[Git][clojure-team/puppetlabs-http-client-clojure][upstream] 2 commits: New upstream version 2.2.0
Thomas Goirand (@zigo)
gitlab at salsa.debian.org
Thu Jul 30 14:38:11 BST 2026
Thomas Goirand pushed to branch upstream at Debian Clojure Maintainers / puppetlabs-http-client-clojure
Commits:
150550a3 by Thomas Goirand at 2026-07-19T16:39:08+02:00
New upstream version 2.2.0
- - - - -
73cfbb35 by Thomas Goirand at 2026-07-19T22:00:26+02:00
New upstream version 2.3.1
- - - - -
29 changed files:
- + .clj-kondo/config.edn
- + .github/dependabot.yml
- + .github/release.yml
- + .github/workflows/pr-testing.yaml
- + .github/workflows/release.yaml
- − .github/workflows/snyk_merge.yaml
- − .travis.yml
- CHANGELOG.md
- − CODEOWNERS
- − CONTRIBUTING.md
- README.md
- + dev-resources/jdk17-fips-security
- dev-resources/ssl/alternate-ca.pem
- dev-resources/ssl/ca.pem
- dev-resources/ssl/cert.pem
- dev-resources/ssl/key.pem
- − jenkins/deploy.sh
- project.clj
- + renovate.json
- src/clj/puppetlabs/http/client/async.clj
- src/clj/puppetlabs/http/client/metrics.clj
- src/java/com/puppetlabs/http/client/impl/JavaClient.java
- src/java/com/puppetlabs/http/client/impl/StreamingAsyncResponseConsumer.java
- test/puppetlabs/http/client/async_plaintext_test.clj
- test/puppetlabs/http/client/async_unbuffered_test.clj
- test/puppetlabs/http/client/gzip_request_test.clj
- test/puppetlabs/http/client/metrics_test.clj
- test/puppetlabs/http/client/sync_plaintext_test.clj
- test/puppetlabs/http/client/sync_ssl_test.clj
Changes:
=====================================
.clj-kondo/config.edn
=====================================
@@ -0,0 +1,9 @@
+{:linters {:refer-all {:exclude [clojure.test slingshot.test
+ puppetlabs.http.client.test-common]}
+ :unresolved-symbol {:level :warning :exclude [(puppetlabs.trapperkeeper.core/defservice)
+ (puppetlabs.trapperkeeper.testutils.bootstrap/with-app-with-config)
+ (puppetlabs.trapperkeeper.testutils.webserver/with-test-webserver)
+ (puppetlabs.trapperkeeper.testutils.webserver/with-test-webserver-and-config)]}
+ :invalid-arity {:skip-args [puppetlabs.trapperkeeper.core/defservice]}}
+ :output {:linter-name true}
+ :lint-as {puppetlabs.trapperkeeper.core/defservice clojure.core/def}}
=====================================
.github/dependabot.yml
=====================================
@@ -0,0 +1,17 @@
+version: 2
+updates:
+ # raise PRs for gem updates
+ - package-ecosystem: bundler
+ directory: "/"
+ schedule:
+ interval: daily
+ time: "13:00"
+ open-pull-requests-limit: 10
+
+ # Maintain dependencies for GitHub Actions
+ - package-ecosystem: github-actions
+ directory: "/"
+ schedule:
+ interval: daily
+ time: "13:00"
+ open-pull-requests-limit: 10
=====================================
.github/release.yml
=====================================
@@ -0,0 +1,39 @@
+---
+# https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
+
+changelog:
+ exclude:
+ labels:
+ - duplicate
+ - invalid
+ - modulesync
+ - question
+ - skip-changelog
+ - wont-fix
+ - wontfix
+
+ categories:
+ - title: Breaking Changes 🛠
+ labels:
+ - backwards-incompatible
+
+ - title: New Features 🎉
+ labels:
+ - enhancement
+
+ - title: Bug Fixes 🐛
+ labels:
+ - bug
+
+ - title: Documentation Updates 📚
+ labels:
+ - documentation
+ - docs
+
+ - title: Dependency Updates ⬆️
+ labels:
+ - dependencies
+
+ - title: Other Changes
+ labels:
+ - "*"
=====================================
.github/workflows/pr-testing.yaml
=====================================
@@ -0,0 +1,61 @@
+name: PR Testing
+
+on:
+ pull_request: {}
+ push:
+ branches:
+ - main
+
+# minimal permissions
+permissions:
+ contents: read
+
+jobs:
+ pr-testing:
+ name: PR Testing
+ strategy:
+ fail-fast: false
+ matrix:
+ version: ['17','21', '25']
+ runs-on: ubuntu-latest
+ steps:
+ - name: checkout repo
+ uses: actions/checkout at v7
+ with:
+ submodules: recursive
+ - name: setup java
+ uses: actions/setup-java at v5
+ with:
+ distribution: 'temurin'
+ java-version: ${{ matrix.version }}
+ - name: Install Clojure tools
+ uses: DeLaGuardo/setup-clojure at 13.5
+ with:
+ cli: latest # Clojure CLI based on tools.deps
+ lein: latest # Leiningen
+ boot: latest # Boot.clj
+ bb: latest # Babashka
+ clj-kondo: latest # Clj-kondo
+ cljstyle: latest # cljstyle
+ zprint: latest # zprint
+ - name: kondo lint
+ run: clj-kondo --lint src test
+ - name: eastwood lint
+ run: |
+ java -version
+ lein eastwood
+ - name: clojure tests
+ run: lein test
+ timeout-minutes: 30
+
+ tests:
+ if: always()
+ needs:
+ - pr-testing
+ runs-on: ubuntu-24.04
+ name: Test suite
+ steps:
+ - name: Decide whether the needed jobs succeeded or failed
+ uses: re-actors/alls-green at release/v1
+ with:
+ jobs: ${{ toJSON(needs) }}
=====================================
.github/workflows/release.yaml
=====================================
@@ -0,0 +1,18 @@
+---
+name: Release and publish package to clojars.org
+
+permissions:
+ contents: write
+ packages: write
+
+on:
+ workflow_dispatch:
+
+jobs:
+ release:
+ uses: 'openvoxproject/shared-actions/.github/workflows/clojure_release.yml at main'
+ secrets:
+ github_pat: ${{ secrets.OPENVOXBOT_COMMIT_AND_PRS }}
+ ssh_private_key: ${{ secrets.OPENVOXBOT_SSH_PRIVATE_KEY }}
+ clojars_username: ${{ secrets.CLOJARS_USERNAME }}
+ clojars_password: ${{ secrets.CLOJARS_PASSWORD }}
=====================================
.github/workflows/snyk_merge.yaml deleted
=====================================
@@ -1,29 +0,0 @@
----
-name: Snyk Clojure Merge
-
-on: push
-
-jobs:
- snyk_clojure:
- runs-on: ubuntu-latest
- steps:
- - name: Connect to Twingate
- uses: twingate/github-action at v1
- with:
- service-key: ${{ secrets.TWINGATE_PUBLIC_REPO_KEY }}
- - name: checkout the current PR
- uses: actions/checkout at v2
- with:
- fetch-depth: 1
- persist-credentials: false
- - name: Run Clojure Snyk Scan
- id: scan
- uses: puppetlabs/security-snyk-clojure-action at v2
- with:
- snykToken: ${{ secrets.SNYK_PE_TOKEN }}
- snykOrg: 'puppet-enterprise'
- snykProject: 'clj-http-client'
- # snykPolicy: '.snyk'
- - name: Check output
- if: steps.scan.outputs.vulns != ''
- run: echo "Vulnerabilities detected; ${{ steps.scan.outputs.vulns }}" && exit 1
=====================================
.travis.yml deleted
=====================================
@@ -1,41 +0,0 @@
-dist: bionic
-language: clojure
-lein: 2.9.10
-jobs:
- include:
- # The OpenJDK versions used by Travis are pretty old, which causes
- # problems with some of the tests. This pulls in a semi-recent version
- # from the Ubuntu repos.
- - name: jdk8
- before_install:
- - sudo rm -rf /usr/local/lib/jvm/
- - sudo rm -rf /usr/lib/jvm/openjdk-8
- - sudo apt-get install -y openjdk-8-jdk-headless
- - export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64/
- script:
- - lein with-profile dev test
- #- # same as previous stage
- # script: lein with-profile fips test
- # jdk: openjdk8
- - name: jdk11
- before_install:
- - sudo rm -rf /usr/local/lib/jvm/
- - sudo rm -rf /usr/lib/jvm/openjdk-11
- - sudo apt-get install -y openjdk-11-jdk-headless
- - export JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64/
- script:
- - lein with-profile dev test
- #- # same as previous stage
- # script: lein with-profile fips test
- # jdk: openjdk11
-sudo: false
-# Java needs to be able to resolve its hostname when doing integration style
-# tests, which it cannot do in certain cases with travis-ci. If we need the
-# runtime/container to be able to resolve its own hostname we need to use
-# either the `hostname` or `hosts` "addon" for travis. Since we don't care
-# what the hostname is, here we just give it a garbage name based on the name
-# of the project.
-addons:
- hostname: cljhttpclient
-notifications:
- email: false
=====================================
CHANGELOG.md
=====================================
@@ -1,5 +1,15 @@
## Unreleased
+# 2.1.4
+* improve logging around non-successful outcomes
+
+# 2.1.3
+* ensure unbuffered-stream correctly handles 204 responses with no body in the response.
+
+# 2.1.2
+* add support for multiple `Set-Cookie` headers in a response separated by newlines.
