The GitHub Actions job "Java CI with Maven" on stormcrawler.git/issue-2079-okhttp-trust-v2 has failed. Run started by GitHub user abhinav-phi (triggered by rzo1).
Head commit for run: 10c7ba3e8820f706e04ed620e544eb5bfb1e32e9 / abhinav-phi <[email protected]> OKHttp: authenticated TLS by default, credentials withheld from unauthenticated servers (#2079) http.trust.everything shipped enabled with a static SSLContext('SSL'), a no-op trust manager and a hostname verifier that accepted any name: anybody able to answer for a host name received the Authorization header built from http.basicauth.*, credential headers from http.custom.headers and the replayed cookies. - http.trust.everything now defaults to false: certificate chains are validated and the servers are authenticated, as a normal TLS client would do. Self-signed intranet hosts need the operator to opt in - the trust-all context is built from 'TLS' instead of 'SSL' - hostname verification is a separate decision (http.verify.hostnames, default true) and is no longer disabled as a side effect of trusting any certificate - credentials are withheld over connections whose server certificate was not validated, unless http.credentials.allow.insecure is set: basic auth, credential headers (authorization, proxy-authorization, cookie, x-api-key) in http.custom.headers, headers set by request and cookies are all covered - every insecure state logs a WARN naming the keys, and the keys are surfaced in crawler-default.yaml and the archetype crawler-conf.yaml files Report URL: https://github.com/apache/stormcrawler/actions/runs/33998246644 With regards, GitHub Actions via GitBox
