(hive) branch master updated: HIVE-30009: Do not ship bundled TLS keystore in standalone server (#6810)

[dengzh]

This is an automated email from the ASF dual-hosted git repository.

dengzhhu653 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hive.git


The following commit(s) were added to refs/heads/master by this push:
     new d4b03173fe7 HIVE-30009: Do not ship bundled TLS keystore in standalone 
server (#6810)
d4b03173fe7 is described below

commit d4b03173fe7ae14677c97ac66c0dc7819c601f44
Author: dengzh <dengzhhu...@gmail.com>
AuthorDate: Thu Sep 24 14:03:42 2026 +0800

    HIVE-30009: Do not ship bundled TLS keystore in standalone server (#6810)
---
 .../hive/cli/BaseStandaloneRESTCatalogServerTest.java   |  16 +++++++++++++++-
 .../qtest-iceberg/src/test}/resources/keystore.p12      | Bin
 .../src/main/resources/application.yml                  |  12 +++++-------
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git 
a/itests/qtest-iceberg/src/test/java/org/apache/hadoop/hive/cli/BaseStandaloneRESTCatalogServerTest.java
 
b/itests/qtest-iceberg/src/test/java/org/apache/hadoop/hive/cli/BaseStandaloneRESTCatalogServerTest.java
index ea1c3c4604b..fa41c37b0f7 100644
--- 
a/itests/qtest-iceberg/src/test/java/org/apache/hadoop/hive/cli/BaseStandaloneRESTCatalogServerTest.java
+++ 
b/itests/qtest-iceberg/src/test/java/org/apache/hadoop/hive/cli/BaseStandaloneRESTCatalogServerTest.java
@@ -31,10 +31,10 @@
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.conn.ssl.NoopHostnameVerifier;
-import org.apache.http.ssl.SSLContextBuilder;
 import org.apache.http.entity.StringEntity;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClients;
+import org.apache.http.ssl.SSLContextBuilder;
 import org.apache.http.util.EntityUtils;
 import org.apache.hadoop.hive.metastore.MetaStoreTestUtils;
 import org.apache.hadoop.hive.metastore.security.HadoopThriftAuthBridge;
@@ -116,10 +116,24 @@ public void beforeTestClass(TestContext testContext) 
throws Exception {
       MetastoreConf.setVar(hmsConf, ConfVars.WAREHOUSE, 
warehouseDir.getAbsolutePath());
       MetastoreConf.setVar(hmsConf, ConfVars.WAREHOUSE_EXTERNAL, 
warehouseDir.getAbsolutePath());
 
+      configureTestSsl();
+
       hmsPort = MetaStoreTestUtils.startMetaStoreWithRetry(
           HadoopThriftAuthBridge.getBridge(), hmsConf, true, false, false, 
false);
       LOG.info("Started embedded HMS on port: {} (before Spring context)", 
hmsPort);
     }
+
+    /**
+     * Enables HTTPS for the standalone server using a test-only keystore.
+     */
+    private static void configureTestSsl() {
+      File keystore = new File(System.getProperty("java.io.tmpdir"), 
"../../src/test/resources/keystore.p12");
+      System.setProperty("server.ssl.enabled", "true");
+      System.setProperty("server.ssl.key-store", keystore.getAbsolutePath());
+      System.setProperty("server.ssl.key-store-password", "changeit");
+      System.setProperty("server.ssl.key-store-type", "PKCS12");
+      System.setProperty("server.ssl.key-alias", "iceberg");
+    }
   }
 
   @SpringBootApplication
diff --git 
a/standalone-metastore/metastore-rest-catalog/src/main/resources/keystore.p12 
b/itests/qtest-iceberg/src/test/resources/keystore.p12
similarity index 100%
rename from 
standalone-metastore/metastore-rest-catalog/src/main/resources/keystore.p12
rename to itests/qtest-iceberg/src/test/resources/keystore.p12
diff --git 
a/standalone-metastore/metastore-rest-catalog/src/main/resources/application.yml
 
b/standalone-metastore/metastore-rest-catalog/src/main/resources/application.yml
index d15c0701e80..a182bec7a66 100644
--- 
a/standalone-metastore/metastore-rest-catalog/src/main/resources/application.yml
+++ 
b/standalone-metastore/metastore-rest-catalog/src/main/resources/application.yml
@@ -18,17 +18,15 @@
 
 # Server configuration
 # Port is set via MetastoreConf.CATALOG_SERVLET_PORT or 
-Dmetastore.catalog.servlet.port
-# SSL is enabled by default with a bundled self-signed cert (dev). Override 
for production:
-#   -Dserver.ssl.key-store=/path/to/keystore.p12 
-Dserver.ssl.key-store-password=secret
+# TLS is disabled by default. To enable, supply an operator-managed keystore 
(never classpath:):
+#   --server.ssl.enabled=true
+#   --server.ssl.key-store=file:/path/to/keystore.p12
+#   --server.ssl.key-store-password=secret
 server:
   port: ${metastore.catalog.servlet.port:8080}
   shutdown: graceful
   ssl:
-    enabled: true
-    key-store: classpath:keystore.p12
-    key-store-password: changeit
-    key-store-type: PKCS12
-    key-alias: iceberg
+    enabled: false
 spring:
   lifecycle:
     timeout-per-shutdown-phase: 30s