+* update project.clj to remove composite profiles that include maps, it is deprecated in lein 2.11.0
+
# 2.1.1
* [PE-34843](https://tickets.puppetlabs.com/browse/PE-34843) Properly reuse connections when using a client certificate
* Update to clj-parent 5.2.11
=====================================
CODEOWNERS deleted
=====================================
@@ -1 +0,0 @@
-* @puppetlabs/dumpling
=====================================
CONTRIBUTING.md deleted
=====================================
@@ -1,9 +0,0 @@
-# How to contribute
-
-Third-party patches are essential for keeping puppet open-source projects
-great. We want to keep it as easy as possible to contribute changes that
-allow you to get the most out of our projects. There are a few guidelines
-that we need contributors to follow so that we can have a chance of keeping on
-top of things. For more info, see our canonical guide to contributing:
-
-[https://github.com/puppetlabs/puppet/blob/master/CONTRIBUTING.md](https://github.com/puppetlabs/puppet/blob/master/CONTRIBUTING.md)
=====================================
README.md
=====================================
@@ -1,16 +1,14 @@
-# puppetlabs/http-client
-
-[](https://travis-ci.com/puppetlabs/clj-http-client)
+# org.openvoxproject/http-client
This is a wrapper around the [Apache HttpAsyncClient
library](http://hc.apache.org/httpcomponents-asyncclient-4.0.x/) providing
-some extra functionality for configuring SSL in a way compatible with Puppet.
+some extra functionality for configuring SSL in a way compatible with OpenVox.
## Installation
Add the following dependency to your `project.clj` file:
-[](http://clojars.org/puppetlabs/http-client)
+[](http://clojars.org/org.openvoxproject/http-client)
## Details
@@ -44,5 +42,4 @@ SafeRedirectedRequest and RedirectStrategy.
## Support
-We use the [Trapperkeeper project on JIRA](https://tickets.puppetlabs.com/browse/TK)
-for tickets on clj-http-client, although Github issues are welcome too.
+GitHub issues and PRs are welcome! Additionally, drop us a line in [the Vox Pupuli Slack or IRC channel](https://voxpupuli.org/connect/).
=====================================
dev-resources/jdk17-fips-security
=====================================
@@ -0,0 +1,1098 @@
+#
+# This is the "master security properties file".
+#
+# An alternate java.security properties file may be specified
+# from the command line via the system property
+#
+# -Djava.security.properties=<URL>
+#
+# This properties file appends to the master security properties file.
+# If both properties files specify values for the same key, the value
+# from the command-line properties file is selected, as it is the last
+# one loaded.
+#
+# Also, if you specify
+#
+# -Djava.security.properties==<URL> (2 equals),
+#
+# then that properties file completely overrides the master security
+# properties file.
+#
+# To disable the ability to specify an additional properties file from
+# the command line, set the key security.overridePropertiesFile
+# to false in the master security properties file. It is set to true
+# by default.
+
+# In this file, various security properties are set for use by
+# java.security classes. This is where users can statically register
+# Cryptography Package Providers ("providers" for short). The term
+# "provider" refers to a package or set of packages that supply a
+# concrete implementation of a subset of the cryptography aspects of
+# the Java Security API. A provider may, for example, implement one or
+# more digital signature algorithms or message digest algorithms.
+#
+# Each provider must implement a subclass of the Provider class.
+# To register a provider in this master security properties file,
+# specify the provider and priority in the format
+#
+# security.provider.<n>=<provName | className>
+#
+# This declares a provider, and specifies its preference
+# order n. The preference order is the order in which providers are
+# searched for requested algorithms (when no specific provider is
+# requested). The order is 1-based; 1 is the most preferred, followed
+# by 2, and so on.
+#
+# <provName> must specify the name of the Provider as passed to its super
+# class java.security.Provider constructor. This is for providers loaded
+# through the ServiceLoader mechanism.
+#
+# <className> must specify the subclass of the Provider class whose
+# constructor sets the values of various properties that are required
+# for the Java Security API to look up the algorithms or other
+# facilities implemented by the provider. This is for providers loaded
+# through classpath.
+#
+# Note: Providers can be dynamically registered instead by calls to
+# either the addProvider or insertProviderAt method in the Security
+# class.
+
+#
+# List of providers and their preference orders (see above):
+#
+security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
+security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS
+security.provider.3=SUN
+security.provider.4=SunRsaSign
+#security.provider.5=SunEC
+#security.provider.6=SunJSSE
+#security.provider.7=SunJCE
+#security.provider.8=SunJGSS
+#security.provider.9=SunSASL
+#security.provider.10=XMLDSig
+#security.provider.11=SunPCSC
+#security.provider.12=JdkLDAP
+#security.provider.13=JdkSASL
+#security.provider.14=SunPKCS11
+
+#
+# A list of preferred providers for specific algorithms. These providers will
+# be searched for matching algorithms before the list of registered providers.
+# Entries containing errors (parsing, etc) will be ignored. Use the
+# -Djava.security.debug=jca property to debug these errors.
+#
+# The property is a comma-separated list of serviceType.algorithm:provider
+# entries. The serviceType (example: "MessageDigest") is optional, and if
+# not specified, the algorithm applies to all service types that support it.
+# The algorithm is the standard algorithm name or transformation.
+# Transformations can be specified in their full standard name
+# (ex: AES/CBC/PKCS5Padding), or as partial matches (ex: AES, AES/CBC).
+# The provider is the name of the provider. Any provider that does not
+# also appear in the registered list will be ignored.
+#
+# There is a special serviceType for this property only to group a set of
+# algorithms together. The type is "Group" and is followed by an algorithm
+# keyword. Groups are to simplify and lessen the entries on the property
+# line. Current groups are:
+# Group.SHA2 = SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256
+# Group.HmacSHA2 = HmacSHA224, HmacSHA256, HmacSHA384, HmacSHA512
+# Group.SHA2RSA = SHA224withRSA, SHA256withRSA, SHA384withRSA, SHA512withRSA
+# Group.SHA2DSA = SHA224withDSA, SHA256withDSA, SHA384withDSA, SHA512withDSA
+# Group.SHA2ECDSA = SHA224withECDSA, SHA256withECDSA, SHA384withECDSA, \
+# SHA512withECDSA
+# Group.SHA3 = SHA3-224, SHA3-256, SHA3-384, SHA3-512
+# Group.HmacSHA3 = HmacSHA3-224, HmacSHA3-256, HmacSHA3-384, HmacSHA3-512
+#
+# Example:
+# jdk.security.provider.preferred=AES/GCM/NoPadding:SunJCE, \
+# MessageDigest.SHA-256:SUN, Group.HmacSHA2:SunJCE
+#
+#jdk.security.provider.preferred=
+
+
+#
+# Sun Provider SecureRandom seed source.
+#
+# Select the primary source of seed data for the "NativePRNG", "SHA1PRNG"
+# and "DRBG" SecureRandom implementations in the "Sun" provider.
+# (Other SecureRandom implementations might also use this property.)
+#
+# On Unix-like systems (for example, Solaris/Linux/MacOS), the
+# "NativePRNG", "SHA1PRNG" and "DRBG" implementations obtains seed data from
+# special device files such as file:/dev/random.
+#
+# On Windows systems, specifying the URLs "file:/dev/random" or
+# "file:/dev/urandom" will enable the native Microsoft CryptoAPI seeding
+# mechanism for SHA1PRNG and DRBG.
+#
+# By default, an attempt is made to use the entropy gathering device
+# specified by the "securerandom.source" Security property. If an
+# exception occurs while accessing the specified URL:
+#
+# NativePRNG:
+# a default value of /dev/random will be used. If neither
+# are available, the implementation will be disabled.
+# "file" is the only currently supported protocol type.
+#
+# SHA1PRNG and DRBG:
+# the traditional system/thread activity algorithm will be used.
+#
+# The entropy gathering device can also be specified with the System
+# property "java.security.egd". For example:
+#
+# % java -Djava.security.egd=file:/dev/random MainClass
+#
+# Specifying this System property will override the
+# "securerandom.source" Security property.
+#
+# In addition, if "file:/dev/random" or "file:/dev/urandom" is
+# specified, the "NativePRNG" implementation will be more preferred than
+# DRBG and SHA1PRNG in the Sun provider.
+#
+securerandom.source=file:/dev/random
+
+#
+# A list of known strong SecureRandom implementations.
+#
+# To help guide applications in selecting a suitable strong
+# java.security.SecureRandom implementation, Java distributions should
+# indicate a list of known strong implementations using the property.
+#
+# This is a comma-separated list of algorithm and/or algorithm:provider
+# entries.
+#
+securerandom.strongAlgorithms=NativePRNGBlocking:SUN,DRBG:SUN
+
+#
+# Sun provider DRBG configuration and default instantiation request.
+#
+# NIST SP 800-90Ar1 lists several DRBG mechanisms. Each can be configured
+# with a DRBG algorithm name, and can be instantiated with a security strength,
+# prediction resistance support, etc. This property defines the configuration
+# and the default instantiation request of "DRBG" SecureRandom implementations
+# in the SUN provider. (Other DRBG implementations can also use this property.)
+# Applications can request different instantiation parameters like security
+# strength, capability, personalization string using one of the
+# getInstance(...,SecureRandomParameters,...) methods with a
+# DrbgParameters.Instantiation argument, but other settings such as the
+# mechanism and DRBG algorithm names are not currently configurable by any API.
+#
+# Please note that the SUN implementation of DRBG always supports reseeding.
+#
+# The value of this property is a comma-separated list of all configurable
+# aspects. The aspects can appear in any order but the same aspect can only
+# appear at most once. Its BNF-style definition is:
+#
+# Value:
+# aspect { "," aspect }
+#
+# aspect:
+# mech_name | algorithm_name | strength | capability | df
+#
+# // The DRBG mechanism to use. Default "Hash_DRBG"
+# mech_name:
+# "Hash_DRBG" | "HMAC_DRBG" | "CTR_DRBG"
+#
+# // The DRBG algorithm name. The "SHA-***" names are for Hash_DRBG and
+# // HMAC_DRBG, default "SHA-256". The "AES-***" names are for CTR_DRBG,
+# // default "AES-128" when using the limited cryptographic or "AES-256"
+# // when using the unlimited.
