The GitHub Actions job "CI" on pekko-connectors.git/fix-tls-min-version has failed. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: 89f5ff3bfb6e5587d78a099d6caeb6dda4a96128 / PJ Fanning <[email protected]> Google/Huawei: apply min TLS version to the SSLEngine Motivation: The min-tls-version setting added in #1808 had no effect. Both forward proxy HTTPS contexts configured the enabled protocols via sslContext.getDefaultSSLParameters.setProtocols(protocols) SSLContext.getDefaultSSLParameters() returns a fresh defensive copy on every call, so mutating it is discarded. Connections were negotiated with the JDK defaults regardless of the configured value, meaning min-tls-version = "TLSv1.3" was silently ignored and TLSv1.2 remained enabled. Modification: Build the HttpsConnectionContext from a client SSLEngine factory instead of from the SSLContext, and set the protocols on each engine's own SSLParameters. ConnectionContext.httpsClient(SSLContext) sets the "https" endpoint identification algorithm internally; taking the engine-factory overload bypasses that, so it is set explicitly to keep hostname verification enabled. The minTlsVersion lookup is moved ahead of the certificate load so an invalid value fails before any file IO. Result: min-tls-version is honoured. With the default TLSv1.2 the enabled set is TLSv1.2 and TLSv1.3; with TLSv1.3 only TLSv1.3 is enabled. Hostname verification is unchanged. Tests: Added ForwardProxyHttpsContextSpec to google-common and huawei-push-kit, asserting the engine's enabled protocols, client mode and endpoint identification algorithm. Verified the protocol assertion fails against the previous getDefaultSSLParameters implementation and passes with this change. Ran google-common/mimaReportBinaryIssues and huawei-push-kit/mimaReportBinaryIssues (clean) and scalafmtCheckAll. References: Follow-up to #1808. JDK javadoc for SSLContext.getDefaultSSLParameters specifies that the returned parameters are a copy. Report URL: https://github.com/apache/pekko-connectors/actions/runs/33272669295 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
