Revise fix for [CALCITE-6587] Support Java 23 and Guava 33.3.0

Add '-Djava.security.manager=allow' in Gradle and re-enable
tests under JDK 23. (Tests will fail if people run them via
Junit.)

build.gradle.kts

@@ -847,6 +847,17 @@ allprojects {
                     showStandardStreams = true
                 }
                 exclude("**/*Suite*")
+                if (JavaVersion.current() >= JavaVersion.VERSION_23) {
+                    // Subject.doAs is deprecated and does not work in JDK 23
+                    // and higher unless the (also deprecated) SecurityManager
+                    // is enabled. However, we depend on libraries Avatica and
+                    // Hadoop for our remote driver and Pig and Spark
+                    // adapters. So as a workaround we require enabling the
+                    // security manager on JDK 23 and higher. See
+                    // [CALCITE-6587], [CALCITE-6590] (Avatica), [HADOOP-19212],
+                    // https://openjdk.org/jeps/411.
+                    jvmArgs("-Djava.security.manager=allow")
+                }
                 jvmArgs("-Xmx1536m")
                 jvmArgs("-Djdk.net.URLClassPath.disableClassPathURLCheck=true")
                 // Pass the property to tests

core/src/test/java/org/apache/calcite/jdbc/CalciteRemoteDriverTest.java

@@ -31,7 +31,6 @@
 import org.apache.calcite.test.schemata.hr.Employee;
 import org.apache.calcite.util.TestUtil;
 import org.apache.calcite.util.Util;
-import org.apache.calcite.util.Version;
 
 import com.google.common.collect.ImmutableList;
 
@@ -85,7 +84,6 @@
 import static org.hamcrest.CoreMatchers.nullValue;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assumptions.assumeFalse;
 
 import static java.util.Objects.requireNonNull;
 
@@ -97,6 +95,11 @@
  * <a href="https://issues.apache.org/jira/browse/CALCITE-2853">
  * [CALCITE-2853] avatica.MetaImpl and calcite.jdbc.CalciteMetaImpl are not
  * thread-safe</a>.
+ *
+ * <p>Under JDK 23 and higher, this test requires
+ * "{@code -Djava.security.manager=allow}" command-line arguments due to
+ * Avatica's use of deprecated methods in {@link javax.security.auth.Subject}.
+ * These arguments are set automatically if you run via Gradle.
  */
 @Execution(ExecutionMode.SAME_THREAD)
 class CalciteRemoteDriverTest {
@@ -110,11 +113,6 @@ class CalciteRemoteDriverTest {
   private static @Nullable HttpServer start;
 
   @BeforeAll public static void beforeClass() throws Exception {
-    assumeFalse(TestUtil.getJavaMajorVersion() >= 23
-            && TestUtil.AVATICA_VERSION.compareTo(Version.of(1, 25)) > 0,
-        "Cannot run on JDK 23 and higher with Avatica version 1.25 or lower; "
-            + "enable when [CALCITE-6588] is fixed in Avatica");
-
     localConnection = CalciteAssert.hr().connect();
 
     // Make sure we pick an ephemeral port for the server

piglet/src/test/java/org/apache/calcite/test/PigRelTestBase.java

@@ -19,7 +19,6 @@
 import org.apache.calcite.piglet.PigConverter;
 import org.apache.calcite.rel.RelNode;
 import org.apache.calcite.tools.FrameworkConfig;
-import org.apache.calcite.util.TestUtil;
 
 import org.junit.jupiter.api.BeforeEach;
 
@@ -32,6 +31,11 @@
 
 /**
  * Abstract class for Pig to {@link RelNode} tests.
+ *
+ * <p>Under JDK 23 and higher, this test requires
+ * "{@code -Djava.security.manager=allow}" command-line arguments due to
+ * Hadoop's use of deprecated methods in {@link javax.security.auth.Subject}.
+ * These arguments are set automatically if you run via Gradle.
  */
 public abstract class PigRelTestBase {
   PigConverter converter;
@@ -40,8 +44,6 @@ public abstract class PigRelTestBase {
   public void testSetup() throws Exception {
     assumeFalse(getProperty("os.name").startsWith("Windows"),
         "Skip: Pig/Hadoop tests do not work on Windows");
-    assumeFalse(TestUtil.getJavaMajorVersion() >= 23,
-        "Skip: Pig/Hadoop tests do not work on JDK 23 and higher");
 
     final FrameworkConfig config = config().build();
     converter = create(config);

plus/src/test/java/org/apache/calcite/chinook/RemotePreparedStatementParametersTest.java