+# algorithm_name:
+# "SHA-224" | "SHA-512/224" | "SHA-256" |
+# "SHA-512/256" | "SHA-384" | "SHA-512" |
+# "AES-128" | "AES-192" | "AES-256"
+#
+# // Security strength requested. Default "128"
+# strength:
+# "112" | "128" | "192" | "256"
+#
+# // Prediction resistance and reseeding request. Default "none"
+# // "pr_and_reseed" - Both prediction resistance and reseeding
+# // support requested
+# // "reseed_only" - Only reseeding support requested
+# // "none" - Neither prediction resistance not reseeding
+# // support requested
+# pr:
+# "pr_and_reseed" | "reseed_only" | "none"
+#
+# // Whether a derivation function should be used. only applicable
+# // to CTR_DRBG. Default "use_df"
+# df:
+# "use_df" | "no_df"
+#
+# Examples,
+# securerandom.drbg.config=Hash_DRBG,SHA-224,112,none
+# securerandom.drbg.config=CTR_DRBG,AES-256,192,pr_and_reseed,use_df
+#
+# The default value is an empty string, which is equivalent to
+# securerandom.drbg.config=Hash_DRBG,SHA-256,128,none
+#
+securerandom.drbg.config=
+
+#
+# Class to instantiate as the javax.security.auth.login.Configuration
+# provider.
+#
+login.configuration.provider=sun.security.provider.ConfigFile
+
+#
+# Default login configuration file
+#
+#login.config.url.1=file:${user.home}/.java.login.config
+
+#
+# Class to instantiate as the system Policy. This is the name of the class
+# that will be used as the Policy object. The system class loader is used to
+# locate this class.
+#
+policy.provider=sun.security.provider.PolicyFile
+
+# The default is to have a single system-wide policy file,
+# and a policy file in the user's home directory.
+#
+policy.url.1=file:${java.home}/conf/security/java.policy
+policy.url.2=file:${user.home}/.java.policy
+
+# whether or not we expand properties in the policy file
+# if this is set to false, properties (${...}) will not be expanded in policy
+# files.
+#
+policy.expandProperties=true
+
+# whether or not we allow an extra policy to be passed on the command line
+# with -Djava.security.policy=somefile. Comment out this line to disable
+# this feature.
+#
+policy.allowSystemProperty=true
+
+# whether or not we look into the IdentityScope for trusted Identities
+# when encountering a 1.1 signed JAR file. If the identity is found
+# and is trusted, we grant it AllPermission. Note: the default policy
+# provider (sun.security.provider.PolicyFile) does not support this property.
+#
+policy.ignoreIdentityScope=false
+
+#
+# Default keystore type.
+#
+keystore.type=pkcs12
+
+#
+# Controls compatibility mode for JKS and PKCS12 keystore types.
+#
+# When set to 'true', both JKS and PKCS12 keystore types support loading
+# keystore files in either JKS or PKCS12 format. When set to 'false' the
+# JKS keystore type supports loading only JKS keystore files and the PKCS12
+# keystore type supports loading only PKCS12 keystore files.
+#
+keystore.type.compat=true
+
+#
+# List of comma-separated packages that start with or equal this string
+# will cause a security exception to be thrown when passed to the
+# SecurityManager::checkPackageAccess method unless the corresponding
+# RuntimePermission("accessClassInPackage."+package) has been granted.
+#
+package.access=sun.misc.,\
+ sun.reflect.,\
+ org.GNOME.Accessibility.
+
+#
+# List of comma-separated packages that start with or equal this string
+# will cause a security exception to be thrown when passed to the
+# SecurityManager::checkPackageDefinition method unless the corresponding
+# RuntimePermission("defineClassInPackage."+package) has been granted.
+#
+# By default, none of the class loaders supplied with the JDK call
+# checkPackageDefinition.
+#
+package.definition=sun.misc.,\
+ sun.reflect.
+
+#
+# Determines whether this properties file can be appended to
+# or overridden on the command line via -Djava.security.properties
+#
+security.overridePropertiesFile=true
+
+#
+# Determines the default key and trust manager factory algorithms for
+# the javax.net.ssl package.
+#
+ssl.KeyManagerFactory.algorithm=BCFKS
+ssl.TrustManagerFactory.algorithm=PKIX
+
+#
+# The Java-level namelookup cache policy for successful lookups:
+#
+# any negative value: caching forever
+# any positive value: the number of seconds to cache an address for
+# zero: do not cache
+#
+# default value is forever (FOREVER). For security reasons, this
+# caching is made forever when a security manager is set. When a security
+# manager is not set, the default behavior in this implementation
+# is to cache for 30 seconds.
+#
+# NOTE: setting this to anything other than the default value can have
+# serious security implications. Do not set it unless
+# you are sure you are not exposed to DNS spoofing attack.
+#
+#networkaddress.cache.ttl=-1
+
+# The Java-level namelookup cache policy for failed lookups:
+#
+# any negative value: cache forever
+# any positive value: the number of seconds to cache negative lookup results
+# zero: do not cache
+#
+# In some Microsoft Windows networking environments that employ
+# the WINS name service in addition to DNS, name service lookups
+# that fail may take a noticeably long time to return (approx. 5 seconds).
+# For this reason the default caching policy is to maintain these
+# results for 10 seconds.
+#
+networkaddress.cache.negative.ttl=10
+
+#
+# Properties to configure OCSP for certificate revocation checking
+#
+
+# Enable OCSP
+#
+# By default, OCSP is not used for certificate revocation checking.
+# This property enables the use of OCSP when set to the value "true".
+#
+# NOTE: SocketPermission is required to connect to an OCSP responder.
+#
+# Example,
+# ocsp.enable=true
+
+#
+# Location of the OCSP responder
+#
+# By default, the location of the OCSP responder is determined implicitly
+# from the certificate being validated. This property explicitly specifies
+# the location of the OCSP responder. The property is used when the
+# Authority Information Access extension (defined in RFC 5280) is absent
+# from the certificate or when it requires overriding.
+#
+# Example,
+# ocsp.responderURL=http://ocsp.example.net:80
+
+#
+# Subject name of the OCSP responder's certificate
+#
+# By default, the certificate of the OCSP responder is that of the issuer
+# of the certificate being validated. This property identifies the certificate
+# of the OCSP responder when the default does not apply. Its value is a string
+# distinguished name (defined in RFC 2253) which identifies a certificate in
+# the set of certificates supplied during cert path validation. In cases where
+# the subject name alone is not sufficient to uniquely identify the certificate
+# then both the "ocsp.responderCertIssuerName" and
+# "ocsp.responderCertSerialNumber" properties must be used instead. When this
+# property is set then those two properties are ignored.
+#
+# Example,
+# ocsp.responderCertSubjectName=CN=OCSP Responder, O=XYZ Corp
+
+#
+# Issuer name of the OCSP responder's certificate
+#
+# By default, the certificate of the OCSP responder is that of the issuer
+# of the certificate being validated. This property identifies the certificate
+# of the OCSP responder when the default does not apply. Its value is a string
+# distinguished name (defined in RFC 2253) which identifies a certificate in
+# the set of certificates supplied during cert path validation. When this
+# property is set then the "ocsp.responderCertSerialNumber" property must also
+# be set. When the "ocsp.responderCertSubjectName" property is set then this
+# property is ignored.
+#
+# Example,
+# ocsp.responderCertIssuerName=CN=Enterprise CA, O=XYZ Corp
+
+#
+# Serial number of the OCSP responder's certificate
+#
+# By default, the certificate of the OCSP responder is that of the issuer
+# of the certificate being validated. This property identifies the certificate
+# of the OCSP responder when the default does not apply. Its value is a string
+# of hexadecimal digits (colon or space separators may be present) which
+# identifies a certificate in the set of certificates supplied during cert path
+# validation. When this property is set then the "ocsp.responderCertIssuerName"
+# property must also be set. When the "ocsp.responderCertSubjectName" property
+# is set then this property is ignored.
+#
+# Example,
+# ocsp.responderCertSerialNumber=2A:FF:00
+
+#
+# Policy for failed Kerberos KDC lookups:
+#
+# When a KDC is unavailable (network error, service failure, etc), it is
+# put inside a blacklist and accessed less often for future requests. The
+# value (case-insensitive) for this policy can be:
+#
+# tryLast
+# KDCs in the blacklist are always tried after those not on the list.
+#
+# tryLess[:max_retries,timeout]
+# KDCs in the blacklist are still tried by their order in the configuration,
+# but with smaller max_retries and timeout values. max_retries and timeout
+# are optional numerical parameters (default 1 and 5000, which means once
+# and 5 seconds). Please notes that if any of the values defined here is
+# more than what is defined in krb5.conf, it will be ignored.
+#
+# Whenever a KDC is detected as available, it is removed from the blacklist.
+# The blacklist is reset when krb5.conf is reloaded. You can add
+# refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is
+# reloaded whenever a JAAS authentication is attempted.
+#
+# Example,
+# krb5.kdc.bad.policy = tryLast
+# krb5.kdc.bad.policy = tryLess:2,2000
+#
+krb5.kdc.bad.policy = tryLast
+
+#
+# Algorithm restrictions for certification path (CertPath) processing
+#
+# In some environments, certain algorithms or key lengths may be undesirable
+# for certification path building and validation. For example, "MD2" is
+# generally no longer considered to be a secure hash algorithm. This section
+# describes the mechanism for disabling algorithms based on algorithm name
+# and/or key length. This includes algorithms used in certificates, as well
+# as revocation information such as CRLs and signed OCSP Responses.
+# The syntax of the disabled algorithm string is described as follows:
+# DisabledAlgorithms:
+# " DisabledAlgorithm { , DisabledAlgorithm } "
+#
+# DisabledAlgorithm:
+# AlgorithmName [Constraint] { '&' Constraint }
+#
+# AlgorithmName:
+# (see below)
+#
+# Constraint:
+# KeySizeConstraint | CAConstraint | DenyAfterConstraint |
+# UsageConstraint
+#
+# KeySizeConstraint:
+# keySize Operator KeyLength
+#
+# Operator:
+# <= | < | == | != | >= | >
+#
+# KeyLength:
+# Integer value of the algorithm's key length in bits
+#
+# CAConstraint:
+# jdkCA
+#
+# DenyAfterConstraint:
+# denyAfter YYYY-MM-DD
+#
+# UsageConstraint:
+# usage [TLSServer] [TLSClient] [SignedJAR]
+#
+# The "AlgorithmName" is the standard algorithm name of the disabled
+# algorithm. See "Java Cryptography Architecture Standard Algorithm Name
+# Documentation" for information about Standard Algorithm Names. Matching
+# is performed using a case-insensitive sub-element matching rule. (For
+# example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and
+# "ECDSA" for signatures.) If the assertion "AlgorithmName" is a
+# sub-element of the certificate algorithm name, the algorithm will be
+# rejected during certification path building and validation. For example,
+# the assertion algorithm name "DSA" will disable all certificate algorithms
+# that rely on DSA, such as NONEwithDSA, SHA1withDSA. However, the assertion
+# will not disable algorithms related to "ECDSA".
