bamaer opened a new issue, #8392:
URL: https://github.com/apache/hop/issues/8392
### What needs to happen?
`verifyingSsl` is declared without an initialiser
(`BaseVaultVariableResolver.java:134`) and passed straight to the client's
SSL
configuration (`:498`), so a resolver verifies the secrets server's
certificate
only when someone ticks the option. Both the Vault and OpenBao resolvers
extend
this class.
Initialise the field to `true` so verification is on unless it is
deliberately
turned off.
## Existing resolvers are not covered by the default
`verifyingSsl` is a `@HopMetadataProperty`, so it is serialised into each
resolver's metadata and booleans are always written. Resolvers created before
this change therefore carry `"verifyingSsl": false` explicitly and keep their
current behaviour — changing the field default only affects newly created
ones.
Two things follow:
- The release note needs to tell operators to check existing Vault and
OpenBao
resolver definitions rather than assume the upgrade covers them.
- Worth logging a warning when a resolver is used with verification off. The
state is currently silent, which is why it is easy to miss in a definition
that was created years ago.
## Compatibility
Deployments using a self-signed or private CA certificate without a
configured
PEM will start failing on new resolvers. The resolver already supports
supplying
the certificate through `pemFilePath` (`:146`) or `pemString` (`:159`),
which is
the intended path; turning the option back off remains possible.
### Issue Priority
Priority: 2
### Issue Component
Component: Metadata
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
