The GitHub Actions job "Nightly Builds (1.7)" on pekko.git/main has failed. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: f9f8db5c74847087d2174f79d8270ef92e797ca5 / PJ Fanning <[email protected]> feat: load every certificate in the rotating keys engine ca-cert-file (#3528) * feat: load every certificate in the rotating keys engine ca-cert-file Motivation: `RotatingKeysSSLEngineProvider` read `ca-cert-file` with `CertificateFactory.generateCertificate`, which stops at the first PEM block. A CA file that bundles more than one certificate - a root plus the intermediates it delegates to, or two roots while a CA is being rotated - was therefore only half trusted, and peers presenting a certificate from any of the other CAs in the bundle were rejected. Modification: Add `PemManagersProvider.loadCertificates`, which uses `generateCertificates` and closes the stream. `buildTrustManagers` and `buildKeyManagers` now take the whole `Seq[Certificate]`; every CA certificate is stored under its own alias so all of them become trust anchors. The chain attached to the key entry is built by walking issuer -> subject from the node certificate upwards, so CA certificates that did not issue it are trusted without being sent to the peer; when none of them matches the issuer the previous behaviour (all of them) is kept. `readFiles` now fails with `SslTransportException` when the CA file yields no certificate at all, instead of passing a null certificate on. Result: `ca-cert-file` may bundle any number of certificates and all of them are trusted. Single-certificate configurations behave as before. Tests: - sbt "remote/testOnly org.apache.pekko.remote.artery.tcp.ssl.PemManagersProviderSpec org.apache.pekko.remote.artery.tcp.ssl.TlsResourcesSpec org.apache.pekko.remote.artery.tcp.ssl.*Rotating*" - passed - sbt "remote/mimaReportBinaryIssues" - passed - both were run before this change was merged with the keystore-password change on main; verification of the merged state is left to CI References: None - follow-up on multi-certificate `ca-cert-file` support * fix: pick the CA certificate by signature, not by subject alone A CA rotation that keeps the distinguished name leaves two certificates with the same subject in `ca-cert-file`, and only one of them signed the node certificate. Keying the candidate issuers by subject picked whichever came last in the file, so the chain sent to the peer could carry an intermediate that does not verify the certificate below it. Walk the chain by verifying the signature instead, and send the node certificate on its own when no CA in the bundle issued it rather than sending the whole bundle. Also close the stream in `loadCertificate`. `gen-ca-bundles.sh` generates the multi-certificate samples, including the new rotated CA sharing exampleCA's subject, and is called from `gencerts.sh` so the bundles survive a regeneration. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix: close the input streams handed to KeyStore.load Motivation: `KeyStore.load` does not close the stream it is given, so every call that passes a freshly opened stream inline leaks the handle. Review of #3528 raised this for `PemManagersProvider.loadCertificate`, which the previous commit fixed; the same shape is in the TLS setup code elsewhere in the tree, where it was left in place. Modification: Bind the stream, load through a `try`, and close in a `finally`, at all five remaining sites: two in `TlsSpec.initWithTrust`, one in `TcpSpec`'s `sslContext`, and two in `TlsBenchmark.initSslContext`. `getResourceAsStream` returns null for a missing resource, so the close is guarded to avoid masking the real failure with a NullPointerException. `PemManagersProvider.loadCertificate` and `loadCertificates` already close their streams, and the other keystore loaders (`ConfigSSLEngineProvider.loadKeystore` and the netty `SSLEngineProvider.loadKeystore`) already close theirs. Result: No TLS keystore load leaks a file descriptor. Tests: - `sbt "remote/testOnly org.apache.pekko.remote.artery.tcp.ssl.*"` -- 16 passed, 1 ignored - `sbt "stream-tests/testOnly org.apache.pekko.stream.io.TlsSpec"` -- 113 passed, which is the directional check that the keystores still load after the streams are closed - `sbt "stream-tests/Test/compile" "bench-jmh/compile"` -- clean - `sbt "stream-tests/scalafmtCheckAll" "bench-jmh/scalafmtCheckAll" "remote/scalafmtCheckAll"` -- clean References: Refs #3528 --------- Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Report URL: https://github.com/apache/pekko/actions/runs/34174711633 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
