oscerd opened a new pull request, #26545:
URL: https://github.com/apache/camel/pull/26545
## Motivation
`components/camel-oauth/helm/etc/` carries a committed X.509 certificate and
its matching RSA private key:
- `cluster.crt` — self-signed, `CN=Camel Cloud Examples`, valid `2025-04-16`
→ `2026-04-16`, i.e. **expired**.
- `cluster.key` — a genuine, usable RSA private key (`openssl rsa -check` →
`RSA key ok`; the public key MD5 matches the certificate's).
Nothing in the chart consumes either file:
- `helm/README.md` instructs the user to generate their own certificate with
`mkcert` and create the `edge-tls` secret from it.
- The `cluster.crt` mentions in `oauth.adoc` (lines 446-505) refer to a file
the *reader* produces at runtime via `openssl s_client -connect ... | openssl
x509 > cluster.crt` — not to this committed file.
So the pair is dead weight that also happens to be a private key in git.
## Modifications
- Delete `helm/etc/cluster.crt` and `helm/etc/cluster.key`. `helm/etc/`
retains `camel-realm.json`.
- Delete `SSLCertTrustTest#testCheckClusterCertificateTrust`, the only
reader of `helm/etc/cluster.crt`, and the six imports it alone used.
Deleting rather than regenerating: regenerating would re-commit a private
key for no functional benefit and re-arm the same expiry a year from now, while
the old key stays in git history either way.
About the removed test — it asserted nothing:
```java
} catch (CertificateException ex) {
LOG.error("Untrusted, because of: ", ex);
return;
}
LOG.info("Trusted");
```
Both branches are a log line, so it passed whether the certificate validated
or not. There is no coverage to preserve. The two real tests in the class,
`testCheckKeycloakCertificateTrust` and `testUntrustedCertificate` (the latter
backed by the `selfsigned-keystore.p12` test resource, valid to 2126), are
untouched.
## Result
`mvn test -pl components/camel-oauth` → **124 tests, 0 failures, 0 errors, 7
skipped** (the skips are the Keycloak-gated tests;
`Assumptions.assumeTrue(admin.isKeycloakRunning())`). `SSLCertTrustTest` now
reports 2 tests instead of 3.
No user-facing behavior change, so no upgrade-guide entry.
Jira: https://issues.apache.org/jira/browse/CAMEL-24790
---
_Claude Code on behalf of @oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
