}/i18n/esctrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/unesctrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/funcrepl.cpp"
-"${ICU_SOURCE_DIR}/i18n/strrepl.cpp"
-"${ICU_SOURCE_DIR}/i18n/tridpars.cpp"
 "${ICU_SOURCE_DIR}/i18n/cpdtrans.cpp"
-"${ICU_SOURCE_DIR}/i18n/rbt.cpp"
-"${ICU_SOURCE_DIR}/i18n/rbt_data.cpp"
-"${ICU_SOURCE_DIR}/i18n/rbt_pars.cpp"
-"${ICU_SOURCE_DIR}/i18n/rbt_rule.cpp"
-"${ICU_SOURCE_DIR}/i18n/rbt_set.cpp"
-"${ICU_SOURCE_DIR}/i18n/nultrans.cpp"
-"${ICU_SOURCE_DIR}/i18n/remtrans.cpp"
-"${ICU_SOURCE_DIR}/i18n/casetrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/titletrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/tolowtrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/toupptrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/anytrans.cpp"
-"${ICU_SOURCE_DIR}/i18n/name2uni.cpp"
-"${ICU_SOURCE_DIR}/i18n/uni2name.cpp"
-"${ICU_SOURCE_DIR}/i18n/nortrans.cpp"
-"${ICU_SOURCE_DIR}/i18n/quant.cpp"
-"${ICU_SOURCE_DIR}/i18n/transreg.cpp"
-"${ICU_SOURCE_DIR}/i18n/brktrans.cpp"
-"${ICU_SOURCE_DIR}/i18n/regexcmp.cpp"
-"${ICU_SOURCE_DIR}/i18n/rematch.cpp"
-"${ICU_SOURCE_DIR}/i18n/repattrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/regexst.cpp"
-"${ICU_SOURCE_DIR}/i18n/regextxt.cpp"
-"${ICU_SOURCE_DIR}/i18n/regeximp.cpp"
-"${ICU_SOURCE_DIR}/i18n/uregex.cpp"
-"${ICU_SOURCE_DIR}/i18n/uregexc.cpp"
-"${ICU_SOURCE_DIR}/i18n/ulocdata.cpp"
-"${ICU_SOURCE_DIR}/i18n/measfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/currfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/curramt.cpp"
-"${ICU_SOURCE_DIR}/i18n/currunit.cpp"
-"${ICU_SOURCE_DIR}/i18n/measure.cpp"
-"${ICU_SOURCE_DIR}/i18n/utmscale.cpp"
 "${ICU_SOURCE_DIR}/i18n/csdetect.cpp"
 "${ICU_SOURCE_DIR}/i18n/csmatch.cpp"
 "${ICU_SOURCE_DIR}/i18n/csr2022.cpp"
@@ -346,60 +262,80 @@ set(ICUI18N_SOURCES
 "${ICU_SOURCE_DIR}/i18n/csrsbcs.cpp"
 "${ICU_SOURCE_DIR}/i18n/csrucode.cpp"
 "${ICU_SOURCE_DIR}/i18n/csrutf8.cpp"
-"${ICU_SOURCE_DIR}/i18n/inputext.cpp"
+"${ICU_SOURCE_DIR}/i18n/curramt.cpp"
-"${ICU_SOURCE_DIR}/i18n/wintzimpl.cpp"
+"${ICU_SOURCE_DIR}/i18n/currfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/windtfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/currpinf.cpp"
-"${ICU_SOURCE_DIR}/i18n/winnmfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/currunit.cpp"
-"${ICU_SOURCE_DIR}/i18n/basictz.cpp"
+"${ICU_SOURCE_DIR}/i18n/dangical.cpp"
-"${ICU_SOURCE_DIR}/i18n/dtrule.cpp"
+"${ICU_SOURCE_DIR}/i18n/datefmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/rbtz.cpp"
+"${ICU_SOURCE_DIR}/i18n/dayperiodrules.cpp"
-"${ICU_SOURCE_DIR}/i18n/tzrule.cpp"
+"${ICU_SOURCE_DIR}/i18n/dcfmtsym.cpp"
-"${ICU_SOURCE_DIR}/i18n/tztrans.cpp"
+"${ICU_SOURCE_DIR}/i18n/decContext.cpp"
-"${ICU_SOURCE_DIR}/i18n/vtzone.cpp"
+"${ICU_SOURCE_DIR}/i18n/decNumber.cpp"
-"${ICU_SOURCE_DIR}/i18n/zonemeta.cpp"
+"${ICU_SOURCE_DIR}/i18n/decimfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/standardplural.cpp"
+"${ICU_SOURCE_DIR}/i18n/displayoptions.cpp"
-"${ICU_SOURCE_DIR}/i18n/upluralrules.cpp"
+"${ICU_SOURCE_DIR}/i18n/double-conversion-bignum-dtoa.cpp"
-"${ICU_SOURCE_DIR}/i18n/plurrule.cpp"
+"${ICU_SOURCE_DIR}/i18n/double-conversion-bignum.cpp"
-"${ICU_SOURCE_DIR}/i18n/plurfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/double-conversion-cached-powers.cpp"
-"${ICU_SOURCE_DIR}/i18n/selfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/double-conversion-double-to-string.cpp"
+"${ICU_SOURCE_DIR}/i18n/double-conversion-fast-dtoa.cpp"
+"${ICU_SOURCE_DIR}/i18n/double-conversion-string-to-double.cpp"
+"${ICU_SOURCE_DIR}/i18n/double-conversion-strtod.cpp"
+"${ICU_SOURCE_DIR}/i18n/dtfmtsym.cpp"
 "${ICU_SOURCE_DIR}/i18n/dtitvfmt.cpp"
 "${ICU_SOURCE_DIR}/i18n/dtitvinf.cpp"
-"${ICU_SOURCE_DIR}/i18n/udateintervalformat.cpp"
+"${ICU_SOURCE_DIR}/i18n/dtptngen.cpp"
-"${ICU_SOURCE_DIR}/i18n/tmunit.cpp"
+"${ICU_SOURCE_DIR}/i18n/dtrule.cpp"
-"${ICU_SOURCE_DIR}/i18n/tmutamt.cpp"
+"${ICU_SOURCE_DIR}/i18n/erarules.cpp"
-"${ICU_SOURCE_DIR}/i18n/tmutfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/esctrn.cpp"
-"${ICU_SOURCE_DIR}/i18n/currpinf.cpp"
+"${ICU_SOURCE_DIR}/i18n/ethpccal.cpp"
-"${ICU_SOURCE_DIR}/i18n/uspoof.cpp"
+"${ICU_SOURCE_DIR}/i18n/fmtable.cpp"
-"${ICU_SOURCE_DIR}/i18n/uspoof_impl.cpp"
+"${ICU_SOURCE_DIR}/i18n/fmtable_cnv.cpp"
-"${ICU_SOURCE_DIR}/i18n/uspoof_build.cpp"
+"${ICU_SOURCE_DIR}/i18n/format.cpp"
-"${ICU_SOURCE_DIR}/i18n/uspoof_conf.cpp"
+"${ICU_SOURCE_DIR}/i18n/formatted_string_builder.cpp"
-"${ICU_SOURCE_DIR}/i18n/smpdtfst.cpp"
+"${ICU_SOURCE_DIR}/i18n/formattedval_iterimpl.cpp"
-"${ICU_SOURCE_DIR}/i18n/ztrans.cpp"
+"${ICU_SOURCE_DIR}/i18n/formattedval_sbimpl.cpp"
-"${ICU_SOURCE_DIR}/i18n/zrule.cpp"
+"${ICU_SOURCE_DIR}/i18n/formattedvalue.cpp"
-"${ICU_SOURCE_DIR}/i18n/vzone.cpp"
 "${ICU_SOURCE_DIR}/i18n/fphdlimp.cpp"
 "${ICU_SOURCE_DIR}/i18n/fpositer.cpp"
-"${ICU_SOURCE_DIR}/i18n/ufieldpositer.cpp"
+"${ICU_SOURCE_DIR}/i18n/funcrepl.cpp"
-"${ICU_SOURCE_DIR}/i18n/decNumber.cpp"
-"${ICU_SOURCE_DIR}/i18n/decContext.cpp"
-"${ICU_SOURCE_DIR}/i18n/alphaindex.cpp"
-"${ICU_SOURCE_DIR}/i18n/tznames.cpp"
-"${ICU_SOURCE_DIR}/i18n/tznames_impl.cpp"
-"${ICU_SOURCE_DIR}/i18n/tzgnames.cpp"
-"${ICU_SOURCE_DIR}/i18n/tzfmt.cpp"
-"${ICU_SOURCE_DIR}/i18n/compactdecimalformat.cpp"
 "${ICU_SOURCE_DIR}/i18n/gender.cpp"
-"${ICU_SOURCE_DIR}/i18n/region.cpp"
+"${ICU_SOURCE_DIR}/i18n/gregocal.cpp"
-"${ICU_SOURCE_DIR}/i18n/scriptset.cpp"
+"${ICU_SOURCE_DIR}/i18n/gregoimp.cpp"
-"${ICU_SOURCE_DIR}/i18n/uregion.cpp"
+"${ICU_SOURCE_DIR}/i18n/hebrwcal.cpp"
-"${ICU_SOURCE_DIR}/i18n/reldatefmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/indiancal.cpp"
-"${ICU_SOURCE_DIR}/i18n/quantityformatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/inputext.cpp"
+"${ICU_SOURCE_DIR}/i18n/islamcal.cpp"
+"${ICU_SOURCE_DIR}/i18n/iso8601cal.cpp"
+"${ICU_SOURCE_DIR}/i18n/japancal.cpp"
+"${ICU_SOURCE_DIR}/i18n/listformatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/measfmt.cpp"
 "${ICU_SOURCE_DIR}/i18n/measunit.cpp"
-"${ICU_SOURCE_DIR}/i18n/sharedbreakiterator.cpp"
+"${ICU_SOURCE_DIR}/i18n/measunit_extra.cpp"
-"${ICU_SOURCE_DIR}/i18n/scientificnumberformatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/measure.cpp"
-"${ICU_SOURCE_DIR}/i18n/dayperiodrules.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_arguments.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_checker.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_data_model.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_errors.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_evaluation.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_formattable.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_formatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_function_registry.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_parser.cpp"
+"${ICU_SOURCE_DIR}/i18n/messageformat2_serializer.cpp"
+"${ICU_SOURCE_DIR}/i18n/msgfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/name2uni.cpp"
+"${ICU_SOURCE_DIR}/i18n/nfrs.cpp"
+"${ICU_SOURCE_DIR}/i18n/nfrule.cpp"
+"${ICU_SOURCE_DIR}/i18n/nfsubs.cpp"
+"${ICU_SOURCE_DIR}/i18n/nortrans.cpp"
+"${ICU_SOURCE_DIR}/i18n/nultrans.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_affixutils.cpp"
+"${ICU_SOURCE_DIR}/i18n/number_asformat.cpp"
+"${ICU_SOURCE_DIR}/i18n/number_capi.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_compact.cpp"
+"${ICU_SOURCE_DIR}/i18n/number_currencysymbols.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_decimalquantity.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_decimfmtprops.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_fluent.cpp"
@@ -407,7 +343,9 @@ set(ICUI18N_SOURCES
 "${ICU_SOURCE_DIR}/i18n/number_grouping.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_integerwidth.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_longnames.cpp"
+"${ICU_SOURCE_DIR}/i18n/number_mapper.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_modifiers.cpp"
+"${ICU_SOURCE_DIR}/i18n/number_multiplier.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_notation.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_output.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_padding.cpp"
@@ -415,46 +353,125 @@ set(ICUI18N_SOURCES
 "${ICU_SOURCE_DIR}/i18n/number_patternstring.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_rounding.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_scientific.cpp"
-"${ICU_SOURCE_DIR}/i18n/number_utils.cpp"
+"${ICU_SOURCE_DIR}/i18n/number_simple.cpp"
-"${ICU_SOURCE_DIR}/i18n/number_asformat.cpp"
-"${ICU_SOURCE_DIR}/i18n/number_mapper.cpp"
-"${ICU_SOURCE_DIR}/i18n/number_multiplier.cpp"
-"${ICU_SOURCE_DIR}/i18n/number_currencysymbols.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_skeletons.cpp"
-"${ICU_SOURCE_DIR}/i18n/number_capi.cpp"
-"${ICU_SOURCE_DIR}/i18n/double-conversion-string-to-double.cpp"
-"${ICU_SOURCE_DIR}/i18n/double-conversion-double-to-string.cpp"
-"${ICU_SOURCE_DIR}/i18n/double-conversion-bignum-dtoa.cpp"
-"${ICU_SOURCE_DIR}/i18n/double-conversion-bignum.cpp"
-"${ICU_SOURCE_DIR}/i18n/double-conversion-cached-powers.cpp"
-"${ICU_SOURCE_DIR}/i18n/double-conversion-fast-dtoa.cpp"
-"${ICU_SOURCE_DIR}/i18n/double-conversion-strtod.cpp"
-"${ICU_SOURCE_DIR}/i18n/string_segment.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_parsednumber.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_impl.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_symbols.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_decimal.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_scientific.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_currency.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_affixes.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_compositions.cpp"
-"${ICU_SOURCE_DIR}/i18n/numparse_validators.cpp"
-"${ICU_SOURCE_DIR}/i18n/numrange_fluent.cpp"
-"${ICU_SOURCE_DIR}/i18n/numrange_impl.cpp"
-"${ICU_SOURCE_DIR}/i18n/erarules.cpp"
-"${ICU_SOURCE_DIR}/i18n/formattedvalue.cpp"
-"${ICU_SOURCE_DIR}/i18n/formattedval_iterimpl.cpp"
-"${ICU_SOURCE_DIR}/i18n/formattedval_sbimpl.cpp"
-"${ICU_SOURCE_DIR}/i18n/formatted_string_builder.cpp"
-"${ICU_SOURCE_DIR}/i18n/measunit_extra.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_symbolswrapper.cpp"
 "${ICU_SOURCE_DIR}/i18n/number_usageprefs.cpp"
+"${ICU_SOURCE_DIR}/i18n/number_utils.cpp"
+"${ICU_SOURCE_DIR}/i18n/numfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_affixes.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_compositions.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_currency.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_decimal.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_impl.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_parsednumber.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_scientific.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_symbols.cpp"
+"${ICU_SOURCE_DIR}/i18n/numparse_validators.cpp"
 "${ICU_SOURCE_DIR}/i18n/numrange_capi.cpp"
+"${ICU_SOURCE_DIR}/i18n/numrange_fluent.cpp"
+"${ICU_SOURCE_DIR}/i18n/numrange_impl.cpp"
+"${ICU_SOURCE_DIR}/i18n/numsys.cpp"
+"${ICU_SOURCE_DIR}/i18n/olsontz.cpp"
+"${ICU_SOURCE_DIR}/i18n/persncal.cpp"
 "${ICU_SOURCE_DIR}/i18n/pluralranges.cpp"
+"${ICU_SOURCE_DIR}/i18n/plurfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/plurrule.cpp"
+"${ICU_SOURCE_DIR}/i18n/quant.cpp"
+"${ICU_SOURCE_DIR}/i18n/quantityformatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/rbnf.cpp"
+"${ICU_SOURCE_DIR}/i18n/rbt.cpp"
+"${ICU_SOURCE_DIR}/i18n/rbt_data.cpp"
+"${ICU_SOURCE_DIR}/i18n/rbt_pars.cpp"
+"${ICU_SOURCE_DIR}/i18n/rbt_rule.cpp"
+"${ICU_SOURCE_DIR}/i18n/rbt_set.cpp"
+"${ICU_SOURCE_DIR}/i18n/rbtz.cpp"
+"${ICU_SOURCE_DIR}/i18n/regexcmp.cpp"
+"${ICU_SOURCE_DIR}/i18n/regeximp.cpp"
+"${ICU_SOURCE_DIR}/i18n/regexst.cpp"
+"${ICU_SOURCE_DIR}/i18n/regextxt.cpp"
+"${ICU_SOURCE_DIR}/i18n/region.cpp"
+"${ICU_SOURCE_DIR}/i18n/reldatefmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/reldtfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/rematch.cpp"
+"${ICU_SOURCE_DIR}/i18n/remtrans.cpp"
+"${ICU_SOURCE_DIR}/i18n/repattrn.cpp"
+"${ICU_SOURCE_DIR}/i18n/rulebasedcollator.cpp"
+"${ICU_SOURCE_DIR}/i18n/scientificnumberformatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/scriptset.cpp"
+"${ICU_SOURCE_DIR}/i18n/search.cpp"
+"${ICU_SOURCE_DIR}/i18n/selfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/sharedbreakiterator.cpp"
+"${ICU_SOURCE_DIR}/i18n/simpletz.cpp"
+"${ICU_SOURCE_DIR}/i18n/smpdtfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/smpdtfst.cpp"
+"${ICU_SOURCE_DIR}/i18n/sortkey.cpp"
+"${ICU_SOURCE_DIR}/i18n/standardplural.cpp"
+"${ICU_SOURCE_DIR}/i18n/string_segment.cpp"
+"${ICU_SOURCE_DIR}/i18n/strmatch.cpp"
+"${ICU_SOURCE_DIR}/i18n/strrepl.cpp"
+"${ICU_SOURCE_DIR}/i18n/stsearch.cpp"
+"${ICU_SOURCE_DIR}/i18n/taiwncal.cpp"
+"${ICU_SOURCE_DIR}/i18n/timezone.cpp"
+"${ICU_SOURCE_DIR}/i18n/titletrn.cpp"
+"${ICU_SOURCE_DIR}/i18n/tmunit.cpp"
+"${ICU_SOURCE_DIR}/i18n/tmutamt.cpp"
+"${ICU_SOURCE_DIR}/i18n/tmutfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/tolowtrn.cpp"
+"${ICU_SOURCE_DIR}/i18n/toupptrn.cpp"
+"${ICU_SOURCE_DIR}/i18n/translit.cpp"
+"${ICU_SOURCE_DIR}/i18n/transreg.cpp"
+"${ICU_SOURCE_DIR}/i18n/tridpars.cpp"
+"${ICU_SOURCE_DIR}/i18n/tzfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/tzgnames.cpp"
+"${ICU_SOURCE_DIR}/i18n/tznames.cpp"
+"${ICU_SOURCE_DIR}/i18n/tznames_impl.cpp"
+"${ICU_SOURCE_DIR}/i18n/tzrule.cpp"
+"${ICU_SOURCE_DIR}/i18n/tztrans.cpp"
+"${ICU_SOURCE_DIR}/i18n/ucal.cpp"
+"${ICU_SOURCE_DIR}/i18n/ucln_in.cpp"
+"${ICU_SOURCE_DIR}/i18n/ucol.cpp"
+"${ICU_SOURCE_DIR}/i18n/ucol_res.cpp"
+"${ICU_SOURCE_DIR}/i18n/ucol_sit.cpp"
+"${ICU_SOURCE_DIR}/i18n/ucoleitr.cpp"
+"${ICU_SOURCE_DIR}/i18n/ucsdet.cpp"
+"${ICU_SOURCE_DIR}/i18n/udat.cpp"
+"${ICU_SOURCE_DIR}/i18n/udateintervalformat.cpp"
+"${ICU_SOURCE_DIR}/i18n/udatpg.cpp"
+"${ICU_SOURCE_DIR}/i18n/ufieldpositer.cpp"
+"${ICU_SOURCE_DIR}/i18n/uitercollationiterator.cpp"
+"${ICU_SOURCE_DIR}/i18n/ulistformatter.cpp"
+"${ICU_SOURCE_DIR}/i18n/ulocdata.cpp"
+"${ICU_SOURCE_DIR}/i18n/umsg.cpp"
+"${ICU_SOURCE_DIR}/i18n/unesctrn.cpp"
+"${ICU_SOURCE_DIR}/i18n/uni2name.cpp"
 "${ICU_SOURCE_DIR}/i18n/units_complexconverter.cpp"
 "${ICU_SOURCE_DIR}/i18n/units_converter.cpp"
 "${ICU_SOURCE_DIR}/i18n/units_data.cpp"
-"${ICU_SOURCE_DIR}/i18n/units_router.cpp")
+"${ICU_SOURCE_DIR}/i18n/units_router.cpp"
+"${ICU_SOURCE_DIR}/i18n/unum.cpp"
+"${ICU_SOURCE_DIR}/i18n/unumsys.cpp"
+"${ICU_SOURCE_DIR}/i18n/upluralrules.cpp"
+"${ICU_SOURCE_DIR}/i18n/uregex.cpp"
+"${ICU_SOURCE_DIR}/i18n/uregexc.cpp"
+"${ICU_SOURCE_DIR}/i18n/uregion.cpp"
+"${ICU_SOURCE_DIR}/i18n/usearch.cpp"
+"${ICU_SOURCE_DIR}/i18n/uspoof.cpp"
+"${ICU_SOURCE_DIR}/i18n/uspoof_build.cpp"
+"${ICU_SOURCE_DIR}/i18n/uspoof_conf.cpp"
+"${ICU_SOURCE_DIR}/i18n/uspoof_impl.cpp"
+"${ICU_SOURCE_DIR}/i18n/utf16collationiterator.cpp"
+"${ICU_SOURCE_DIR}/i18n/utf8collationiterator.cpp"
+"${ICU_SOURCE_DIR}/i18n/utmscale.cpp"
+"${ICU_SOURCE_DIR}/i18n/utrans.cpp"
+"${ICU_SOURCE_DIR}/i18n/vtzone.cpp"
+"${ICU_SOURCE_DIR}/i18n/vzone.cpp"
+"${ICU_SOURCE_DIR}/i18n/windtfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/winnmfmt.cpp"
+"${ICU_SOURCE_DIR}/i18n/wintzimpl.cpp"
+"${ICU_SOURCE_DIR}/i18n/zonemeta.cpp"
+"${ICU_SOURCE_DIR}/i18n/zrule.cpp"
+"${ICU_SOURCE_DIR}/i18n/ztrans.cpp")
 
 file(GENERATE OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/empty.cpp" CONTENT " ")
 enable_language(ASM)
@@ -464,6 +481,11 @@ if (ARCH_S390X)
 else()
     set(ICUDATA_SOURCE_FILE "${ICUDATA_SOURCE_DIR}/icudt75l_dat.S" )
 endif()
+# ^^ you might be confused how for different little endian platforms (x86, ARM) the same assembly files can be used.
+# These files are indeed assembly but they only contain data ('.long' directive), which makes them portable accross CPUs.
+# Only the endianness and the character set (ASCII, EBCDIC) makes a difference, also see
+# https://unicode-org.github.io/icu/userguide/icu_data/#sharing-icu-data-between-platforms, 'Sharing ICU Data Between Platforms')
+# (and as an experiment, try re-generating the data files on x86 vs. ARM, ... you'll get exactly the same files)
 
 set(ICUDATA_SOURCES
     "${ICUDATA_SOURCE_FILE}"

contrib/libarchive

@@ -1 +1 @@
-Subproject commit 0c21691b177fac5f4cceca2a1ff2ddfa5d60f51c
+Subproject commit 313aa1fa10b657de791e3202c168a6c833bc3543

contrib/libarchive-cmake/CMakeLists.txt

@@ -1,6 +1,6 @@
 set (LIBRARY_DIR "${ClickHouse_SOURCE_DIR}/contrib/libarchive")
 
-set(SRCS 
+set(SRCS
     "${LIBRARY_DIR}/libarchive/archive_acl.c"
     "${LIBRARY_DIR}/libarchive/archive_blake2sp_ref.c"
     "${LIBRARY_DIR}/libarchive/archive_blake2s_ref.c"
@@ -135,7 +135,7 @@ set(SRCS
 )
 
 add_library(_libarchive ${SRCS})
-target_include_directories(_libarchive PUBLIC 
+target_include_directories(_libarchive PUBLIC
     ${CMAKE_CURRENT_SOURCE_DIR}
     "${LIBRARY_DIR}/libarchive"
 )
@@ -157,7 +157,7 @@ if (TARGET ch_contrib::zlib)
 endif()
 
 if (TARGET ch_contrib::zstd)
-    target_compile_definitions(_libarchive PUBLIC HAVE_ZSTD_H=1 HAVE_LIBZSTD=1 HAVE_LIBZSTD_COMPRESSOR=1)
+    target_compile_definitions(_libarchive PUBLIC HAVE_ZSTD_H=1 HAVE_LIBZSTD=1 HAVE_ZSTD_compressStream=1)
     target_link_libraries(_libarchive PRIVATE ch_contrib::zstd)
 endif()
 
@@ -179,4 +179,4 @@ if (OS_LINUX)
     )
 endif()
 
-add_library(ch_contrib::libarchive ALIAS _libarchive)
+add_library(ch_contrib::libarchive ALIAS _libarchive)

contrib/libarchive-cmake/config.h

@@ -334,13 +334,16 @@ typedef uint64_t uintmax_t;
 /* #undef ARCHIVE_XATTR_LINUX */
 
 /* Version number of bsdcpio */
-#define BSDCPIO_VERSION_STRING "3.7.0"
+#define BSDCPIO_VERSION_STRING "3.7.4"
 
 /* Version number of bsdtar */
-#define BSDTAR_VERSION_STRING "3.7.0"
+#define BSDTAR_VERSION_STRING "3.7.4"
 
 /* Version number of bsdcat */
-#define BSDCAT_VERSION_STRING "3.7.0"
+#define BSDCAT_VERSION_STRING "3.7.4"
+
+/* Version number of bsdunzip */
+#define BSDUNZIP_VERSION_STRING "3.7.4"
 
 /* Define to 1 if you have the `acl_create_entry' function. */
 /* #undef HAVE_ACL_CREATE_ENTRY */
@@ -642,8 +645,8 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the `getgrnam_r' function. */
 #define HAVE_GETGRNAM_R 1
 
-/* Define to 1 if platform uses `optreset` to reset `getopt` */
+/* Define to 1 if you have the `getline' function. */
-#define HAVE_GETOPT_OPTRESET 1
+#define HAVE_GETLINE 1
 
 /* Define to 1 if you have the `getpid' function. */
 #define HAVE_GETPID 1
@@ -750,6 +753,12 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the `pcreposix' library (-lpcreposix). */
 /* #undef HAVE_LIBPCREPOSIX */
 
+/* Define to 1 if you have the `pcre2-8' library (-lpcre2-8). */
+/* #undef HAVE_LIBPCRE2 */
+
+/* Define to 1 if you have the `pcreposix' library (-lpcre2posix). */
+/* #undef HAVE_LIBPCRE2POSIX */
+
 /* Define to 1 if you have the `xml2' library (-lxml2). */
 #define HAVE_LIBXML2 1
 
@@ -765,9 +774,8 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the `zstd' library (-lzstd). */
 /* #undef HAVE_LIBZSTD */
 
-/* Define to 1 if you have the `zstd' library (-lzstd) with compression
+/* Define to 1 if you have the ZSTD_compressStream function. */
-   support. */
+/* #undef HAVE_ZSTD_compressStream */
-/* #undef HAVE_LIBZSTD_COMPRESSOR */
 
 /* Define to 1 if you have the <limits.h> header file. */
 #define HAVE_LIMITS_H 1
@@ -923,6 +931,9 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the <pcreposix.h> header file. */
 /* #undef HAVE_PCREPOSIX_H */
 
+/* Define to 1 if you have the <pcre2posix.h> header file. */
+/* #undef HAVE_PCRE2POSIX_H */
+
 /* Define to 1 if you have the `pipe' function. */
 #define HAVE_PIPE 1
 
@@ -1029,6 +1040,12 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the `strrchr' function. */
 #define HAVE_STRRCHR 1
 
+/* Define to 1 if the system has the type `struct statfs'. */
+/* #undef HAVE_STRUCT_STATFS */
+
+/* Define to 1 if `f_iosize' is a member of `struct statfs'. */
+/* #undef HAVE_STRUCT_STATFS_F_IOSIZE */
+
 /* Define to 1 if `f_namemax' is a member of `struct statfs'. */
 /* #undef HAVE_STRUCT_STATFS_F_NAMEMAX */
 
@@ -1077,6 +1094,9 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the `symlink' function. */
 #define HAVE_SYMLINK 1
 
+/* Define to 1 if you have the `sysconf' function. */
+#define HAVE_SYSCONF 1
+
 /* Define to 1 if you have the <sys/acl.h> header file. */
 /* #undef HAVE_SYS_ACL_H */
 
@@ -1273,13 +1293,13 @@ typedef uint64_t uintmax_t;
 /* #undef HAVE__MKGMTIME */
 
 /* Define as const if the declaration of iconv() needs const. */
-#define ICONV_CONST 
+#define ICONV_CONST
 
 /* Version number of libarchive as a single integer */
-#define LIBARCHIVE_VERSION_NUMBER "3007000"
+#define LIBARCHIVE_VERSION_NUMBER "3007004"
 
 /* Version number of libarchive */
-#define LIBARCHIVE_VERSION_STRING "3.7.0"
+#define LIBARCHIVE_VERSION_STRING "3.7.4"
 
 /* Define to 1 if `lstat' dereferences a symlink specified with a trailing
    slash. */
@@ -1333,7 +1353,7 @@ typedef uint64_t uintmax_t;
 #endif /* SAFE_TO_DEFINE_EXTENSIONS */
 
