[C++] Use source releases when building ORC instead of using GitHub tag snapshots

[asfimport]

See related discussion in ORC-374. It would be better to use the release artifacts that have been voted on by the ORC PMC.

Reporter: Wes McKinney / @wesm

Related issues:

• Possible to reduce size of release tarballs? (is related to)

_{Note: This issue was originally created as ARROW-2681. Please see the migration documentation for further details.}

[asfimport]

Wes McKinney / @wesm:
I looked at this but can't figure out how to convince CMake ExternalProject to download from the ASF mirror system. Moving this to 0.11 in the meantime

[asfimport]

Uwe Korn / @xhochy:
It would probably work with the URL mentioned in https://stackoverflow.com/a/42770603/1689261 but as we depend on an exact version of ORC, we cannot rely on the Apache mirror system as it only serves the latest release.

[asfimport]

Wes McKinney / @wesm:
That's weird that releases would be removed from the mirrors, why is that?

[asfimport]

Wes McKinney / @wesm:
I guess it's not so weird since we remove our old releases from the mirrors, too.

[asfimport]

Wes McKinney / @wesm:
cc @nealrichardson for context. Since we just started hosting our own tarball of Boost because of reliability issues on Bintray, we might consider more generally having a mirror containing tarballs of projects we depend on stored as artifacts on tagged GitHub releases. I'm envisioning something like

Git repo: github.com/apache-arrow-dev/dependencies
tag: orc-$VERSION, with tarball attached as artifact

[asfimport]

Owen O'Malley:
You could probably download what you need from the archive:

 

https://archive.apache.org/dist/orc/

[asfimport]

Antoine Pitrou / @pitrou:
We currently bundle ORC 1.6.9, nothing more to do here.