adnanhemani · adnanhemani · Aug 22, 2025 · Aug 22, 2025 · Aug 23, 2025 · Aug 24, 2025
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -51,6 +51,8 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
 ### New Features
 
 - Added Catalog configuration for S3 and STS endpoints. This also allows using non-AWS S3 implementations.
+  The realm-level feature flag `ALLOW_SETTING_S3_ENDPOINTS` (default: true) may be used to disable this
+  functionality.
 
 - The `IMPLICIT` authentication type enables users to create federated catalogs without explicitly
 providing authentication parameters to Polaris. When the authentication type is set to `IMPLICIT`,
@@ -81,6 +83,11 @@ at locations that better optimize for object storage.
 
 - Introduced bootstrap command options to specify custom schema files for database initialization.
 
+- Added refresh credentials endpoint configuration to LoadTableResponse for AWS, Azure, and GCP. Enabling
+automatic storage credential refresh per table on the client side. Java client version >= 1.8.0 is required.
+The endpoint path is always returned when using vended credentials, but clients must enable the 
+refresh-credentials flag for the desired storage provider.
+
 ### Changes
 
 - Polaris Management API clients must be prepared to deal with new attributes in `AwsStorageConfigInfo` objects.
@@ -89,9 +96,8 @@ at locations that better optimize for object storage.
 
 ### Deprecations
 
-* The property `polaris.active-roles-provider.type` is deprecated in favor of
-  `polaris.authentication.active-roles-provider.type`. The old property is still supported, but will be removed in a
-  future release.
+- The property `polaris.active-roles-provider.type` is deprecated for removal.
+- The `ActiveRolesProvider` interface is deprecated for removal.
 
 ### Fixes
 

diff --git a/Makefile b/Makefile
@@ -134,7 +134,7 @@ client-lint: client-setup-env ## Run linting checks for Polaris client
 .PHONY: client-regenerate
 client-regenerate: client-setup-env ## Regenerate the client code
 	@echo "--- Regenerating client code ---"
-	@$(ACTIVATE_AND_CD) && python3 generate_clients.py
+	@$(ACTIVATE_AND_CD) && python3 -B generate_clients.py
 	@echo "--- Client code regeneration complete ---"
 
 .PHONY: client-unit-test

diff --git a/api/iceberg-service/build.gradle.kts b/api/iceberg-service/build.gradle.kts
@@ -22,7 +22,7 @@ import org.openapitools.generator.gradle.plugin.tasks.GenerateTask
 plugins {
   alias(libs.plugins.openapi.generator)
   id("polaris-client")
-  alias(libs.plugins.jandex)
+  id("org.kordamp.gradle.jandex")
 }
 
 dependencies {

diff --git a/api/management-model/build.gradle.kts b/api/management-model/build.gradle.kts
@@ -22,7 +22,7 @@ import org.openapitools.generator.gradle.plugin.tasks.GenerateTask
 plugins {
   alias(libs.plugins.openapi.generator)
   id("polaris-client")
-  alias(libs.plugins.jandex)
+  id("org.kordamp.gradle.jandex")
 }
 
 dependencies {

diff --git a/api/management-service/build.gradle.kts b/api/management-service/build.gradle.kts
@@ -22,7 +22,7 @@ import org.openapitools.generator.gradle.plugin.tasks.GenerateTask
 plugins {
   alias(libs.plugins.openapi.generator)
   id("polaris-client")
-  alias(libs.plugins.jandex)
+  id("org.kordamp.gradle.jandex")
 }
 
 dependencies {

diff --git a/api/polaris-catalog-service/build.gradle.kts b/api/polaris-catalog-service/build.gradle.kts
@@ -22,7 +22,7 @@ import org.openapitools.generator.gradle.plugin.tasks.GenerateTask
 plugins {
   alias(libs.plugins.openapi.generator)
   id("polaris-client")
-  alias(libs.plugins.jandex)
+  id("org.kordamp.gradle.jandex")
 }
 
 val genericTableModels =

diff --git a/build-logic/build.gradle.kts b/build-logic/build.gradle.kts
@@ -23,6 +23,7 @@ dependencies {
   implementation(gradleKotlinDsl())
   implementation(baselibs.errorprone)
   implementation(baselibs.idea.ext)
+  implementation(baselibs.jandex)
   implementation(baselibs.license.report)
   implementation(baselibs.nexus.publish)
   implementation(baselibs.shadow)

diff --git a/build-logic/src/main/kotlin/Utilities.kt b/build-logic/src/main/kotlin/Utilities.kt
@@ -14,6 +14,11 @@
  * limitations under the License.
  */
 
+import java.io.File
+import java.io.FileOutputStream
+import java.nio.file.attribute.FileTime
+import java.util.zip.ZipFile
+import java.util.zip.ZipOutputStream
 import org.gradle.api.Project
 import org.gradle.process.JavaForkOptions
 
