The GitHub Actions job "CI" on rocketmq-dashboard.git/fix/k8s-issuer-bound has 
failed.
Run started by GitHub user unbridled-41 (triggered by unbridled-41).

Head commit for run:
9d23c63162018958e9458b05f1a124120c0871dd / unbridled-41 
<[email protected]>
fix(k8s): bound the certificate identity fields and the derived issuer

The write path trims the identity fields and checks for blank, but never their 
width,
while the columns are `k8s_id VARCHAR(128)`, `cluster VARCHAR(128)`,
`issuer VARCHAR(256)`. A longer value reached the database, whose rejection
(DataIntegrityViolationException) no handler maps, so the API answered 500 - 
and for
the issuer the caller cannot even shorten it: when a PEM is supplied the 
submitted
issuer is discarded and the DN is read out of the certificate, which a large
enterprise CA exceeds.

Reject a caller-supplied identity longer than its column with 400 (the 
code-point
rule the repo uses elsewhere), and bound the derived issuer to the column with a
visible marker instead of failing the whole registration - it is informational, 
and
refusing it would make the certificate-inventory feature unusable for that CA.

Tests (server/): mvn -o -B -ntp test 
-Dtest='org.apache.rocketmq.studio.cluster.k8s.**'
-> Tests run: 45, Failures: 0, Errors: 0.
- new createCertShouldRejectAnIdentityLongerThanItsColumnTest fails before the 
bound
  ("Expecting code to raise a throwable") and passes after it, asserting no 
save.
- new 
aDerivedIssuerLongerThanItsColumnIsMarkedInsteadOfFailingTheRegistrationTest
  pins the truncation contract (259 code points, "...", short values untouched).
- checkstyle passes.

Report URL: 
https://github.com/apache/rocketmq-dashboard/actions/runs/37998374554

With regards,
GitHub Actions via GitBox

Reply via email to