+#
+# A "Constraint" defines restrictions on the keys and/or certificates for
+# a specified AlgorithmName:
+#
+# KeySizeConstraint:
+# keySize Operator KeyLength
+# The constraint requires a key of a valid size range if the
+# "AlgorithmName" is of a key algorithm. The "KeyLength" indicates
+# the key size specified in number of bits. For example,
+# "RSA keySize <= 1024" indicates that any RSA key with key size less
+# than or equal to 1024 bits should be disabled, and
+# "RSA keySize < 1024, RSA keySize > 2048" indicates that any RSA key
+# with key size less than 1024 or greater than 2048 should be disabled.
+# This constraint is only used on algorithms that have a key size.
+#
+# CAConstraint:
+# jdkCA
+# This constraint prohibits the specified algorithm only if the
+# algorithm is used in a certificate chain that terminates at a marked
+# trust anchor in the lib/security/cacerts keystore. If the jdkCA
+# constraint is not set, then all chains using the specified algorithm
+# are restricted. jdkCA may only be used once in a DisabledAlgorithm
+# expression.
+# Example: To apply this constraint to SHA-1 certificates, include
+# the following: "SHA1 jdkCA"
+#
+# DenyAfterConstraint:
+# denyAfter YYYY-MM-DD
+# This constraint prohibits a certificate with the specified algorithm
+# from being used after the date regardless of the certificate's
+# validity. JAR files that are signed and timestamped before the
+# constraint date with certificates containing the disabled algorithm
+# will not be restricted. The date is processed in the UTC timezone.
+# This constraint can only be used once in a DisabledAlgorithm
+# expression.
+# Example: To deny usage of RSA 2048 bit certificates after Feb 3 2020,
+# use the following: "RSA keySize == 2048 & denyAfter 2020-02-03"
+#
+# UsageConstraint:
+# usage [TLSServer] [TLSClient] [SignedJAR]
+# This constraint prohibits the specified algorithm for
+# a specified usage. This should be used when disabling an algorithm
+# for all usages is not practical. 'TLSServer' restricts the algorithm
+# in TLS server certificate chains when server authentication is
+# performed. 'TLSClient' restricts the algorithm in TLS client
+# certificate chains when client authentication is performed.
+# 'SignedJAR' constrains use of certificates in signed jar files.
+# The usage type follows the keyword and more than one usage type can
+# be specified with a whitespace delimiter.
+# Example: "SHA1 usage TLSServer TLSClient"
+#
+# When an algorithm must satisfy more than one constraint, it must be
+# delimited by an ampersand '&'. For example, to restrict certificates in a
+# chain that terminate at a distribution provided trust anchor and contain
+# RSA keys that are less than or equal to 1024 bits, add the following
+# constraint: "RSA keySize <= 1024 & jdkCA".
+#
+# All DisabledAlgorithms expressions are processed in the order defined in the
+# property. This requires lower keysize constraints to be specified
+# before larger keysize constraints of the same algorithm. For example:
+# "RSA keySize < 1024 & jdkCA, RSA keySize < 2048".
+#
+# Note: The algorithm restrictions do not apply to trust anchors or
+# self-signed certificates.
+#
+# Note: This property is currently used by Oracle's PKIX implementation. It
+# is not guaranteed to be examined and used by other implementations.
+#
+# Example:
+# jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048
+#
+#
+jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \
+ RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224
+
+#
+# Algorithm restrictions for signed JAR files
+#
+# In some environments, certain algorithms or key lengths may be undesirable
+# for signed JAR validation. For example, "MD2" is generally no longer
+# considered to be a secure hash algorithm. This section describes the
+# mechanism for disabling algorithms based on algorithm name and/or key length.
+# JARs signed with any of the disabled algorithms or key sizes will be treated
+# as unsigned.
+#
+# The syntax of the disabled algorithm string is described as follows:
+# DisabledAlgorithms:
+# " DisabledAlgorithm { , DisabledAlgorithm } "
+#
+# DisabledAlgorithm:
+# AlgorithmName [Constraint] { '&' Constraint }
+#
+# AlgorithmName:
+# (see below)
+#
+# Constraint:
+# KeySizeConstraint | DenyAfterConstraint
+#
+# KeySizeConstraint:
+# keySize Operator KeyLength
+#
+# DenyAfterConstraint:
+# denyAfter YYYY-MM-DD
+#
+# Operator:
+# <= | < | == | != | >= | >
+#
+# KeyLength:
+# Integer value of the algorithm's key length in bits
+#
+# Note: This property is currently used by the JDK Reference
+# implementation. It is not guaranteed to be examined and used by other
+# implementations.
+#
+# See "jdk.certpath.disabledAlgorithms" for syntax descriptions.
+#
+jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \
+ DSA keySize < 1024
+
+#
+# Algorithm restrictions for Secure Socket Layer/Transport Layer Security
+# (SSL/TLS/DTLS) processing
+#
+# In some environments, certain algorithms or key lengths may be undesirable
+# when using SSL/TLS/DTLS. This section describes the mechanism for disabling
+# algorithms during SSL/TLS/DTLS security parameters negotiation, including
+# protocol version negotiation, cipher suites selection, peer authentication
+# and key exchange mechanisms.
+#
+# Disabled algorithms will not be negotiated for SSL/TLS connections, even
+# if they are enabled explicitly in an application.
+#
+# For PKI-based peer authentication and key exchange mechanisms, this list
+# of disabled algorithms will also be checked during certification path
+# building and validation, including algorithms used in certificates, as
+# well as revocation information such as CRLs and signed OCSP Responses.
+# This is in addition to the jdk.certpath.disabledAlgorithms property above.
+#
+# See the specification of "jdk.certpath.disabledAlgorithms" for the
+# syntax of the disabled algorithm string.
+#
+# Note: The algorithm restrictions do not apply to trust anchors or
+# self-signed certificates.
+#
+# Note: This property is currently used by the JDK Reference implementation.
+# It is not guaranteed to be examined and used by other implementations.
+#
+# Example:
+# jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048
+jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \
+ EC keySize < 224, 3DES_EDE_CBC, anon, NULL
+
+#
+# Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS)
+# processing in JSSE implementation.
+#
+# In some environments, a certain algorithm may be undesirable but it
+# cannot be disabled because of its use in legacy applications. Legacy
+# algorithms may still be supported, but applications should not use them
+# as the security strength of legacy algorithms are usually not strong enough
+# in practice.
+#
+# During SSL/TLS security parameters negotiation, legacy algorithms will
+# not be negotiated unless there are no other candidates.
+#
+# The syntax of the legacy algorithms string is described as this Java
+# BNF-style:
+# LegacyAlgorithms:
+# " LegacyAlgorithm { , LegacyAlgorithm } "
+#
+# LegacyAlgorithm:
+# AlgorithmName (standard JSSE algorithm name)
+#
+# See the specification of security property "jdk.certpath.disabledAlgorithms"
+# for the syntax and description of the "AlgorithmName" notation.
+#
+# Per SSL/TLS specifications, cipher suites have the form:
+# SSL_KeyExchangeAlg_WITH_CipherAlg_MacAlg
+# or
+# TLS_KeyExchangeAlg_WITH_CipherAlg_MacAlg
+#
+# For example, the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA uses RSA as the
+# key exchange algorithm, AES_128_CBC (128 bits AES cipher algorithm in CBC
+# mode) as the cipher (encryption) algorithm, and SHA-1 as the message digest
+# algorithm for HMAC.
+#
+# The LegacyAlgorithm can be one of the following standard algorithm names:
+# 1. JSSE cipher suite name, e.g., TLS_RSA_WITH_AES_128_CBC_SHA
+# 2. JSSE key exchange algorithm name, e.g., RSA
+# 3. JSSE cipher (encryption) algorithm name, e.g., AES_128_CBC
+# 4. JSSE message digest algorithm name, e.g., SHA
+#
+# See SSL/TLS specifications and "Java Cryptography Architecture Standard
+# Algorithm Name Documentation" for information about the algorithm names.
+#
+# Note: If a legacy algorithm is also restricted through the
+# jdk.tls.disabledAlgorithms property or the
+# java.security.AlgorithmConstraints API (See
+# javax.net.ssl.SSLParameters.setAlgorithmConstraints()),
+# then the algorithm is completely disabled and will not be negotiated.
+#
+# Note: This property is currently used by the JDK Reference implementation.
+# It is not guaranteed to be examined and used by other implementations.
+# There is no guarantee the property will continue to exist or be of the
+# same syntax in future releases.
+#
+# Example:
+# jdk.tls.legacyAlgorithms=DH_anon, DES_CBC, SSL_RSA_WITH_RC4_128_MD5
+#
+jdk.tls.legacyAlgorithms= \
+ K_NULL, C_NULL, M_NULL, \
+ DH_anon, ECDH_anon, \
+ RC4_128, RC4_40, DES_CBC, DES40_CBC, \
+ 3DES_EDE_CBC
+
+#
+# The pre-defined default finite field Diffie-Hellman ephemeral (DHE)
+# parameters for Transport Layer Security (SSL/TLS/DTLS) processing.
+#
+# In traditional SSL/TLS/DTLS connections where finite field DHE parameters
+# negotiation mechanism is not used, the server offers the client group
+# parameters, base generator g and prime modulus p, for DHE key exchange.
+# It is recommended to use dynamic group parameters. This property defines
+# a mechanism that allows you to specify custom group parameters.