@@ -61,3 +66,41 @@ fun JavaForkOptions.addSparkJvmOptions() {
         "-Djdk.reflect.useDirectMethodHandle=false",
       )
 }
+
+/**
+ * Rewrites the given ZIP file.
+ *
+ * The timestamps of all entries are set to `1980-02-01 00:00`, zip entries appear in a
+ * deterministic order.
+ */
+fun makeZipReproducible(source: File) {
+  val t = FileTime.fromMillis(318211200_000) // 1980-02-01 00:00 GMT
+
+  val outFile = File(source.absolutePath + ".tmp.out")
+
+  val names = mutableListOf<String>()
+  ZipFile(source).use { zip -> zip.stream().forEach { e -> names.add(e.name) } }
+  names.sort()
+
+  ZipOutputStream(FileOutputStream(outFile)).use { dst ->
+    ZipFile(source).use { zip ->
+      names.forEach { n ->
+        val e = zip.getEntry(n)
+        zip.getInputStream(e).use { src ->
+          e.setCreationTime(t)
+          e.setLastAccessTime(t)
+          e.setLastModifiedTime(t)
+          dst.putNextEntry(e)
+          src.copyTo(dst)
+          dst.closeEntry()
+          src.close()
+        }
+      }
+    }
+  }
+
+  val origFile = File(source.absolutePath + ".tmp.orig")
+  source.renameTo(origFile)
+  outFile.renameTo(source)
+  origFile.delete()
+}
diff --git a/build-logic/src/main/kotlin/polaris-java.gradle.kts b/build-logic/src/main/kotlin/polaris-java.gradle.kts
@@ -23,6 +23,8 @@ import net.ltgt.gradle.errorprone.errorprone
 import org.gradle.api.tasks.compile.JavaCompile
 import org.gradle.api.tasks.testing.Test
 import org.gradle.kotlin.dsl.named
+import org.kordamp.gradle.plugin.jandex.JandexExtension
+import org.kordamp.gradle.plugin.jandex.JandexPlugin
 import publishing.PublishingHelperPlugin
 
 plugins {
@@ -32,12 +34,27 @@ plugins {
   `jvm-test-suite`
   checkstyle
   id("polaris-spotless")
+  id("polaris-reproducible")
   id("jacoco-report-aggregation")
   id("net.ltgt.errorprone")
 }
 
 apply<PublishingHelperPlugin>()
 
+plugins.withType<JandexPlugin>().configureEach {
+  extensions.getByType(JandexExtension::class).run {
+    version =
+      versionCatalogs
+        .named("libs")
+        .findLibrary("jandex")
+        .orElseThrow { GradleException("jandex version not found in libs.versions.toml") }
+        .get()
+        .version
+    // https://smallrye.io/jandex/jandex/3.4.0/index.html#persistent_index_format_versions
+    indexVersion = 12
+  }
+}
+
 checkstyle {
   val checkstyleVersion =
     versionCatalogs
@@ -237,9 +254,20 @@ configurations.all {
     }
 }
 
-// ensure jars conform to reproducible builds
-// (https://docs.gradle.org/current/userguide/working_with_files.html#sec:reproducible_archives)
-tasks.withType<AbstractArchiveTask>().configureEach {
-  isPreserveFileTimestamps = false
-  isReproducibleFileOrder = true
+if (plugins.hasPlugin("io.quarkus")) {
+  tasks.named("quarkusBuild") {
+    actions.addLast {
+      listOf(
+          "quarkus-app/quarkus-run.jar",
+          "quarkus-app/quarkus/generated-bytecode.jar",
+          "quarkus-app/quarkus/transformed-bytecode.jar",
+        )
+        .forEach { name ->
+          val file = project.layout.buildDirectory.get().file(name).asFile
+          if (file.exists()) {
+            makeZipReproducible(file)
+          }
+        }
+    }
+  }
 }
diff --git a/build-logic/src/main/kotlin/polaris-reproducible.gradle.kts b/build-logic/src/main/kotlin/polaris-reproducible.gradle.kts
@@ -0,0 +1,25 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// ensure jars conform to reproducible builds
+// (https://docs.gradle.org/current/userguide/working_with_files.html#sec:reproducible_archives)
+tasks.withType<AbstractArchiveTask>().configureEach {
+  isPreserveFileTimestamps = false
+  isReproducibleFileOrder = true
+}
diff --git a/build.gradle.kts b/build.gradle.kts
@@ -20,21 +20,14 @@
 import java.net.URI
 import org.nosphere.apache.rat.RatTask
 
-buildscript {
-  repositories { maven { url = java.net.URI("https://plugins.gradle.org/m2/") } }
-  dependencies {
-    classpath("org.kordamp.gradle:jandex-gradle-plugin:${libs.plugins.jandex.get().version}")
-  }
-}
+buildscript { repositories { maven { url = java.net.URI("https://plugins.gradle.org/m2/") } } }
 
 plugins {
   id("idea")
   id("eclipse")
   id("polaris-root")
   alias(libs.plugins.rat)
   alias(libs.plugins.jetbrains.changelog)
-  // workaround for https://github.com/kordamp/jandex-gradle-plugin/issues/25
-  alias(libs.plugins.jandex) apply false
 }
 
 val projectName = rootProject.file("ide-name.txt").readText().trim()

diff --git a/client/python/.openapi-generator-ignore b/client/python/.openapi-generator-ignore
@@ -53,3 +53,6 @@ setup.cfg
 tox.ini
 README.md
 pyproject.toml
+docs/
+**/catalog_README.md
+**/management_README.md
diff --git a/client/python/docs/.keep b/client/python/docs/.keep