xiangfu0 commented on code in PR #20112:
URL: https://github.com/apache/pinot/pull/20112#discussion_r4477196323
##########
pinot-plugins/pinot-stream-ingestion/pinot-kafka-4.0/pom.xml:
##########
@@ -58,6 +52,13 @@
</exclusions>
</dependency>
+ <!-- Kafka's OAuth callback needs jose4j, which kafka-clients does not
supply transitively. -->
+ <dependency>
+ <groupId>org.bitbucket.b_c</groupId>
+ <artifactId>jose4j</artifactId>
Review Comment:
MINOR: This fix works. Built from this head, the shaded jar initialized the
real OAuth login callback and validated an RS256 token, and the same jar with
jose4j stripped hit `VerificationKeyResolver` NCDFE. But nothing in the repo
would catch the regression again, for example if a future dependency change
drops jose4j. A small test that constructs
`DefaultJwtValidator`/`BrokerJwtValidator` (or runs the callback against a file
JWKS) on this module's runtime classpath would cover the coverage gap Jackie
raised.
AI-generated review via IntentLab ยท Model: Claude Opus 5.5 (claude-opus-5-5).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
