nevzheng opened a new issue, #12299:
URL: https://github.com/apache/gravitino/issues/12299
### Describe the subtask
The server has supported HTTPS and client-certificate authentication since
0.3.0
(`keyStorePath`, `enableClientAuth`, `trustStorePath`), but none of it is
covered
by tests — today it's behavior we believe in rather than behavior CI
enforces.
The rest of this epic builds a client for that behavior, so before we depend
on
it, we pin it down.
Test-only: no production code changes anywhere in this subtask.
## Deliverable
- **Handshake tests against a real Jetty:** client auth configured without a
truststore fails fast; a trusted client certificate is accepted; a missing
client certificate is rejected; an untrusted client certificate is
rejected;
a client rejects an untrusted *server* certificate; HTTPS works without
client
auth; plain HTTP is unaffected.
- **A single home for TLS test fixtures:** the keystores/truststores these
tests
need, in one place, published to other modules via the `testArtifacts`
pattern
already used by `integration-test-common`, `flink-common`, and
`authorization-ranger` — so the client-side subtasks consume these fixtures
instead of committing their own copies.
- **Reproducibility:** a script that regenerates every fixture from scratch,
and
a README stating the material is test-only and documenting the passwords.
## Acceptance criteria
- [ ] All seven scenarios above covered in `server-common` tests
- [ ] Fixtures exist in exactly one location in the repo
- [ ] `server-common` publishes them via a `testArtifacts` configuration
- [ ] The TLS server setup helper is publishable to other modules, so client
subtasks can spin up a TLS Jetty without re-deriving it
- [ ] Regeneration script reproduces every fixture and carries an ASF header
- [ ] `./gradlew rat` passes
- [ ] Fixture certificates have long validity (10y+) so CI doesn't inherit an
expiry bomb
- [ ] No file under any `src/main` is modified
Depends on: nothing — this can start immediately, in parallel with M0.
Blocks: M2 (which consumes the fixtures and the server setup helper).
### Parent issue
https://github.com/apache/gravitino/issues/9836
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
