Phoenix500526 opened a new pull request, #12020: URL: https://github.com/apache/arrow-rs/pull/12020
# Which issue does this PR close? - Closes #12009 # Rationale for this change The Flight example certificate generator has uncertain provenance. Reimplement it from the examples' mutual TLS requirements using the documented OpenSSL [`req`](https://docs.openssl.org/3.0/man1/openssl-req/) and [`x509`](https://docs.openssl.org/3.0/man1/openssl-x509/) operations, with an ASF license header and running instructions. # What changes are included in this PR? - Generate a root CA and directly sign the client and server certificate requests, with explicit certificate constraints and TLS purposes. Preserve the filenames, RSA-2048 keys, 1825-day validity and localhost support. - Regenerate all six checked-in certificate and private-key fixtures with the rewritten script. - Fix the example's `USE_TLS` startup path to load `ca_root.pem`; it previously referenced the missing `client_ca.pem`. AI assistance: Codex generated the script rewrite, CA-path fix and validation commands. The certificate and key fixtures were generated with OpenSSL. # Are these changes tested? No new tests were added because the existing Flight SQL example tests exercise authentication, queries and updates over mutual TLS. All three passed using the newly generated fixtures. OpenSSL checks also passed for certificate chains, TLS purposes, localhost matching and certificate/private-key matches. The `USE_TLS` example was started and a TLS connection with HTTP/2 ALPN was verified. Formatting, spelling and Clippy for the Flight examples passed. Full-workspace tests and Clippy could not complete locally because the configured proxy prevented downloading the missing `brotli` dependency. # Are there any significant user-facing changes? No public API changes. The test certificates and keys are regenerated as a matching set. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
