This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/storm.git
commit 81b5b80ec652c931bec906adf37ad8ad1db62070 Author: Richard Zowalla <[email protected]> AuthorDate: Tue Apr 14 13:37:18 2026 +0200 The root cause of the CI failure was that the old code's SSLContext.setDefault() silently weakened TLS for the entire JVM, and the test's readContent was unknowingly piggy-backing on that global relaxation. After the hardening fix, readContent now does its own per-connection trust-all + hostname-verifier override (same pattern as the production fix), so the test no longer depends on JVM-wide state. This also makes the test an implicit regression guard: if someone reintroduces SSLContext.setDefault() in the reporter, nothing in the test relies on it. --- .../PrometheusPreparableReporterTest.java | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/external/storm-metrics-prometheus/src/test/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporterTest.java b/external/storm-metrics-prometheus/src/test/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporterTest.java index a49a808d7..9e33be80f 100644 --- a/external/storm-metrics-prometheus/src/test/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporterTest.java +++ b/external/storm-metrics-prometheus/src/test/java/org/apache/storm/metrics/prometheus/PrometheusPreparableReporterTest.java @@ -22,11 +22,17 @@ import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Testcontainers; import org.testcontainers.utility.MountableFile; +import javax.net.ssl.HttpsURLConnection; +import javax.net.ssl.SSLContext; +import javax.net.ssl.TrustManager; +import javax.net.ssl.X509TrustManager; import java.io.BufferedReader; import java.io.IOException; import java.io.InputStreamReader; import java.net.HttpURLConnection; import java.net.URL; +import java.security.GeneralSecurityException; +import java.security.cert.X509Certificate; import java.util.Arrays; import java.util.Base64; import java.util.HashSet; @@ -163,6 +169,31 @@ public class PrometheusPreparableReporterTest { private String readContent(String url, Map<String, Object> conf) throws IOException { final URL obj = new URL(url); final HttpURLConnection con = (HttpURLConnection) obj.openConnection(); + if (con instanceof HttpsURLConnection) { + // The test PushGateway uses a self-signed certificate. Scope the trust-all + // SSLContext to this connection only, so we do not mutate JVM-wide TLS state. + try { + final SSLContext sslContext = SSLContext.getInstance("TLS"); + sslContext.init(null, new TrustManager[]{new X509TrustManager() { + @Override + public X509Certificate[] getAcceptedIssuers() { + return new X509Certificate[0]; + } + + @Override + public void checkClientTrusted(X509Certificate[] chain, String authType) { + } + + @Override + public void checkServerTrusted(X509Certificate[] chain, String authType) { + } + }}, null); + ((HttpsURLConnection) con).setSSLSocketFactory(sslContext.getSocketFactory()); + ((HttpsURLConnection) con).setHostnameVerifier((h, s) -> true); + } catch (GeneralSecurityException e) { + throw new IOException(e); + } + } con.setRequestMethod("GET"); if (conf.containsKey("storm.daemon.metrics.reporter.plugin.prometheus.basic_auth_user")) {