+#
+# The syntax of this property string is described as this Java BNF-style:
+# DefaultDHEParameters:
+# DefinedDHEParameters { , DefinedDHEParameters }
+#
+# DefinedDHEParameters:
+# "{" DHEPrimeModulus , DHEBaseGenerator "}"
+#
+# DHEPrimeModulus:
+# HexadecimalDigits
+#
+# DHEBaseGenerator:
+# HexadecimalDigits
+#
+# HexadecimalDigits:
+# HexadecimalDigit { HexadecimalDigit }
+#
+# HexadecimalDigit: one of
+# 0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f
+#
+# Whitespace characters are ignored.
+#
+# The "DefinedDHEParameters" defines the custom group parameters, prime
+# modulus p and base generator g, for a particular size of prime modulus p.
+# The "DHEPrimeModulus" defines the hexadecimal prime modulus p, and the
+# "DHEBaseGenerator" defines the hexadecimal base generator g of a group
+# parameter. It is recommended to use safe primes for the custom group
+# parameters.
+#
+# If this property is not defined or the value is empty, the underlying JSSE
+# provider's default group parameter is used for each connection.
+#
+# If the property value does not follow the grammar, or a particular group
+# parameter is not valid, the connection will fall back and use the
+# underlying JSSE provider's default group parameter.
+#
+# Note: This property is currently used by OpenJDK's JSSE implementation. It
+# is not guaranteed to be examined and used by other implementations.
+#
+# Example:
+# jdk.tls.server.defaultDHEParameters=
+# { \
+# FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 \
+# 29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD \
+# EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245 \
+# E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED \
+# EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381 \
+# FFFFFFFF FFFFFFFF, 2}
+
+#
+# TLS key limits on symmetric cryptographic algorithms
+#
+# This security property sets limits on algorithms key usage in TLS 1.3.
+# When the amount of data encrypted exceeds the algorithm value listed below,
+# a KeyUpdate message will trigger a key change. This is for symmetric ciphers
+# with TLS 1.3 only.
+#
+# The syntax for the property is described below:
+# KeyLimits:
+# " KeyLimit { , KeyLimit } "
+#
+# WeakKeyLimit:
+# AlgorithmName Action Length
+#
+# AlgorithmName:
+# A full algorithm transformation.
+#
+# Action:
+# KeyUpdate
+#
+# Length:
+# The amount of encrypted data in a session before the Action occurs
+# This value may be an integer value in bytes, or as a power of two, 2^29.
+#
+# KeyUpdate:
+# The TLS 1.3 KeyUpdate handshake process begins when the Length amount
+# is fulfilled.
+#
+# Note: This property is currently used by OpenJDK's JSSE implementation. It
+# is not guaranteed to be examined and used by other implementations.
+#
+jdk.tls.keyLimits=AES/GCM/NoPadding KeyUpdate 2^37
+
+#
+# Cryptographic Jurisdiction Policy defaults
+#
+# Import and export control rules on cryptographic software vary from
+# country to country. By default, Java provides two different sets of
+# cryptographic policy files[1]:
+#
+# unlimited: These policy files contain no restrictions on cryptographic
+# strengths or algorithms
+#
+# limited: These policy files contain more restricted cryptographic
+# strengths
+#
+# The default setting is determined by the value of the "crypto.policy"
+# Security property below. If your country or usage requires the
+# traditional restrictive policy, the "limited" Java cryptographic
+# policy is still available and may be appropriate for your environment.
+#
+# If you have restrictions that do not fit either use case mentioned
+# above, Java provides the capability to customize these policy files.
+# The "crypto.policy" security property points to a subdirectory
+# within <java-home>/conf/security/policy/ which can be customized.
+# Please see the <java-home>/conf/security/policy/README.txt file or consult
+# the Java Security Guide/JCA documentation for more information.
+#
+# YOU ARE ADVISED TO CONSULT YOUR EXPORT/IMPORT CONTROL COUNSEL OR ATTORNEY
+# TO DETERMINE THE EXACT REQUIREMENTS.
+#
+# [1] Please note that the JCE for Java SE, including the JCE framework,
+# cryptographic policy files, and standard JCE providers provided with
+# the Java SE, have been reviewed and approved for export as mass market
+# encryption item by the US Bureau of Industry and Security.
+#
+# Note: This property is currently used by the JDK Reference implementation.
+# It is not guaranteed to be examined and used by other implementations.
+#
+crypto.policy=unlimited
+
+#
+# The policy for the XML Signature secure validation mode. The mode is
+# enabled by setting the property "org.jcp.xml.dsig.secureValidation" to
+# true with the javax.xml.crypto.XMLCryptoContext.setProperty() method,
+# or by running the code with a SecurityManager.
+#
+# Policy:
+# Constraint {"," Constraint }
+# Constraint:
+# AlgConstraint | MaxTransformsConstraint | MaxReferencesConstraint |
+# ReferenceUriSchemeConstraint | KeySizeConstraint | OtherConstraint
+# AlgConstraint
+# "disallowAlg" Uri
+# MaxTransformsConstraint:
+# "maxTransforms" Integer
+# MaxReferencesConstraint:
+# "maxReferences" Integer
+# ReferenceUriSchemeConstraint:
+# "disallowReferenceUriSchemes" String { String }
+# KeySizeConstraint:
+# "minKeySize" KeyAlg Integer
+# OtherConstraint:
+# "noDuplicateIds" | "noRetrievalMethodLoops"
+#
+# For AlgConstraint, Uri is the algorithm URI String that is not allowed.
+# See the XML Signature Recommendation for more information on algorithm
+# URI Identifiers. For KeySizeConstraint, KeyAlg is the standard algorithm
+# name of the key type (ex: "RSA"). If the MaxTransformsConstraint,
+# MaxReferencesConstraint or KeySizeConstraint (for the same key type) is
+# specified more than once, only the last entry is enforced.
+#
+# Note: This property is currently used by the JDK Reference implementation. It
+# is not guaranteed to be examined and used by other implementations.
+#
+jdk.xml.dsig.secureValidationPolicy=\
+ disallowAlg http://www.w3.org/TR/1999/REC-xslt-19991116,\
+ disallowAlg http://www.w3.org/2001/04/xmldsig-more#rsa-md5,\
+ disallowAlg http://www.w3.org/2001/04/xmldsig-more#hmac-md5,\
+ disallowAlg http://www.w3.org/2001/04/xmldsig-more#md5,\
+ maxTransforms 5,\
+ maxReferences 30,\
+ disallowReferenceUriSchemes file http https,\
+ minKeySize RSA 1024,\
+ minKeySize DSA 1024,\
+ minKeySize EC 224,\
+ noDuplicateIds,\
+ noRetrievalMethodLoops
+
+#
+# Serialization process-wide filter
+#
+# A filter, if configured, is used by java.io.ObjectInputStream during
+# deserialization to check the contents of the stream.
+# A filter is configured as a sequence of patterns, each pattern is either
+# matched against the name of a class in the stream or defines a limit.
+# Patterns are separated by ";" (semicolon).
+# Whitespace is significant and is considered part of the pattern.
+#
+# If the system property jdk.serialFilter is also specified, it supersedes
+# the security property value defined here.
+#
+# If a pattern includes a "=", it sets a limit.
+# If a limit appears more than once the last value is used.
+# Limits are checked before classes regardless of the order in the
+# sequence of patterns.
+# If any of the limits are exceeded, the filter status is REJECTED.
+#
+# maxdepth=value - the maximum depth of a graph
+# maxrefs=value - the maximum number of internal references
+# maxbytes=value - the maximum number of bytes in the input stream
+# maxarray=value - the maximum array length allowed
+#
+# Other patterns, from left to right, match the class or package name as
+# returned from Class.getName.
+# If the class is an array type, the class or package to be matched is the
+# element type.
+# Arrays of any number of dimensions are treated the same as the element type.
+# For example, a pattern of "!example.Foo", rejects creation of any instance or
+# array of example.Foo.
+#
+# If the pattern starts with "!", the status is REJECTED if the remaining
+# pattern is matched; otherwise the status is ALLOWED if the pattern matches.
+# If the pattern contains "/", the non-empty prefix up to the "/" is the
+# module name;
+# if the module name matches the module name of the class then
+# the remaining pattern is matched with the class name.
+# If there is no "/", the module name is not compared.
+# If the pattern ends with ".**" it matches any class in the package and all
+# subpackages.
+# If the pattern ends with ".*" it matches any class in the package.
+# If the pattern ends with "*", it matches any class with the pattern as a
+# prefix.
+# If the pattern is equal to the class name, it matches.
+# Otherwise, the status is UNDECIDED.
+#
+#jdk.serialFilter=pattern;pattern
+
+#
+# RMI Registry Serial Filter
+#
+# The filter pattern uses the same format as jdk.serialFilter.
+# This filter can override the builtin filter if additional types need to be
+# allowed or rejected from the RMI Registry or to decrease limits but not
+# to increase limits.
+# If the limits (maxdepth, maxrefs, or maxbytes) are exceeded, the object is rejected.
+#
+# Each non-array type is allowed or rejected if it matches one of the patterns,
+# evaluated from left to right, and is otherwise allowed. Arrays of any
+# component type, including subarrays and arrays of primitives, are allowed.
+#
+# Array construction of any component type, including subarrays and arrays of
+# primitives, are allowed unless the length is greater than the maxarray limit.
+# The filter is applied to each array element.
+#
+# Note: This property is currently used by the JDK Reference implementation.
+# It is not guaranteed to be examined and used by other implementations.
+#
+# The built-in filter allows subclasses of allowed classes and
+# can approximately be represented as the pattern:
+#
+#sun.rmi.registry.registryFilter=\
+# maxarray=1000000;\
+# maxdepth=20;\
+# java.lang.String;\
+# java.lang.Number;\
+# java.lang.reflect.Proxy;\
+# java.rmi.Remote;\
+# sun.rmi.server.UnicastRef;\
+# sun.rmi.server.RMIClientSocketFactory;\
+# sun.rmi.server.RMIServerSocketFactory;\
+# java.rmi.activation.ActivationID;\
+# java.rmi.server.UID
+#
+# RMI Distributed Garbage Collector (DGC) Serial Filter
+#
+# The filter pattern uses the same format as jdk.serialFilter.