 /* Version number of package */
-#define VERSION "3.7.0"
+#define VERSION "3.7.4"
 
 /* Number of bits in a file offset, on hosts where this is settable. */
 /* #undef _FILE_OFFSET_BITS */

contrib/libpq

@@ -1 +0,0 @@
-Subproject commit 2446f2c85650b56df9d4ebc4c2ea7f4b01beee57

contrib/libpq-cmake/CMakeLists.txt

@@ -1,78 +0,0 @@
-if (NOT ENABLE_LIBPQXX)
-    return()
-endif()
-
-set(LIBPQ_SOURCE_DIR "${ClickHouse_SOURCE_DIR}/contrib/libpq")
-
-set(SRCS
-        "${LIBPQ_SOURCE_DIR}/fe-auth.c"
-        "${LIBPQ_SOURCE_DIR}/fe-auth-scram.c"
-        "${LIBPQ_SOURCE_DIR}/fe-connect.c"
-        "${LIBPQ_SOURCE_DIR}/fe-exec.c"
-        "${LIBPQ_SOURCE_DIR}/fe-lobj.c"
-        "${LIBPQ_SOURCE_DIR}/fe-misc.c"
-        "${LIBPQ_SOURCE_DIR}/fe-print.c"
-        "${LIBPQ_SOURCE_DIR}/fe-trace.c"
-        "${LIBPQ_SOURCE_DIR}/fe-protocol3.c"
-        "${LIBPQ_SOURCE_DIR}/fe-secure.c"
-        "${LIBPQ_SOURCE_DIR}/fe-secure-common.c"
-        "${LIBPQ_SOURCE_DIR}/fe-secure-openssl.c"
-        "${LIBPQ_SOURCE_DIR}/legacy-pqsignal.c"
-        "${LIBPQ_SOURCE_DIR}/libpq-events.c"
-        "${LIBPQ_SOURCE_DIR}/pqexpbuffer.c"
-
-        "${LIBPQ_SOURCE_DIR}/common/scram-common.c"
-        "${LIBPQ_SOURCE_DIR}/common/sha2.c"
-        "${LIBPQ_SOURCE_DIR}/common/sha1.c"
-        "${LIBPQ_SOURCE_DIR}/common/md5.c"
-        "${LIBPQ_SOURCE_DIR}/common/md5_common.c"
-        "${LIBPQ_SOURCE_DIR}/common/hmac_openssl.c"
-        "${LIBPQ_SOURCE_DIR}/common/cryptohash.c"
-        "${LIBPQ_SOURCE_DIR}/common/saslprep.c"
-        "${LIBPQ_SOURCE_DIR}/common/unicode_norm.c"
-        "${LIBPQ_SOURCE_DIR}/common/ip.c"
-        "${LIBPQ_SOURCE_DIR}/common/jsonapi.c"
-        "${LIBPQ_SOURCE_DIR}/common/wchar.c"
-        "${LIBPQ_SOURCE_DIR}/common/base64.c"
-        "${LIBPQ_SOURCE_DIR}/common/link-canary.c"
-        "${LIBPQ_SOURCE_DIR}/common/fe_memutils.c"
-        "${LIBPQ_SOURCE_DIR}/common/string.c"
-        "${LIBPQ_SOURCE_DIR}/common/pg_get_line.c"
-        "${LIBPQ_SOURCE_DIR}/common/stringinfo.c"
-        "${LIBPQ_SOURCE_DIR}/common/psprintf.c"
-        "${LIBPQ_SOURCE_DIR}/common/encnames.c"
-        "${LIBPQ_SOURCE_DIR}/common/logging.c"
-
-        "${LIBPQ_SOURCE_DIR}/port/snprintf.c"
-        "${LIBPQ_SOURCE_DIR}/port/strlcpy.c"
-        "${LIBPQ_SOURCE_DIR}/port/strerror.c"
-        "${LIBPQ_SOURCE_DIR}/port/inet_net_ntop.c"
-        "${LIBPQ_SOURCE_DIR}/port/getpeereid.c"
-        "${LIBPQ_SOURCE_DIR}/port/chklocale.c"
-        "${LIBPQ_SOURCE_DIR}/port/noblock.c"
-        "${LIBPQ_SOURCE_DIR}/port/pg_strong_random.c"
-        "${LIBPQ_SOURCE_DIR}/port/pgstrcasecmp.c"
-        "${LIBPQ_SOURCE_DIR}/port/thread.c"
-        "${LIBPQ_SOURCE_DIR}/port/path.c"
-        )
-
-add_library(_libpq ${SRCS})
-
-add_definitions(-DHAVE_BIO_METH_NEW)
-add_definitions(-DHAVE_HMAC_CTX_NEW)
-add_definitions(-DHAVE_HMAC_CTX_FREE)
-
-target_include_directories (_libpq SYSTEM PUBLIC ${LIBPQ_SOURCE_DIR})
-target_include_directories (_libpq SYSTEM PUBLIC "${LIBPQ_SOURCE_DIR}/include")
-target_include_directories (_libpq SYSTEM PRIVATE "${LIBPQ_SOURCE_DIR}/configs")
-
-# NOTE: this is a dirty hack to avoid and instead pg_config.h should be shipped
-# for different OS'es like for jemalloc, not one generic for all OS'es like
-# now.
-if (OS_DARWIN OR OS_FREEBSD OR USE_MUSL)
-    target_compile_definitions(_libpq PRIVATE -DSTRERROR_R_INT=1)
-endif()
-
-target_link_libraries (_libpq PRIVATE OpenSSL::SSL)
-
-add_library(ch_contrib::libpq ALIAS _libpq)

contrib/libpqxx

@@ -1 +1 @@
-Subproject commit c995193a3a14d71f4711f1f421f65a1a1db64640
+Subproject commit 41e4c331564167cca97ad6eccbd5b8879c2ca044

contrib/libpqxx-cmake/CMakeLists.txt

@@ -1,16 +1,9 @@
-option(ENABLE_LIBPQXX "Enalbe libpqxx" ${ENABLE_LIBRARIES})
-
-if (NOT ENABLE_LIBPQXX)
-    message(STATUS "Not using libpqxx")
-    return()
-endif()
-
 set (LIBRARY_DIR "${ClickHouse_SOURCE_DIR}/contrib/libpqxx")
 
 set (SRCS
-    "${LIBRARY_DIR}/src/strconv.cxx"
     "${LIBRARY_DIR}/src/array.cxx"
     "${LIBRARY_DIR}/src/binarystring.cxx"
+    "${LIBRARY_DIR}/src/blob.cxx"
     "${LIBRARY_DIR}/src/connection.cxx"
     "${LIBRARY_DIR}/src/cursor.cxx"
     "${LIBRARY_DIR}/src/encodings.cxx"
@@ -19,59 +12,25 @@ set (SRCS
     "${LIBRARY_DIR}/src/field.cxx"
     "${LIBRARY_DIR}/src/largeobject.cxx"
     "${LIBRARY_DIR}/src/notification.cxx"
+    "${LIBRARY_DIR}/src/params.cxx"
     "${LIBRARY_DIR}/src/pipeline.cxx"
     "${LIBRARY_DIR}/src/result.cxx"
     "${LIBRARY_DIR}/src/robusttransaction.cxx"
+    "${LIBRARY_DIR}/src/row.cxx"
     "${LIBRARY_DIR}/src/sql_cursor.cxx"
+    "${LIBRARY_DIR}/src/strconv.cxx"
     "${LIBRARY_DIR}/src/stream_from.cxx"
     "${LIBRARY_DIR}/src/stream_to.cxx"
     "${LIBRARY_DIR}/src/subtransaction.cxx"
+    "${LIBRARY_DIR}/src/time.cxx"
     "${LIBRARY_DIR}/src/transaction.cxx"
     "${LIBRARY_DIR}/src/transaction_base.cxx"
-    "${LIBRARY_DIR}/src/row.cxx"
-    "${LIBRARY_DIR}/src/params.cxx"
     "${LIBRARY_DIR}/src/util.cxx"
     "${LIBRARY_DIR}/src/version.cxx"
+    "${LIBRARY_DIR}/src/wait.cxx"
 )
 
-# Need to explicitly include each header file, because in the directory include/pqxx there are also files
+add_library(_libpqxx ${SRCS})
-# like just 'array'. So if including the whole directory with `target_include_directories`, it will make
-# conflicts with all includes of <array>.
-set (HDRS
-    "${LIBRARY_DIR}/include/pqxx/array.hxx"
-    "${LIBRARY_DIR}/include/pqxx/params.hxx"
-    "${LIBRARY_DIR}/include/pqxx/binarystring.hxx"
-    "${LIBRARY_DIR}/include/pqxx/composite.hxx"
-    "${LIBRARY_DIR}/include/pqxx/connection.hxx"
-    "${LIBRARY_DIR}/include/pqxx/cursor.hxx"
-    "${LIBRARY_DIR}/include/pqxx/dbtransaction.hxx"
-    "${LIBRARY_DIR}/include/pqxx/errorhandler.hxx"
-    "${LIBRARY_DIR}/include/pqxx/except.hxx"
-    "${LIBRARY_DIR}/include/pqxx/field.hxx"
-    "${LIBRARY_DIR}/include/pqxx/isolation.hxx"
-    "${LIBRARY_DIR}/include/pqxx/largeobject.hxx"
-    "${LIBRARY_DIR}/include/pqxx/nontransaction.hxx"
-    "${LIBRARY_DIR}/include/pqxx/notification.hxx"
-    "${LIBRARY_DIR}/include/pqxx/pipeline.hxx"
-    "${LIBRARY_DIR}/include/pqxx/prepared_statement.hxx"
-    "${LIBRARY_DIR}/include/pqxx/result.hxx"
-    "${LIBRARY_DIR}/include/pqxx/robusttransaction.hxx"
-    "${LIBRARY_DIR}/include/pqxx/row.hxx"
-    "${LIBRARY_DIR}/include/pqxx/separated_list.hxx"
-    "${LIBRARY_DIR}/include/pqxx/strconv.hxx"
-    "${LIBRARY_DIR}/include/pqxx/stream_from.hxx"
-    "${LIBRARY_DIR}/include/pqxx/stream_to.hxx"
-    "${LIBRARY_DIR}/include/pqxx/subtransaction.hxx"
-    "${LIBRARY_DIR}/include/pqxx/transaction.hxx"
-    "${LIBRARY_DIR}/include/pqxx/transaction_base.hxx"
-    "${LIBRARY_DIR}/include/pqxx/types.hxx"
-    "${LIBRARY_DIR}/include/pqxx/util.hxx"
-    "${LIBRARY_DIR}/include/pqxx/version.hxx"
-    "${LIBRARY_DIR}/include/pqxx/zview.hxx"
-)
-
-add_library(_libpqxx ${SRCS} ${HDRS})
-
 target_link_libraries(_libpqxx PUBLIC ch_contrib::libpq)
 target_include_directories (_libpqxx SYSTEM BEFORE PUBLIC "${LIBRARY_DIR}/include")
 

contrib/postgres

@@ -0,0 +1 @@
+Subproject commit cfd77000af28469fcb650485bad65a35e7649e41

contrib/postgres-cmake/CMakeLists.txt

@@ -0,0 +1,78 @@
+# Build description for libpq which is part of the PostgreSQL sources
+
+set(POSTGRES_SOURCE_DIR "${ClickHouse_SOURCE_DIR}/contrib/postgres")
+set(LIBPQ_SOURCE_DIR "${POSTGRES_SOURCE_DIR}/src/interfaces/libpq")
+set(LIBPQ_CMAKE_SOURCE_DIR "${ClickHouse_SOURCE_DIR}/contrib/postgres-cmake")
+
+set(SRCS
+    "${LIBPQ_SOURCE_DIR}/fe-auth.c"
+    "${LIBPQ_SOURCE_DIR}/fe-auth-scram.c"
+    "${LIBPQ_SOURCE_DIR}/fe-connect.c"
+    "${LIBPQ_SOURCE_DIR}/fe-exec.c"
+    "${LIBPQ_SOURCE_DIR}/fe-lobj.c"
+    "${LIBPQ_SOURCE_DIR}/fe-misc.c"
+    "${LIBPQ_SOURCE_DIR}/fe-print.c"
+    "${LIBPQ_SOURCE_DIR}/fe-trace.c"
+    "${LIBPQ_SOURCE_DIR}/fe-protocol3.c"
+    "${LIBPQ_SOURCE_DIR}/fe-secure.c"
+    "${LIBPQ_SOURCE_DIR}/fe-secure-common.c"
+    "${LIBPQ_SOURCE_DIR}/fe-secure-openssl.c"
+    "${LIBPQ_SOURCE_DIR}/legacy-pqsignal.c"
+    "${LIBPQ_SOURCE_DIR}/libpq-events.c"
+    "${LIBPQ_SOURCE_DIR}/pqexpbuffer.c"
+
+    "${POSTGRES_SOURCE_DIR}/src/common/scram-common.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/sha2.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/sha1.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/md5.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/md5_common.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/hmac_openssl.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/cryptohash.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/saslprep.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/unicode_norm.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/ip.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/jsonapi.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/wchar.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/base64.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/link-canary.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/fe_memutils.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/string.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/pg_get_line.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/stringinfo.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/psprintf.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/encnames.c"
+    "${POSTGRES_SOURCE_DIR}/src/common/logging.c"
+
+    "${POSTGRES_SOURCE_DIR}/src/port/snprintf.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/strlcpy.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/strerror.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/inet_net_ntop.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/getpeereid.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/chklocale.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/noblock.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/pg_strong_random.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/pgstrcasecmp.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/thread.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/path.c"
+)
+
+add_library(_libpq ${SRCS})
+
+add_definitions(-DHAVE_BIO_METH_NEW)
+add_definitions(-DHAVE_HMAC_CTX_NEW)
+add_definitions(-DHAVE_HMAC_CTX_FREE)
+
+target_include_directories (_libpq SYSTEM PUBLIC ${LIBPQ_SOURCE_DIR})
+target_include_directories (_libpq SYSTEM PUBLIC "${POSTGRES_SOURCE_DIR}/src/include")
+target_include_directories (_libpq SYSTEM PUBLIC "${LIBPQ_CMAKE_SOURCE_DIR}") # pre-generated headers
+
+# NOTE: this is a dirty hack to avoid and instead pg_config.h should be shipped
+# for different OS'es like for jemalloc, not one generic for all OS'es like
+# now.
+if (OS_DARWIN OR OS_FREEBSD OR USE_MUSL)
+    target_compile_definitions(_libpq PRIVATE -DSTRERROR_R_INT=1)
+endif()
+
+target_link_libraries (_libpq PRIVATE OpenSSL::SSL)
+
+add_library(ch_contrib::libpq ALIAS _libpq)

