[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137718#comment-18137718
]
Anton Vinogradov commented on IGNITE-29209:
-------------------------------------------
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13751] verdict for PR
13751 · RunAll build [9469045|https://ci2.ignite.apache.org/build/9469045] ·
tested
[f004af6|https://github.com/apache/ignite/pull/13751/commits/f004af6a7b83a7a7f5ac5fcf2c11f5f9022dcec7]
· 149 suites ran, 0 reused
(!) *This run doesn't cover the PR fully:*
- 1 suite ran fewer tests than the same suite on master
Everything below is what it did manage to say.
(?) *1 suite ran fewer tests than on master* (tests that never ran can't fail):
- PDS 3: ran 45 of master's 52 tests (*-13%*)
(?) *No blockers found — but the run above can't prove the PR is clean.* 22
failing tests are not blamed on this PR. Re-run after you handle what is listed
above.
_What each label means and what to do: [verdict
glossary|https://github.com/anton-vinogradov/ignite-pr-checker/blob/main/docs/features.md#verdict-glossary]._
♻️ Settled after 1 auto re-run wave: #1 — 5 suites that failed mid-run.
> Add SSL bundle metadata and explicit factory initialization
> -----------------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 4h
> Remaining Estimate: 0h
>
> Keep an SSL context and its certificate metadata from the same key-store
> read. Applications explicitly replace the accepted material and obtain its
> new context from the factory. IGNITE-29210 uses this snapshot for reload
> validation and status; IGNITE-29211 uses its expiry dates for renewal.
> h3. Result and acceptance
> * {{init()}} prepares a fresh bundle, verifies that its context can create an
> engine, then publishes context and metadata together. Failure retains the
> previous bundle; a failed first attempt can be retried.
> * {{create()}} initializes once, including concurrent first calls, and
> returns the accepted context. {{sslBundle()}} returns its snapshot. Repeated
> reads do not reload stores; serialization keeps configuration rather than
> runtime contexts.
> * Obtain the context again after successful {{init()}}. Previously obtained
> contexts, engines, socket factories and sockets retain their material. An
> initialized factory reused across node restarts retains its material until
> {{init()}}.
> * Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
> metadata and an empty chain map are distinct. Metadata describes loaded
> material, not the certificate selected for a connection.
> h3. Compatibility
> Affected subclasses must be updated and recompiled: {{create()}} becomes
> final; the protected {{sslCtx}} field and {{createKeyManagers()}} hook are
> removed. Implement the protected {{createSslBundle()}} hook, which may throw
> {{SSLException}}. Store-backed implementations load once and use
> {{createSslBundle(store, keyPassword, algorithm)}}. See the [factory
> contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L127]
> and [migration
> reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
> Direct subclasses of {{AbstractSslContextFactory}} that retain
> {{checkParameters()}} must remove its {{@Override}} and call it from
> {{createSslBundle()}}; subclasses of {{SslContextFactory}} can keep that
> override.
> Plain {{Factory<SSLContext>}} remains supported. Empty stores support clients
> without private keys; loaded stores must remain unchanged while their
> contexts are in use. Unsupported TLS names fail first initialization.
> Certificate-date and empty-chain replacement policies belong to IGNITE-29210.
> h3. Delivery and validation
> [PR #13751|https://github.com/apache/ignite/pull/13751] contains this API
> change. At {{06489a85}}, all 18 selected API, wrapper and startup cases
> passed, as did Checkstyle and Javadoc/doclint; CLI test sources compiled.
> These are targeted local checks, not full CI.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