+# This filter can override the builtin filter if additional types need to be
+# allowed or rejected from the RMI DGC.
+#
+# Note: This property is currently used by the JDK Reference implementation.
+# It is not guaranteed to be examined and used by other implementations.
+#
+# The builtin DGC filter can approximately be represented as the filter pattern:
+#
+#sun.rmi.transport.dgcFilter=\
+# java.rmi.server.ObjID;\
+# java.rmi.server.UID;\
+# java.rmi.dgc.VMID;\
+# java.rmi.dgc.Lease;\
+# maxdepth=5;maxarray=10000
+
+# CORBA ORBIorTypeCheckRegistryFilter
+# Type check enhancement for ORB::string_to_object processing
+#
+# An IOR type check filter, if configured, is used by an ORB during
+# an ORB::string_to_object invocation to check the veracity of the type encoded
+# in the ior string.
+#
+# The filter pattern consists of a semi-colon separated list of class names.
+# The configured list contains the binary class names of the IDL interface types
+# corresponding to the IDL stub class to be instantiated.
+# As such, a filter specifies a list of IDL stub classes that will be
+# allowed by an ORB when an ORB::string_to_object is invoked.
+# It is used to specify a white list configuration of acceptable
+# IDL stub types which may be contained in a stringified IOR
+# parameter passed as input to an ORB::string_to_object method.
+#
+# Note: This property is currently used by the JDK Reference implementation.
+# It is not guaranteed to be examined and used by other implementations.
+#
+#com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name
+
+#
+# JCEKS Encrypted Key Serial Filter
+#
+# This filter, if configured, is used by the JCEKS KeyStore during the
+# deserialization of the encrypted Key object stored inside a key entry.
+# If not configured or the filter result is UNDECIDED (i.e. none of the patterns
+# matches), the filter configured by jdk.serialFilter will be consulted.
+#
+# If the system property jceks.key.serialFilter is also specified, it supersedes
+# the security property value defined here.
+#
+# The filter pattern uses the same format as jdk.serialFilter. The default
+# pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type,
+# and javax.crypto.spec.SecretKeySpec and rejects all the others.
+jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep;\
+ java.base/java.security.KeyRep$Type;java.base/javax.crypto.spec.SecretKeySpec;!*
+
+#
+# Enhanced exception message information
+#
+# By default, exception messages should not include potentially sensitive
+# information such as file names, host names, or port numbers. This property
+# accepts one or more comma separated values, each of which represents a
+# category of enhanced exception message information to enable. Values are
+# case-insensitive. Leading and trailing whitespaces, surrounding each value,
+# are ignored. Unknown values are ignored.
+#
+# NOTE: Use caution before setting this property. Setting this property
+# exposes sensitive information in Exceptions, which could, for example,
+# propagate to untrusted code or be emitted in stack traces that are
+# inadvertently disclosed and made accessible over a public network.
+#
+# The categories are:
+#
+# hostInfo - IOExceptions thrown by java.net.Socket and the socket types in the
+# java.nio.channels package will contain enhanced exception
+# message information
+#
+# The property setting in this file can be overridden by a system property of
+# the same name, with the same syntax and possible values.
+#
+#jdk.includeInExceptions=hostInfo
+
+#
+# Policies for distrusting Certificate Authorities (CAs).
+#
+# This is a comma separated value of one or more case-sensitive strings, each
+# of which represents a policy for determining if a CA should be distrusted.
+# The supported values are:
+#
+# SYMANTEC_TLS : Distrust TLS Server certificates anchored by a Symantec
+# root CA and issued after April 16, 2019 unless issued by one of the
+# following subordinate CAs which have a later distrust date:
+# 1. Apple IST CA 2 - G1, SHA-256 fingerprint:
+# AC2B922ECFD5E01711772FEA8ED372DE9D1E2245FCE3F57A9CDBEC77296A424B
+# Distrust after December 31, 2019.
+# 2. Apple IST CA 8 - G1, SHA-256 fingerprint:
+# A4FE7C7F15155F3F0AEF7AAA83CF6E06DEB97CA3F909DF920AC1490882D488ED
+# Distrust after December 31, 2019.
+#
+# Leading and trailing whitespace surrounding each value are ignored.
+# Unknown values are ignored. If the property is commented out or set to the
+# empty String, no policies are enforced.
+#
+# Note: This property is currently used by the JDK Reference implementation.
+# It is not guaranteed to be supported by other SE implementations. Also, this
+# property does not override other security properties which can restrict
+# certificates such as jdk.tls.disabledAlgorithms or
+# jdk.certpath.disabledAlgorithms; those restrictions are still enforced even
+# if this property is not enabled.
+#
+jdk.security.caDistrustPolicies=SYMANTEC_TLS
+
=====================================
dev-resources/ssl/alternate-ca.pem
=====================================
@@ -1,32 +1,32 @@
-----BEGIN CERTIFICATE-----
-MIIFkTCCA3mgAwIBAgIJAL1Ogx7eNBo3MA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
+MIIFkTCCA3mgAwIBAgIJANGPM8FNFV15MA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJPUjERMA8GA1UEBwwIUG9ydGxhbmQxFDASBgNVBAoM
-C1B1cHBldCwgSW5jMRIwEAYDVQQDDAlhbHRlcm5hdGUwHhcNMTgwMzI4MjAzNzEz
-WhcNMjMwMzI3MjAzNzEzWjBXMQswCQYDVQQGEwJVUzELMAkGA1UECAwCT1IxETAP
+C1B1cHBldCwgSW5jMRIwEAYDVQQDDAlhbHRlcm5hdGUwHhcNMjMwNzA2MjE1NTAy
+WhcNMjgwNzA0MjE1NTAyWjBXMQswCQYDVQQGEwJVUzELMAkGA1UECAwCT1IxETAP
BgNVBAcMCFBvcnRsYW5kMRQwEgYDVQQKDAtQdXBwZXQsIEluYzESMBAGA1UEAwwJ
-YWx0ZXJuYXRlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwpLfuk4g
