The GitHub Actions job "Headers" on pekko-grpc.git/tls has succeeded. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: fcedf76aad80541def86b1bd4b5445f1325973f2 / PJ Fanning <[email protected]> Apply the minimum TLS version on every client TLS path Motivation: Three problems with the setting as first written. The netty backend ignored it in exactly the configuration most users run. `(settings.trustManager, settings.sslProvider) match { case (None, None) => builder }` returned before `minimumTlsVersion` was consulted, and with stock config (`trusted = ""`, `ssl-provider = ""`, no programmatic sslContext) both are `None` - so the default backend, on default settings, got no floor at all. `enabledProtocols` filtered `getDefaultSSLParameters.getProtocols`, the set the JDK already enables, so the floor could only ever remove versions, never make a supported-but-not-enabled one reachable. The netty branch also read this from `SSLContext.getDefault` rather than the context being configured. `reference.conf` shipped `minimum-tls-version = "TLSv1.2"` under a comment saying to leave it empty to allow all JDK-supported versions. On Java 17 that is a no-op, but it is a behaviour-bearing default presented as inert, and `enabledProtocols` throws when nothing matches, so a JDK with TLSv1.2 disabled would fail at channel creation rather than degrade. Modification: - Matched on `minimumTlsVersion` alongside the trust manager and provider in `NettyClientUtils`, so a configured floor builds an `SslContext` even when neither of the other two is set. Only the all-empty case still defers to grpc-java's own context. - `enabledProtocols(sslContext, _)` now reads `getSupportedSSLParameters`. `TlsVersionOrder` still bounds the result to TLSv1.2 and TLSv1.3, so this cannot re-enable TLSv1.1 or SSLv3. - Defaulted `minimum-tls-version` to `""`, which `getOptionalString` maps to `None`, and reworded the comment to say what an empty value does. Result: A configured floor reaches both backends on every TLS path, including netty with default trust settings, and the shipped default no longer quietly pins a version. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Report URL: https://github.com/apache/pekko-grpc/actions/runs/33283696362 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