contrib/postgres-cmake/pg_config.h

@@ -0,0 +1,943 @@
+/* src/include/pg_config.h.  Generated from pg_config.h.in by configure.  */
+/* src/include/pg_config.h.in.  Generated from configure.in by autoheader.  */
+
+/* Define if building universal (internal helper macro) */
+/* #undef AC_APPLE_UNIVERSAL_BUILD */
+
+/* The normal alignment of `double', in bytes. */
+#define ALIGNOF_DOUBLE 4
+
+/* The normal alignment of `int', in bytes. */
+#define ALIGNOF_INT 4
+
+/* The normal alignment of `long', in bytes. */
+#define ALIGNOF_LONG 4
+
+/* The normal alignment of `long long int', in bytes. */
+#define ALIGNOF_LONG_LONG_INT 4
+
+/* The normal alignment of `short', in bytes. */
+#define ALIGNOF_SHORT 2
+
+/* Size of a disk block --- this also limits the size of a tuple. You can set
+   it bigger if you need bigger tuples (although TOAST should reduce the need
+   to have large tuples, since fields can be spread across multiple tuples).
+   BLCKSZ must be a power of 2. The maximum possible value of BLCKSZ is
+   currently 2^15 (32768). This is determined by the 15-bit widths of the
+   lp_off and lp_len fields in ItemIdData (see include/storage/itemid.h).
+   Changing BLCKSZ requires an initdb. */
+#define BLCKSZ 8192
+
+/* Define to the default TCP port number on which the server listens and to
+   which clients will try to connect. This can be overridden at run-time, but
+   it's convenient if your clients have the right default compiled in.
+   (--with-pgport=PORTNUM) */
+#define DEF_PGPORT 5432
+
+/* Define to the default TCP port number as a string constant. */
+#define DEF_PGPORT_STR "5432"
+
+/* Define to the file name extension of dynamically-loadable modules. */
+#define DLSUFFIX ".so"
+
+/* Define to build with GSSAPI support. (--with-gssapi) */
+//#define ENABLE_GSS 0
+
+/* Define to 1 if you want National Language Support. (--enable-nls) */
+/* #undef ENABLE_NLS */
+
+/* Define to 1 to build client libraries as thread-safe code.
+   (--enable-thread-safety) */
+#define ENABLE_THREAD_SAFETY 1
+
+/* Define to nothing if C supports flexible array members, and to 1 if it does
+   not. That way, with a declaration like `struct s { int n; double
+   d[FLEXIBLE_ARRAY_MEMBER]; };', the struct hack can be used with pre-C99
+   compilers. When computing the size of such an object, don't use 'sizeof
+   (struct s)' as it overestimates the size. Use 'offsetof (struct s, d)'
+   instead. Don't use 'offsetof (struct s, d[0])', as this doesn't work with
+   MSVC and with C++ compilers. */
+#define FLEXIBLE_ARRAY_MEMBER /**/
+
+/* float4 values are passed by value if 'true', by reference if 'false' */
+#define FLOAT4PASSBYVAL true
+
+/* float8, int8, and related values are passed by value if 'true', by
+   reference if 'false' */
+#define FLOAT8PASSBYVAL false
+
+/* Define to 1 if gettimeofday() takes only 1 argument. */
+/* #undef GETTIMEOFDAY_1ARG */
+
+#ifdef GETTIMEOFDAY_1ARG
+# define gettimeofday(a,b) gettimeofday(a)
+#endif
+
+/* Define to 1 if you have the `append_history' function. */
+/* #undef HAVE_APPEND_HISTORY */
+
+/* Define to 1 if you want to use atomics if available. */
+#define HAVE_ATOMICS 1
+
+/* Define to 1 if you have the <atomic.h> header file. */
+/* #undef HAVE_ATOMIC_H */
+
+/* Define to 1 if you have the `cbrt' function. */
+#define HAVE_CBRT 1
+
+/* Define to 1 if you have the `class' function. */
+/* #undef HAVE_CLASS */
+
+/* Define to 1 if you have the <crtdefs.h> header file. */
+/* #undef HAVE_CRTDEFS_H */
+
+/* Define to 1 if you have the `crypt' function. */
+#define HAVE_CRYPT 1
+
+/* Define to 1 if you have the <crypt.h> header file. */
+#define HAVE_CRYPT_H 1
+
+/* Define to 1 if you have the declaration of `fdatasync', and to 0 if you
+   don't. */
+#define HAVE_DECL_FDATASYNC 1
+
+/* Define to 1 if you have the declaration of `F_FULLFSYNC', and to 0 if you
+   don't. */
+#define HAVE_DECL_F_FULLFSYNC 0
+
+/* Define to 1 if you have the declaration of `posix_fadvise', and to 0 if you
+   don't. */
+#define HAVE_DECL_POSIX_FADVISE 1
+
+/* Define to 1 if you have the declaration of `snprintf', and to 0 if you
+   don't. */
+#define HAVE_DECL_SNPRINTF 1
+
+/* Define to 1 if you have the declaration of `sigwait', and to 0 if you don't. */
+#define HAVE_DECL_SIGWAIT 1
+
+/* Define to 1 if you have the declaration of `strlcat', and to 0 if you
+   don't. */
+#if OS_DARWIN
+#define HAVE_DECL_STRLCAT 1
+#endif
+
+/* Define to 1 if you have the declaration of `strlcpy', and to 0 if you
+   don't. */
+#if OS_DARWIN
+#define HAVE_DECL_STRLCPY 1
+#endif
+
+/* Define to 1 if you have the declaration of `sys_siglist', and to 0 if you
+   don't. */
+#define HAVE_DECL_SYS_SIGLIST 1
+
+/* Define to 1 if you have the declaration of `vsnprintf', and to 0 if you
+   don't. */
+#define HAVE_DECL_VSNPRINTF 1
+
+/* Define to 1 if you have the <dld.h> header file. */
+/* #undef HAVE_DLD_H */
+
+/* Define to 1 if you have the `dlopen' function. */
+#define HAVE_DLOPEN 1
+
+/* Define to 1 if you have the <editline/history.h> header file. */
+/* #undef HAVE_EDITLINE_HISTORY_H */
+
+/* Define to 1 if you have the <editline/readline.h> header file. */
+#define HAVE_EDITLINE_READLINE_H 1
+
+/* Define to 1 if you have the `fdatasync' function. */
+#define HAVE_FDATASYNC 1
+
+/* Define to 1 if you have the `fls' function. */
+/* #undef HAVE_FLS */
+
+/* Define to 1 if you have the `fpclass' function. */
+/* #undef HAVE_FPCLASS */
+
+/* Define to 1 if you have the `fp_class' function. */
+/* #undef HAVE_FP_CLASS */
+
+/* Define to 1 if you have the `fp_class_d' function. */
+/* #undef HAVE_FP_CLASS_D */
+
+/* Define to 1 if you have the <fp_class.h> header file. */
+/* #undef HAVE_FP_CLASS_H */
+
+/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
+#define HAVE_FSEEKO 1
+
+/* Define to 1 if your compiler understands __func__. */
+#define HAVE_FUNCNAME__FUNC 1
+
+/* Define to 1 if your compiler understands __FUNCTION__. */
+/* #undef HAVE_FUNCNAME__FUNCTION */
+
+/* Define to 1 if you have __atomic_compare_exchange_n(int *, int *, int). */
+/* #undef HAVE_GCC__ATOMIC_INT32_CAS */
+
+/* Define to 1 if you have __atomic_compare_exchange_n(int64 *, int *, int64).
+   */
+/* #undef HAVE_GCC__ATOMIC_INT64_CAS */
+
+/* Define to 1 if you have __sync_lock_test_and_set(char *) and friends. */
+#define HAVE_GCC__SYNC_CHAR_TAS 1
+
+/* Define to 1 if you have __sync_compare_and_swap(int *, int, int). */
+/* #undef HAVE_GCC__SYNC_INT32_CAS */
+
+/* Define to 1 if you have __sync_lock_test_and_set(int *) and friends. */
+#define HAVE_GCC__SYNC_INT32_TAS 1
+
+/* Define to 1 if you have __sync_compare_and_swap(int64 *, int64, int64). */
+/* #undef HAVE_GCC__SYNC_INT64_CAS */
+
+/* Define to 1 if you have the `getaddrinfo' function. */
+#define HAVE_GETADDRINFO 1
+
+/* Define to 1 if you have the `gethostbyname_r' function. */
+#define HAVE_GETHOSTBYNAME_R 1
+
+/* Define to 1 if you have the `getifaddrs' function. */
+#define HAVE_GETIFADDRS 1
+
+/* Define to 1 if you have the `getopt' function. */
+#define HAVE_GETOPT 1
+
+/* Define to 1 if you have the <getopt.h> header file. */
+#define HAVE_GETOPT_H 1
+
+/* Define to 1 if you have the `getopt_long' function. */
+#define HAVE_GETOPT_LONG 1
+
+/* Define to 1 if you have the `getpeereid' function. */
+/* #undef HAVE_GETPEEREID */
+
+/* Define to 1 if you have the `getpeerucred' function. */
+/* #undef HAVE_GETPEERUCRED */
+
+/* Define to 1 if you have the `getpwuid_r' function. */
+#define HAVE_GETPWUID_R 1
+
+/* Define to 1 if you have the `getrlimit' function. */
+#define HAVE_GETRLIMIT 1
+
+/* Define to 1 if you have the `getrusage' function. */
+#define HAVE_GETRUSAGE 1
+
+/* Define to 1 if you have the `gettimeofday' function. */
+/* #undef HAVE_GETTIMEOFDAY */
+
+/* Define to 1 if you have the <gssapi/gssapi.h> header file. */
+//#define HAVE_GSSAPI_GSSAPI_H 0
+
+/* Define to 1 if you have the <gssapi.h> header file. */
+/* #undef HAVE_GSSAPI_H */
+
+/* Define to 1 if you have the <history.h> header file. */
+/* #undef HAVE_HISTORY_H */
+
+/* Define to 1 if you have the `history_truncate_file' function. */
+#define HAVE_HISTORY_TRUNCATE_FILE 1
+
+/* Define to 1 if you have the <ieeefp.h> header file. */
+/* #undef HAVE_IEEEFP_H */
+
+/* Define to 1 if you have the <ifaddrs.h> header file. */
+#define HAVE_IFADDRS_H 1
+
+/* Define to 1 if you have the `inet_aton' function. */
+#define HAVE_INET_ATON 1
+
+/* Define to 1 if you have the `inet_pton' function. */
+#define HAVE_INET_PTON 1
+
+/* Define to 1 if the system has the type `int64'. */
+/* #undef HAVE_INT64 */
+
+/* Define to 1 if the system has the type `int8'. */
+/* #undef HAVE_INT8 */
+
+/* Define to 1 if the system has the type `intptr_t'. */
+#define HAVE_INTPTR_T 1
+
+/* Define to 1 if you have the <inttypes.h> header file. */
+#define HAVE_INTTYPES_H 1
+
+/* Define to 1 if you have the global variable 'int opterr'. */
+#define HAVE_INT_OPTERR 1
+
+/* Define to 1 if you have the global variable 'int optreset'. */
+/* #undef HAVE_INT_OPTRESET */
+
+/* Define to 1 if you have the global variable 'int timezone'. */
+#define HAVE_INT_TIMEZONE 1
+
+/* Define to 1 if you have support for IPv6. */
+#define HAVE_IPV6 1
+
+/* Define to 1 if you have isinf(). */
+#define HAVE_ISINF 1
+
+/* Define to 1 if you have the <langinfo.h> header file. */
+#define HAVE_LANGINFO_H 1
+
+/* Define to 1 if you have the <ldap.h> header file. */
+//#define HAVE_LDAP_H 0
+
+/* Define to 1 if you have the `crypto' library (-lcrypto). */
+#define HAVE_LIBCRYPTO 1
+
+/* Define to 1 if you have the `ldap' library (-lldap). */
+//#define HAVE_LIBLDAP 0
+
+/* Define to 1 if you have the `m' library (-lm). */
+#define HAVE_LIBM 1
+
+/* Define to 1 if you have the `pam' library (-lpam). */
+#define HAVE_LIBPAM 1
+
+/* Define if you have a function readline library */
+#define HAVE_LIBREADLINE 1
+
+/* Define to 1 if you have the `selinux' library (-lselinux). */
+/* #undef HAVE_LIBSELINUX */
+
+/* Define to 1 if you have the `ssl' library (-lssl). */
+#define HAVE_LIBSSL 0
+
+/* Define to 1 if you have the `wldap32' library (-lwldap32). */
+/* #undef HAVE_LIBWLDAP32 */
+
+/* Define to 1 if you have the `xml2' library (-lxml2). */
+#define HAVE_LIBXML2 1
+
+/* Define to 1 if you have the `xslt' library (-lxslt). */
+#define HAVE_LIBXSLT 1
+
+/* Define to 1 if you have the `z' library (-lz). */
+#define HAVE_LIBZ 1
+
+/* Define to 1 if you have the `zstd' library (-lzstd). */
+/* #undef HAVE_LIBZSTD */
+
+/* Define to 1 if constants of type 'long long int' should have the suffix LL.
+   */
+#define HAVE_LL_CONSTANTS 1
+
+/* Define to 1 if the system has the type `locale_t'. */
+#define HAVE_LOCALE_T 1
+
+/* Define to 1 if `long int' works and is 64 bits. */
+/* #undef HAVE_LONG_INT_64 */
+
+/* Define to 1 if the system has the type `long long int'. */
+#define HAVE_LONG_LONG_INT 1
+
+/* Define to 1 if `long long int' works and is 64 bits. */
+#define HAVE_LONG_LONG_INT_64 1
+
+/* Define to 1 if you have the <mbarrier.h> header file. */
+/* #undef HAVE_MBARRIER_H */
+
+/* Define to 1 if you have the `mbstowcs_l' function. */
+/* #undef HAVE_MBSTOWCS_L */
+
+/* Define to 1 if you have the `memmove' function. */
+#define HAVE_MEMMOVE 1
+
+/* Define to 1 if you have the <memory.h> header file. */
+#define HAVE_MEMORY_H 1
+
+/* Define to 1 if the system has the type `MINIDUMP_TYPE'. */
+/* #undef HAVE_MINIDUMP_TYPE */
+
+/* Define to 1 if you have the `mkdtemp' function. */
+#define HAVE_MKDTEMP 1
+
+/* Define to 1 if you have the <netinet/in.h> header file. */
+#define HAVE_NETINET_IN_H 1
+
+/* Define to 1 if you have the <netinet/tcp.h> header file. */
+#define HAVE_NETINET_TCP_H 1
+
+/* Define to 1 if you have the <net/if.h> header file. */
+#define HAVE_NET_IF_H 1
+
+/* Define to 1 if you have the <ossp/uuid.h> header file. */
+/* #undef HAVE_OSSP_UUID_H */
+
+/* Define to 1 if you have the <pam/pam_appl.h> header file. */
+/* #undef HAVE_PAM_PAM_APPL_H */
+
+/* Define to 1 if you have the `poll' function. */
+#define HAVE_POLL 1
+
+/* Define to 1 if you have the <poll.h> header file. */
+#define HAVE_POLL_H 1
+
+/* Define to 1 if you have a POSIX-conforming sigwait declaration. */
+/* #undef HAVE_POSIX_DECL_SIGWAIT */
+
+/* Define to 1 if you have the `posix_fadvise' function. */
+#define HAVE_POSIX_FADVISE 1
+
+/* Define to 1 if you have the declaration of `preadv', and to 0 if you don't. */
+/* #undef HAVE_DECL_PREADV */
+
+/* Define to 1 if you have the declaration of `pwritev', and to 0 if you don't. */
+/* #define HAVE_DECL_PWRITEV */
+
+/* Define to 1 if you have the `X509_get_signature_info' function. */
+/* #undef HAVE_X509_GET_SIGNATURE_INFO */
+
+/* Define to 1 if you have the POSIX signal interface. */
+#define HAVE_POSIX_SIGNALS 1
+
+/* Define to 1 if the assembler supports PPC's LWARX mutex hint bit. */
+/* #undef HAVE_PPC_LWARX_MUTEX_HINT */
+
+/* Define to 1 if you have the `pstat' function. */
+/* #undef HAVE_PSTAT */
+
+/* Define to 1 if the PS_STRINGS thing exists. */
+/* #undef HAVE_PS_STRINGS */
+
+/* Define to 1 if you have the `pthread_is_threaded_np' function. */
+/* #undef HAVE_PTHREAD_IS_THREADED_NP */
+
+/* Define to 1 if you have the <pwd.h> header file. */
+#define HAVE_PWD_H 1
+
+/* Define to 1 if you have the <readline.h> header file. */
+/* #undef HAVE_READLINE_H */
+
+/* Define to 1 if you have the <readline/history.h> header file. */
+#define HAVE_READLINE_HISTORY_H 1
+
+/* Define to 1 if you have the <readline/readline.h> header file. */
+/* #undef HAVE_READLINE_READLINE_H */
+
+/* Define to 1 if you have the `readlink' function. */
+#define HAVE_READLINK 1
+
+/* Define to 1 if you have the `rint' function. */
+#define HAVE_RINT 1
+
+/* Define to 1 if you have the `rl_completion_matches' function. */
+#define HAVE_RL_COMPLETION_MATCHES 1
+
+/* Define to 1 if you have the `rl_filename_completion_function' function. */
+#define HAVE_RL_FILENAME_COMPLETION_FUNCTION 1
+
+/* Define to 1 if you have the `rl_reset_screen_size' function. */
+/* #undef HAVE_RL_RESET_SCREEN_SIZE */
+
+/* Define to 1 if you have the `rl_variable_bind' function. */
+#define HAVE_RL_VARIABLE_BIND 1
+
+/* Define to 1 if you have the <security/pam_appl.h> header file. */
+#define HAVE_SECURITY_PAM_APPL_H 1
+
+/* Define to 1 if you have the `setproctitle' function. */
+/* #undef HAVE_SETPROCTITLE */
+
+/* Define to 1 if you have the `setsid' function. */
+#define HAVE_SETSID 1
+
+/* Define to 1 if you have the `shm_open' function. */
+#define HAVE_SHM_OPEN 1
+
+/* Define to 1 if the system has the type `socklen_t'. */
+#define HAVE_SOCKLEN_T 1
+
+/* Define to 1 if you have the `sigprocmask' function. */
+#define HAVE_SIGPROCMASK 1
+
+/* Define to 1 if you have sigsetjmp(). */
+#define HAVE_SIGSETJMP 1
+
+/* Define to 1 if the system has the type `sig_atomic_t'. */
+#define HAVE_SIG_ATOMIC_T 1
+
+/* Define to 1 if you have the `snprintf' function. */
+#define HAVE_SNPRINTF 1
+
+/* Define to 1 if you have spinlocks. */
+#define HAVE_SPINLOCKS 1
+
+/* Define to 1 if you have the `SSL_CTX_set_num_tickets' function. */
+/* #define HAVE_SSL_CTX_SET_NUM_TICKETS */
+
+/* Define to 1 if you have the `SSL_get_current_compression' function. */
+#define HAVE_SSL_GET_CURRENT_COMPRESSION 0
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#define HAVE_STDINT_H 1
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+#define HAVE_STDLIB_H 1
+
+/* Define to 1 if you have the `strerror' function. */
+#define HAVE_STRERROR 1
+
+/* Define to 1 if you have the `strerror_r' function. */
+#define HAVE_STRERROR_R 1
+
+/* Define to 1 if you have the <strings.h> header file. */
+//#define HAVE_STRINGS_H 1
+
+/* Define to 1 if you have the <string.h> header file. */
+#define HAVE_STRING_H 1
+
+/* Define to 1 if you have the `strlcat' function. */
+/* #undef HAVE_STRLCAT */
+
+/* Define to 1 if you have the `strlcpy' function. */
+/* #undef HAVE_STRLCPY */
+
+/* Define to 1 if you have the `strtoll' function. */
+#define HAVE_STRTOLL 1
+
+#if (!OS_DARWIN)
+#define HAVE_STRCHRNUL 1
+#endif
+
+/* Define to 1 if you have the `strtoq' function. */
+/* #undef HAVE_STRTOQ */
+
+/* Define to 1 if you have the `strtoull' function. */
+#define HAVE_STRTOULL 1
+
+/* Define to 1 if you have the `strtouq' function. */
+/* #undef HAVE_STRTOUQ */
+
+/* Define to 1 if the system has the type `struct addrinfo'. */
+#define HAVE_STRUCT_ADDRINFO 1
+
+/* Define to 1 if the system has the type `struct cmsgcred'. */
+/* #undef HAVE_STRUCT_CMSGCRED */
+
+/* Define to 1 if the system has the type `struct option'. */
+#define HAVE_STRUCT_OPTION 1
+
+/* Define to 1 if `sa_len' is a member of `struct sockaddr'. */
+/* #undef HAVE_STRUCT_SOCKADDR_SA_LEN */
+
+/* Define to 1 if the system has the type `struct sockaddr_storage'. */
+#define HAVE_STRUCT_SOCKADDR_STORAGE 1
+
+/* Define to 1 if `ss_family' is a member of `struct sockaddr_storage'. */
+#define HAVE_STRUCT_SOCKADDR_STORAGE_SS_FAMILY 1
+
+/* Define to 1 if `ss_len' is a member of `struct sockaddr_storage'. */
+/* #undef HAVE_STRUCT_SOCKADDR_STORAGE_SS_LEN */
+
+/* Define to 1 if `__ss_family' is a member of `struct sockaddr_storage'. */
+/* #undef HAVE_STRUCT_SOCKADDR_STORAGE___SS_FAMILY */
+
+/* Define to 1 if `__ss_len' is a member of `struct sockaddr_storage'. */
+/* #undef HAVE_STRUCT_SOCKADDR_STORAGE___SS_LEN */
+
+/* Define to 1 if `tm_zone' is a member of `struct tm'. */
+#define HAVE_STRUCT_TM_TM_ZONE 1
+
+/* Define to 1 if you have the `symlink' function. */
+#define HAVE_SYMLINK 1
+
+/* Define to 1 if you have the `sync_file_range' function. */
+/* #undef HAVE_SYNC_FILE_RANGE */
+
+/* Define to 1 if you have the syslog interface. */
+#define HAVE_SYSLOG 1
+
+/* Define to 1 if you have the <sys/ioctl.h> header file. */
+#define HAVE_SYS_IOCTL_H 1
+
+/* Define to 1 if you have the <sys/ipc.h> header file. */
+#define HAVE_SYS_IPC_H 1
+
+/* Define to 1 if you have the <sys/personality.h> header file. */
+/* #undef HAVE_SYS_PERSONALITY_H */
+
+/* Define to 1 if you have the <sys/poll.h> header file. */
+#define HAVE_SYS_POLL_H 1
+
+/* Define to 1 if you have the <sys/pstat.h> header file. */
+/* #undef HAVE_SYS_PSTAT_H */
+
+/* Define to 1 if you have the <sys/resource.h> header file. */
+#define HAVE_SYS_RESOURCE_H 1
+
+/* Define to 1 if you have the <sys/select.h> header file. */
+#define HAVE_SYS_SELECT_H 1
+
+/* Define to 1 if you have the <sys/sem.h> header file. */
+#define HAVE_SYS_SEM_H 1
+
+/* Define to 1 if you have the <sys/shm.h> header file. */
+#define HAVE_SYS_SHM_H 1
+
+/* Define to 1 if you have the <sys/signalfd.h> header file. */
+/* #undef HAVE_SYS_SIGNALFD_H */
+
+/* Define to 1 if you have the <sys/socket.h> header file. */
+#define HAVE_SYS_SOCKET_H 1
+
+/* Define to 1 if you have the <sys/sockio.h> header file. */
+/* #undef HAVE_SYS_SOCKIO_H */
+
+/* Define to 1 if you have the <sys/stat.h> header file. */
+#define HAVE_SYS_STAT_H 1
+
+/* Define to 1 if you have the <sys/tas.h> header file. */
+/* #undef HAVE_SYS_TAS_H */
+
+/* Define to 1 if you have the <sys/time.h> header file. */
+#define HAVE_SYS_TIME_H 1
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#define HAVE_SYS_TYPES_H 1
+
+/* Define to 1 if you have the <sys/ucred.h> header file. */
+#if (OS_DARWIN || OS_FREEBSD)
+#define HAVE_SYS_UCRED_H 1
+#endif
+
+/* Define to 1 if you have the <sys/un.h> header file. */
+#define HAVE_SYS_UN_H 1
+#define _GNU_SOURCE 1 /* Needed for glibc struct ucred */
+
+/* Define to 1 if you have the <termios.h> header file. */
+#define HAVE_TERMIOS_H 1
+
+/* Define to 1 if your `struct tm' has `tm_zone'. Deprecated, use
+   `HAVE_STRUCT_TM_TM_ZONE' instead. */
+#define HAVE_TM_ZONE 1
+
+/* Define to 1 if you have the `towlower' function. */
+#define HAVE_TOWLOWER 1
+
+/* Define to 1 if you have the external array `tzname'. */
+#define HAVE_TZNAME 1
+
+/* Define to 1 if you have the <ucred.h> header file. */
+/* #undef HAVE_UCRED_H */
+
+/* Define to 1 if the system has the type `uint64'. */
+/* #undef HAVE_UINT64 */
+
+/* Define to 1 if the system has the type `uint8'. */
+/* #undef HAVE_UINT8 */
+
+/* Define to 1 if the system has the type `uintptr_t'. */
+#define HAVE_UINTPTR_T 1
+
+/* Define to 1 if the system has the type `union semun'. */
+/* #undef HAVE_UNION_SEMUN */
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#define HAVE_UNISTD_H 1
+
+/* Define to 1 if you have unix sockets. */
+#define HAVE_UNIX_SOCKETS 1
+
+/* Define to 1 if you have the `unsetenv' function. */
+#define HAVE_UNSETENV 1
+
+/* Define to 1 if the system has the type `unsigned long long int'. */
+#define HAVE_UNSIGNED_LONG_LONG_INT 1
+
+/* Define to 1 if you have the `utime' function. */
+#define HAVE_UTIME 1
+
+/* Define to 1 if you have the `utimes' function. */
+#define HAVE_UTIMES 1
+
+/* Define to 1 if you have the <utime.h> header file. */
+#define HAVE_UTIME_H 1
+
+/* Define to 1 if you have BSD UUID support. */
+/* #undef HAVE_UUID_BSD */
+
+/* Define to 1 if you have E2FS UUID support. */
+/* #undef HAVE_UUID_E2FS */
+
+/* Define to 1 if you have the <uuid.h> header file. */
+#define HAVE_UUID_H 1
+
+/* Define to 1 if you have OSSP UUID support. */
+#define HAVE_UUID_OSSP 1
+
+/* Define to 1 if you have the <uuid/uuid.h> header file. */
+/* #undef HAVE_UUID_UUID_H */
+
+/* Define to 1 if you have the `vsnprintf' function. */
+#define HAVE_VSNPRINTF 1
+
+/* Define to 1 if you have the <wchar.h> header file. */
+#define HAVE_WCHAR_H 1
+
+/* Define to 1 if you have the `wcstombs' function. */
+#define HAVE_WCSTOMBS 1
+
+/* Define to 1 if you have the `wcstombs_l' function. */
+/* #undef HAVE_WCSTOMBS_L */
+
+/* Define to 1 if you have the <wctype.h> header file. */
+#define HAVE_WCTYPE_H 1
+
+/* Define to 1 if you have the <winldap.h> header file. */
+/* #undef HAVE_WINLDAP_H */
+
+/* Define to 1 if your compiler understands __builtin_bswap32. */
+/* #undef HAVE__BUILTIN_BSWAP32 */
+
+/* Define to 1 if your compiler understands __builtin_constant_p. */
+#define HAVE__BUILTIN_CONSTANT_P 1
+
+/* Define to 1 if your compiler understands __builtin_frame_address. */
+/* #undef HAVE__BUILTIN_FRAME_ADDRESS */
+
+/* Define to 1 if your compiler understands __builtin_types_compatible_p. */
+#define HAVE__BUILTIN_TYPES_COMPATIBLE_P 1
+
+/* Define to 1 if your compiler understands __builtin_unreachable. */
+/* #undef HAVE__BUILTIN_UNREACHABLE */
+
+/* Define to 1 if you have __cpuid. */
+/* #undef HAVE__CPUID */
+
+/* Define to 1 if you have __get_cpuid. */
+/* #undef HAVE__GET_CPUID */
+
+/* Define to 1 if your compiler understands _Static_assert. */
+/* #undef HAVE__STATIC_ASSERT */
+
+/* Define to 1 if your compiler understands __VA_ARGS__ in macros. */
+#define HAVE__VA_ARGS 1
+
+/* Define to the appropriate snprintf length modifier for 64-bit ints. */
+#define INT64_MODIFIER "ll"
+
+/* Define to 1 if `locale_t' requires <xlocale.h>. */
+/* #undef LOCALE_T_IN_XLOCALE */
+
+/* Define as the maximum alignment requirement of any C data type. */
+#define MAXIMUM_ALIGNOF 4
+
+/* Define bytes to use libc memset(). */
+#define MEMSET_LOOP_LIMIT 1024
+
+/* Define to the address where bug reports for this package should be sent. */
+#define PACKAGE_BUGREPORT "pgsql-bugs@postgresql.org"
+
+/* Define to the full name of this package. */
+#define PACKAGE_NAME "PostgreSQL"
+
+/* Define to the full name and version of this package. */
+#define PACKAGE_STRING "PostgreSQL 9.5.4"
+
+/* Define to the one symbol short name of this package. */
+#define PACKAGE_TARNAME "postgresql"
+
+/* Define to the home page for this package. */
+#define PACKAGE_URL ""
+
+/* Define to the version of this package. */
+#define PACKAGE_VERSION "9.5.4"
+
+/* Define to the name of a signed 128-bit integer type. */
+/* #undef PG_INT128_TYPE */
+
+/* Define to the name of a signed 64-bit integer type. */
+#define PG_INT64_TYPE long long int
+
+/* Define to the name of the default PostgreSQL service principal in Kerberos
+   (GSSAPI). (--with-krb-srvnam=NAME) */
+#define PG_KRB_SRVNAM "postgres"
+
+/* PostgreSQL major version as a string */
+#define PG_MAJORVERSION "9.5"
+
+/* Define to gnu_printf if compiler supports it, else printf. */
+#define PG_PRINTF_ATTRIBUTE printf
+
+/* Define to 1 if "static inline" works without unwanted warnings from
+   compilations where static inline functions are defined but not called. */
+#define PG_USE_INLINE 1
+
+/* PostgreSQL version as a string */
+#define PG_VERSION "9.5.4"
+
+/* PostgreSQL version as a number */
+#define PG_VERSION_NUM 90504
+
+/* A string containing the version number, platform, and C compiler */
+#define PG_VERSION_STR "PostgreSQL 9.5.4 on i686-pc-linux-gnu, compiled by gcc (GCC) 4.1.2 20080704 (Red Hat 4.1.2-55), 32-bit"
+
+/* Define to 1 to allow profiling output to be saved separately for each
+   process. */
+/* #undef PROFILE_PID_DIR */
+
+/* RELSEG_SIZE is the maximum number of blocks allowed in one disk file. Thus,
+   the maximum size of a single file is RELSEG_SIZE * BLCKSZ; relations bigger
+   than that are divided into multiple files. RELSEG_SIZE * BLCKSZ must be
+   less than your OS' limit on file size. This is often 2 GB or 4GB in a
+   32-bit operating system, unless you have large file support enabled. By
+   default, we make the limit 1 GB to avoid any possible integer-overflow
+   problems within the OS. A limit smaller than necessary only means we divide
+   a large relation into more chunks than necessary, so it seems best to err
+   in the direction of a small limit. A power-of-2 value is recommended to
+   save a few cycles in md.c, but is not absolutely required. Changing
+   RELSEG_SIZE requires an initdb. */
+#define RELSEG_SIZE 131072
+
+/* The size of `long', as computed by sizeof. */
+#define SIZEOF_LONG 4
+
+/* The size of `off_t', as computed by sizeof. */
+#define SIZEOF_OFF_T 8
+
+/* The size of `size_t', as computed by sizeof. */
+#define SIZEOF_SIZE_T 4
+
+/* The size of `void *', as computed by sizeof. */
+#define SIZEOF_VOID_P 4
+
+/* Define to 1 if you have the ANSI C header files. */
+#define STDC_HEADERS 1
+
+/* Define to 1 if strerror_r() returns a int. */
+/* #undef STRERROR_R_INT */
+
+/* Define to 1 if your <sys/time.h> declares `struct tm'. */
+/* #undef TM_IN_SYS_TIME */
+
+/* Define to 1 to build with assertion checks. (--enable-cassert) */
+/* #undef USE_ASSERT_CHECKING */
+
+/* Define to 1 to build with Bonjour support. (--with-bonjour) */
+/* #undef USE_BONJOUR */
+
+/* Define to 1 if you want float4 values to be passed by value.
+   (--enable-float4-byval) */
+#define USE_FLOAT4_BYVAL 1
+
+/* Define to 1 if you want float8, int8, etc values to be passed by value.
+   (--enable-float8-byval) */
+/* #undef USE_FLOAT8_BYVAL */
+
+/* Define to 1 if you want 64-bit integer timestamp and interval support.
+   (--enable-integer-datetimes) */
+#define USE_INTEGER_DATETIMES 1
+
+/* Define to 1 to build with LDAP support. (--with-ldap) */
+//#define USE_LDAP 0
+
+/* Define to 1 to build with XML support. (--with-libxml) */
+#define USE_LIBXML 1
+
+/* Define to 1 to use XSLT support when building contrib/xml2.
+   (--with-libxslt) */
+#define USE_LIBXSLT 1
+
+/* Define to select named POSIX semaphores. */
+/* #undef USE_NAMED_POSIX_SEMAPHORES */
+
+/* Define to build with OpenSSL support. (--with-openssl) */
+#define USE_OPENSSL 0
+
+#define USE_OPENSSL_RANDOM 0
+
+#define FRONTEND 1
+
+/* Define to 1 to build with PAM support. (--with-pam) */
+#define USE_PAM 1
+
+/* Use replacement snprintf() functions. */
+/* #undef USE_REPL_SNPRINTF */
+
+/* Define to 1 to use Intel SSE 4.2 CRC instructions with a runtime check. */
+#define USE_SLICING_BY_8_CRC32C 1
+
+/* Define to 1 use Intel SSE 4.2 CRC instructions. */
+/* #undef USE_SSE42_CRC32C */
+
+/* Define to 1 to use Intel SSSE 4.2 CRC instructions with a runtime check. */
+/* #undef USE_SSE42_CRC32C_WITH_RUNTIME_CHECK */
+
+/* Define to select SysV-style semaphores. */
+#define USE_SYSV_SEMAPHORES 1
+
+/* Define to select SysV-style shared memory. */
+#define USE_SYSV_SHARED_MEMORY 1
+
+/* Define to select unnamed POSIX semaphores. */
+/* #undef USE_UNNAMED_POSIX_SEMAPHORES */
+
+/* Define to select Win32-style semaphores. */
+/* #undef USE_WIN32_SEMAPHORES */
+
+/* Define to select Win32-style shared memory. */
+/* #undef USE_WIN32_SHARED_MEMORY */
+
+/* Define to 1 to build with ZSTD support. (--with-zstd) */
+/* #undef USE_ZSTD */
+
+/* Define to 1 if `wcstombs_l' requires <xlocale.h>. */
+/* #undef WCSTOMBS_L_IN_XLOCALE */
+
+/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
+   significant byte first (like Motorola and SPARC, unlike Intel). */
+#if defined AC_APPLE_UNIVERSAL_BUILD
+# if defined __BIG_ENDIAN__
+#  define WORDS_BIGENDIAN 1
+# endif
+#else
+# ifndef WORDS_BIGENDIAN
+/* #  undef WORDS_BIGENDIAN */
+# endif
+#endif
+
+/* Size of a WAL file block. This need have no particular relation to BLCKSZ.
+   XLOG_BLCKSZ must be a power of 2, and if your system supports O_DIRECT I/O,
+   XLOG_BLCKSZ must be a multiple of the alignment requirement for direct-I/O
+   buffers, else direct I/O may fail. Changing XLOG_BLCKSZ requires an initdb.
+   */
+#define XLOG_BLCKSZ 8192
+
+/* XLOG_SEG_SIZE is the size of a single WAL file. This must be a power of 2
+   and larger than XLOG_BLCKSZ (preferably, a great deal larger than
+   XLOG_BLCKSZ). Changing XLOG_SEG_SIZE requires an initdb. */
+#define XLOG_SEG_SIZE (16 * 1024 * 1024)
+
+
+
+/* Number of bits in a file offset, on hosts where this is settable. */
+#define _FILE_OFFSET_BITS 64
+
+/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
+/* #undef _LARGEFILE_SOURCE */
+
+/* Define for large files, on AIX-style hosts. */
+/* #undef _LARGE_FILES */
+
+/* Define to `__inline__' or `__inline' if that's what the C compiler
+   calls it, or to nothing if 'inline' is not supported under any name.  */
+#ifndef __cplusplus
+/* #undef inline */
+#endif
+
+/* Define to the type of a signed integer type wide enough to hold a pointer,
+   if such a type exists, and if the system does not define it. */
+/* #undef intptr_t */
+
+/* Define to empty if the C compiler does not understand signed types. */
+/* #undef signed */
+
+/* Define to the type of an unsigned integer type wide enough to hold a
+   pointer, if such a type exists, and if the system does not define it. */
+/* #undef uintptr_t */

contrib/postgres-cmake/pg_config_ext.h

@@ -0,0 +1,7 @@
+/*
+ *  * src/include/pg_config_ext.h.in.  This is generated manually, not by
+ *   * autoheader, since we want to limit which symbols get defined here.
+ *    */
+
+/* Define to the name of a signed 64-bit integer type. */
+#define PG_INT64_TYPE long long int

contrib/postgres-cmake/pg_config_os.h

@@ -0,0 +1,34 @@
+#if defined(OS_DARWIN)
+
+/* src/include/port/darwin.h */
+#define __darwin__	1
+
+#if HAVE_DECL_F_FULLFSYNC		/* not present before macOS 10.3 */
+#define HAVE_FSYNC_WRITETHROUGH
+#endif
+
+#else
+/* src/include/port/linux.h */
+/*
+ * As of July 2007, all known versions of the Linux kernel will sometimes
+ * return EIDRM for a shmctl() operation when EINVAL is correct (it happens
+ * when the low-order 15 bits of the supplied shm ID match the slot number
+ * assigned to a newer shmem segment).  We deal with this by assuming that
+ * EIDRM means EINVAL in PGSharedMemoryIsInUse().  This is reasonably safe
+ * since in fact Linux has no excuse for ever returning EIDRM; it doesn't
+ * track removed segments in a way that would allow distinguishing them from
+ * private ones.  But someday that code might get upgraded, and we'd have
+ * to have a kernel version test here.
+ */
+#define HAVE_LINUX_EIDRM_BUG
+
+/*
+ * Set the default wal_sync_method to fdatasync.  With recent Linux versions,
+ * xlogdefs.h's normal rules will prefer open_datasync, which (a) doesn't
+ * perform better and (b) causes outright failures on ext4 data=journal
+ * filesystems, because those don't support O_DIRECT.
+ */
+#define PLATFORM_DEFAULT_SYNC_METHOD	SYNC_METHOD_FDATASYNC
+
+#endif
+

contrib/postgres-cmake/pg_config_paths.h

@@ -0,0 +1,12 @@
+#define PGBINDIR "/bin"
+#define PGSHAREDIR "/share"
+#define SYSCONFDIR "/etc"
+#define INCLUDEDIR "/include"
+#define PKGINCLUDEDIR "/include"
+#define INCLUDEDIRSERVER "/include/server"
+#define LIBDIR "/lib"
+#define PKGLIBDIR "/lib"
+#define LOCALEDIR "/share/locale"
+#define DOCDIR "/doc"
+#define HTMLDIR "/doc"
+#define MANDIR "/man"

docker/server/entrypoint.sh

@@ -109,7 +109,7 @@ if [ -n "$CLICKHOUSE_USER" ] && [ "$CLICKHOUSE_USER" != "default" ] || [ -n "$CL
           <networks>
             <ip>::/0</ip>
           </networks>
-          <password>${CLICKHOUSE_PASSWORD}</password>
+          <password><![CDATA[${CLICKHOUSE_PASSWORD//]]>/]]]]><![CDATA[>}]]></password>
           <quota>default</quota>
           <access_management>${CLICKHOUSE_ACCESS_MANAGEMENT}</access_management>
         </${CLICKHOUSE_USER}>

docker/test/base/setup_export_logs.sh

@@ -124,6 +124,8 @@ function setup_logs_replication
     check_logs_credentials || return 0
     __set_connection_args
 
+    echo "My hostname is ${HOSTNAME}"
+
     echo 'Create all configured system logs'
     clickhouse-client --query "SYSTEM FLUSH LOGS"
 
@@ -184,7 +186,17 @@ function setup_logs_replication
             /^TTL /d
             ')
 
-        echo -e "Creating remote destination table ${table}_${hash} with statement:\n${statement}" >&2
+        echo -e "Creating remote destination table ${table}_${hash} with statement:" >&2
+
+        echo "::group::${table}"
+        # there's the only way big "$statement" can be printed without causing EAGAIN error
+        # cat: write error: Resource temporarily unavailable
+        statement_print="${statement}"
+        if [ "${#statement_print}" -gt 4000 ]; then
+          statement_print="${statement::1999}\n…\n${statement:${#statement}-1999}"
+        fi
+        echo -e "$statement_print"
+        echo "::endgroup::"
 
         echo "$statement" | clickhouse-client --database_replicated_initial_query_timeout_sec=10 \
             --distributed_ddl_task_timeout=30 --distributed_ddl_output_mode=throw_only_active \

docs/en/engines/database-engines/index.md

@@ -13,16 +13,17 @@ Here is a complete list of available database engines. Follow the links for more
 
 - [Atomic](../../engines/database-engines/atomic.md)
 
-- [MySQL](../../engines/database-engines/mysql.md)
+- [Lazy](../../engines/database-engines/lazy.md)
+
+- [MaterializedPostgreSQL](../../engines/database-engines/materialized-postgresql.md)
 
 - [MaterializedMySQL](../../engines/database-engines/materialized-mysql.md)
 
-- [Lazy](../../engines/database-engines/lazy.md)
+- [MySQL](../../engines/database-engines/mysql.md)
 
 - [PostgreSQL](../../engines/database-engines/postgresql.md)
 
-- [MaterializedPostgreSQL](../../engines/database-engines/materialized-postgresql.md)
-
 - [Replicated](../../engines/database-engines/replicated.md)
 
 - [SQLite](../../engines/database-engines/sqlite.md)
+

docs/en/engines/database-engines/materialized-postgresql.md

@@ -155,6 +155,12 @@ Replication of [**TOAST**](https://www.postgresql.org/docs/9.5/storage-toast.htm
 
     Sets a comma-separated list of PostgreSQL database tables, which will be replicated via [MaterializedPostgreSQL](../../engines/database-engines/materialized-postgresql.md) database engine.
 
+    Each table can have subset of replicated columns in brackets. If subset of columns is omitted, then all columns for table will be replicated.
+
+    ``` sql
+    materialized_postgresql_tables_list = 'table1(co1, col2),table2,table3(co3, col5, col7)
+    ```
+
     Default value: empty list — means whole PostgreSQL database will be replicated.
 