@@ -16,30 +16,25 @@
  */
 package org.apache.calcite.chinook;
 
-import org.apache.calcite.util.TestUtil;
-import org.apache.calcite.util.Version;
-
 import org.junit.jupiter.api.Test;
 
 import java.sql.Connection;
 import java.sql.DriverManager;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 
-import static org.junit.jupiter.api.Assumptions.assumeFalse;
-
 /**
  * Tests against parameters in prepared statement when using underlying JDBC
  * sub-schema.
+ *
+ * <p>Under JDK 23 and higher, this test requires
+ * "{@code -Djava.security.manager=allow}" command-line arguments due to
+ * Avatica's use of deprecated methods in {@link javax.security.auth.Subject}.
+ * These arguments are set automatically if you run via Gradle.
  */
 class RemotePreparedStatementParametersTest {
 
   @Test void testSimpleStringParameterShouldWorkWithCalcite() throws Exception {
-    assumeFalse(TestUtil.getJavaMajorVersion() >= 23
-            && TestUtil.AVATICA_VERSION.compareTo(Version.of(1, 25)) > 0,
-        "Cannot run on JDK 23 and higher with Avatica version 1.25 or lower; "
-            + "enable when [CALCITE-6588] is fixed in Avatica");
-
     // given
     ChinookAvaticaServer server = new ChinookAvaticaServer();
     server.startWithCalcite();
@@ -54,11 +49,6 @@ class RemotePreparedStatementParametersTest {
   }
 
   @Test void testSeveralParametersShouldWorkWithCalcite() throws Exception {
-    assumeFalse(TestUtil.getJavaMajorVersion() >= 23
-            && TestUtil.AVATICA_VERSION.compareTo(Version.of(1, 25)) > 0,
-        "Cannot run on JDK 23 and higher with Avatica version 1.25 or lower; "
-            + "enable when [CALCITE-6588] is fixed in Avatica");
-
     // given
     ChinookAvaticaServer server = new ChinookAvaticaServer();
     server.startWithCalcite();
@@ -75,11 +65,6 @@ class RemotePreparedStatementParametersTest {
   }
 
   @Test void testParametersShouldWorkWithRaw() throws Exception {
-    assumeFalse(TestUtil.getJavaMajorVersion() >= 23
-            && TestUtil.AVATICA_VERSION.compareTo(Version.of(1, 25)) > 0,
-        "Cannot run on JDK 23 and higher with Avatica version 1.25 or lower; "
-            + "enable when [CALCITE-6588] is fixed in Avatica");
-
     // given
     ChinookAvaticaServer server = new ChinookAvaticaServer();
     server.startWithRaw();

spark/src/test/java/org/apache/calcite/test/SparkAdapterTest.java

@@ -17,17 +17,19 @@
 package org.apache.calcite.test;
 
 import org.apache.calcite.adapter.spark.SparkRel;
-import org.apache.calcite.util.TestUtil;
 import org.apache.calcite.util.Util;
 
 import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 
-import static org.junit.jupiter.api.Assumptions.assumeFalse;
-
 /**
  * Tests for using Calcite with Spark as an internal engine, as implemented by
  * the {@link org.apache.calcite.adapter.spark} package.
+ *
+ * <p>Under JDK 23 and higher, this test requires
+ * "{@code -Djava.security.manager=allow}" command-line arguments due to
+ * Hadoop's use of deprecated methods in {@link javax.security.auth.Subject}.
+ * These arguments are set automatically if you run via Gradle.
  */
 class SparkAdapterTest {
   private static final String VALUES0 = "(values (1, 'a'), (2, 'b'))";
@@ -45,10 +47,6 @@ class SparkAdapterTest {
       "(values (1, 'a'), (2, 'b'), (3, 'b'), (4, 'c'), (2, 'c')) as t(x, y)";
 
   private CalciteAssert.AssertQuery sql(String sql) {
-    assumeFalse(TestUtil.getJavaMajorVersion() >= 23,
-        "Cannot run on JDK 23 and higher; "
-            + "enable when [HADOOP-19212] has been fixed");
-
     return CalciteAssert.that()
         .with(CalciteAssert.Config.SPARK)
         .query(sql);