-/WpLxw2v6eCPs48kniZ4tuW+QtrZYoQVE3H2saf1j97oHvKw1DsJ48x9qmyTxKOF
-4FDp4xAoOthEWbMnxydO8KREVDUbUiJTV2Dd6VTzyNxlCA7mtGVCNscgKZZwE83Q
-EnOVH6/q1dMcgHeXPzwSsTqh+4Ej8fgUmvuoK4Z2VGBGry5DQdSwdhNi+iFhtrBb
-BeaNGQ9G2oRiTPBh1sOqgO84HjPvHk8/lM6LZS41b+M/jEpSieU2LpwB9t+wVG34
-TdS0UkL65yaPEX7Guv887Rvhe0uuk6FZnUP/8L0Wxy3M9yZyLV62GjGyfj9IMo6B
-R8sxprp5D9jMunHgHuZpE0wG4TpQ2xVt5sDkuCworaUlNhBBr+ibBC+q9k28Xyt1
-c6A5Ck4Mvfuu+WFoPE0GcnmjoazL5lDjZot25ooVFOaHldFMV4qnPBskwJTZG64K
-VtBPV7vtI0BD49BdQIj4EVPXDOO0PgdzZShavS+YtldHrNmi1NT6aI4OWV7wwSvM
-KAHNqtWT4KcNN+q7VgfyyCBqmI+o82BIErmwEpWNlsMy8s9rRJEtnU+6p6SyNIj8
-kkOHH4bla+Jg3FseXGq1T5WzZlHzU8I5/mZo8wXuoj1rRBEywdgGBP2QZncaFrLm
-3DaQMbAGU5cHqdCA32wAtPRJmY9pPywr67UCAwEAAaNgMF4wHQYDVR0OBBYEFMgD
-SWTq5JTmQXKlhSr69e/u6xoYMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgGG
-MB8GA1UdIwQYMBaAFMgDSWTq5JTmQXKlhSr69e/u6xoYMA0GCSqGSIb3DQEBCwUA
-A4ICAQBl5O/yAWTxQW2Oede15AEfie6sYfAXFIRlWhh5OR0ZgThNDSiQQ/QcMRmT
-OZzuwjZ0VtH5wIDwFyU9a7yegB6AORwnZC7BzWWmu8o/JOPAv5cDDmvBOak29CUu
-Jy3ppdWMdxaoHTw33e+YqjaTZMKbpXtA5WmWZbGOKpfUQnNdqoiDEuPapcZByTiW
-5mgzXR4WbYgBO0gtLu6b5K4Rq9IkU2b1H4CTpmhin7Rr8nYbrfnIx+rKg7fAa58a
-SozSuA6LmAmgUrrz6IxvqwONrCEiTpZBvZldiYiyBfnOw9C8HdUAhVgS2bdp78uy
-ARrbmcfNU/VIiKMP92dySNRxaQJPPYs+ufafQhItKEkyeljBbFpgMXZmnGLrwedc
-VTQyCEY6KDxc+29qfefE0aBh27GlJJ+Q2NodSHpjAefrQ/iDScYHjrHXXq22DKzP
-K6lLTH+ELLgeVw0vv4JYCowTQXG++Lazo1m27gzhXWU81SODZLe35d4pf+Wi5M/N
-JEoj9ZLzR124IpfCVGcvGeaIiFvRo5n94vHbA/HAspwLWgIfepGdtHA0yuku7hbT
-tM9zW3w2uwMa3I1kfpkpiOiS1xlOw+yScVcDZzn2hCvXK662wNInuYI6O+Lv3Een
-rZ//M9KhnsCLJb3d4DJMMm5RsXnUnApC6I64DilKORLaAY3j9w==
+YWx0ZXJuYXRlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApZv7/XJ7
+zlRovxHiaEusnA2tE9xrGN9hrgk4REUZpPmM+dthhqKyesJHuPSt0SPMhX8j93yF
+8KRKHBsYdmSXiDB57w70q33Yb/V4fMv/IWRMuKJda/sS0kuMXmmsZIxQpaD5tOrm
+rfPaO6606OANBmjZdnDWpeCwna/87ojf0LLE77RvtYpbgwauGfMYU5Ae5mNSX19h
+T+e+qZPUIuxBFoHFXBXxothe/SeU7MvGPC1fRdKREhr1o19cMbchF2HS3LH37oIi
+cF3PRye80TMrr3fHHzExHEGhjUgDqnmSXPIRmP7S+Ma5tNnxxAp6LBw2dAdNWb6h
+FAZyIsU8F2z64aUA059J6PUivqRaeL05lrbqqdBCnEnEHqkex9b5NsCIx/o5O5Lj
+xVBSNW3u7kq+ooEcejENi16IWUSv+FVdtmzrWLAdu9nOrLLy2JRuvy6XVOxvkeiI
+RZ4HSxxTanN1jkUa6mW9NTpaJN4XSOVgQLRZZTekQWB2ySdrD/YxoE2H0PWQEn4L
+pW5WsONAx3okOEIV4NlBzqrsnDydwarJ9ABx3+3mCS7+rM5gC06xjON9fINjqA98
+Rgdn0MWvseN0TUDlaWQ5bZO6RTQcunm9hingjCDrSfssr8GJlJaOClSHZ/o53OzH
+Fp5L5bmf2BicV00OtaMWgyAxrjUjZohHooECAwEAAaNgMF4wHQYDVR0OBBYEFCjz
+hhlZIbhvIhBvYYuDZhPLpJ7nMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgGG
+MB8GA1UdIwQYMBaAFCjzhhlZIbhvIhBvYYuDZhPLpJ7nMA0GCSqGSIb3DQEBCwUA
+A4ICAQCJYsyfuMr9NJKPKxopd/1GjLsJGkdiWHmIdzfc6RDaiLEpZ2UnU5G1CUzn
+SXclD6SmCASfq/jqBMLyq/BOXAXBGOgslVxOBNTVSY5yFiEip+r9y29Erd+ngLr5
+ITE6+m8Wsq8fIShtcwEughKG2Gu6Lz8NQw+W5eLx+zztcKSZpnRv6zcBV/8sNmA2
+SRlNZwb2yJ6NlPJN8JdqnCn1Od+vxGhcg5aT7AqDQRQ46O2GbDS8f4y4Y0Di6tue
+muhR2CeCNJcDgLhCpZJ//35Ga2cZFz2ZDAdvsGGNdrePy6nK8/DZLTA4KiiZMei9
+D/i/gdfCdv5l/BJJzRCrG1J5BRz7j1OOyNZ3K+E3tTrU46aTt2N667KWmOQeFRI9
+A3KoBNIRV7assmFWSbuKU7bVhb4+7QHTx9NGOEil8gF/1gpbZ8/AvkwH0ba0au3d
+5HPFXJkPis0L3FzHkNSS92pqNWPUyhxpIfcepD8/M9lqkHp+znUfm5drPWLbbO66
+MwgnFOyJR6leXR+ftbnPQ0k5wxETykjapddbbIuBH/uFsTgZYshOJWqvf0iPwYiu
+dTy7hv6Qovl+t93KILqL2nBxRzw117FkzuM50sSd6Uj933y5Am3eVn6ola8bXYHS
+P3qRiCFZQ3t5R/jLZqQKaxynLy/k9zDgNCYMQfvLh4fVdOu4eg==
-----END CERTIFICATE-----
=====================================
dev-resources/ssl/ca.pem
=====================================
@@ -1,32 +1,32 @@
-----BEGIN CERTIFICATE-----
-MIIFizCCA3OgAwIBAgIJAPpFWxUE/Xu5MA0GCSqGSIb3DQEBCwUAMFQxCzAJBgNV
+MIIFizCCA3OgAwIBAgIJAODrD7R4ZHmfMA0GCSqGSIb3DQEBCwUAMFQxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJPUjERMA8GA1UEBwwIUG9ydGxhbmQxFDASBgNVBAoM
-C1B1cHBldCwgSW5jMQ8wDQYDVQQDDAZwdXBwZXQwHhcNMTgwMzI4MjAzNzA3WhcN
-MjMwMzI3MjAzNzA3WjBUMQswCQYDVQQGEwJVUzELMAkGA1UECAwCT1IxETAPBgNV
+C1B1cHBldCwgSW5jMQ8wDQYDVQQDDAZwdXBwZXQwHhcNMjMwNzA2MjE1NTAyWhcN
+MjgwNzA0MjE1NTAyWjBUMQswCQYDVQQGEwJVUzELMAkGA1UECAwCT1IxETAPBgNV
BAcMCFBvcnRsYW5kMRQwEgYDVQQKDAtQdXBwZXQsIEluYzEPMA0GA1UEAwwGcHVw
-cGV0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxeXxq5PH2Y8B6tC3
-dSTJ91Cnp6Jc+jKtzSEbUAZzAt610wz66qByv+K9XZr6nMAnmnQktFe9TwcHjUq7
-M7aDpAehLq7nziQTKGqz9fEkVftyBUo/GHkmsukVtPGR3kqbKu4J/YiIXRL1paBN
-rYOOJQ9PxbsKhPw8qsUe3bu0QOrpj+e0c+XVI7zau2EdWuI3QKYjVh+h6qo8dEe8
-8Hn2R2fSKcU1M8OIBD4qcnuitFv7nCc+kzHRZfIje1iJaBT0ya7K/hbAr9Tc8xeu
-Wh5LC9fsu3Ar9fYuKDUKoQVf6DLYvQl0r7piK5N3kqYIVpCKgM3zpGS7OTfdG0E+
-FBWTDY/SF397wWrWiyUwVI8j7YvQ3lRs7mDQH8TocNdgD3D/LJRYljtYTfG29m/B
-8zit/aQRW3PzvxCfnGRQSy3hfx/T1zk+Oo6Y/02j3MXGNv+ODlz5V1YtWh+Bl6dF
-1Y0TAEthqkx6xNZV3Re6r4ymrTnL2jApi/TPhJxxqZG2cCNnide5LKGUdZhOnklq
-JAO58dex3eKDByA6dfkKo5kzTvTPhq8d02LoaK8+npajGqR8setDv1UrkoF7hysz
-EB0669PYmkmorrGm31fcTnS9bZlhJysbCSmECcKdfCNlC9qU1tl2xq5QpHxHod2n
-BDCxfhahpkVn1rA6YoycEoNKQJkCAwEAAaNgMF4wHQYDVR0OBBYEFGzsV9cwJ1oY
-hEygrcaxbmCSFsrfMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgGGMB8GA1Ud
-IwQYMBaAFGzsV9cwJ1oYhEygrcaxbmCSFsrfMA0GCSqGSIb3DQEBCwUAA4ICAQCs
-l1sQspqkAMUu9juVBRSmK1qkfrop1cr3U3sVzcWvE177lyskQ2I2vcetjt+5HN8o
-YPami02qA5E9IUY2VxDfI1aceSNdldC6kaxdQhDFrd2C2hZVmn8niSH8ssSduN1d
-+JmYSSD2noQ+ZnqI+80xI/2lA6nDqIHezbR088znL2w2WLhaUHFuBxCXrt7hPvdU
-KjF+4viyOrz84RLDSsqBlapq8n4k9ZSklgK+U4bptTOsIl3E9YZf1sELLMCpJ9Ky
-BniZPj7ON4gOdGIR90iWCxYca1QLqmqFEXqEFgru7lgoXRYJ+OA046ruFI1ox13y
-LG9VEMMcb9jYtK7oZ5fVXmGzdfOw7x3LGyLK9GoPsLUuLdW06XSgvNu68g5HJDmb
-trDOPLIn2MjkaEHNgMcJyFkh4i7pOUFSOVF4IDJ/kGKBY1E0G7WfHuSJ/OfTvt0g
-uvr7xE0/GpEshpTvOTlVoEaf3UibDEUYQ6kjhXgG0UEl1UKY6qLtUb/mmnLQ+axm
-UhjKsZuORun5n5dHAS0uNpkHvIONM9ajRE4YWcqWSLGQSFk+3+hI0hVwMdvJY3GC
-UwRoSoLfwRPGBPlCdVVEm3ALnErerOOIFLRzffT4ljzZPoaUnizIcuH163L8yi0B
-N5XusBTCEP8DMJPVws4OnBLXK3xc7Sm8/LtKkDP0Hg==
+cGV0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt4RXxU3eocqhDD+F