 ### `materialized_postgresql_schema` {#materialized-postgresql-schema}

docs/en/engines/table-engines/integrations/azure-queue.md

@@ -0,0 +1,72 @@
+---
+slug: /en/engines/table-engines/integrations/azure-queue
+sidebar_position: 181
+sidebar_label: AzureQueue
+---
+
+# AzureQueue Table Engine
+
+This engine provides an integration with [Azure Blob Storage](https://azure.microsoft.com/en-us/products/storage/blobs) ecosystem, allowing streaming data import.
+
+## Create Table {#creating-a-table}
+
+``` sql
+CREATE TABLE test (name String, value UInt32)
+    ENGINE = AzureQueue(...)
+    [SETTINGS]
+    [mode = '',]
+    [after_processing = 'keep',]
+    [keeper_path = '',]
+    ...
+```
+
+**Engine parameters**
+
+`AzureQueue` parameters are the same as `AzureBlobStorage` table engine supports. See parameters section [here](../../../engines/table-engines/integrations/azureBlobStorage.md).
+
+**Example**
+
+```sql
+CREATE TABLE azure_queue_engine_table (name String, value UInt32)
+ENGINE=AzureQueue('DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://azurite1:10000/devstoreaccount1/data/')
+SETTINGS
+    mode = 'unordered'
+```
+
+## Settings {#settings}
+
+The set of supported settings is the same as for `S3Queue` table engine, but without `s3queue_` prefix. See [full list of settings settings](../../../engines/table-engines/integrations/s3queue.md#settings).
+
+## Description {#description}
+
+`SELECT` is not particularly useful for streaming import (except for debugging), because each file can be imported only once. It is more practical to create real-time threads using [materialized views](../../../sql-reference/statements/create/view.md). To do this:
+
+1.  Use the engine to create a table for consuming from specified path in S3 and consider it a data stream.
+2.  Create a table with the desired structure.
+3.  Create a materialized view that converts data from the engine and puts it into a previously created table.
+
+When the `MATERIALIZED VIEW` joins the engine, it starts collecting data in the background.
+
+Example:
+
+``` sql
+  CREATE TABLE azure_queue_engine_table (name String, value UInt32)
+    ENGINE=AzureQueue('<endpoint>', 'CSV', 'gzip')
+    SETTINGS
+        mode = 'unordered';
+
+  CREATE TABLE stats (name String, value UInt32)
+    ENGINE = MergeTree() ORDER BY name;
+
+  CREATE MATERIALIZED VIEW consumer TO stats
+    AS SELECT name, value FROM azure_queue_engine_table;
+
+  SELECT * FROM stats ORDER BY name;
+```
+
+## Virtual columns {#virtual-columns}
+
+- `_path` — Path to the file.
+- `_file` — Name of the file.
+
+For more information about virtual columns see [here](../../../engines/table-engines/index.md#table_engines-virtual_columns).

docs/en/engines/table-engines/integrations/nats.md

@@ -112,7 +112,7 @@ Example:
 ```
 
 The NATS server configuration can be added using the ClickHouse config file.
- More specifically you can add Redis password for NATS engine:
+More specifically you can add Redis password for NATS engine:
 
 ``` xml
 <nats>
@@ -167,7 +167,7 @@ If you want to change the target table by using `ALTER`, we recommend disabling
 
 - `_subject` - NATS message subject. Data type: `String`.
 
-Additional virtual columns when `kafka_handle_error_mode='stream'`:
+Additional virtual columns when `nats_handle_error_mode='stream'`:
 
 - `_raw_message` - Raw message that couldn't be parsed successfully. Data type: `Nullable(String)`.
 - `_error` - Exception message happened during failed parsing. Data type: `Nullable(String)`.

docs/en/engines/table-engines/integrations/s3.md

@@ -35,7 +35,7 @@ CREATE TABLE s3_engine_table (name String, value UInt32)
     [SETTINGS ...]
 ```
 
-### Engine parameters
+### Engine parameters {#parameters}
 
 - `path` — Bucket url with path to file. Supports following wildcards in readonly mode: `*`, `**`, `?`, `{abc,def}` and `{N..M}` where `N`, `M` — numbers, `'abc'`, `'def'` — strings. For more information see [below](#wildcards-in-path).
 - `NOSIGN` - If this keyword is provided in place of credentials, all the requests will not be signed.

docs/en/engines/table-engines/integrations/s3queue.md

@@ -5,6 +5,7 @@ sidebar_label: S3Queue
 ---
 
 # S3Queue Table Engine
+
 This engine provides integration with [Amazon S3](https://aws.amazon.com/s3/) ecosystem and allows streaming import. This engine is similar to the [Kafka](../../../engines/table-engines/integrations/kafka.md), [RabbitMQ](../../../engines/table-engines/integrations/rabbitmq.md) engines, but provides S3-specific features.
 
 ## Create Table {#creating-a-table}
@@ -16,27 +17,25 @@ CREATE TABLE s3_queue_engine_table (name String, value UInt32)
     [mode = '',]
     [after_processing = 'keep',]
     [keeper_path = '',]
-    [s3queue_loading_retries = 0,]
+    [loading_retries = 0,]
-    [s3queue_processing_threads_num = 1,]
+    [processing_threads_num = 1,]
-    [s3queue_enable_logging_to_s3queue_log = 0,]
+    [enable_logging_to_s3queue_log = 0,]
-    [s3queue_polling_min_timeout_ms = 1000,]
+    [polling_min_timeout_ms = 1000,]
-    [s3queue_polling_max_timeout_ms = 10000,]
+    [polling_max_timeout_ms = 10000,]
-    [s3queue_polling_backoff_ms = 0,]
+    [polling_backoff_ms = 0,]
-    [s3queue_tracked_file_ttl_sec = 0,]
+    [tracked_file_ttl_sec = 0,]
-    [s3queue_tracked_files_limit = 1000,]
+    [tracked_files_limit = 1000,]
-    [s3queue_cleanup_interval_min_ms = 10000,]
+    [cleanup_interval_min_ms = 10000,]
-    [s3queue_cleanup_interval_max_ms = 30000,]
+    [cleanup_interval_max_ms = 30000,]
 ```
 
-Starting with `24.7` settings without `s3queue_` prefix are also supported.
+:::warning
+Before `24.7`, it is required to use `s3queue_` prefix for all settings apart from `mode`, `after_processing` and `keeper_path`.
+:::
 
 **Engine parameters**
 
-- `path` — Bucket url with path to file. Supports following wildcards in readonly mode: `*`, `**`, `?`, `{abc,def}` and `{N..M}` where `N`, `M` — numbers, `'abc'`, `'def'` — strings. For more information see [below](#wildcards-in-path).
+`S3Queue` parameters are the same as `S3` table engine supports. See parameters section [here](../../../engines/table-engines/integrations/s3.md#parameters).
-- `NOSIGN` - If this keyword is provided in place of credentials, all the requests will not be signed.
-- `format` — The [format](../../../interfaces/formats.md#formats) of the file.
-- `aws_access_key_id`, `aws_secret_access_key` - Long-term credentials for the [AWS](https://aws.amazon.com/) account user.  You can use these to authenticate your requests. Parameter is optional. If credentials are not specified, they are used from the configuration file. For more information see [Using S3 for Data Storage](../mergetree-family/mergetree.md#table_engine-mergetree-s3).
-- `compression` — Compression type. Supported values: `none`, `gzip/gz`, `brotli/br`, `xz/LZMA`, `zstd/zst`. Parameter is optional. By default, it will autodetect compression by file extension.
 
 **Example**
 

docs/en/engines/table-engines/mergetree-family/annindexes.md

@@ -107,6 +107,10 @@ The vector similarity index currently does not work with per-table, non-default
 [here](https://github.com/ClickHouse/ClickHouse/pull/51325#issuecomment-1605920475)). If necessary, the value must be changed in config.xml.
 :::
 
+Vector index creation is known to be slow. To speed the process up, index creation can be parallelized. The maximum number of threads can be
+configured using server configuration
+setting [max_build_vector_similarity_index_thread_pool_size](../../../operations/server-configuration-parameters/settings.md#server_configuration_parameters_max_build_vector_similarity_index_thread_pool_size).
+
 ANN indexes are built during column insertion and merge. As a result, `INSERT` and `OPTIMIZE` statements will be slower than for ordinary
 tables. ANNIndexes are ideally used only with immutable or rarely changed data, respectively when are far more read requests than write
 requests.

docs/en/engines/table-engines/mergetree-family/mergetree.md

@@ -995,34 +995,42 @@ They can be used for prewhere optimization only if we enable `set allow_statisti
 
     The minimum and maximum column value which allows to estimate the selectivity of range filters on numeric columns.
 
+    Syntax: `minmax`
+
 - `TDigest`
 
     [TDigest](https://github.com/tdunning/t-digest) sketches which allow to compute approximate percentiles (e.g. the 90th percentile) for numeric columns.
 
+    Syntax: `tdigest`
+
 - `Uniq`
 
     [HyperLogLog](https://en.wikipedia.org/wiki/HyperLogLog) sketches which provide an estimation how many distinct values a column contains.
 
-- `count_min`
+    Syntax: `uniq`
 
-    [Count-min](https://en.wikipedia.org/wiki/Count%E2%80%93min_sketch) sketches which provide an approximate count of the frequency of each value in a column.
+- `CountMin`
+
+    [CountMin](https://en.wikipedia.org/wiki/Count%E2%80%93min_sketch) sketches which provide an approximate count of the frequency of each value in a column.
+
+    Syntax `countmin`
 
 
 ### Supported Data Types {#supported-data-types}
 
-|           | (U)Int* | Float* | Decimal(*) | Date* | Boolean | Enum* | (Fixed)String    |
+|           | (U)Int*, Float*, Decimal(*), Date*, Boolean, Enum* | String or FixedString |
-|-----------|---------|--------|------------|-------|---------|-------|------------------|
+|-----------|----------------------------------------------------|-----------------------|
-| count_min | ✔       | ✔      | ✔          | ✔     | ✔       | ✔     | ✔                |
+| CountMin  | ✔                                                  | ✔                     |
-| MinMax    | ✔       | ✔      | ✔          | ✔     | ✔       | ✔     | ✗                |
+| MinMax    | ✔                                                  | ✗                     |
-| TDigest   | ✔       | ✔      | ✔          | ✔     | ✔       | ✔     | ✗                |
+| TDigest   | ✔                                                  | ✗                     |
-| Uniq      | ✔       | ✔      | ✔          | ✔     | ✔       | ✔     | ✔                |
+| Uniq      | ✔                                                  | ✔                     |
 
 
 ### Supported Operations {#supported-operations}
 
 |           | Equality filters (==) | Range filters (>, >=, <, <=) |
 |-----------|-----------------------|------------------------------|
-| count_min | ✔                     | ✗                            |
+| CountMin  | ✔                     | ✗                            |
 | MinMax    | ✗                     | ✔                            |
 | TDigest   | ✗                     | ✔                            |
 | Uniq      | ✔                     | ✗                            |

docs/en/engines/table-engines/special/filelog.md

@@ -97,7 +97,7 @@ If you want to change the target table by using `ALTER`, we recommend disabling
 - `_filename` - Name of the log file. Data type: `LowCardinality(String)`.
 - `_offset` - Offset in the log file. Data type: `UInt64`.
 
-Additional virtual columns when `kafka_handle_error_mode='stream'`:
+Additional virtual columns when `handle_error_mode='stream'`:
 
 - `_raw_record` - Raw record that couldn't be parsed successfully. Data type: `Nullable(String)`.
 - `_error` - Exception message happened during failed parsing. Data type: `Nullable(String)`.

docs/en/interfaces/formats.md

@@ -826,17 +826,17 @@ Result:
 
 ## JSONAsObject {#jsonasobject}
 
-In this format, a single JSON object is interpreted as a single [Object('json')](/docs/en/sql-reference/data-types/json.md) value. If the input has several JSON objects (comma separated), they are interpreted as separate rows. If the input data is enclosed in square brackets, it is interpreted as an array of JSONs.
+In this format, a single JSON object is interpreted as a single [JSON](/docs/en/sql-reference/data-types/newjson.md) value. If the input has several JSON objects (comma separated), they are interpreted as separate rows. If the input data is enclosed in square brackets, it is interpreted as an array of JSONs.
 
-This format can only be parsed for a table with a single field of type [Object('json')](/docs/en/sql-reference/data-types/json.md). The remaining columns must be set to [DEFAULT](/docs/en/sql-reference/statements/create/table.md/#default) or [MATERIALIZED](/docs/en/sql-reference/statements/create/table.md/#materialized).
+This format can only be parsed for a table with a single field of type [JSON](/docs/en/sql-reference/data-types/newjson.md). The remaining columns must be set to [DEFAULT](/docs/en/sql-reference/statements/create/table.md/#default) or [MATERIALIZED](/docs/en/sql-reference/statements/create/table.md/#materialized).
 
 **Examples**
 
 Query:
 
 ``` sql
-SET allow_experimental_object_type = 1;
+SET allow_experimental_json_type = 1;
-CREATE TABLE json_as_object (json Object('json')) ENGINE = Memory;
+CREATE TABLE json_as_object (json JSON) ENGINE = Memory;
 INSERT INTO json_as_object (json) FORMAT JSONAsObject {"foo":{"bar":{"x":"y"},"baz":1}},{},{"any json stucture":1}
 SELECT * FROM json_as_object FORMAT JSONEachRow;
 ```
@@ -844,9 +844,9 @@ SELECT * FROM json_as_object FORMAT JSONEachRow;
 Result:
 
 ``` response
-{"json":{"any json stucture":0,"foo":{"bar":{"x":"y"},"baz":1}}}
+{"json":{"foo":{"bar":{"x":"y"},"baz":"1"}}}
-{"json":{"any json stucture":0,"foo":{"bar":{"x":""},"baz":0}}}
+{"json":{}}
-{"json":{"any json stucture":1,"foo":{"bar":{"x":""},"baz":0}}}
+{"json":{"any json stucture":"1"}}
 ```
 
 **An array of JSON objects**
@@ -854,35 +854,34 @@ Result:
 Query:
 
 ``` sql
-SET allow_experimental_object_type = 1;
+SET allow_experimental_json_type = 1;
-CREATE TABLE json_square_brackets (field Object('json')) ENGINE = Memory;
+CREATE TABLE json_square_brackets (field JSON) ENGINE = Memory;
 INSERT INTO json_square_brackets FORMAT JSONAsObject [{"id": 1, "name": "name1"}, {"id": 2, "name": "name2"}];
-
 SELECT * FROM json_square_brackets FORMAT JSONEachRow;
 ```
 
 Result:
 
 ```response
-{"field":{"id":1,"name":"name1"}}
+{"field":{"id":"1","name":"name1"}}
-{"field":{"id":2,"name":"name2"}}
+{"field":{"id":"2","name":"name2"}}
 ```
 
 **Columns with default values**
 
 ```sql
-SET allow_experimental_object_type = 1;
+SET allow_experimental_json_type = 1;
-CREATE TABLE json_as_object (json Object('json'), time DateTime MATERIALIZED now()) ENGINE = Memory;
+CREATE TABLE json_as_object (json JSON, time DateTime MATERIALIZED now()) ENGINE = Memory;
 INSERT INTO json_as_object (json) FORMAT JSONAsObject {"foo":{"bar":{"x":"y"},"baz":1}};
 INSERT INTO json_as_object (json) FORMAT JSONAsObject {};
 INSERT INTO json_as_object (json) FORMAT JSONAsObject {"any json stucture":1}
-SELECT * FROM json_as_object FORMAT JSONEachRow
+SELECT time, json FROM json_as_object FORMAT JSONEachRow
 ```
 
 ```resonse
-{"json":{"any json stucture":0,"foo":{"bar":{"x":"y"},"baz":1}},"time":"2024-07-25 17:02:45"}
+{"time":"2024-09-16 12:18:10","json":{}}
-{"json":{"any json stucture":0,"foo":{"bar":{"x":""},"baz":0}},"time":"2024-07-25 17:02:47"}
+{"time":"2024-09-16 12:18:13","json":{"any json stucture":"1"}}
-{"json":{"any json stucture":1,"foo":{"bar":{"x":""},"baz":0}},"time":"2024-07-25 17:02:50"}
+{"time":"2024-09-16 12:18:08","json":{"foo":{"bar":{"x":"y"},"baz":"1"}}}
 ```
 
 ## JSONCompact {#jsoncompact}
@@ -1396,6 +1395,7 @@ SELECT * FROM json_each_row_nested
 - [input_format_json_ignore_unknown_keys_in_named_tuple](/docs/en/operations/settings/settings-formats.md/#input_format_json_ignore_unknown_keys_in_named_tuple) - ignore unknown keys in json object for named tuples. Default value - `false`.
 - [input_format_json_compact_allow_variable_number_of_columns](/docs/en/operations/settings/settings-formats.md/#input_format_json_compact_allow_variable_number_of_columns) - allow variable number of columns in JSONCompact/JSONCompactEachRow format, ignore extra columns and use default values on missing columns. Default value - `false`.
 - [input_format_json_throw_on_bad_escape_sequence](/docs/en/operations/settings/settings-formats.md/#input_format_json_throw_on_bad_escape_sequence) - throw an exception if JSON string contains bad escape sequence. If disabled, bad escape sequences will remain as is in the data. Default value - `true`.
+- [input_format_json_empty_as_default](/docs/en/operations/settings/settings-formats.md/#input_format_json_empty_as_default) - treat empty fields in JSON input as default values. Default value - `false`. For complex default expressions [input_format_defaults_for_omitted_fields](/docs/en/operations/settings/settings-formats.md/#input_format_defaults_for_omitted_fields) must be enabled too.
 - [output_format_json_quote_64bit_integers](/docs/en/operations/settings/settings-formats.md/#output_format_json_quote_64bit_integers) - controls quoting of 64-bit integers in JSON output format. Default value - `true`.
 - [output_format_json_quote_64bit_floats](/docs/en/operations/settings/settings-formats.md/#output_format_json_quote_64bit_floats) - controls quoting of 64-bit floats in JSON output format. Default value - `false`.
 - [output_format_json_quote_denormals](/docs/en/operations/settings/settings-formats.md/#output_format_json_quote_denormals) - enables '+nan', '-nan', '+inf', '-inf' outputs in JSON output format. Default value - `false`.

docs/en/interfaces/third-party/gui.md

@@ -233,6 +233,16 @@ Features:
 - Useful tools: Zookeeper data exploration, query EXPLAIN, kill queries, etc.
 - Visualization metric charts: queries and resource usage, number of merges/mutation, merge performance, query performance, etc.
 
+### CKibana {#ckibana}
+
+[CKibana](https://github.com/TongchengOpenSource/ckibana) is a lightweight service that allows you to effortlessly search, explore, and visualize ClickHouse data using the native Kibana UI.
+
+Features:
+
+- Translates chart requests from the native Kibana UI into ClickHouse query syntax.
+- Supports advanced features such as sampling and caching to enhance query performance.
+- Minimizes the learning cost for users after migrating from ElasticSearch to ClickHouse.
+
 ## Commercial {#commercial}
 
 ### DataGrip {#datagrip}

docs/en/operations/external-authenticators/ssl-x509.md

@@ -6,7 +6,7 @@ import SelfManaged from '@site/docs/en/_snippets/_self_managed_only_no_roadmap.m
 
 <SelfManaged />
 
-[SSL 'strict' option](../server-configuration-parameters/settings.md#server_configuration_parameters-openssl) enables mandatory certificate validation for the incoming connections. In this case, only connections with trusted certificates can be established. Connections with untrusted certificates will be rejected. Thus, certificate validation allows to uniquely authenticate an incoming connection. `Common Name` or `subjectAltName extension` field of the certificate is used to identify the connected user. This allows to associate multiple certificates with the same user. Additionally, reissuing and revoking of the certificates does not affect the ClickHouse configuration.
+[SSL 'strict' option](../server-configuration-parameters/settings.md#server_configuration_parameters-openssl) enables mandatory certificate validation for the incoming connections. In this case, only connections with trusted certificates can be established. Connections with untrusted certificates will be rejected. Thus, certificate validation allows to uniquely authenticate an incoming connection. `Common Name` or `subjectAltName extension` field of the certificate is used to identify the connected user. `subjectAltName extension` supports the usage of one wildcard '*' in the server configuration. This allows to associate multiple certificates with the same user. Additionally, reissuing and revoking of the certificates does not affect the ClickHouse configuration.
 
 To enable SSL certificate authentication, a list of `Common Name`'s or `Subject Alt Name`'s for each ClickHouse user must be specified in the settings file `users.xml `:
 
@@ -30,6 +30,12 @@ To enable SSL certificate authentication, a list of `Common Name`'s or `Subject
             </ssl_certificates>
             <!-- Other settings -->
         </user_name_2>
+        <user_name_3>
+            <ssl_certificates>
+                <!-- Wildcard support -->
+                <subject_alt_name>URI:spiffe://foo.com/*/bar</subject_alt_name>
+            </ssl_certificates>
+        </user_name_3>
     </users>
 </clickhouse>
 ```

docs/en/operations/server-configuration-parameters/settings.md

@@ -491,6 +491,14 @@ Type: Double
 
 Default: 0.9
 
+## max_build_vector_similarity_index_thread_pool_size {#server_configuration_parameters_max_build_vector_similarity_index_thread_pool_size}
+
+The maximum number of threads to use for building vector indexes. 0 means all cores.
+
+Type: UInt64
+
+Default: 16
+
 ## cgroups_memory_usage_observer_wait_time
 
 Interval in seconds during which the server's maximum allowed memory consumption is adjusted by the corresponding threshold in cgroups. (see
@@ -3142,3 +3150,15 @@ Default value: "default"
 
 **See Also**
 - [Workload Scheduling](/docs/en/operations/workload-scheduling.md)
+
+## max_authentication_methods_per_user {#max_authentication_methods_per_user}
+
+The maximum number of authentication methods a user can be created with or altered to.
+Changing this setting does not affect existing users. Create/alter authentication-related queries will fail if they exceed the limit specified in this setting.
+Non authentication create/alter queries will succeed.
+
+Type: UInt64
+
+Default value: 100
+
+Zero means unlimited

docs/en/operations/settings/settings-formats.md

@@ -752,6 +752,17 @@ Possible values:
 
 Default value: 0.
 
+### input_format_json_empty_as_default {#input_format_json_empty_as_default}
+
+When enabled, replace empty input fields in JSON with default values. For complex default expressions `input_format_defaults_for_omitted_fields` must be enabled too.
+
+Possible values:
+
++ 0 — Disable.
++ 1 — Enable.
+
+Default value: 0.
+
 ## TSV format settings {#tsv-format-settings}
 
 ### input_format_tsv_empty_as_default {#input_format_tsv_empty_as_default}

docs/en/operations/utilities/clickhouse-keeper-client.md

@@ -47,13 +47,15 @@ keeper foo bar
 
 -   `ls '[path]'` -- Lists the nodes for the given path (default: cwd)
 -   `cd '[path]'` -- Changes the working path (default `.`)
+-   `cp '<src>' '<dest>'`  -- Copies 'src' node to 'dest' path
+-   `mv '<src>' '<dest>'`  -- Moves 'src' node to the 'dest' path
 -   `exists '<path>'` -- Returns `1` if node exists, `0` otherwise
 -   `set '<path>' <value> [version]` -- Updates the node's value. Only updates if version matches (default: -1)
 -   `create '<path>' <value> [mode]` -- Creates new node with the set value
 -   `touch '<path>'` -- Creates new node with an empty string as value. Doesn't throw an exception if the node already exists
 -   `get '<path>'` -- Returns the node's value
 -   `rm '<path>' [version]` -- Removes the node only if version matches (default: -1)
--   `rmr '<path>'` -- Recursively deletes path. Confirmation required
+-   `rmr '<path>' [limit]` -- Recursively deletes path if the subtree size is smaller than the limit. Confirmation required (default limit = 100)
 -   `flwc <command>` -- Executes four-letter-word command
 -   `help` -- Prints this message
 -   `get_direct_children_number '[path]'` -- Get numbers of direct children nodes under a specific path

docs/en/sql-reference/aggregate-functions/reference/quantileddsketch.md

@@ -9,7 +9,7 @@ Computes an approximate [quantile](https://en.wikipedia.org/wiki/Quantile) of a
 **Syntax**
 
