xiangfu0 commented on code in PR #19828:
URL: https://github.com/apache/pinot/pull/19828#discussion_r4266275607
##########
pom.xml:
##########
@@ -218,7 +218,7 @@
<libthrift.version>0.25.0</libthrift.version>
<log4j.version>2.26.1</log4j.version>
<slf4j.version>2.0.20</slf4j.version>
- <netty.version>4.1.139.Final</netty.version>
+ <netty.version>4.2.18.Final</netty.version>
Review Comment:
Fixed within Pinot in 031666fb968094c434d4509fcc9d603fd17cc77a, with
StarTree proxy bootstrap wiring in
startreedata/startree-pinot@f7e24b12d0dbb9425aec6ecfc28170e6b111f56e. No
ZooKeeper source or dependency version change is needed for this selected JDK
TLS path; the upstream PR is closed.
A Pinot-owned Supplier<SSLContext> uses released ZooKeeper 3.9.6's public
context hook and its supported createSSLContextAndOptionsFromConfig API.
Registration runs before Pinot service/early controller cluster setup,
CLI/Java-client/predownload, and proxy/controller-URL-provider connections. It
selects JDK TLS only for bootstrap hostnameVerification=false without an
existing custom supplier. Enabled verification keeps ZooKeeper's ordinary path,
and custom suppliers retain their provider/context ownership. No global Netty
default, copied vendor class or new runtime knob was added. This adapts the
existing process-owned ZooKeeper bootstrap configuration; arbitrary per-client
TLS maps are outside the vendor's no-argument supplier contract.
Actual wrapper/JDK 25 source validation passes 38 distinct OSS cases (33
existing plus five regression cases), 54 existing paired proxy cases, all six
parent-version rules, and affected quality checks, with zero test
failures/errors/skips. The regression exercises real trusted mismatched-peer
handshakes under both FIPS configuration flags plus custom-supplier
preservation. Separate actual secure ZooKeeper session probes use the exact
compiled production helper with released 3.9.6/Netty 4.2.19: the original eight
outcomes include successful disabled-policy create/read/delete and stock
controls reproducing both disabled-policy failures. Eight additional
localhost-SAN outcomes verify matching hosts succeed with verification enabled,
mismatched 127.0.0.1 succeeds only with verification disabled, and both enabled
mismatches fail with actual SSLHandshakeException/CertificateException. All six
connected SAN cases complete create/read/delete. These flags do not certify
cryptographic FIPS
compliance; new-head hosted CI, image validation and benchmarks remain
separate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