 ``` sql
-quantileDDsketch[relative_accuracy, (level)](expr)
+quantileDD(relative_accuracy, [level])(expr)
 ```
 
 **Arguments**

docs/en/sql-reference/functions/date-time-functions.md

@@ -1636,37 +1636,329 @@ SELECT toStartOfInterval(toDateTime('2023-01-01 14:45:00'), INTERVAL 1 MINUTE, t
 
 Converts a date with time to a certain fixed date, while preserving the time.
 
+**Syntax**
+
+```sql
+toTime(date[,timezone])
+```
+
+**Arguments**
+
+- `date` — Date to convert to a time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+- `timezone` (optional) — Timezone for the returned value. [String](../data-types/string.md).
+
+**Returned value**
+
+- DateTime with date equated to `1970-01-02` while preserving the time. [DateTime](../data-types/datetime.md).
+
+:::note
+If the `date` input argument contained sub-second components,
+they will be dropped in the returned `DateTime` value with second-accuracy.
+:::
+
+**Example**
+
+Query:
+
+```sql
+SELECT toTime(toDateTime64('1970-12-10 01:20:30.3000',3)) AS result, toTypeName(result);
+```
+
+Result:
+
+```response
+┌──────────────result─┬─toTypeName(result)─┐
+│ 1970-01-02 01:20:30 │ DateTime           │
+└─────────────────────┴────────────────────┘
+```
+
 ## toRelativeYearNum
 
-Converts a date, or date with time, to the number of the year, starting from a certain fixed point in the past.
+Converts a date, or date with time, to the number of years elapsed since a certain fixed point in the past. 
+
+**Syntax**
+
+```sql
+toRelativeYearNum(date)
+```
+
+**Arguments**
+
+- `date` — Date or date with time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- The number of years from a fixed reference point in the past. [UInt16](../data-types/int-uint.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+    toRelativeYearNum(toDate('2002-12-08')) AS y1,
+    toRelativeYearNum(toDate('2010-10-26')) AS y2
+```
+
+Result:
+
+```response
+┌───y1─┬───y2─┐
+│ 2002 │ 2010 │
+└──────┴──────┘
+```
 
 ## toRelativeQuarterNum
 
-Converts a date, or date with time, to the number of the quarter, starting from a certain fixed point in the past.
+Converts a date, or date with time, to the number of quarters elapsed since a certain fixed point in the past.
+
+**Syntax**
+
+```sql
+toRelativeQuarterNum(date)
+```
+
+**Arguments**
+
+- `date` — Date or date with time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- The number of quarters from a fixed reference point in the past. [UInt32](../data-types/int-uint.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+  toRelativeQuarterNum(toDate('1993-11-25')) AS q1,
+  toRelativeQuarterNum(toDate('2005-01-05')) AS q2
+```
+
+Result:
+
+```response
+┌───q1─┬───q2─┐
+│ 7975 │ 8020 │
+└──────┴──────┘
+```
 
 ## toRelativeMonthNum
 
-Converts a date, or date with time, to the number of the month, starting from a certain fixed point in the past.
+Converts a date, or date with time, to the number of months elapsed since a certain fixed point in the past.
+
+**Syntax**
+
+```sql
+toRelativeMonthNum(date)
+```
+
+**Arguments**
+
+- `date` — Date or date with time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- The number of months from a fixed reference point in the past. [UInt32](../data-types/int-uint.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+  toRelativeMonthNum(toDate('2001-04-25')) AS m1,
+  toRelativeMonthNum(toDate('2009-07-08')) AS m2
+```
+
+Result:
+
+```response
+┌────m1─┬────m2─┐
+│ 24016 │ 24115 │
+└───────┴───────┘
+```
 
 ## toRelativeWeekNum
 
-Converts a date, or date with time, to the number of the week, starting from a certain fixed point in the past.
+Converts a date, or date with time, to the number of weeks elapsed since a certain fixed point in the past.
+
+**Syntax**
+
+```sql
+toRelativeWeekNum(date)
+```
+
+**Arguments**
+
+- `date` — Date or date with time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- The number of weeks from a fixed reference point in the past. [UInt32](../data-types/int-uint.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+  toRelativeWeekNum(toDate('2000-02-29')) AS w1,
+  toRelativeWeekNum(toDate('2001-01-12')) AS w2
+```
+
+Result:
+
+```response
+┌───w1─┬───w2─┐
+│ 1574 │ 1619 │
+└──────┴──────┘
+```
 
 ## toRelativeDayNum
 
-Converts a date, or date with time, to the number of the day, starting from a certain fixed point in the past.
+Converts a date, or date with time, to the number of days elapsed since a certain fixed point in the past.
+
+**Syntax**
+
+```sql
+toRelativeDayNum(date)
+```
+
+**Arguments**
+
+- `date` — Date or date with time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- The number of days from a fixed reference point in the past. [UInt32](../data-types/int-uint.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+  toRelativeDayNum(toDate('1993-10-05')) AS d1,
+  toRelativeDayNum(toDate('2000-09-20')) AS d2
+```
+
+Result:
+
+```response
+┌───d1─┬────d2─┐
+│ 8678 │ 11220 │
+└──────┴───────┘
+```
 
 ## toRelativeHourNum
 
-Converts a date, or date with time, to the number of the hour, starting from a certain fixed point in the past.
+Converts a date, or date with time, to the number of hours elapsed since a certain fixed point in the past.
+
+**Syntax**
+
+```sql
+toRelativeHourNum(date)
+```
+
+**Arguments**
+
+- `date` — Date or date with time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- The number of hours from a fixed reference point in the past. [UInt32](../data-types/int-uint.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+  toRelativeHourNum(toDateTime('1993-10-05 05:20:36')) AS h1,
+  toRelativeHourNum(toDateTime('2000-09-20 14:11:29')) AS h2
+```
+
+Result:
+
+```response
+┌─────h1─┬─────h2─┐
+│ 208276 │ 269292 │
+└────────┴────────┘
+```
 
 ## toRelativeMinuteNum
 
-Converts a date, or date with time, to the number of the minute, starting from a certain fixed point in the past.
+Converts a date, or date with time, to the number of minutes elapsed since a certain fixed point in the past.
+
+**Syntax**
+
+```sql
+toRelativeMinuteNum(date)
+```
+
+**Arguments**
+
+- `date` — Date or date with time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- The number of minutes from a fixed reference point in the past. [UInt32](../data-types/int-uint.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+  toRelativeMinuteNum(toDateTime('1993-10-05 05:20:36')) AS m1,
+  toRelativeMinuteNum(toDateTime('2000-09-20 14:11:29')) AS m2
+```
+
+Result:
+
+```response
+┌───────m1─┬───────m2─┐
+│ 12496580 │ 16157531 │
+└──────────┴──────────┘
+```
 
 ## toRelativeSecondNum
 
-Converts a date, or date with time, to the number of the second, starting from a certain fixed point in the past.
+Converts a date, or date with time, to the number of the seconds elapsed since a certain fixed point in the past.
+
+**Syntax**
+
+```sql
+toRelativeSecondNum(date)
+```
+
+**Arguments**
+
+- `date` — Date or date with time. [Date](../data-types/date.md)/[DateTime](../data-types/datetime.md)/[DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- The number of seconds from a fixed reference point in the past. [UInt32](../data-types/int-uint.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+  toRelativeSecondNum(toDateTime('1993-10-05 05:20:36')) AS s1,
+  toRelativeSecondNum(toDateTime('2000-09-20 14:11:29')) AS s2
+```
+
+Result:
+
+```response
+┌────────s1─┬────────s2─┐
+│ 749794836 │ 969451889 │
+└───────────┴───────────┘
+```
 
 ## toISOYear
 

docs/en/sql-reference/functions/type-conversion-functions.md

@@ -3906,7 +3906,7 @@ Result:
 
 ## toDateTime64
 
-Converts the argument to the [DateTime64](../data-types/datetime64.md) data type.
+Converts an input value to a value of type [DateTime64](../data-types/datetime64.md).
 
 **Syntax**
 
@@ -3918,7 +3918,7 @@ toDateTime64(expr, scale, [timezone])
 
 - `expr` — The value. [String](../data-types/string.md), [UInt32](../data-types/int-uint.md), [Float](../data-types/float.md) or [DateTime](../data-types/datetime.md).
 - `scale` - Tick size (precision): 10<sup>-precision</sup> seconds. Valid range: [ 0 : 9 ].
-- `timezone` - Time zone of the specified datetime64 object.
+- `timezone` (optional) - Time zone of the specified datetime64 object.
 
 **Returned value**
 
@@ -3977,10 +3977,137 @@ SELECT toDateTime64('2019-01-01 00:00:00', 3, 'Asia/Istanbul') AS value, toTypeN
 
 ## toDateTime64OrZero
 
+Like [toDateTime64](#todatetime64), this function converts an input value to a value of type [DateTime64](../data-types/datetime64.md) but returns the min value of [DateTime64](../data-types/datetime64.md) if an invalid argument is received.
+
+**Syntax**
+
+``` sql
+toDateTime64OrZero(expr, scale, [timezone])
+```
+
+**Arguments**
+
+- `expr` — The value. [String](../data-types/string.md), [UInt32](../data-types/int-uint.md), [Float](../data-types/float.md) or [DateTime](../data-types/datetime.md).
+- `scale` - Tick size (precision): 10<sup>-precision</sup> seconds. Valid range: [ 0 : 9 ].
+- `timezone` (optional) - Time zone of the specified DateTime64 object.
+
+**Returned value**
+
+- A calendar date and time of day, with sub-second precision, otherwise the minimum value of `DateTime64`: `1970-01-01 01:00:00.000`. [DateTime64](../data-types/datetime64.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT toDateTime64OrZero('2008-10-12 00:00:00 00:30:30', 3) AS invalid_arg
+```
+
+Result:
+
+```response
+┌─────────────invalid_arg─┐
+│ 1970-01-01 01:00:00.000 │
+└─────────────────────────┘
+```
+
+**See also**
+
+- [toDateTime64](#todatetime64).
+- [toDateTime64OrNull](#todatetime64ornull).
+- [toDateTime64OrDefault](#todatetime64ordefault).
+
 ## toDateTime64OrNull
 
+Like [toDateTime64](#todatetime64), this function converts an input value to a value of type [DateTime64](../data-types/datetime64.md) but returns `NULL` if an invalid argument is received.
+
+**Syntax**
+
+``` sql
+toDateTime64OrNull(expr, scale, [timezone])
+```
+
+**Arguments**
+
+- `expr` — The value. [String](../data-types/string.md), [UInt32](../data-types/int-uint.md), [Float](../data-types/float.md) or [DateTime](../data-types/datetime.md).
+- `scale` - Tick size (precision): 10<sup>-precision</sup> seconds. Valid range: [ 0 : 9 ].
+- `timezone` (optional) - Time zone of the specified DateTime64 object.
+
+**Returned value**
+
+- A calendar date and time of day, with sub-second precision, otherwise `NULL`. [DateTime64](../data-types/datetime64.md)/[NULL](../data-types/nullable.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+    toDateTime64OrNull('1976-10-18 00:00:00.30', 3) AS valid_arg,
+    toDateTime64OrNull('1976-10-18 00:00:00 30', 3) AS invalid_arg
+```
+
+Result:
+
+```response
+┌───────────────valid_arg─┬─invalid_arg─┐
+│ 1976-10-18 00:00:00.300 │        ᴺᵁᴸᴸ │
+└─────────────────────────┴─────────────┘
+```
+
+**See also**
+
+- [toDateTime64](#todatetime64).
+- [toDateTime64OrZero](#todatetime64orzero).
+- [toDateTime64OrDefault](#todatetime64ordefault).
+
 ## toDateTime64OrDefault
 
+Like [toDateTime64](#todatetime64), this function converts an input value to a value of type [DateTime64](../data-types/datetime64.md), 
+but returns either the default value of [DateTime64](../data-types/datetime64.md)
+or the provided default if an invalid argument is received.
+
+**Syntax**
+
+``` sql
+toDateTime64OrNull(expr, scale, [timezone, default])
+```
+
+**Arguments**
+
+- `expr` — The value. [String](../data-types/string.md), [UInt32](../data-types/int-uint.md), [Float](../data-types/float.md) or [DateTime](../data-types/datetime.md).
+- `scale` - Tick size (precision): 10<sup>-precision</sup> seconds. Valid range: [ 0 : 9 ].
+- `timezone` (optional) - Time zone of the specified DateTime64 object.
+- `default` (optional) - Default value to return if an invalid argument is received. [DateTime64](../data-types/datetime64.md).
+
+**Returned value**
+
+- A calendar date and time of day, with sub-second precision, otherwise the minimum value of `DateTime64` or the `default` value if provided. [DateTime64](../data-types/datetime64.md).
+
+**Example**
+
+Query:
+
+```sql
+SELECT
+    toDateTime64OrDefault('1976-10-18 00:00:00 30', 3) AS invalid_arg,
+    toDateTime64OrDefault('1976-10-18 00:00:00 30', 3, 'UTC', toDateTime64('2001-01-01 00:00:00.00',3)) AS invalid_arg_with_default
+```
+
+Result:
+
+```response
+┌─────────────invalid_arg─┬─invalid_arg_with_default─┐
+│ 1970-01-01 01:00:00.000 │  2000-12-31 23:00:00.000 │
+└─────────────────────────┴──────────────────────────┘
+```
+
+**See also**
+
+- [toDateTime64](#todatetime64).
+- [toDateTime64OrZero](#todatetime64orzero).
+- [toDateTime64OrNull](#todatetime64ornull).
+
 ## toDecimal32
 
 Converts an input value to a value of type [`Decimal(9, S)`](../data-types/decimal.md) with scale of `S`. Throws an exception in case of an error.

docs/en/sql-reference/statements/alter/user.md

@@ -12,9 +12,10 @@ Syntax:
 ``` sql
 ALTER USER [IF EXISTS] name1 [ON CLUSTER cluster_name1] [RENAME TO new_name1]
         [, name2 [ON CLUSTER cluster_name2] [RENAME TO new_name2] ...]
-    [NOT IDENTIFIED | IDENTIFIED {[WITH {no_password | plaintext_password | sha256_password | sha256_hash | double_sha1_password | double_sha1_hash}] BY {'password' | 'hash'}} | {WITH ldap SERVER 'server_name'} | {WITH kerberos [REALM 'realm']} | {WITH ssl_certificate CN 'common_name' | SAN 'TYPE:subject_alt_name'}]
+    [NOT IDENTIFIED | IDENTIFIED | ADD IDENTIFIED {[WITH {no_password | plaintext_password | sha256_password | sha256_hash | double_sha1_password | double_sha1_hash}] BY {'password' | 'hash'}} | {WITH ldap SERVER 'server_name'} | {WITH kerberos [REALM 'realm']} | {WITH ssl_certificate CN 'common_name' | SAN 'TYPE:subject_alt_name'}]
     [[ADD | DROP] HOST {LOCAL | NAME 'name' | REGEXP 'name_regexp' | IP 'address' | LIKE 'pattern'} [,...] | ANY | NONE]
     [VALID UNTIL datetime]
+    [RESET AUTHENTICATION METHODS TO NEW]
     [DEFAULT ROLE role [,...] | ALL | ALL EXCEPT role [,...] ]
     [GRANTEES {user | role | ANY | NONE} [,...] [EXCEPT {user | role} [,...]]]
     [SETTINGS variable [= value] [MIN [=] min_value] [MAX [=] max_value] [READONLY | WRITABLE] | PROFILE 'profile_name'] [,...]
@@ -62,3 +63,31 @@ Allows the user with `john` account to grant his privileges to the user with `ja
 ``` sql
 ALTER USER john GRANTEES jack;
 ```
+
+Adds new authentication methods to the user while keeping the existing ones:
+
+``` sql
+ALTER USER user1 ADD IDENTIFIED WITH plaintext_password by '1', bcrypt_password by '2', plaintext_password by '3'
+```
+
+Notes:
+1. Older versions of ClickHouse might not support the syntax of multiple authentication methods. Therefore, if the ClickHouse server contains such users and is downgraded to a version that does not support it, such users will become unusable and some user related operations will be broken. In order to downgrade gracefully, one must set all users to contain a single authentication method prior to downgrading. Alternatively, if the server was downgraded without the proper procedure, the faulty users should be dropped.
+2. `no_password` can not co-exist with other authentication methods for security reasons.
+Because of that, it is not possible to `ADD` a `no_password` authentication method. The below query will throw an error:
+
+``` sql
+ALTER USER user1 ADD IDENTIFIED WITH no_password
+```
+
+If you want to drop authentication methods for a user and rely on `no_password`, you must specify in the below replacing form.
+
+Reset authentication methods and adds the ones specified in the query (effect of leading IDENTIFIED without the ADD keyword):
+
+``` sql
+ALTER USER user1 IDENTIFIED WITH plaintext_password by '1', bcrypt_password by '2', plaintext_password by '3'
+```
+
+Reset authentication methods and keep the most recent added one:
+``` sql
+ALTER USER user1 RESET AUTHENTICATION METHODS TO NEW
+```

docs/en/sql-reference/statements/create/user.md

@@ -15,6 +15,7 @@ CREATE USER [IF NOT EXISTS | OR REPLACE] name1 [ON CLUSTER cluster_name1]
     [NOT IDENTIFIED | IDENTIFIED {[WITH {no_password | plaintext_password | sha256_password | sha256_hash | double_sha1_password | double_sha1_hash}] BY {'password' | 'hash'}} | {WITH ldap SERVER 'server_name'} | {WITH kerberos [REALM 'realm']} | {WITH ssl_certificate CN 'common_name' | SAN 'TYPE:subject_alt_name'} | {WITH ssh_key BY KEY 'public_key' TYPE 'ssh-rsa|...'} | {WITH http SERVER 'server_name' [SCHEME 'Basic']}]
     [HOST {LOCAL | NAME 'name' | REGEXP 'name_regexp' | IP 'address' | LIKE 'pattern'} [,...] | ANY | NONE]
     [VALID UNTIL datetime]
+    [RESET AUTHENTICATION METHODS TO NEW]
     [IN access_storage_type]
     [DEFAULT ROLE role [,...]]
     [DEFAULT DATABASE database | NONE]
@@ -144,6 +145,17 @@ In ClickHouse Cloud, by default, passwords must meet the following complexity re
 
     The available password types are: `plaintext_password`, `sha256_password`, `double_sha1_password`.
 
+7. Multiple authentication methods can be specified: 
+
+   ```sql
+   CREATE USER user1 IDENTIFIED WITH plaintext_password by '1', bcrypt_password by '2', plaintext_password by '3''
+   ```
+
+Notes:
+1. Older versions of ClickHouse might not support the syntax of multiple authentication methods. Therefore, if the ClickHouse server contains such users and is downgraded to a version that does not support it, such users will become unusable and some user related operations will be broken. In order to downgrade gracefully, one must set all users to contain a single authentication method prior to downgrading. Alternatively, if the server was downgraded without the proper procedure, the faulty users should be dropped.
+2. `no_password` can not co-exist with other authentication methods for security reasons. Therefore, you can only specify
+`no_password` if it is the only authentication method in the query. 
+
 ## User Host
 
 User host is a host from which a connection to ClickHouse server could be established. The host can be specified in the `HOST` query section in the following ways:

programs/keeper-client/Commands.cpp

@@ -506,14 +506,23 @@ bool RMRCommand::parse(IParser::Pos & pos, std::shared_ptr<ASTKeeperQuery> & nod
         return false;
     node->args.push_back(std::move(path));
 
+    ASTPtr remove_nodes_limit;
+    if (ParserUnsignedInteger{}.parse(pos, remove_nodes_limit, expected))
+        node->args.push_back(remove_nodes_limit->as<ASTLiteral &>().value);
+    else
+        node->args.push_back(UInt64(100));
+
     return true;
 }
 
 void RMRCommand::execute(const ASTKeeperQuery * query, KeeperClient * client) const
 {
     String path = client->getAbsolutePath(query->args[0].safeGet<String>());
+    UInt64 remove_nodes_limit = query->args[1].safeGet<UInt64>();
+
     client->askConfirmation(
-        "You are going to recursively delete path " + path, [client, path] { client->zookeeper->removeRecursive(path); });
+        "You are going to recursively delete path " + path,
+        [client, path, remove_nodes_limit] { client->zookeeper->removeRecursive(path, static_cast<UInt32>(remove_nodes_limit)); });
 }
 
 bool ReconfigCommand::parse(IParser::Pos & pos, std::shared_ptr<ASTKeeperQuery> & node, DB::Expected & expected) const

programs/keeper-client/Commands.h

@@ -184,7 +184,7 @@ class RMRCommand : public IKeeperClientCommand
 
     void execute(const ASTKeeperQuery * query, KeeperClient * client) const override;
 
-    String getHelpMessage() const override { return "{} <path> -- Recursively deletes path. Confirmation required"; }
+    String getHelpMessage() const override { return "{} <path> [limit] -- Recursively deletes path if the subtree size is smaller than the limit. Confirmation required (default limit = 100)"; }
 };
 
 class ReconfigCommand : public IKeeperClientCommand

programs/keeper/Keeper.cpp

@@ -11,6 +11,7 @@
 #include <Core/ServerUUID.h>
 #include <Common/logger_useful.h>
 #include <Common/CgroupsMemoryUsageObserver.h>
+#include <Common/MemoryWorker.h>
 #include <Common/ErrorHandlers.h>
 #include <Common/assertProcessUserMatchesDataOwner.h>
 #include <Common/makeSocketAddress.h>
@@ -384,6 +385,9 @@ try
         LOG_INFO(log, "Background threads finished in {} ms", watch.elapsedMilliseconds());
     });
 
+    MemoryWorker memory_worker(config().getUInt64("memory_worker_period_ms", 0));
+    memory_worker.start();
+
     static ServerErrorHandler error_handler;
     Poco::ErrorHandler::set(&error_handler);
 
@@ -425,8 +429,9 @@ try
             for (const auto & server : *servers)
                 metrics.emplace_back(ProtocolServerMetrics{server.getPortName(), server.currentThreads(), server.refusedConnections()});
             return metrics;
-        }
+        },
-    );
+        /*update_jemalloc_epoch_=*/memory_worker.getSource() != MemoryWorker::MemoryUsageSource::Jemalloc,
+        /*update_rss_=*/memory_worker.getSource() == MemoryWorker::MemoryUsageSource::None);
 
     std::vector<std::string> listen_hosts = DB::getMultipleValuesFromConfig(config(), "", "listen_host");
 
@@ -655,7 +660,6 @@ try
     GWPAsan::initFinished();
 #endif
 
-
     LOG_INFO(log, "Ready for connections.");
 
     waitForTerminationRequest();

programs/server/Server.cpp

@@ -11,7 +11,6 @@
 #include <Poco/Util/HelpFormatter.h>
 #include <Poco/Environment.h>
 #include <Poco/Config.h>
-#include <Common/Jemalloc.h>
 #include <Common/scope_guard_safe.h>
 #include <Common/logger_useful.h>
 #include <base/phdr_cache.h>
@@ -25,6 +24,7 @@
 #include <base/Numa.h>
 #include <Common/PoolId.h>
 #include <Common/MemoryTracker.h>
+#include <Common/MemoryWorker.h>
 #include <Common/ClickHouseRevision.h>
 #include <Common/DNSResolver.h>
 #include <Common/CgroupsMemoryUsageObserver.h>
@@ -111,6 +111,8 @@
 #include <filesystem>
 #include <unordered_set>
 
+#include <Common/Jemalloc.h>
+
 #include "config.h"
 #include <Common/config_version.h>
 
@@ -449,9 +451,12 @@ void checkForUsersNotInMainConfig(
     }
 }
 
+namespace
+{
+
 /// Unused in other builds
 #if defined(OS_LINUX)
-static String readLine(const String & path)
+String readLine(const String & path)
 {
     ReadBufferFromFile in(path);
     String contents;
@@ -459,7 +464,7 @@ static String readLine(const String & path)
     return contents;
 }
 
-static int readNumber(const String & path)
+int readNumber(const String & path)
 {
     ReadBufferFromFile in(path);
     int result;
@@ -469,7 +474,7 @@ static int readNumber(const String & path)
 
 #endif
 
-static void sanityChecks(Server & server)
+void sanityChecks(Server & server)
 {
     std::string data_path = getCanonicalPath(server.config().getString("path", DBMS_DEFAULT_PATH));
     std::string logs_path = server.config().getString("logger.log", "");
@@ -590,6 +595,8 @@ static void sanityChecks(Server & server)
     }
 }
 
+}
+
 void loadStartupScripts(const Poco::Util::AbstractConfiguration & config, ContextMutablePtr context, Poco::Logger * log)
 {
     try
@@ -906,6 +913,8 @@ try
         LOG_INFO(log, "Background threads finished in {} ms", watch.elapsedMilliseconds());
     });
 
+    MemoryWorker memory_worker(global_context->getServerSettings().memory_worker_period_ms);
+
     /// This object will periodically calculate some metrics.
     ServerAsynchronousMetrics async_metrics(
         global_context,
@@ -924,8 +933,9 @@ try
             for (const auto & server : servers)
                 metrics.emplace_back(ProtocolServerMetrics{server.getPortName(), server.currentThreads(), server.refusedConnections()});
             return metrics;
-        }
+        },
-    );
+        /*update_jemalloc_epoch_=*/memory_worker.getSource() != MemoryWorker::MemoryUsageSource::Jemalloc,
+        /*update_rss_=*/memory_worker.getSource() == MemoryWorker::MemoryUsageSource::None);
 
     /// NOTE: global context should be destroyed *before* GlobalThreadPool::shutdown()
     /// Otherwise GlobalThreadPool::shutdown() will hang, since Context holds some threads.
@@ -1204,6 +1214,8 @@ try
 
     FailPointInjection::enableFromGlobalConfig(config());
 
+    memory_worker.start();
+
     int default_oom_score = 0;
 
 #if !defined(NDEBUG)
@@ -1547,15 +1559,6 @@ try
             total_memory_tracker.setDescription("(total)");
             total_memory_tracker.setMetric(CurrentMetrics::MemoryTracking);
 
-            if (cgroups_memory_usage_observer)
-            {
-                double hard_limit_ratio = new_server_settings.cgroup_memory_watcher_hard_limit_ratio;
-                double soft_limit_ratio = new_server_settings.cgroup_memory_watcher_soft_limit_ratio;
-                cgroups_memory_usage_observer->setMemoryUsageLimits(
-                    static_cast<uint64_t>(max_server_memory_usage * hard_limit_ratio),
-                    static_cast<uint64_t>(max_server_memory_usage * soft_limit_ratio));
-            }
-
             size_t merges_mutations_memory_usage_soft_limit = new_server_settings.merges_mutations_memory_usage_soft_limit;
 
             size_t default_merges_mutations_server_memory_usage = static_cast<size_t>(current_physical_server_memory * new_server_settings.merges_mutations_memory_usage_to_ram_ratio);
@@ -1584,8 +1587,6 @@ try
             background_memory_tracker.setDescription("(background)");
             background_memory_tracker.setMetric(CurrentMetrics::MergesMutationsMemoryTracking);
 
-            total_memory_tracker.setAllowUseJemallocMemory(new_server_settings.allow_use_jemalloc_memory);
-
             auto * global_overcommit_tracker = global_context->getGlobalOvercommitTracker();
             total_memory_tracker.setOvercommitTracker(global_overcommit_tracker);
 

src/Access/AccessBackup.cpp

@@ -29,6 +29,7 @@ namespace DB
 namespace ErrorCodes
 {
     extern const int CANNOT_RESTORE_TABLE;
+    extern const int ACCESS_ENTITY_ALREADY_EXISTS;
     extern const int LOGICAL_ERROR;
 }
 
@@ -175,9 +176,46 @@ namespace
         return res;
     }
 
-    std::unordered_map<UUID, UUID> resolveDependencies(const std::unordered_map<UUID, std::pair<String, AccessEntityType>> & dependencies, const AccessControl & access_control, bool allow_unresolved_dependencies)
+    /// Checks if new entities (which we're going to restore) already exist,
+    /// and either skips them or throws an exception depending on the restore settings.
+    void checkExistingEntities(std::vector<std::pair<UUID, AccessEntityPtr>> & entities,
+                               std::unordered_map<UUID, UUID> & old_to_new_id,
+                               const AccessControl & access_control,
+                               RestoreAccessCreationMode creation_mode)
+    {
+        if (creation_mode == RestoreAccessCreationMode::kReplace)
+            return;
+
+        auto should_skip = [&](const std::pair<UUID, AccessEntityPtr> & id_and_entity)
+        {
+            const auto & id = id_and_entity.first;
+            const auto & entity = *id_and_entity.second;
+            auto existing_id = access_control.find(entity.getType(), entity.getName());
+            if (!existing_id)
+            {
+                return false;
+            }
+            else if (creation_mode == RestoreAccessCreationMode::kCreateIfNotExists)
+            {
+                old_to_new_id[id] = *existing_id;
+                return true;
+            }
+            else
+            {
+                throw Exception(ErrorCodes::ACCESS_ENTITY_ALREADY_EXISTS, "Cannot restore {} because it already exists", entity.formatTypeWithName());
+            }
+        };
+
+        std::erase_if(entities, should_skip);
+    }
+
+    /// If new entities (which we're going to restore) depend on other entities which are not going to be restored or not present in the backup
+    /// then we should try to replace those dependencies with already existing entities.
+    void resolveDependencies(const std::unordered_map<UUID, std::pair<String, AccessEntityType>> & dependencies,
+                             std::unordered_map<UUID, UUID> & old_to_new_ids,
+                             const AccessControl & access_control,
+                             bool allow_unresolved_dependencies)
     {
-        std::unordered_map<UUID, UUID> old_to_new_ids;
         for (const auto & [id, name_and_type] : dependencies)
         {
             std::optional<UUID> new_id;
@@ -188,9 +226,9 @@ namespace
             if (new_id)
                 old_to_new_ids.emplace(id, *new_id);
         }
-        return old_to_new_ids;
     }
 
+    /// Generates random IDs for the new entities.
     void generateRandomIDs(std::vector<std::pair<UUID, AccessEntityPtr>> & entities, std::unordered_map<UUID, UUID> & old_to_new_ids)
     {
         Poco::UUIDGenerator generator;
@@ -203,27 +241,12 @@ namespace
         }
     }
 
-    void replaceDependencies(std::vector<std::pair<UUID, AccessEntityPtr>> & entities, const std::unordered_map<UUID, UUID> & old_to_new_ids)
+    /// Updates dependencies of the new entities using a specified map.
+    void replaceDependencies(std::vector<std::pair<UUID, AccessEntityPtr>> & entities,
+                             const std::unordered_map<UUID, UUID> & old_to_new_ids)
     {
         for (auto & entity : entities | boost::adaptors::map_values)
-        {
+            IAccessEntity::replaceDependencies(entity, old_to_new_ids);
-            bool need_replace = false;
-            for (const auto & dependency : entity->findDependencies())
-            {
-                if (old_to_new_ids.contains(dependency))
-                {
-                    need_replace = true;
-                    break;
-                }
-            }
-
-            if (!need_replace)
-                continue;
-
-            auto new_entity = entity->clone();
-            new_entity->replaceDependencies(old_to_new_ids);
-            entity = new_entity;
-        }
     }
 
     AccessRightsElements getRequiredAccessToRestore(const std::vector<std::pair<UUID, AccessEntityPtr>> & entities)
@@ -314,7 +337,9 @@ std::pair<String, BackupEntryPtr> makeBackupEntryForAccess(
 
 AccessRestorerFromBackup::AccessRestorerFromBackup(
     const BackupPtr & backup_, const RestoreSettings & restore_settings_)
-    : backup(backup_), allow_unresolved_access_dependencies(restore_settings_.allow_unresolved_access_dependencies)
+    : backup(backup_)
+    , creation_mode(restore_settings_.create_access)
+    , allow_unresolved_dependencies(restore_settings_.allow_unresolved_access_dependencies)
 {
 }
 
@@ -362,7 +387,9 @@ std::vector<std::pair<UUID, AccessEntityPtr>> AccessRestorerFromBackup::getAcces
 {
     auto new_entities = entities;
 
-    auto old_to_new_ids = resolveDependencies(dependencies, access_control, allow_unresolved_access_dependencies);
+    std::unordered_map<UUID, UUID> old_to_new_ids;
+    checkExistingEntities(new_entities, old_to_new_ids, access_control, creation_mode);
+    resolveDependencies(dependencies, old_to_new_ids, access_control, allow_unresolved_dependencies);
     generateRandomIDs(new_entities, old_to_new_ids);
     replaceDependencies(new_entities, old_to_new_ids);
 

src/Access/AccessBackup.h

@@ -17,6 +17,7 @@ using BackupPtr = std::shared_ptr<const IBackup>;
 class IBackupEntry;
 using BackupEntryPtr = std::shared_ptr<const IBackupEntry>;
 struct RestoreSettings;
+enum class RestoreAccessCreationMode : uint8_t;
 
 
 /// Makes a backup of access entities of a specified type.
@@ -45,7 +46,8 @@ public:
 
 private:
     BackupPtr backup;
-    bool allow_unresolved_access_dependencies = false;
+    RestoreAccessCreationMode creation_mode;
+    bool allow_unresolved_dependencies = false;
     std::vector<std::pair<UUID, AccessEntityPtr>> entities;
     std::unordered_map<UUID, std::pair<String, AccessEntityType>> dependencies;
     std::unordered_set<String> data_paths;

src/Access/AccessControl.cpp

@@ -544,9 +544,9 @@ scope_guard AccessControl::subscribeForChanges(const std::vector<UUID> & ids, co
     return changes_notifier->subscribeForChanges(ids, handler);
 }
 
-bool AccessControl::insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists)
+bool AccessControl::insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id)
 {
-    if (MultipleAccessStorage::insertImpl(id, entity, replace_if_exists, throw_if_exists))
+    if (MultipleAccessStorage::insertImpl(id, entity, replace_if_exists, throw_if_exists, conflicting_id))
     {
         changes_notifier->sendNotifications();
         return true;

src/Access/AccessControl.h

@@ -243,7 +243,7 @@ private:
     class CustomSettingsPrefixes;
     class PasswordComplexityRules;
 
-    bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists) override;
+    bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id) override;
     bool removeImpl(const UUID & id, bool throw_if_not_exists) override;
     bool updateImpl(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists) override;
 

src/Access/AccessEntityIO.cpp

@@ -82,7 +82,7 @@ AccessEntityPtr deserializeAccessEntityImpl(const String & definition)
             if (res)
                 throw Exception(ErrorCodes::INCORRECT_ACCESS_ENTITY_DEFINITION, "Two access entities attached in the same file");
             res = user = std::make_unique<User>();
-            InterpreterCreateUserQuery::updateUserFromQuery(*user, *create_user_query, /* allow_no_password = */ true, /* allow_plaintext_password = */ true);
+            InterpreterCreateUserQuery::updateUserFromQuery(*user, *create_user_query, /* allow_no_password = */ true, /* allow_plaintext_password = */ true, /* max_number_of_authentication_methods = zero is unlimited*/ 0);
         }
         else if (auto * create_role_query = query->as<ASTCreateRoleQuery>())
         {

src/Access/Authentication.cpp

@@ -14,11 +14,6 @@
 
 namespace DB
 {
-namespace ErrorCodes
-{
-    extern const int NOT_IMPLEMENTED;
-    extern const int SUPPORT_IS_DISABLED;
-}
 
 namespace
 {
@@ -84,12 +79,140 @@ namespace
         return false;
     }
 #endif
-}
 
+    bool checkKerberosAuthentication(
+        const GSSAcceptorContext * gss_acceptor_context,
+        const AuthenticationData & authentication_method,
+        const ExternalAuthenticators & external_authenticators)
+    {
+        return authentication_method.getType() == AuthenticationType::KERBEROS
+            && external_authenticators.checkKerberosCredentials(authentication_method.getKerberosRealm(), *gss_acceptor_context);
+    }
+
+    bool checkMySQLAuthentication(
+        const MySQLNative41Credentials * mysql_credentials,
+        const AuthenticationData & authentication_method)
+    {
+        switch (authentication_method.getType())
+        {
+            case AuthenticationType::PLAINTEXT_PASSWORD:
+                return checkPasswordPlainTextMySQL(
+                    mysql_credentials->getScramble(),
+                    mysql_credentials->getScrambledPassword(),
+                    authentication_method.getPasswordHashBinary());
+            case AuthenticationType::DOUBLE_SHA1_PASSWORD:
+                return checkPasswordDoubleSHA1MySQL(
+                    mysql_credentials->getScramble(),
+                    mysql_credentials->getScrambledPassword(),
+                    authentication_method.getPasswordHashBinary());
+            default:
+                return false;
+        }
+    }
+
+    bool checkBasicAuthentication(
+        const BasicCredentials * basic_credentials,
+        const AuthenticationData & authentication_method,
+        const ExternalAuthenticators & external_authenticators,
+        SettingsChanges & settings)
+    {
+        switch (authentication_method.getType())
+        {
+            case AuthenticationType::NO_PASSWORD:
+            {
+                return true; // N.B. even if the password is not empty!
+            }
+            case AuthenticationType::PLAINTEXT_PASSWORD:
+            {
+                return checkPasswordPlainText(basic_credentials->getPassword(), authentication_method.getPasswordHashBinary());
+            }
+            case AuthenticationType::SHA256_PASSWORD:
+            {
+                return checkPasswordSHA256(
+                    basic_credentials->getPassword(), authentication_method.getPasswordHashBinary(), authentication_method.getSalt());
+            }
+            case AuthenticationType::DOUBLE_SHA1_PASSWORD:
+            {
+                return checkPasswordDoubleSHA1(basic_credentials->getPassword(), authentication_method.getPasswordHashBinary());
+            }
+            case AuthenticationType::LDAP:
+            {
+                return external_authenticators.checkLDAPCredentials(authentication_method.getLDAPServerName(), *basic_credentials);
+            }
+            case AuthenticationType::BCRYPT_PASSWORD:
+            {
+                return checkPasswordBcrypt(basic_credentials->getPassword(), authentication_method.getPasswordHashBinary());
+            }
+            case AuthenticationType::HTTP:
+            {
+                if (authentication_method.getHTTPAuthenticationScheme() == HTTPAuthenticationScheme::BASIC)
+                {
+                    return external_authenticators.checkHTTPBasicCredentials(
+                        authentication_method.getHTTPAuthenticationServerName(), *basic_credentials, settings);
+                }
+                break;
+            }
+            default:
+                break;
+        }
+
+        return false;
+    }
+
+    bool checkSSLCertificateAuthentication(
+        const SSLCertificateCredentials * ssl_certificate_credentials,
+        const AuthenticationData & authentication_method)
+    {
+        if (AuthenticationType::SSL_CERTIFICATE != authentication_method.getType())
+        {
+            return false;
+        }
+
+        for (SSLCertificateSubjects::Type type : {SSLCertificateSubjects::Type::CN, SSLCertificateSubjects::Type::SAN})
+        {
+            for (const auto & subject : authentication_method.getSSLCertificateSubjects().at(type))
+            {
+                if (ssl_certificate_credentials->getSSLCertificateSubjects().at(type).contains(subject))
+                    return true;
+
+                // Wildcard support (1 only)
+                if (subject.contains('*'))
+                {
+                    auto prefix = std::string_view(subject).substr(0, subject.find('*'));
+                    auto suffix = std::string_view(subject).substr(subject.find('*') + 1);
+                    auto slashes = std::count(subject.begin(), subject.end(), '/');
+
+                    for (const auto & certificate_subject : ssl_certificate_credentials->getSSLCertificateSubjects().at(type))
+                    {
+                        bool matches_wildcard = certificate_subject.starts_with(prefix) && certificate_subject.ends_with(suffix);
+
+                        // '*' must not represent a '/' in URI, so check if the number of '/' are equal
+                        bool matches_slashes = slashes == count(certificate_subject.begin(), certificate_subject.end(), '/');
+
+                        if (matches_wildcard && matches_slashes)
+                            return true;
+                    }
+                }
+            }
+        }
+
+        return false;
+    }
+
+#if USE_SSH
+    bool checkSshAuthentication(
+        const SshCredentials * ssh_credentials,
+        const AuthenticationData & authentication_method)
+    {
+        return AuthenticationType::SSH_KEY == authentication_method.getType()
+            && checkSshSignature(authentication_method.getSSHKeys(), ssh_credentials->getSignature(), ssh_credentials->getOriginal());
+    }
+#endif
+}
 
 bool Authentication::areCredentialsValid(
     const Credentials & credentials,
-    const AuthenticationData & auth_data,
+    const AuthenticationData & authentication_method,
     const ExternalAuthenticators & external_authenticators,
     SettingsChanges & settings)
 {
@@ -98,204 +221,35 @@ bool Authentication::areCredentialsValid(
 
     if (const auto * gss_acceptor_context = typeid_cast<const GSSAcceptorContext *>(&credentials))
     {
-        switch (auth_data.getType())
+        return checkKerberosAuthentication(gss_acceptor_context, authentication_method, external_authenticators);
-        {
-            case AuthenticationType::NO_PASSWORD:
-            case AuthenticationType::PLAINTEXT_PASSWORD:
-            case AuthenticationType::SHA256_PASSWORD:
-            case AuthenticationType::DOUBLE_SHA1_PASSWORD:
-            case AuthenticationType::BCRYPT_PASSWORD:
-            case AuthenticationType::LDAP:
-            case AuthenticationType::HTTP:
-                throw Authentication::Require<BasicCredentials>("ClickHouse Basic Authentication");
-
-            case AuthenticationType::JWT:
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "JWT is available only in ClickHouse Cloud");
-
-            case AuthenticationType::KERBEROS:
-                return external_authenticators.checkKerberosCredentials(auth_data.getKerberosRealm(), *gss_acceptor_context);
-
-            case AuthenticationType::SSL_CERTIFICATE:
-                throw Authentication::Require<BasicCredentials>("ClickHouse X.509 Authentication");
-
-            case AuthenticationType::SSH_KEY:
-#if USE_SSH
-                throw Authentication::Require<SshCredentials>("SSH Keys Authentication");
-#else
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "SSH is disabled, because ClickHouse is built without libssh");
-#endif
-
-            case AuthenticationType::MAX:
-                break;
-        }
     }
 
     if (const auto * mysql_credentials = typeid_cast<const MySQLNative41Credentials *>(&credentials))
     {
-        switch (auth_data.getType())
+        return checkMySQLAuthentication(mysql_credentials, authentication_method);
-        {
-            case AuthenticationType::NO_PASSWORD:
-                return true; // N.B. even if the password is not empty!
-
-            case AuthenticationType::PLAINTEXT_PASSWORD:
-                return checkPasswordPlainTextMySQL(mysql_credentials->getScramble(), mysql_credentials->getScrambledPassword(), auth_data.getPasswordHashBinary());
-
-            case AuthenticationType::DOUBLE_SHA1_PASSWORD:
-                return checkPasswordDoubleSHA1MySQL(mysql_credentials->getScramble(), mysql_credentials->getScrambledPassword(), auth_data.getPasswordHashBinary());
-
-            case AuthenticationType::SHA256_PASSWORD:
-            case AuthenticationType::BCRYPT_PASSWORD:
-            case AuthenticationType::LDAP:
-            case AuthenticationType::KERBEROS:
-            case AuthenticationType::HTTP:
-                throw Authentication::Require<BasicCredentials>("ClickHouse Basic Authentication");
-
-            case AuthenticationType::SSL_CERTIFICATE:
-                throw Authentication::Require<BasicCredentials>("ClickHouse X.509 Authentication");
-
-            case AuthenticationType::JWT:
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "JWT is available only in ClickHouse Cloud");
-
-            case AuthenticationType::SSH_KEY:
-#if USE_SSH
-                throw Authentication::Require<SshCredentials>("SSH Keys Authentication");
-#else
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "SSH is disabled, because ClickHouse is built without libssh");
-#endif
-
-            case AuthenticationType::MAX:
-                break;
-        }
     }
 
     if (const auto * basic_credentials = typeid_cast<const BasicCredentials *>(&credentials))
     {
-        switch (auth_data.getType())
+        return checkBasicAuthentication(basic_credentials, authentication_method, external_authenticators, settings);
-        {
-            case AuthenticationType::NO_PASSWORD:
-                return true; // N.B. even if the password is not empty!
-
-            case AuthenticationType::PLAINTEXT_PASSWORD:
-                return checkPasswordPlainText(basic_credentials->getPassword(), auth_data.getPasswordHashBinary());
-
-            case AuthenticationType::SHA256_PASSWORD:
-                return checkPasswordSHA256(basic_credentials->getPassword(), auth_data.getPasswordHashBinary(), auth_data.getSalt());
-
-            case AuthenticationType::DOUBLE_SHA1_PASSWORD:
-                return checkPasswordDoubleSHA1(basic_credentials->getPassword(), auth_data.getPasswordHashBinary());
-
-            case AuthenticationType::LDAP:
-                return external_authenticators.checkLDAPCredentials(auth_data.getLDAPServerName(), *basic_credentials);
-
-            case AuthenticationType::KERBEROS:
-                throw Authentication::Require<GSSAcceptorContext>(auth_data.getKerberosRealm());
-
-            case AuthenticationType::SSL_CERTIFICATE:
-                throw Authentication::Require<BasicCredentials>("ClickHouse X.509 Authentication");
-
-            case AuthenticationType::SSH_KEY:
-#if USE_SSH
-                throw Authentication::Require<SshCredentials>("SSH Keys Authentication");
-#else
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "SSH is disabled, because ClickHouse is built without libssh");
-#endif
-
-            case AuthenticationType::JWT:
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "JWT is available only in ClickHouse Cloud");
-
-            case AuthenticationType::BCRYPT_PASSWORD:
-                return checkPasswordBcrypt(basic_credentials->getPassword(), auth_data.getPasswordHashBinary());
-
-            case AuthenticationType::HTTP:
-                switch (auth_data.getHTTPAuthenticationScheme())
-                {
-                    case HTTPAuthenticationScheme::BASIC:
-                        return external_authenticators.checkHTTPBasicCredentials(
-                            auth_data.getHTTPAuthenticationServerName(), *basic_credentials, settings);
-                }
-
-            case AuthenticationType::MAX:
-                break;
-        }
     }
 
     if (const auto * ssl_certificate_credentials = typeid_cast<const SSLCertificateCredentials *>(&credentials))
     {
-        switch (auth_data.getType())
+        return checkSSLCertificateAuthentication(ssl_certificate_credentials, authentication_method);
-        {
-            case AuthenticationType::NO_PASSWORD:
-            case AuthenticationType::PLAINTEXT_PASSWORD:
-            case AuthenticationType::SHA256_PASSWORD:
-            case AuthenticationType::DOUBLE_SHA1_PASSWORD:
-            case AuthenticationType::BCRYPT_PASSWORD:
-            case AuthenticationType::LDAP:
-            case AuthenticationType::HTTP:
-                throw Authentication::Require<BasicCredentials>("ClickHouse Basic Authentication");
-
-            case AuthenticationType::JWT:
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "JWT is available only in ClickHouse Cloud");
-
-            case AuthenticationType::KERBEROS:
-                throw Authentication::Require<GSSAcceptorContext>(auth_data.getKerberosRealm());
-
-            case AuthenticationType::SSL_CERTIFICATE:
-                for (SSLCertificateSubjects::Type type : {SSLCertificateSubjects::Type::CN, SSLCertificateSubjects::Type::SAN})
-                {
-                    for (const auto & subject : auth_data.getSSLCertificateSubjects().at(type))
-                    {
-                        if (ssl_certificate_credentials->getSSLCertificateSubjects().at(type).contains(subject))
-                            return true;
-                    }
-                }
-                return false;
-
-            case AuthenticationType::SSH_KEY:
-#if USE_SSH
-                throw Authentication::Require<SshCredentials>("SSH Keys Authentication");
-#else
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "SSH is disabled, because ClickHouse is built without libssh");
-#endif
-
-            case AuthenticationType::MAX:
-                break;
-        }
     }
 
 #if USE_SSH
     if (const auto * ssh_credentials = typeid_cast<const SshCredentials *>(&credentials))
     {
-        switch (auth_data.getType())
+        return checkSshAuthentication(ssh_credentials, authentication_method);
-        {
-            case AuthenticationType::NO_PASSWORD:
-            case AuthenticationType::PLAINTEXT_PASSWORD:
-            case AuthenticationType::SHA256_PASSWORD:
-            case AuthenticationType::DOUBLE_SHA1_PASSWORD:
-            case AuthenticationType::BCRYPT_PASSWORD:
-            case AuthenticationType::LDAP:
-            case AuthenticationType::HTTP:
-                throw Authentication::Require<BasicCredentials>("ClickHouse Basic Authentication");
-
-            case AuthenticationType::JWT:
-                throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "JWT is available only in ClickHouse Cloud");
-
-            case AuthenticationType::KERBEROS:
-                throw Authentication::Require<GSSAcceptorContext>(auth_data.getKerberosRealm());
-
-            case AuthenticationType::SSL_CERTIFICATE:
-                throw Authentication::Require<SSLCertificateCredentials>("ClickHouse X.509 Authentication");
-
-            case AuthenticationType::SSH_KEY:
-                return checkSshSignature(auth_data.getSSHKeys(), ssh_credentials->getSignature(), ssh_credentials->getOriginal());
-            case AuthenticationType::MAX:
-                break;
-        }
     }
 #endif
 
     if ([[maybe_unused]] const auto * always_allow_credentials = typeid_cast<const AlwaysAllowCredentials *>(&credentials))
         return true;
 
-    throw Exception(ErrorCodes::NOT_IMPLEMENTED, "areCredentialsValid(): authentication type {} not supported", toString(auth_data.getType()));
+    return false;
 }
 
 }

src/Access/Authentication.h

@@ -24,7 +24,7 @@ struct Authentication
     /// returned by the authentication server
     static bool areCredentialsValid(
         const Credentials & credentials,
-        const AuthenticationData & auth_data,
+        const AuthenticationData & authentication_method,
         const ExternalAuthenticators & external_authenticators,
         SettingsChanges & settings);
 

src/Access/AuthenticationData.cpp

@@ -375,7 +375,8 @@ std::shared_ptr<ASTAuthenticationData> AuthenticationData::toAST() const
             break;
         }
 
-        case AuthenticationType::NO_PASSWORD: [[fallthrough]];
+        case AuthenticationType::NO_PASSWORD:
+            break;
         case AuthenticationType::MAX:
             throw Exception(ErrorCodes::LOGICAL_ERROR, "AST: Unexpected authentication type {}", toString(auth_type));
     }

src/Access/DiskAccessStorage.cpp

@@ -1,8 +1,6 @@
 #include <Access/DiskAccessStorage.h>
 #include <Access/AccessEntityIO.h>
 #include <Access/AccessChangesNotifier.h>
-#include <Backups/RestorerFromBackup.h>
-#include <Backups/RestoreSettings.h>
 #include <IO/WriteHelpers.h>
 #include <IO/ReadHelpers.h>
 #include <IO/ReadBufferFromFile.h>
@@ -418,7 +416,7 @@ void DiskAccessStorage::setAllInMemory(const std::vector<std::pair<UUID, AccessE
 
     /// Insert or update entities.
     for (const auto & [id, entity] : entities_without_conflicts)
-        insertNoLock(id, entity, /* replace_if_exists = */ true, /* throw_if_exists = */ false, /* write_on_disk= */ false);
+        insertNoLock(id, entity, /* replace_if_exists = */ true, /* throw_if_exists = */ false, /* conflicting_id = */ nullptr, /* write_on_disk= */ false);
 }
 
 void DiskAccessStorage::removeAllExceptInMemory(const boost::container::flat_set<UUID> & ids_to_keep)
@@ -507,14 +505,14 @@ std::optional<std::pair<String, AccessEntityType>> DiskAccessStorage::readNameWi
 }
 
 
-bool DiskAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists)
+bool DiskAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id)
 {
     std::lock_guard lock{mutex};
-    return insertNoLock(id, new_entity, replace_if_exists, throw_if_exists, /* write_on_disk = */ true);
+    return insertNoLock(id, new_entity, replace_if_exists, throw_if_exists, conflicting_id, /* write_on_disk = */ true);
 }
 
 
-bool DiskAccessStorage::insertNoLock(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, bool write_on_disk)
+bool DiskAccessStorage::insertNoLock(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id, bool write_on_disk)
 {
     const String & name = new_entity->getName();
     AccessEntityType type = new_entity->getType();
@@ -533,9 +531,15 @@ bool DiskAccessStorage::insertNoLock(const UUID & id, const AccessEntityPtr & ne
     if (name_collision && !replace_if_exists)
     {
         if (throw_if_exists)
+        {
             throwNameCollisionCannotInsert(type, name);
+        }
         else
+        {
+            if (conflicting_id)
+                *conflicting_id = id_by_name;
             return false;
+        }
     }
 
     auto it_by_id = entries_by_id.find(id);
@@ -548,7 +552,11 @@ bool DiskAccessStorage::insertNoLock(const UUID & id, const AccessEntityPtr & ne
             throwIDCollisionCannotInsert(id, type, name, existing_entry.type, existing_entry.name);
         }
         else
+        {
+            if (conflicting_id)
+                *conflicting_id = id;
             return false;
+        }
     }
 
     if (write_on_disk)
@@ -727,25 +735,4 @@ void DiskAccessStorage::deleteAccessEntityOnDisk(const UUID & id) const
         throw Exception(ErrorCodes::FILE_DOESNT_EXIST, "Couldn't delete {}", file_path);
 }
 
-
-void DiskAccessStorage::restoreFromBackup(RestorerFromBackup & restorer)
-{
-    if (!isRestoreAllowed())
-        throwRestoreNotAllowed();
-
-    auto entities = restorer.getAccessEntitiesToRestore();
-    if (entities.empty())
-        return;
-
-    auto create_access = restorer.getRestoreSettings().create_access;
-    bool replace_if_exists = (create_access == RestoreAccessCreationMode::kReplace);
-    bool throw_if_exists = (create_access == RestoreAccessCreationMode::kCreate);
-
-    restorer.addDataRestoreTask([this, my_entities = std::move(entities), replace_if_exists, throw_if_exists]
-    {
-        for (const auto & [id, entity] : my_entities)
-            insert(id, entity, replace_if_exists, throw_if_exists);
-    });
-}
-
 }

src/Access/DiskAccessStorage.h

@@ -34,14 +34,13 @@ public:
     bool exists(const UUID & id) const override;
 
     bool isBackupAllowed() const override { return backup_allowed; }
-    void restoreFromBackup(RestorerFromBackup & restorer) override;
 
 private:
     std::optional<UUID> findImpl(AccessEntityType type, const String & name) const override;
     std::vector<UUID> findAllImpl(AccessEntityType type) const override;
     AccessEntityPtr readImpl(const UUID & id, bool throw_if_not_exists) const override;
     std::optional<std::pair<String, AccessEntityType>> readNameWithTypeImpl(const UUID & id, bool throw_if_not_exists) const override;
-    bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists) override;
+    bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id) override;
     bool removeImpl(const UUID & id, bool throw_if_not_exists) override;
     bool updateImpl(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists) override;
 
@@ -55,7 +54,7 @@ private:
     void listsWritingThreadFunc() TSA_NO_THREAD_SAFETY_ANALYSIS;
     void stopListsWritingThread();
 
-    bool insertNoLock(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, bool write_on_disk) TSA_REQUIRES(mutex);
+    bool insertNoLock(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id, bool write_on_disk) TSA_REQUIRES(mutex);
     bool updateNoLock(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists, bool write_on_disk) TSA_REQUIRES(mutex);
     bool removeNoLock(const UUID & id, bool throw_if_not_exists, bool write_on_disk) TSA_REQUIRES(mutex);
 

src/Access/IAccessEntity.cpp

@@ -9,4 +9,28 @@ bool IAccessEntity::equal(const IAccessEntity & other) const
     return (name == other.name) && (getType() == other.getType());
 }
 
+void IAccessEntity::replaceDependencies(std::shared_ptr<const IAccessEntity> & entity, const std::unordered_map<UUID, UUID> & old_to_new_ids)
+{
+    if (old_to_new_ids.empty())
+        return;
+
+    bool need_replace_dependencies = false;
+    auto dependencies = entity->findDependencies();
+    for (const auto & dependency : dependencies)
+    {
+        if (old_to_new_ids.contains(dependency))
+        {
+            need_replace_dependencies = true;
+            break;
+        }
+    }
+
+    if (!need_replace_dependencies)
+        return;
+
+    auto new_entity = entity->clone();
+    new_entity->replaceDependencies(old_to_new_ids);
+    entity = new_entity;
+}
+
 }

src/Access/IAccessEntity.h

@@ -50,7 +50,8 @@ struct IAccessEntity
     virtual std::vector<UUID> findDependencies() const { return {}; }
 
     /// Replaces dependencies according to a specified map.
-    virtual void replaceDependencies(const std::unordered_map<UUID, UUID> & /* old_to_new_ids */) {}
+    void replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) { doReplaceDependencies(old_to_new_ids); }
+    static void replaceDependencies(std::shared_ptr<const IAccessEntity> & entity, const std::unordered_map<UUID, UUID> & old_to_new_ids);
 
     /// Whether this access entity should be written to a backup.
     virtual bool isBackupAllowed() const { return false; }
@@ -66,6 +67,8 @@ protected:
     {
         return std::make_shared<EntityClassT>(typeid_cast<const EntityClassT &>(*this));
     }
+
+    virtual void doReplaceDependencies(const std::unordered_map<UUID, UUID> & /* old_to_new_ids */) {}
 };
 
 using AccessEntityPtr = std::shared_ptr<const IAccessEntity>;

src/Access/IAccessStorage.cpp

@@ -4,6 +4,8 @@
 #include <Access/User.h>
 #include <Access/AccessBackup.h>
 #include <Backups/BackupEntriesCollector.h>
+#include <Backups/RestorerFromBackup.h>
+#include <Backups/RestoreSettings.h>
 #include <Common/Exception.h>
 #include <Common/quoteString.h>
 #include <Common/callOnce.h>
@@ -14,10 +16,11 @@
 #include <base/FnTraits.h>
 #include <boost/algorithm/string/join.hpp>
 #include <boost/algorithm/string/replace.hpp>
+#include <boost/range/adaptor/map.hpp>
 #include <boost/range/adaptor/reversed.hpp>
+#include <boost/range/algorithm/copy.hpp>
 #include <boost/range/algorithm_ext/erase.hpp>
 
-
 namespace DB
 {
 namespace ErrorCodes
@@ -30,7 +33,6 @@ namespace ErrorCodes
     extern const int IP_ADDRESS_NOT_ALLOWED;
     extern const int LOGICAL_ERROR;
     extern const int NOT_IMPLEMENTED;
-    extern const int AUTHENTICATION_FAILED;
 }
 
 
@@ -179,20 +181,20 @@ UUID IAccessStorage::insert(const AccessEntityPtr & entity)
     return *insert(entity, /* replace_if_exists = */ false, /* throw_if_exists = */ true);
 }
 
-std::optional<UUID> IAccessStorage::insert(const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists)
+std::optional<UUID> IAccessStorage::insert(const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id)
 {
     auto id = generateRandomID();
 
-    if (insert(id, entity, replace_if_exists, throw_if_exists))
+    if (insert(id, entity, replace_if_exists, throw_if_exists, conflicting_id))
         return id;
 
     return std::nullopt;
 }
 
 
-bool IAccessStorage::insert(const DB::UUID & id, const DB::AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists)
+bool IAccessStorage::insert(const DB::UUID & id, const DB::AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id)
 {
-    return insertImpl(id, entity, replace_if_exists, throw_if_exists);
+    return insertImpl(id, entity, replace_if_exists, throw_if_exists, conflicting_id);
 }
 
 
@@ -286,7 +288,7 @@ std::vector<UUID> IAccessStorage::insertOrReplace(const std::vector<AccessEntity
 }
 
 
-bool IAccessStorage::insertImpl(const UUID &, const AccessEntityPtr & entity, bool, bool)
+bool IAccessStorage::insertImpl(const UUID &, const AccessEntityPtr & entity, bool, bool, UUID *)
 {
     if (isReadOnly())
         throwReadonlyCannotInsert(entity->getType(), entity->getName());
@@ -525,15 +527,32 @@ std::optional<AuthResult> IAccessStorage::authenticateImpl(
             if (!isAddressAllowed(*user, address))
                 throwAddressNotAllowed(address);
 
-            auto auth_type = user->auth_data.getType();
+            bool skipped_not_allowed_authentication_methods = false;
-            if (((auth_type == AuthenticationType::NO_PASSWORD) && !allow_no_password) ||
-                ((auth_type == AuthenticationType::PLAINTEXT_PASSWORD) && !allow_plaintext_password))
-                throwAuthenticationTypeNotAllowed(auth_type);
 
-            if (!areCredentialsValid(*user, credentials, external_authenticators, auth_result.settings))
+            for (const auto & auth_method : user->authentication_methods)
-                throwInvalidCredentials();
+            {
+                auto auth_type = auth_method.getType();
+                if (((auth_type == AuthenticationType::NO_PASSWORD) && !allow_no_password) ||
+                    ((auth_type == AuthenticationType::PLAINTEXT_PASSWORD) && !allow_plaintext_password))
+                {
+                    skipped_not_allowed_authentication_methods = true;
+                    continue;
+                }
 
-            return auth_result;
+                if (areCredentialsValid(user->getName(), user->valid_until, auth_method, credentials, external_authenticators, auth_result.settings))
+                {
+                    auth_result.authentication_data = auth_method;
+                    return auth_result;
+                }
+            }
+
+            if (skipped_not_allowed_authentication_methods)
+            {
+                LOG_INFO(log, "Skipped the check for not allowed authentication methods,"
+                              "check allow_no_password and allow_plaintext_password settings in the server configuration");
+            }
+
+            throwInvalidCredentials();
         }
     }
 
@@ -543,9 +562,10 @@ std::optional<AuthResult> IAccessStorage::authenticateImpl(
         return std::nullopt;
 }
 
-
 bool IAccessStorage::areCredentialsValid(
-    const User & user,
+    const std::string & user_name,
+    time_t valid_until,
+    const AuthenticationData & authentication_method,
     const Credentials & credentials,
     const ExternalAuthenticators & external_authenticators,
     SettingsChanges & settings) const
@@ -553,21 +573,20 @@ bool IAccessStorage::areCredentialsValid(
     if (!credentials.isReady())
         return false;
 
-    if (credentials.getUserName() != user.getName())
+    if (credentials.getUserName() != user_name)
         return false;
 
-    if (user.valid_until)
+    if (valid_until)
     {
         const time_t now = std::chrono::system_clock::to_time_t(std::chrono::system_clock::now());
 
-        if (now > user.valid_until)
+        if (now > valid_until)
             return false;
     }
 
-    return Authentication::areCredentialsValid(credentials, user.auth_data, external_authenticators, settings);
+    return Authentication::areCredentialsValid(credentials, authentication_method, external_authenticators, settings);
 }
 
-
 bool IAccessStorage::isAddressAllowed(const User & user, const Poco::Net::IPAddress & address) const
 {
     return user.allowed_client_hosts.contains(address);
@@ -595,12 +614,51 @@ void IAccessStorage::backup(BackupEntriesCollector & backup_entries_collector, c
 }
 
 
-void IAccessStorage::restoreFromBackup(RestorerFromBackup &)
+void IAccessStorage::restoreFromBackup(RestorerFromBackup & restorer)
 {
     if (!isRestoreAllowed())
         throwRestoreNotAllowed();
 
-    throw Exception(ErrorCodes::NOT_IMPLEMENTED, "restoreFromBackup() is not implemented in {}", getStorageType());
+    if (isReplicated() && !acquireReplicatedRestore(restorer))
+        return;
+
+    auto entities = restorer.getAccessEntitiesToRestore();
+    if (entities.empty())
+        return;
+
+    auto create_access = restorer.getRestoreSettings().create_access;
+    bool replace_if_exists = (create_access == RestoreAccessCreationMode::kReplace);
+    bool throw_if_exists = (create_access == RestoreAccessCreationMode::kCreate);
+
+    restorer.addDataRestoreTask([this, entities_to_restore = std::move(entities), replace_if_exists, throw_if_exists] mutable
+    {
+        std::unordered_map<UUID, UUID> new_to_existing_ids;
+        for (auto & [id, entity] : entities_to_restore)
+        {
+            UUID existing_entity_id;
+            if (!insert(id, entity, replace_if_exists, throw_if_exists, &existing_entity_id))
+            {
+                /// Couldn't insert `entity` because there is an existing entity with the same name.
+                new_to_existing_ids[id] = existing_entity_id;
+            }
+        }
+
+        if (!new_to_existing_ids.empty())
+        {
+            /// If new entities restored from backup have dependencies on other entities from backup which were not restored because they existed,
+            /// then we should correct those dependencies.
+            auto update_func = [&](const AccessEntityPtr & entity) -> AccessEntityPtr
+            {
+                auto res = entity;
+                IAccessEntity::replaceDependencies(res, new_to_existing_ids);
+                return res;
+            };
+            std::vector<UUID> ids;
+            ids.reserve(entities_to_restore.size());
+            boost::copy(entities_to_restore | boost::adaptors::map_keys, std::back_inserter(ids));
+            tryUpdate(ids, update_func);
+        }
+    });
 }
 
 
@@ -747,14 +805,6 @@ void IAccessStorage::throwAddressNotAllowed(const Poco::Net::IPAddress & address
     throw Exception(ErrorCodes::IP_ADDRESS_NOT_ALLOWED, "Connections from {} are not allowed", address.toString());
 }
 
-void IAccessStorage::throwAuthenticationTypeNotAllowed(AuthenticationType auth_type)
-{
-    throw Exception(
-        ErrorCodes::AUTHENTICATION_FAILED,
-        "Authentication type {} is not allowed, check the setting allow_{} in the server configuration",
-        toString(auth_type), AuthenticationTypeInfo::get(auth_type).name);
-}
-
 void IAccessStorage::throwInvalidCredentials()
 {
     throw Exception(ErrorCodes::WRONG_PASSWORD, "Invalid credentials");

src/Access/IAccessStorage.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <Access/IAccessEntity.h>
+#include <Access/AuthenticationData.h>
 #include <Core/Types.h>
 #include <Core/UUID.h>
 #include <Parsers/IParser.h>
@@ -34,6 +35,7 @@ struct AuthResult
     UUID user_id;
     /// Session settings received from authentication server (if any)
     SettingsChanges settings{};
+    AuthenticationData authentication_data {};
 };
 
 /// Contains entities, i.e. instances of classes derived from IAccessEntity.
@@ -62,6 +64,9 @@ public:
     /// Returns true if this entity is readonly.
     virtual bool isReadOnly(const UUID &) const { return isReadOnly(); }
 
+    /// Returns true if this storage is replicated.
+    virtual bool isReplicated() const { return false; }
+
     /// Starts periodic reloading and updating of entities in this storage.
     virtual void startPeriodicReloading() {}
 
@@ -151,8 +156,8 @@ public:
     /// Inserts an entity to the storage. Returns ID of a new entry in the storage.
     /// Throws an exception if the specified name already exists.
     UUID insert(const AccessEntityPtr & entity);
-    std::optional<UUID> insert(const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists);
+    std::optional<UUID> insert(const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id = nullptr);
-    bool insert(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists);
+    bool insert(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id = nullptr);
     std::vector<UUID> insert(const std::vector<AccessEntityPtr> & multiple_entities, bool replace_if_exists = false, bool throw_if_exists = true);
     std::vector<UUID> insert(const std::vector<AccessEntityPtr> & multiple_entities, const std::vector<UUID> & ids, bool replace_if_exists = false, bool throw_if_exists = true);
 
@@ -216,7 +221,7 @@ protected:
     virtual std::vector<UUID> findAllImpl(AccessEntityType type) const = 0;
     virtual AccessEntityPtr readImpl(const UUID & id, bool throw_if_not_exists) const = 0;
     virtual std::optional<std::pair<String, AccessEntityType>> readNameWithTypeImpl(const UUID & id, bool throw_if_not_exists) const;
-    virtual bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists);
+    virtual bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id);
     virtual bool removeImpl(const UUID & id, bool throw_if_not_exists);
     virtual bool updateImpl(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists);
     virtual std::optional<AuthResult> authenticateImpl(
@@ -227,7 +232,9 @@ protected:
         bool allow_no_password,
         bool allow_plaintext_password) const;
     virtual bool areCredentialsValid(
-        const User & user,
+        const std::string & user_name,
+        time_t valid_until,
+        const AuthenticationData & authentication_method,
         const Credentials & credentials,
         const ExternalAuthenticators & external_authenticators,
         SettingsChanges & settings) const;
@@ -236,6 +243,7 @@ protected:
     LoggerPtr getLogger() const;
     static String formatEntityTypeWithName(AccessEntityType type, const String & name) { return AccessEntityTypeInfo::get(type).formatEntityNameWithType(name); }
     static void clearConflictsInEntitiesList(std::vector<std::pair<UUID, AccessEntityPtr>> & entities, LoggerPtr log_);
+    virtual bool acquireReplicatedRestore(RestorerFromBackup &) const { return false; }
     [[noreturn]] void throwNotFound(const UUID & id) const;
     [[noreturn]] void throwNotFound(AccessEntityType type, const String & name) const;
     [[noreturn]] static void throwBadCast(const UUID & id, AccessEntityType type, const String & name, AccessEntityType required_type);
@@ -248,7 +256,6 @@ protected:
     [[noreturn]] void throwReadonlyCannotRemove(AccessEntityType type, const String & name) const;
     [[noreturn]] static void throwAddressNotAllowed(const Poco::Net::IPAddress & address);
     [[noreturn]] static void throwInvalidCredentials();
-    [[noreturn]] static void throwAuthenticationTypeNotAllowed(AuthenticationType auth_type);
     [[noreturn]] void throwBackupNotAllowed() const;
     [[noreturn]] void throwRestoreNotAllowed() const;
 

src/Access/LDAPAccessStorage.cpp

@@ -468,8 +468,8 @@ std::optional<AuthResult> LDAPAccessStorage::authenticateImpl(
         // User does not exist, so we create one, and will add it if authentication is successful.
         new_user = std::make_shared<User>();
         new_user->setName(credentials.getUserName());
-        new_user->auth_data = AuthenticationData(AuthenticationType::LDAP);
+        new_user->authentication_methods.emplace_back(AuthenticationType::LDAP);
-        new_user->auth_data.setLDAPServerName(ldap_server_name);
+        new_user->authentication_methods.back().setLDAPServerName(ldap_server_name);
         user = new_user;
     }
 
@@ -504,7 +504,7 @@ std::optional<AuthResult> LDAPAccessStorage::authenticateImpl(
     }
 
     if (id)
-        return AuthResult{ .user_id = *id };
+        return AuthResult{ .user_id = *id, .authentication_data = AuthenticationData(AuthenticationType::LDAP) };
     return std::nullopt;
 }
 

src/Access/MemoryAccessStorage.cpp

@@ -1,7 +1,5 @@
 #include <Access/MemoryAccessStorage.h>
 #include <Access/AccessChangesNotifier.h>
-#include <Backups/RestorerFromBackup.h>
-#include <Backups/RestoreSettings.h>
 #include <base/scope_guard.h>
 #include <boost/container/flat_set.hpp>
 #include <boost/range/adaptor/map.hpp>
@@ -63,14 +61,14 @@ AccessEntityPtr MemoryAccessStorage::readImpl(const UUID & id, bool throw_if_not
 }
 
 
-bool MemoryAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists)
+bool MemoryAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id)
 {
     std::lock_guard lock{mutex};
-    return insertNoLock(id, new_entity, replace_if_exists, throw_if_exists);
+    return insertNoLock(id, new_entity, replace_if_exists, throw_if_exists, conflicting_id);
 }
 
 
-bool MemoryAccessStorage::insertNoLock(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists)
+bool MemoryAccessStorage::insertNoLock(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id)
 {
     const String & name = new_entity->getName();
     AccessEntityType type = new_entity->getType();
@@ -86,9 +84,15 @@ bool MemoryAccessStorage::insertNoLock(const UUID & id, const AccessEntityPtr &
     if (name_collision && !replace_if_exists)
     {
         if (throw_if_exists)
+        {
             throwNameCollisionCannotInsert(type, name);
+        }
         else
+        {
+            if (conflicting_id)
+                *conflicting_id = id_by_name;
             return false;
+        }
     }
 
     auto it_by_id = entries_by_id.find(id);
@@ -97,9 +101,15 @@ bool MemoryAccessStorage::insertNoLock(const UUID & id, const AccessEntityPtr &
     {
         const auto & existing_entry = it_by_id->second;
         if (throw_if_exists)
+        {
             throwIDCollisionCannotInsert(id, type, name, existing_entry.entity->getType(), existing_entry.entity->getName());
+        }
         else
+        {
+            if (conflicting_id)
+                *conflicting_id = id;
             return false;
+        }
     }
 
     /// Remove collisions if necessary.
@@ -270,28 +280,7 @@ void MemoryAccessStorage::setAll(const std::vector<std::pair<UUID, AccessEntityP
 
     /// Insert or update entities.
     for (const auto & [id, entity] : entities_without_conflicts)
-        insertNoLock(id, entity, /* replace_if_exists = */ true, /* throw_if_exists = */ false);
+        insertNoLock(id, entity, /* replace_if_exists = */ true, /* throw_if_exists = */ false, /* conflicting_id = */ nullptr);
-}
-
-
-void MemoryAccessStorage::restoreFromBackup(RestorerFromBackup & restorer)
-{
-    if (!isRestoreAllowed())
-        throwRestoreNotAllowed();
-
-    auto entities = restorer.getAccessEntitiesToRestore();
-    if (entities.empty())
-        return;
-
-    auto create_access = restorer.getRestoreSettings().create_access;
-    bool replace_if_exists = (create_access == RestoreAccessCreationMode::kReplace);
-    bool throw_if_exists = (create_access == RestoreAccessCreationMode::kCreate);
-
-    restorer.addDataRestoreTask([this, my_entities = std::move(entities), replace_if_exists, throw_if_exists]
-    {
-        for (const auto & [id, entity] : my_entities)
-            insert(id, entity, replace_if_exists, throw_if_exists);
-    });
 }
 
 }

src/Access/MemoryAccessStorage.h

@@ -34,17 +34,16 @@ public:
     bool exists(const UUID & id) const override;
 
     bool isBackupAllowed() const override { return backup_allowed; }
-    void restoreFromBackup(RestorerFromBackup & restorer) override;
 
 private:
     std::optional<UUID> findImpl(AccessEntityType type, const String & name) const override;
     std::vector<UUID> findAllImpl(AccessEntityType type) const override;
     AccessEntityPtr readImpl(const UUID & id, bool throw_if_not_exists) const override;
-    bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists) override;
+    bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id) override;
     bool removeImpl(const UUID & id, bool throw_if_not_exists) override;
     bool updateImpl(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists) override;
 
-    bool insertNoLock(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists);
+    bool insertNoLock(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id);
     bool removeNoLock(const UUID & id, bool throw_if_not_exists);
     bool updateNoLock(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists);
 

src/Access/MultipleAccessStorage.cpp

@@ -353,7 +353,7 @@ void MultipleAccessStorage::reload(ReloadMode reload_mode)
 }
 
 
-bool MultipleAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists)
+bool MultipleAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id)
 {
     std::shared_ptr<IAccessStorage> storage_for_insertion;
 
@@ -376,7 +376,7 @@ bool MultipleAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr &
             getStorageName());
     }
 
-    if (storage_for_insertion->insert(id, entity, replace_if_exists, throw_if_exists))
+    if (storage_for_insertion->insert(id, entity, replace_if_exists, throw_if_exists, conflicting_id))
     {
         std::lock_guard lock{mutex};
         ids_cache.set(id, storage_for_insertion);

src/Access/MultipleAccessStorage.h

@@ -67,7 +67,7 @@ protected:
     std::vector<UUID> findAllImpl(AccessEntityType type) const override;
     AccessEntityPtr readImpl(const UUID & id, bool throw_if_not_exists) const override;
     std::optional<std::pair<String, AccessEntityType>> readNameWithTypeImpl(const UUID & id, bool throw_if_not_exists) const override;
-    bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists) override;
+    bool insertImpl(const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id) override;
     bool removeImpl(const UUID & id, bool throw_if_not_exists) override;
     bool updateImpl(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists) override;
     std::optional<AuthResult> authenticateImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators, bool throw_if_user_not_exists, bool allow_no_password, bool allow_plaintext_password) const override;

src/Access/Quota.cpp

@@ -24,7 +24,7 @@ std::vector<UUID> Quota::findDependencies() const
     return to_roles.findDependencies();
 }
 
-void Quota::replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
+void Quota::doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
 {
     to_roles.replaceDependencies(old_to_new_ids);
 }

src/Access/Quota.h

@@ -47,7 +47,7 @@ struct Quota : public IAccessEntity
     AccessEntityType getType() const override { return TYPE; }
 
     std::vector<UUID> findDependencies() const override;
-    void replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
+    void doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
     bool isBackupAllowed() const override { return true; }
 };
 

src/Access/ReplicatedAccessStorage.cpp

@@ -5,10 +5,9 @@
 #include <Access/AccessChangesNotifier.h>
 #include <Access/AccessBackup.h>
 #include <Backups/BackupEntriesCollector.h>
-#include <Backups/RestorerFromBackup.h>
-#include <Backups/RestoreSettings.h>
 #include <Backups/IBackupCoordination.h>
 #include <Backups/IRestoreCoordination.h>
+#include <Backups/RestorerFromBackup.h>
 #include <IO/ReadHelpers.h>
 #include <Interpreters/Context.h>
 #include <Common/ZooKeeper/KeeperException.h>
@@ -120,7 +119,7 @@ static void retryOnZooKeeperUserError(size_t attempts, Func && function)
     }
 }
 
-bool ReplicatedAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists)
+bool ReplicatedAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id)
 {
     const AccessEntityTypeInfo type_info = AccessEntityTypeInfo::get(new_entity->getType());
     const String & name = new_entity->getName();
@@ -128,7 +127,7 @@ bool ReplicatedAccessStorage::insertImpl(const UUID & id, const AccessEntityPtr
 
     auto zookeeper = getZooKeeper();
     bool ok = false;
-    retryOnZooKeeperUserError(10, [&]{ ok = insertZooKeeper(zookeeper, id, new_entity, replace_if_exists, throw_if_exists); });
+    retryOnZooKeeperUserError(10, [&]{ ok = insertZooKeeper(zookeeper, id, new_entity, replace_if_exists, throw_if_exists, conflicting_id); });
 
     if (!ok)
         return false;
@@ -143,7 +142,8 @@ bool ReplicatedAccessStorage::insertZooKeeper(
     const UUID & id,
     const AccessEntityPtr & new_entity,
     bool replace_if_exists,
-    bool throw_if_exists)
+    bool throw_if_exists,
+    UUID * conflicting_id)
 {
     const String & name = new_entity->getName();
     const AccessEntityType type = new_entity->getType();
@@ -167,27 +167,52 @@ bool ReplicatedAccessStorage::insertZooKeeper(
 
     if (res == Coordination::Error::ZNODEEXISTS)
     {
-        if (!throw_if_exists && !replace_if_exists)
+        if (!replace_if_exists)
-            return false; /// Couldn't insert a new entity.
-
-        if (throw_if_exists)
         {
             if (responses[0]->error == Coordination::Error::ZNODEEXISTS)
             {
-                /// To fail with a nice error message, we need info about what already exists.
+                /// Couldn't insert the new entity because there is an existing entity with such UUID.
-                /// This itself could fail if the conflicting uuid disappears in the meantime.
+                if (throw_if_exists)
-                /// If that happens, then we'll just retry from the start.
+                {
-                String existing_entity_definition = zookeeper->get(entity_path);
+                    /// To fail with a nice error message, we need info about what already exists.
+                    /// This itself can fail if the conflicting uuid disappears in the meantime.
+                    /// If that happens, then retryOnZooKeeperUserError() will just retry the operation from the start.
+                    String existing_entity_definition = zookeeper->get(entity_path);
 
-                AccessEntityPtr existing_entity = deserializeAccessEntity(existing_entity_definition, entity_path);
+                    AccessEntityPtr existing_entity = deserializeAccessEntity(existing_entity_definition, entity_path);
-                AccessEntityType existing_type = existing_entity->getType();
+                    AccessEntityType existing_type = existing_entity->getType();
-                String existing_name = existing_entity->getName();
+                    String existing_name = existing_entity->getName();
-                throwIDCollisionCannotInsert(id, type, name, existing_type, existing_name);
+                    throwIDCollisionCannotInsert(id, type, name, existing_type, existing_name);
+                }
+                else
+                {
+                    if (conflicting_id)
+                        *conflicting_id = id;
+                    return false;
+                }
+            }
+            else if (responses[1]->error == Coordination::Error::ZNODEEXISTS)
+            {
+                /// Couldn't insert the new entity because there is an existing entity with the same name.
+                if (throw_if_exists)
+                {
+                    throwNameCollisionCannotInsert(type, name);
+                }
+                else
+                {
+                    if (conflicting_id)
+                    {
+                        /// Get UUID of the existing entry with the same name.
+                        /// This itself can fail if the conflicting name disappears in the meantime.
+                        /// If that happens, then retryOnZooKeeperUserError() will just retry the operation from the start.
+                        *conflicting_id = parseUUID(zookeeper->get(name_path));
+                    }
+                    return false;
+                }
             }
             else
             {
-                /// Couldn't insert the new entity because there is an existing entity with such name.
+                zkutil::KeeperMultiException::check(res, ops, responses);
-                throwNameCollisionCannotInsert(type, name);
             }
         }
 
@@ -693,28 +718,10 @@ void ReplicatedAccessStorage::backup(BackupEntriesCollector & backup_entries_col
 }
 
 
-void ReplicatedAccessStorage::restoreFromBackup(RestorerFromBackup & restorer)
+bool ReplicatedAccessStorage::acquireReplicatedRestore(RestorerFromBackup & restorer) const
 {
-    if (!isRestoreAllowed())
-        throwRestoreNotAllowed();
-
     auto restore_coordination = restorer.getRestoreCoordination();
-    if (!restore_coordination->acquireReplicatedAccessStorage(zookeeper_path))
+    return restore_coordination->acquireReplicatedAccessStorage(zookeeper_path);
-        return;
-
-    auto entities = restorer.getAccessEntitiesToRestore();
-    if (entities.empty())
-        return;
-
-    auto create_access = restorer.getRestoreSettings().create_access;
-    bool replace_if_exists = (create_access == RestoreAccessCreationMode::kReplace);
-    bool throw_if_exists = (create_access == RestoreAccessCreationMode::kCreate);
-
-    restorer.addDataRestoreTask([this, my_entities = std::move(entities), replace_if_exists, throw_if_exists]
-    {
-        for (const auto & [id, entity] : my_entities)
-            insert(id, entity, replace_if_exists, throw_if_exists);
-    });
 }
 
 }

src/Access/ReplicatedAccessStorage.h

@@ -26,6 +26,7 @@ public:
     void shutdown() override;
 
     const char * getStorageType() const override { return STORAGE_TYPE; }
+    bool isReplicated() const override { return true; }
 
     void startPeriodicReloading() override { startWatchingThread(); }
     void stopPeriodicReloading() override { stopWatchingThread(); }
@@ -35,7 +36,6 @@ public:
 
     bool isBackupAllowed() const override { return backup_allowed; }
     void backup(BackupEntriesCollector & backup_entries_collector, const String & data_path_in_backup, AccessEntityType type) const override;
-    void restoreFromBackup(RestorerFromBackup & restorer) override;
 
 private:
     String zookeeper_path;
@@ -48,11 +48,11 @@ private:
     std::unique_ptr<ThreadFromGlobalPool> watching_thread;
     std::shared_ptr<ConcurrentBoundedQueue<UUID>> watched_queue;
 
-    bool insertImpl(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists) override;
+    bool insertImpl(const UUID & id, const AccessEntityPtr & new_entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id) override;
     bool removeImpl(const UUID & id, bool throw_if_not_exists) override;
     bool updateImpl(const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists) override;
 
-    bool insertZooKeeper(const zkutil::ZooKeeperPtr & zookeeper, const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists);
+    bool insertZooKeeper(const zkutil::ZooKeeperPtr & zookeeper, const UUID & id, const AccessEntityPtr & entity, bool replace_if_exists, bool throw_if_exists, UUID * conflicting_id);
     bool removeZooKeeper(const zkutil::ZooKeeperPtr & zookeeper, const UUID & id, bool throw_if_not_exists);
     bool updateZooKeeper(const zkutil::ZooKeeperPtr & zookeeper, const UUID & id, const UpdateFunc & update_func, bool throw_if_not_exists);
 
@@ -80,6 +80,7 @@ private:
     std::optional<UUID> findImpl(AccessEntityType type, const String & name) const override;
     std::vector<UUID> findAllImpl(AccessEntityType type) const override;
     AccessEntityPtr readImpl(const UUID & id, bool throw_if_not_exists) const override;
+    bool acquireReplicatedRestore(RestorerFromBackup & restorer) const override;
 
     mutable std::mutex mutex;
     MemoryAccessStorage memory_storage TSA_GUARDED_BY(mutex);

src/Access/Role.cpp

@@ -21,7 +21,7 @@ std::vector<UUID> Role::findDependencies() const
     return res;
 }
 
-void Role::replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
+void Role::doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
 {
     granted_roles.replaceDependencies(old_to_new_ids);
     settings.replaceDependencies(old_to_new_ids);

src/Access/Role.h

@@ -21,7 +21,7 @@ struct Role : public IAccessEntity
     AccessEntityType getType() const override { return TYPE; }
 
     std::vector<UUID> findDependencies() const override;
-    void replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
+    void doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
     bool isBackupAllowed() const override { return settings.isBackupAllowed(); }
 };
 

src/Access/RowPolicy.cpp

@@ -63,7 +63,7 @@ std::vector<UUID> RowPolicy::findDependencies() const
     return to_roles.findDependencies();
 }
 
-void RowPolicy::replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
+void RowPolicy::doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
 {
     to_roles.replaceDependencies(old_to_new_ids);
 }

src/Access/RowPolicy.h

@@ -50,7 +50,7 @@ struct RowPolicy : public IAccessEntity
     AccessEntityType getType() const override { return TYPE; }
 
     std::vector<UUID> findDependencies() const override;
-    void replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
+    void doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
     bool isBackupAllowed() const override { return true; }
 
     /// Which roles or users should use this row policy.

src/Access/SettingsProfile.cpp

@@ -21,7 +21,7 @@ std::vector<UUID> SettingsProfile::findDependencies() const
     return res;
 }
 
-void SettingsProfile::replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
+void SettingsProfile::doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
 {
     elements.replaceDependencies(old_to_new_ids);
     to_roles.replaceDependencies(old_to_new_ids);

src/Access/SettingsProfile.h

@@ -22,7 +22,7 @@ struct SettingsProfile : public IAccessEntity
     AccessEntityType getType() const override { return TYPE; }
 
     std::vector<UUID> findDependencies() const override;
-    void replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
+    void doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
     bool isBackupAllowed() const override { return elements.isBackupAllowed(); }
 };
 

src/Access/User.cpp

@@ -16,7 +16,8 @@ bool User::equal(const IAccessEntity & other) const
     if (!IAccessEntity::equal(other))
         return false;
     const auto & other_user = typeid_cast<const User &>(other);
-    return (auth_data == other_user.auth_data) && (allowed_client_hosts == other_user.allowed_client_hosts)
+    return (authentication_methods == other_user.authentication_methods)
+        && (allowed_client_hosts == other_user.allowed_client_hosts)
         && (access == other_user.access) && (granted_roles == other_user.granted_roles) && (default_roles == other_user.default_roles)
         && (settings == other_user.settings) && (grantees == other_user.grantees) && (default_database == other_user.default_database)
         && (valid_until == other_user.valid_until);
@@ -48,7 +49,7 @@ std::vector<UUID> User::findDependencies() const
     return res;
 }
 
-void User::replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
+void User::doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids)
 {
     default_roles.replaceDependencies(old_to_new_ids);
     granted_roles.replaceDependencies(old_to_new_ids);

src/Access/User.h

@@ -15,7 +15,7 @@ namespace DB
   */
 struct User : public IAccessEntity
 {
-    AuthenticationData auth_data;
+    std::vector<AuthenticationData> authentication_methods;
     AllowedClientHosts allowed_client_hosts = AllowedClientHosts::AnyHostTag{};
     AccessRights access;
     GrantedRoles granted_roles;
@@ -32,7 +32,7 @@ struct User : public IAccessEntity
     void setName(const String & name_) override;
 
     std::vector<UUID> findDependencies() const override;
-    void replaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
+    void doReplaceDependencies(const std::unordered_map<UUID, UUID> & old_to_new_ids) override;
     bool isBackupAllowed() const override { return settings.isBackupAllowed(); }
 };
 

src/Access/UsersConfigAccessStorage.cpp

@@ -155,18 +155,18 @@ namespace
 
         if (has_password_plaintext)
         {
-            user->auth_data = AuthenticationData{AuthenticationType::PLAINTEXT_PASSWORD};
+            user->authentication_methods.emplace_back(AuthenticationType::PLAINTEXT_PASSWORD);
-            user->auth_data.setPassword(config.getString(user_config + ".password"));
+            user->authentication_methods.back().setPassword(config.getString(user_config + ".password"));
         }
         else if (has_password_sha256_hex)
         {
-            user->auth_data = AuthenticationData{AuthenticationType::SHA256_PASSWORD};
+            user->authentication_methods.emplace_back(AuthenticationType::SHA256_PASSWORD);
-            user->auth_data.setPasswordHashHex(config.getString(user_config + ".password_sha256_hex"));
+            user->authentication_methods.back().setPasswordHashHex(config.getString(user_config + ".password_sha256_hex"));
         }
         else if (has_password_double_sha1_hex)
         {
-            user->auth_data = AuthenticationData{AuthenticationType::DOUBLE_SHA1_PASSWORD};
+            user->authentication_methods.emplace_back(AuthenticationType::DOUBLE_SHA1_PASSWORD);
-            user->auth_data.setPasswordHashHex(config.getString(user_config + ".password_double_sha1_hex"));
+            user->authentication_methods.back().setPasswordHashHex(config.getString(user_config + ".password_double_sha1_hex"));
         }
         else if (has_ldap)
         {
@@ -178,19 +178,19 @@ namespace
             if (ldap_server_name.empty())
                 throw Exception(ErrorCodes::BAD_ARGUMENTS, "LDAP server name cannot be empty for user {}.", user_name);
 
-            user->auth_data = AuthenticationData{AuthenticationType::LDAP};
+            user->authentication_methods.emplace_back(AuthenticationType::LDAP);
-            user->auth_data.setLDAPServerName(ldap_server_name);
+            user->authentication_methods.back().setLDAPServerName(ldap_server_name);
         }
         else if (has_kerberos)
         {
             const auto realm = config.getString(user_config + ".kerberos.realm", "");
 
-            user->auth_data = AuthenticationData{AuthenticationType::KERBEROS};
+            user->authentication_methods.emplace_back(AuthenticationType::KERBEROS);
-            user->auth_data.setKerberosRealm(realm);
+            user->authentication_methods.back().setKerberosRealm(realm);
         }
         else if (has_certificates)
         {
-            user->auth_data = AuthenticationData{AuthenticationType::SSL_CERTIFICATE};
+            user->authentication_methods.emplace_back(AuthenticationType::SSL_CERTIFICATE);
 
             /// Fill list of allowed certificates.
             Poco::Util::AbstractConfiguration::Keys keys;
@@ -200,14 +200,14 @@ namespace
                 if (key.starts_with("common_name"))
                 {
                     String value = config.getString(certificates_config + "." + key);
-                    user->auth_data.addSSLCertificateSubject(SSLCertificateSubjects::Type::CN, std::move(value));
+                    user->authentication_methods.back().addSSLCertificateSubject(SSLCertificateSubjects::Type::CN, std::move(value));
                 }
                 else if (key.starts_with("subject_alt_name"))
                 {
                     String value = config.getString(certificates_config + "." + key);
                     if (value.empty())
                         throw Exception(ErrorCodes::BAD_ARGUMENTS, "Expected ssl_certificates.subject_alt_name to not be empty");
-                    user->auth_data.addSSLCertificateSubject(SSLCertificateSubjects::Type::SAN, std::move(value));
+                    user->authentication_methods.back().addSSLCertificateSubject(SSLCertificateSubjects::Type::SAN, std::move(value));
                 }
                 else
                     throw Exception(ErrorCodes::BAD_ARGUMENTS, "Unknown certificate pattern type: {}", key);
@@ -216,7 +216,7 @@ namespace
         else if (has_ssh_keys)
         {
 #if USE_SSH
-            user->auth_data = AuthenticationData{AuthenticationType::SSH_KEY};
+            user->authentication_methods.emplace_back(AuthenticationType::SSH_KEY);
 
             Poco::Util::AbstractConfiguration::Keys entries;
             config.keys(ssh_keys_config, entries);
@@ -253,26 +253,33 @@ namespace
                 else
                     throw Exception(ErrorCodes::BAD_ARGUMENTS, "Unknown ssh_key entry pattern type: {}", entry);
             }
-            user->auth_data.setSSHKeys(std::move(keys));
+            user->authentication_methods.back().setSSHKeys(std::move(keys));
 #else
             throw Exception(ErrorCodes::SUPPORT_IS_DISABLED, "SSH is disabled, because ClickHouse is built without libssh");
 #endif
         }
         else if (has_http_auth)
         {
-            user->auth_data = AuthenticationData{AuthenticationType::HTTP};
+            user->authentication_methods.emplace_back(AuthenticationType::HTTP);
-            user->auth_data.setHTTPAuthenticationServerName(config.getString(http_auth_config + ".server"));
+            user->authentication_methods.back().setHTTPAuthenticationServerName(config.getString(http_auth_config + ".server"));
             auto scheme = config.getString(http_auth_config + ".scheme");
-            user->auth_data.setHTTPAuthenticationScheme(parseHTTPAuthenticationScheme(scheme));
+            user->authentication_methods.back().setHTTPAuthenticationScheme(parseHTTPAuthenticationScheme(scheme));
+        }
+        else
+        {
+            user->authentication_methods.emplace_back();
         }
 
-        auto auth_type = user->auth_data.getType();
+        for (const auto & authentication_method : user->authentication_methods)
-        if (((auth_type == AuthenticationType::NO_PASSWORD) && !allow_no_password) ||
-            ((auth_type == AuthenticationType::PLAINTEXT_PASSWORD) && !allow_plaintext_password))
         {
-            throw Exception(ErrorCodes::BAD_ARGUMENTS,
+            auto auth_type = authentication_method.getType();
-                            "Authentication type {} is not allowed, check the setting allow_{} in the server configuration",
+            if (((auth_type == AuthenticationType::NO_PASSWORD) && !allow_no_password) ||
-                            toString(auth_type), AuthenticationTypeInfo::get(auth_type).name);
+                ((auth_type == AuthenticationType::PLAINTEXT_PASSWORD) && !allow_plaintext_password))
+            {
+                throw Exception(ErrorCodes::BAD_ARGUMENTS,
+                                "Authentication type {} is not allowed, check the setting allow_{} in the server configuration",
+                                toString(auth_type), AuthenticationTypeInfo::get(auth_type).name);
+            }
         }
 
         const auto profile_name_config = user_config + ".profile";

src/AggregateFunctions/AggregateFunctionGroupConcat.cpp

@@ -116,15 +116,17 @@ class GroupConcatImpl final
     SerializationPtr serialization;
     UInt64 limit;
     const String delimiter;
+    const DataTypePtr type;
 
 public:
     GroupConcatImpl(const DataTypePtr & data_type_, const Array & parameters_, UInt64 limit_, const String & delimiter_)
         : IAggregateFunctionDataHelper<GroupConcatData<has_limit>, GroupConcatImpl<has_limit>>(
             {data_type_}, parameters_, std::make_shared<DataTypeString>())
-        , serialization(this->argument_types[0]->getDefaultSerialization())
         , limit(limit_)
         , delimiter(delimiter_)
+        , type(data_type_)
     {
+        serialization = isFixedString(type) ? std::make_shared<DataTypeString>()->getDefaultSerialization() : this->argument_types[0]->getDefaultSerialization();
     }
 
     String getName() const override { return name; }
@@ -140,7 +142,14 @@ public:
         if (cur_data.data_size != 0)
             cur_data.insertChar(delimiter.c_str(), delimiter.size(), arena);
 
-        cur_data.insert(columns[0], serialization, row_num, arena);
+        if (isFixedString(type))
+        {
+            ColumnWithTypeAndName col = {columns[0]->getPtr(), type, "column"};
+            const auto & col_str = castColumn(col, std::make_shared<DataTypeString>());
+            cur_data.insert(col_str.get(), serialization, row_num, arena);
+        }
+        else
+            cur_data.insert(columns[0], serialization, row_num, arena);
     }
 
     void merge(AggregateDataPtr __restrict place, ConstAggregateDataPtr rhs, Arena * arena) const override

src/Analyzer/FunctionSecretArgumentsFinderTreeNode.h

@@ -3,370 +3,89 @@
 #include <Parsers/FunctionSecretArgumentsFinder.h>
 #include <Analyzer/ConstantNode.h>
 #include <Analyzer/FunctionNode.h>
-#include <Analyzer/IQueryTreeNode.h>
 #include <Analyzer/IdentifierNode.h>
-#include <Analyzer/ListNode.h>
-#include <Common/KnownObjectNames.h>
-#include <Core/QualifiedTableName.h>
-
-#include <boost/algorithm/string/predicate.hpp>
 
 
 namespace DB
 {
 
+class FunctionTreeNode : public AbstractFunction
+{
+public:
+    class ArgumentTreeNode : public Argument
+    {
+    public:
+        explicit ArgumentTreeNode(const IQueryTreeNode * argument_) : argument(argument_) {}
+        std::unique_ptr<AbstractFunction> getFunction() const override
+        {
+            if (const auto * f = argument->as<FunctionNode>())
+                return std::make_unique<FunctionTreeNode>(*f);
+            return nullptr;
+        }
+        bool isIdentifier() const override { return argument->as<IdentifierNode>(); }
+        bool tryGetString(String * res, bool allow_identifier) const override
+        {
+            if (const auto * literal = argument->as<ConstantNode>())
+            {
+                if (literal->getValue().getType() != Field::Types::String)
+                    return false;
+                if (res)
+                    *res = literal->getValue().safeGet<String>();
+                return true;
+            }
+
+            if (allow_identifier)
+            {
+                if (const auto * id = argument->as<IdentifierNode>())
+                {
+                    if (res)
+                        *res = id->getIdentifier().getFullName();
+                    return true;
+                }
+            }
+
+            return false;
+        }
+    private:
+        const IQueryTreeNode * argument = nullptr;
+    };
+
+    class ArgumentsTreeNode : public Arguments
+    {
+    public:
+        explicit ArgumentsTreeNode(const QueryTreeNodes * arguments_) : arguments(arguments_) {}
+        size_t size() const override { return arguments ? arguments->size() : 0; }
+        std::unique_ptr<Argument> at(size_t n) const override { return std::make_unique<ArgumentTreeNode>(arguments->at(n).get()); }
+    private:
+        const QueryTreeNodes * arguments = nullptr;
+    };
+
+    explicit FunctionTreeNode(const FunctionNode & function_) : function(&function_)
+    {
+        if (const auto & nodes = function->getArguments().getNodes(); !nodes.empty())
+            arguments = std::make_unique<ArgumentsTreeNode>(&nodes);
+    }
+    String name() const override { return function->getFunctionName(); }
+private:
+    const FunctionNode * function = nullptr;
+};
+
 
 /// Finds arguments of a specified function which should not be displayed for most users for security reasons.
 /// That involves passwords and secret keys.
-class FunctionSecretArgumentsFinderTreeNode
+class FunctionSecretArgumentsFinderTreeNode : public FunctionSecretArgumentsFinder
 {
 public:
-    explicit FunctionSecretArgumentsFinderTreeNode(const FunctionNode & function_) : function(function_), arguments(function.getArguments())
+    explicit FunctionSecretArgumentsFinderTreeNode(const FunctionNode & function_)
+        : FunctionSecretArgumentsFinder(std::make_unique<FunctionTreeNode>(function_))
     {
-        if (arguments.getNodes().empty())
+        if (!function->hasArguments())
             return;
 
-        findFunctionSecretArguments();
+        findOrdinaryFunctionSecretArguments();
     }
 
-    struct Result
-    {
-        /// Result constructed by default means no arguments will be hidden.
-        size_t start = static_cast<size_t>(-1);
-        size_t count = 0; /// Mostly it's either 0 or 1. There are only a few cases where `count` can be greater than 1 (e.g. see `encrypt`).
-                            /// In all known cases secret arguments are consecutive
-        bool are_named = false; /// Arguments like `password = 'password'` are considered as named arguments.
-        /// E.g. "headers" in `url('..', headers('foo' = '[HIDDEN]'))`
-        std::vector<std::string> nested_maps;
-
-        bool hasSecrets() const
-        {
-            return count != 0 || !nested_maps.empty();
-        }
-    };
-
     FunctionSecretArgumentsFinder::Result getResult() const { return result; }
-
-private:
-    const FunctionNode & function;
-    const ListNode & arguments;
-    FunctionSecretArgumentsFinder::Result result;
-
-    void markSecretArgument(size_t index, bool argument_is_named = false)
-    {
-        if (index >= arguments.getNodes().size())
-            return;
-        if (!result.count)
-        {
-            result.start = index;
-            result.are_named = argument_is_named;
-        }
-        chassert(index >= result.start); /// We always check arguments consecutively
-        result.count = index + 1 - result.start;
-        if (!argument_is_named)
-            result.are_named = false;
-    }
-
-    void findFunctionSecretArguments()
-    {
-        const auto & name = function.getFunctionName();
-
-        if ((name == "mysql") || (name == "postgresql") || (name == "mongodb"))
-        {
-            /// mysql('host:port', 'database', 'table', 'user', 'password', ...)
-            /// postgresql('host:port', 'database', 'table', 'user', 'password', ...)
-            /// mongodb('host:port', 'database', 'collection', 'user', 'password', ...)
-            findMySQLFunctionSecretArguments();
-        }
-        else if ((name == "s3") || (name == "cosn") || (name == "oss") ||
-                    (name == "deltaLake") || (name == "hudi") || (name == "iceberg"))
-        {
-            /// s3('url', 'aws_access_key_id', 'aws_secret_access_key', ...)
-            findS3FunctionSecretArguments(/* is_cluster_function= */ false);
-        }
-        else if (name == "s3Cluster")
-        {
-            /// s3Cluster('cluster_name', 'url', 'aws_access_key_id', 'aws_secret_access_key', ...)
-            findS3FunctionSecretArguments(/* is_cluster_function= */ true);
-        }
-        else if ((name == "remote") || (name == "remoteSecure"))
-        {
-            /// remote('addresses_expr', 'db', 'table', 'user', 'password', ...)
-            findRemoteFunctionSecretArguments();
-        }
-        else if ((name == "encrypt") || (name == "decrypt") ||
-                    (name == "aes_encrypt_mysql") || (name == "aes_decrypt_mysql") ||
-                    (name == "tryDecrypt"))
-        {
-            /// encrypt('mode', 'plaintext', 'key' [, iv, aad])
-            findEncryptionFunctionSecretArguments();
-        }
-        else if (name == "url")
-        {
-            findURLSecretArguments();
-        }
-    }
-
-    void findMySQLFunctionSecretArguments()
-    {
-        if (isNamedCollectionName(0))
-        {
-            /// mysql(named_collection, ..., password = 'password', ...)
-            findSecretNamedArgument("password", 1);
-        }
-        else
-        {
-            /// mysql('host:port', 'database', 'table', 'user', 'password', ...)
-            markSecretArgument(4);
-        }
-    }
-
-    /// Returns the number of arguments excluding "headers" and "extra_credentials" (which should
-    /// always be at the end). Marks "headers" as secret, if found.
-    size_t excludeS3OrURLNestedMaps()
-    {
-        const auto & nodes = arguments.getNodes();
-        size_t count = nodes.size();
-        while (count > 0)
-        {
-            const FunctionNode * f = nodes.at(count - 1)->as<FunctionNode>();
-            if (!f)
-                break;
-            if (f->getFunctionName() == "headers")
-                result.nested_maps.push_back(f->getFunctionName());
-            else if (f->getFunctionName() != "extra_credentials")
-                break;
-            count -= 1;
-        }
-        return count;
-    }
-
-    void findS3FunctionSecretArguments(bool is_cluster_function)
-    {
-        /// s3Cluster('cluster_name', 'url', ...) has 'url' as its second argument.
-        size_t url_arg_idx = is_cluster_function ? 1 : 0;
-
-        if (!is_cluster_function && isNamedCollectionName(0))
-        {
-            /// s3(named_collection, ..., secret_access_key = 'secret_access_key', ...)
-            findSecretNamedArgument("secret_access_key", 1);
-            return;
-        }
-
-        /// We should check other arguments first because we don't need to do any replacement in case of
-        /// s3('url', NOSIGN, 'format' [, 'compression'] [, extra_credentials(..)] [, headers(..)])
-        /// s3('url', 'format', 'structure' [, 'compression'] [, extra_credentials(..)] [, headers(..)])
-        size_t count = excludeS3OrURLNestedMaps();
-        if ((url_arg_idx + 3 <= count) && (count <= url_arg_idx + 4))
-        {
-            String second_arg;
-            if (tryGetStringFromArgument(url_arg_idx + 1, &second_arg))
-            {
-                if (boost::iequals(second_arg, "NOSIGN"))
-                    return; /// The argument after 'url' is "NOSIGN".
-
-                if (second_arg == "auto" || KnownFormatNames::instance().exists(second_arg))
-                    return; /// The argument after 'url' is a format: s3('url', 'format', ...)
-            }
-        }
-
-        /// We're going to replace 'aws_secret_access_key' with '[HIDDEN]' for the following signatures:
-        /// s3('url', 'aws_access_key_id', 'aws_secret_access_key', ...)
-        /// s3Cluster('cluster_name', 'url', 'aws_access_key_id', 'aws_secret_access_key', 'format', 'compression')
-        if (url_arg_idx + 2 < count)
-            markSecretArgument(url_arg_idx + 2);
-    }
-
-    void findURLSecretArguments()
-    {
-        if (!isNamedCollectionName(0))
-            excludeS3OrURLNestedMaps();
-    }
-
-    bool tryGetStringFromArgument(size_t arg_idx, String * res, bool allow_identifier = true) const
-    {
-        if (arg_idx >= arguments.getNodes().size())
-            return false;
-
-        return tryGetStringFromArgument(arguments.getNodes()[arg_idx], res, allow_identifier);
-    }
-
-    static bool tryGetStringFromArgument(const QueryTreeNodePtr argument, String * res, bool allow_identifier = true)
-    {
-        if (const auto * literal = argument->as<ConstantNode>())
-        {
-            if (literal->getValue().getType() != Field::Types::String)
-                return false;
-            if (res)
-                *res = literal->getValue().safeGet<String>();
-            return true;
-        }
-
-        if (allow_identifier)
-        {
-            if (const auto * id = argument->as<IdentifierNode>())
-            {
-                if (res)
-                    *res = id->getIdentifier().getFullName();
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    void findRemoteFunctionSecretArguments()
-    {
-        if (isNamedCollectionName(0))
-        {
-            /// remote(named_collection, ..., password = 'password', ...)
-            findSecretNamedArgument("password", 1);
-            return;
-        }
-
-        /// We're going to replace 'password' with '[HIDDEN'] for the following signatures:
-        /// remote('addresses_expr', db.table, 'user' [, 'password'] [, sharding_key])
-        /// remote('addresses_expr', 'db', 'table', 'user' [, 'password'] [, sharding_key])
-        /// remote('addresses_expr', table_function(), 'user' [, 'password'] [, sharding_key])
-
-        /// But we should check the number of arguments first because we don't need to do any replacements in case of
-        /// remote('addresses_expr', db.table)
-        if (arguments.getNodes().size() < 3)
-            return;
-
-        size_t arg_num = 1;
-
-        /// Skip 1 or 2 arguments with table_function() or db.table or 'db', 'table'.
-        const auto * table_function = arguments.getNodes()[arg_num]->as<FunctionNode>();
-        if (table_function && KnownTableFunctionNames::instance().exists(table_function->getFunctionName()))
-        {
-            ++arg_num;
-        }
-        else
-        {
-            std::optional<String> database;
-            std::optional<QualifiedTableName> qualified_table_name;
-            if (!tryGetDatabaseNameOrQualifiedTableName(arg_num, database, qualified_table_name))
-            {
-                /// We couldn't evaluate the argument so we don't know whether it is 'db.table' or just 'db'.
-                /// Hence we can't figure out whether we should skip one argument 'user' or two arguments 'table', 'user'
-                /// before the argument 'password'. So it's safer to wipe two arguments just in case.
-                /// The last argument can be also a `sharding_key`, so we need to check that argument is a literal string
-                /// before wiping it (because the `password` argument is always a literal string).
-                if (tryGetStringFromArgument(arg_num + 2, nullptr, /* allow_identifier= */ false))
-                {
-                    /// Wipe either `password` or `user`.
-                    markSecretArgument(arg_num + 2);
-                }
-                if (tryGetStringFromArgument(arg_num + 3, nullptr, /* allow_identifier= */ false))
-                {
-                    /// Wipe either `password` or `sharding_key`.
-                    markSecretArgument(arg_num + 3);
-                }
-                return;
-            }
-
-            /// Skip the current argument (which is either a database name or a qualified table name).
-            ++arg_num;
-            if (database)
-            {
-                /// Skip the 'table' argument if the previous argument was a database name.
-                ++arg_num;
-            }
-        }
-
-        /// Skip username.
-        ++arg_num;
-
-        /// Do our replacement:
-        /// remote('addresses_expr', db.table, 'user', 'password', ...) -> remote('addresses_expr', db.table, 'user', '[HIDDEN]', ...)
-        /// The last argument can be also a `sharding_key`, so we need to check that argument is a literal string
-        /// before wiping it (because the `password` argument is always a literal string).
-        bool can_be_password = tryGetStringFromArgument(arg_num, nullptr, /* allow_identifier= */ false);
-        if (can_be_password)
-            markSecretArgument(arg_num);
-    }
-
-    /// Tries to get either a database name or a qualified table name from an argument.
-    /// Empty string is also allowed (it means the default database).
-    /// The function is used by findRemoteFunctionSecretArguments() to determine how many arguments to skip before a password.
-    bool tryGetDatabaseNameOrQualifiedTableName(
-        size_t arg_idx,
-        std::optional<String> & res_database,
-        std::optional<QualifiedTableName> & res_qualified_table_name) const
-    {
-        res_database.reset();
-        res_qualified_table_name.reset();
-
-        String str;
-        if (!tryGetStringFromArgument(arg_idx, &str, /* allow_identifier= */ true))
-            return false;
-
-        if (str.empty())
-        {
-            res_database = "";
-            return true;
-        }
-
-        auto qualified_table_name = QualifiedTableName::tryParseFromString(str);
-        if (!qualified_table_name)
-            return false;
-
-        if (qualified_table_name->database.empty())
-            res_database = std::move(qualified_table_name->table);
-        else
-            res_qualified_table_name = std::move(qualified_table_name);
-        return true;
-    }
-
-    void findEncryptionFunctionSecretArguments()
-    {
-        if (arguments.getNodes().empty())
-            return;
-
-        /// We replace all arguments after 'mode' with '[HIDDEN]':
-        /// encrypt('mode', 'plaintext', 'key' [, iv, aad]) -> encrypt('mode', '[HIDDEN]')
-        result.start = 1;
-        result.count = arguments.getNodes().size() - 1;
-    }
-
-
-    /// Whether a specified argument can be the name of a named collection?
-    bool isNamedCollectionName(size_t arg_idx) const
-    {
-        if (arguments.getNodes().size() <= arg_idx)
-            return false;
-
-        const auto * identifier = arguments.getNodes()[arg_idx]->as<IdentifierNode>();
-        return identifier != nullptr;
-    }
-
-    /// Looks for a secret argument with a specified name. This function looks for arguments in format `key=value` where the key is specified.
-    void findSecretNamedArgument(const std::string_view & key, size_t start = 0)
-    {
-        for (size_t i = start; i < arguments.getNodes().size(); ++i)
-        {
-            const auto & argument = arguments.getNodes()[i];
-            const auto * equals_func = argument->as<FunctionNode>();
-            if (!equals_func || (equals_func->getFunctionName() != "equals"))
-                continue;
-
-            const auto * expr_list = equals_func->getArguments().as<ListNode>();
-            if (!expr_list)
-                continue;
-
-            const auto & equal_args = expr_list->getNodes();
-            if (equal_args.size() != 2)
-                continue;
-
-            String found_key;
-            if (!tryGetStringFromArgument(equal_args[0], &found_key))
-                continue;
-
-            if (found_key == key)
-                markSecretArgument(i, /* argument_is_named= */ true);
-        }
-    }
 };
 
 }

src/Analyzer/Resolve/QueryAnalyzer.cpp

@@ -2564,8 +2564,8 @@ void checkFunctionNodeHasEmptyNullsAction(FunctionNode const & node)
     if (node.getNullsAction() != NullsAction::EMPTY)
         throw Exception(
             ErrorCodes::SYNTAX_ERROR,
-            "Function with name '{}' cannot use {} NULLS",
+            "Function with name {} cannot use {} NULLS",
-            node.getFunctionName(),
+            backQuote(node.getFunctionName()),
             node.getNullsAction() == NullsAction::IGNORE_NULLS ? "IGNORE" : "RESPECT");
 }
 }
@@ -3228,16 +3228,16 @@ ProjectionNames QueryAnalyzer::resolveFunction(QueryTreeNodePtr & node, Identifi
             auto hints = NamePrompter<2>::getHints(function_name, possible_function_names);
 
             throw Exception(ErrorCodes::UNKNOWN_FUNCTION,
-                "Function with name '{}' does not exist. In scope {}{}",
+                "Function with name {} does not exist. In scope {}{}",
-                function_name,
+                backQuote(function_name),
                 scope.scope_node->formatASTForErrorMessage(),
                 getHintsErrorMessageSuffix(hints));
         }
 
         if (!function_lambda_arguments_indexes.empty())
             throw Exception(ErrorCodes::UNSUPPORTED_METHOD,
-                "Aggregate function '{}' does not support lambda arguments",
+                "Aggregate function {} does not support lambda arguments",
-                function_name);
+                backQuote(function_name));
 
         auto action = function_node_ptr->getNullsAction();
         std::string aggregate_function_name = rewriteAggregateFunctionNameIfNeeded(function_name, action, scope.context);
@@ -3679,10 +3679,10 @@ ProjectionNames QueryAnalyzer::resolveExpressionNode(
 
                 auto hints = IdentifierResolver::collectIdentifierTypoHints(unresolved_identifier, valid_identifiers);
 
-                throw Exception(ErrorCodes::UNKNOWN_IDENTIFIER, "Unknown {}{} identifier '{}' in scope {}{}",
+                throw Exception(ErrorCodes::UNKNOWN_IDENTIFIER, "Unknown {}{} identifier {} in scope {}{}",
                     toStringLowercase(IdentifierLookupContext::EXPRESSION),
                     message_clarification,
-                    unresolved_identifier.getFullName(),
+                    backQuote(unresolved_identifier.getFullName()),
                     scope.scope_node->formatASTForErrorMessage(),
                     getHintsErrorMessageSuffix(hints));
             }

src/Backups/RestorerFromBackup.cpp

@@ -913,11 +913,15 @@ void RestorerFromBackup::createTable(const QualifiedTableName & table_name)
             table_info.database = DatabaseCatalog::instance().getDatabase(table_name.database);
         DatabasePtr database = table_info.database;
 
+        auto query_context = Context::createCopy(context);
+        query_context->setSetting("database_replicated_allow_explicit_uuid", 3);
+        query_context->setSetting("database_replicated_allow_replicated_engine_arguments", 3);
+
         /// Execute CREATE TABLE query (we call IDatabase::createTableRestoredFromBackup() to allow the database to do some
         /// database-specific things).
         database->createTableRestoredFromBackup(
             create_table_query,
-            context,
+            query_context,
             restore_coordination,
             std::chrono::duration_cast<std::chrono::milliseconds>(create_table_timeout).count());
     }

src/CMakeLists.txt

@@ -176,7 +176,7 @@ add_library (clickhouse_new_delete STATIC Common/new_delete.cpp)
 target_link_libraries (clickhouse_new_delete PRIVATE clickhouse_common_io)
 if (TARGET ch_contrib::jemalloc)
     target_link_libraries (clickhouse_new_delete PRIVATE ch_contrib::jemalloc)
-    target_link_libraries (clickhouse_common_io PRIVATE ch_contrib::jemalloc)
+    target_link_libraries (clickhouse_common_io PUBLIC ch_contrib::jemalloc)
     target_link_libraries (clickhouse_storages_system PRIVATE ch_contrib::jemalloc)
 endif()
 

src/Client/ClientBase.cpp

@@ -1875,11 +1875,11 @@ void ClientBase::processParsedSingleQuery(const String & full_query, const Strin
 
     if (const auto * create_user_query = parsed_query->as<ASTCreateUserQuery>())
     {
-        if (!create_user_query->attach && create_user_query->auth_data)
+        if (!create_user_query->attach && !create_user_query->authentication_methods.empty())
         {
-            if (const auto * auth_data = create_user_query->auth_data->as<ASTAuthenticationData>())
+            for (const auto & authentication_method : create_user_query->authentication_methods)
             {
-                auto password = auth_data->getPassword();
+                auto password = authentication_method->getPassword();
 
                 if (password)
                     client_context->getAccessControl().checkPasswordComplexityRules(*password);

src/Client/Connection.cpp

@@ -455,6 +455,9 @@ void Connection::sendAddendum()
         writeStringBinary(proto_recv_chunked, *out);
     }
 
+    if (server_revision >= DBMS_MIN_REVISION_WITH_VERSIONED_PARALLEL_REPLICAS_PROTOCOL)
+        writeVarUInt(DBMS_PARALLEL_REPLICAS_PROTOCOL_VERSION, *out);
+
     out->next();
 }
 
@@ -525,6 +528,8 @@ void Connection::receiveHello(const Poco::Timespan & handshake_timeout)
         readVarUInt(server_version_major, *in);
         readVarUInt(server_version_minor, *in);
         readVarUInt(server_revision, *in);
+        if (server_revision >= DBMS_MIN_REVISION_WITH_VERSIONED_PARALLEL_REPLICAS_PROTOCOL)
+            readVarUInt(server_parallel_replicas_protocol_version, *in);
         if (server_revision >= DBMS_MIN_REVISION_WITH_SERVER_TIMEZONE)
             readStringBinary(server_timezone, *in);
         if (server_revision >= DBMS_MIN_REVISION_WITH_SERVER_DISPLAY_NAME)
@@ -959,7 +964,7 @@ void Connection::sendReadTaskResponse(const String & response)
 void Connection::sendMergeTreeReadTaskResponse(const ParallelReadResponse & response)
 {
     writeVarUInt(Protocol::Client::MergeTreeReadTaskResponse, *out);
-    response.serialize(*out);
+    response.serialize(*out, server_parallel_replicas_protocol_version);
     out->finishChunk();
     out->next();
 }
@@ -1413,7 +1418,7 @@ ParallelReadRequest Connection::receiveParallelReadRequest() const
 
 InitialAllRangesAnnouncement Connection::receiveInitialParallelReadAnnouncement() const
 {
-    return InitialAllRangesAnnouncement::deserialize(*in);
+    return InitialAllRangesAnnouncement::deserialize(*in, server_parallel_replicas_protocol_version);
 }
 
 

src/Client/Connection.h

@@ -210,6 +210,7 @@ private:
     UInt64 server_version_minor = 0;
     UInt64 server_version_patch = 0;
     UInt64 server_revision = 0;
+    UInt64 server_parallel_replicas_protocol_version = 0;
     String server_timezone;
     String server_display_name;
 

src/Client/ConnectionPoolWithFailover.cpp

@@ -168,7 +168,7 @@ std::vector<ConnectionPoolWithFailover::TryResult> ConnectionPoolWithFailover::g
     { return tryGetEntry(pool, timeouts, fail_message, settings, &table_to_check, /*async_callback=*/ {}); };
 
     return getManyImpl(settings, pool_mode, try_get_entry,
-        /*skip_unavailable_endpoints=*/ std::nullopt,
+        /*skip_unavailable_endpoints=*/ false, /// skip_unavailable_endpoints is used to get the min number of entries, and we need at least one
         /*priority_func=*/ {},
         settings.distributed_insert_skip_read_only_replicas);
 }