+zVU2vnELSEcwoHgD5VS2dtzjlEwv4g8L4Kds/FDoyaZt1846zvEC8+NkLIYypn0L
+PMuR0bO3ZAf4YTnSYYeleds1gKWjetgku2Wz4G/isfRQMYGanE7YyhvQA6MHnPy2
+Kvpy7TpQ0c+YVOdVto06I+Y36YDlljztfFEmAmyUb9kW1+SAwo/Je/PjJ5Gdav47
+rsTEASDe4D2ciVIZLbY8d1zeYvFPNW7K6yWCqxnJJxiNu2ODnO7T9O/jUz6RbzDH
+qbpK6dQoKW0ZCBge7wcQaNLROuAEdXP2zmMXFGIJcpSlYynKo+puVMkdReVWccRB
+VbBybkblhPXmVzd4ZFGbjkiQysLdPSfSfEs/r+r2+yfwzGAgMGmnK6+eIL6zO9PD
+nLEmXV7zCQXz6Ja8Nhx0RHdFBkHdbbxymM5GzIhglVKbx6NTIrnaAWciu5gGv+bI
+hpoIXelh2G87xFoASJbW0b0E6RWRGu7P4PwtEg7cgaUfC4d1auIa4uDv1oBSNYGD
+hd1WefKohJZMXWrCR0g9MEHO7Q0t1Ct7ZDXhRkBabcV6CZssixEY2MxsZvZ5n04m
+islnOvrVhgXM7rGvf3twzgcSAACIUxrf65E5+It6FpeM1bLi/Q/nty9z0GU2hZO8
+YedDSLhMacc97ga0NDoD+F5ms38CAwEAAaNgMF4wHQYDVR0OBBYEFMm/bWMZQQjp
+i8zVAim+VKMkIiYqMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgGGMB8GA1Ud
+IwQYMBaAFMm/bWMZQQjpi8zVAim+VKMkIiYqMA0GCSqGSIb3DQEBCwUAA4ICAQAT
+DlMpQSz1VnQH31Ez1ZFEhju0vzh2cVNvN5zB7+3NjYaYTfROWkOweoa+ZHi2uSuO
+x39mrBURLE4AsUhQYncmOi1EdPBoSUyBQcgVlurF8mfSpLkoo3+GiiBDOBTq6zip
+vQhOylmHfpUd/QdddHGhndmMxFMihIkJeqQY2p0NBRUNG/OeN/w9BNpW1yo7RZ9E
+yfeNnSmeMDFWLSMRVXBgd/Q0n5fjdCDKvATo6YcZAt5WO8h5SH86fBqJKg6dTwXf
+RvwX4c5fONTrUtkGHgxfTpRo6OVYMzG8AKJBqwtJha7vH1qXqPiwP5Wfr6OSL7rI
+G1sNPptHD9z7jTxM5eDtR/6YPf6NVwsp4VyuFawr7Lzo0NTAiBhZ87pv9YrsdlLo
+5uEK0EZC0r9icPKIKqKe1DTBD+Vg0krqm+tCqFP0ma7DVC0POd9FSvOEHBP11O6J
+5KZNIpZXQM8bljlrZCUumH6A6jLSs1YlLXb6H1mDD3b+jHfLnLpwp4+bIVH5myTo
+ZO2QI77eZgHRAoBu8J6j1eLO0ug4PYVzePD0kzghBe5WTMvYoOHU6J1+p4WgjWcQ
+0K5UifVcKOvU+l7OLc5iNUc9bE1+rTm0TIxLkuUJApmConBE+dZis+vfoNR1iHni
+JADCb2Dn56aa8nkhHjqaKx+T8ez/dSZzvR//2Q4lCw==
-----END CERTIFICATE-----
=====================================
dev-resources/ssl/cert.pem
=====================================
@@ -1,25 +1,25 @@
-----BEGIN CERTIFICATE-----
-MIIEJzCCAg8CCQD8aSTWNpzalTANBgkqhkiG9w0BAQsFADBUMQswCQYDVQQGEwJV
+MIIEJzCCAg8CCQCgGYbfS6RdDzANBgkqhkiG9w0BAQsFADBUMQswCQYDVQQGEwJV
UzELMAkGA1UECAwCT1IxETAPBgNVBAcMCFBvcnRsYW5kMRQwEgYDVQQKDAtQdXBw
-ZXQsIEluYzEPMA0GA1UEAwwGcHVwcGV0MB4XDTE4MDMyODIwMzcwOFoXDTIzMDMy
-NzIwMzcwOFowVzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk9SMREwDwYDVQQHDAhQ
+ZXQsIEluYzEPMA0GA1UEAwwGcHVwcGV0MB4XDTIzMDcwNjIxNTUwMloXDTI4MDcw
+NDIxNTUwMlowVzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk9SMREwDwYDVQQHDAhQ
b3J0bGFuZDEUMBIGA1UECgwLUHVwcGV0LCBJbmMxEjAQBgNVBAMMCWxvY2FsaG9z
-dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJlVv11OI5RGAH+Jn813
-KpafOS6Fcbamy8TjAf/70JRL5rjHdGHrbMZXpe/ueRV/DiHosn+yxgqqgrl51eeq
-8obEuTN+wamrz98HzWE7cxJjrtuoj++nWSo6Yux4hi3qJwFf+C+BwJBXQSfc2dFy
-78r4dbLOILmQ1C8MG/OMrHdhwjyRL0ewrH93W5IYRA/+m6skcKeg5ifyLiqNfLmo
-uz4lV5sniN5WBA5FYF9uOxcp4499ZWh1aa8tE/j4QP6Lu7uv4xYb55Vmppr7uyXm
-ge9b1CF5j+po4nbtD6VMPu0A9/6wtjK1G1bvRsg/jRxmY+ZovK7OsiVbC0CTN7UF
-WXcCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEADIUXJEXj7mTfriw96F4aeYxCywqX
-Nnn/IFKXzW2AKJz8bvFgUJNPMjBhdv+vZs8c1xD1ecIzwI2y66QSA2jePMOCVOfD
-qG67+Lcm57pChdPpi5UfLVZ8oKrIdhyhQF2vrXa4MmbcLiZXxe9DyAXUYrN8QFGL
-DFN7YyEe9rv6RYQuxptH4n8dLcvgKCPcJODjs/NhIHr+lto82wAGcd20/LOKe5iu
-K+CmwmDPh6qczNg4zfMUSxVKO9DTgI27oSlmTCV0hJroF5zGr3/puLs91gG0e4+l
-nCwEfO1vBKTggJ2IXHo99ho5cgf2uocPVLdZ6/141RvpjwMeHD+wnZSMRYOLEhQ3
-Ehj6nN6OJkCY4IWov9/XYzzPc+aL30HkdfkKkB41Cj38dZVjQLn3OaxYcoiJgztd
-t/lqsvZR4+O8AiPVBEwtwj/4Bcj2rpbeQEKQJDqHDzndXcTPLYze69qIUzX5/KnW
-ymCuKn0/ZR/cn+QIjsciQgjylZlk4sQwmAn9i85XQoFHEvk6jSBFMv5g1JuPEEUp
-fFtjykpve12hPShrZBXvcBV1Hv3gIEzPqbZDKZ3j7RpNBQzAJTzumBR8dCLxBaun
-qqgkciLc33f6DMmdKmAaxKIixZfF6/dt1P0DKAMZCP1i7QniTAWqurxRe5gse1M8
-aHhWU1capUmR8zk=
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKUl/MYa3jHp2BiLidWZ
+3NmUCSQV7gBUYQkYYAW+XzrSmACXzR/fzwNp4C1ypyHcvNbo/pcB6G6zfnrrfKlD
+XIgSXz0ty/YGYb04taiYdeF5myvXdd9moY60gTxmWYGlaJuj/9qm6Z2+46VZ5eF0
+nrZxWLatM7iIDcFWyvWlPdiiyQiYBerbxCn58LCwLxAucfrIxMsd2QtWRisNpnPE
+N7pZHjEBKghsgCzTsT1fOdVz2PY9VapCJJb78GavcNpY0RLTJLdRsmJ8490W5ruw
+meU0K35ZNuDMRC1IaqeedPxQzpNQATMN5IMho5QipG3DtLsKWKPV7XgAWp5+2AsO
+WekCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEANyLM5dVjjnxMEwX/zsVv1KZwfHp+
+j7+RtfO1/zmmnaqIiQYq5MyYS6dCXZRMZsCLN0RKAOkn+IAi3QXRqoY6g9IrgmOq
+d+6QRfw2mJtkiAyrQ1IrpRhXcfsudJcTuqtQKez3pTfyQrMItzPQmRR10X854PT9
+JhQUuf+KSyoLoCO7VxETb14CNkPeDD8Ae7CUUWap86zmwxW4ssTLxfye5y4fwI0a
+I0b08AY5LBqk8J+yA314DXNQRC7SzLHxGYLigY3r6UN47yNINO7WSG1E/KA37rlR
+bkOnJpmwhv9uONlf7TWz0XR1i9b6utm2L2QSYPutOVMYlZq56qkW5wjODXUUR8J0
+eMp5s4IiSEIsyvTyN+jPoGGWYIDMdZvhKKl4pF3j8Zyu3P1tMGFJIGYSuo4HRmp4
+phYjW9NYzRqrFhldsO37r3y0E3t+Z93GshN2O1lyQCEPLQAQIKYje/1YRPxjxSfE
+t3UeshgJJ+AjVU8KbCXR3N2U2LyS1ZswlL7MB5ug61F3UBPBTmwm3+Wj/g1ysk+S
+awjSzwDZiwXOBThP/xXrGWj64hbOC6a0DdoulMf3jy5YMmdDrYlODTdFyCe/ESoX
+q0sSCh22ZuaPWzXmQ+WCxgW/skzlwxrTXLeF9/b26/slnIS9cReCKXPYc4U9A7vF
+HCACDPww8NaTkeQ=
-----END CERTIFICATE-----
=====================================
dev-resources/ssl/key.pem
=====================================
@@ -1,27 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIEogIBAAKCAQEAmVW/XU4jlEYAf4mfzXcqlp85LoVxtqbLxOMB//vQlEvmuMd0
-Yetsxlel7+55FX8OIeiyf7LGCqqCuXnV56ryhsS5M37BqavP3wfNYTtzEmOu26iP
-76dZKjpi7HiGLeonAV/4L4HAkFdBJ9zZ0XLvyvh1ss4guZDULwwb84ysd2HCPJEv
-R7Csf3dbkhhED/6bqyRwp6DmJ/IuKo18uai7PiVXmyeI3lYEDkVgX247Fynjj31l
-aHVpry0T+PhA/ou7u6/jFhvnlWammvu7JeaB71vUIXmP6mjidu0PpUw+7QD3/rC2
-MrUbVu9GyD+NHGZj5mi8rs6yJVsLQJM3tQVZdwIDAQABAoIBADkhS7WWAYejNVhP
-jKzfM4z/Miz1J1Mofk+TTRF1X1eBmCtMlT5Omy6jRX5J2e96cWeM7cTKdSNQOHim
-vl4cwVQZQ++90KZJD6BHpewOXGeDoIjTGx3tujkTm/wDQ+sjjPjkKvJ4Y6jj+bDC
-hp2VN2bmf+PpDSRWo9gLqPZreW7Y9/prMPkv5kScodDIlH+UxMZ6Ycg7uIWAIq5m
-5Z0jt/+/vAe2aSLbIo7kCuVvzsaRKel0D4Y+C70m9Ts0Iz5Hq5uUAXNml4bOCa2W
-NFtySutOmRT6BVN6IOSH7ZQI78681KM7Zs2GYIt0dTHKxPeIO51OpUP7QSTDyTlS
-iIZH12ECgYEAyrYIuvlpDvdA9paAZWYmL5WFakCpI7bf4wg1iClRICFIb6DlsRAF
-rO7zdx9nSf2iT/+1WgHk0kGkf5e0o0BMZr27Zxo3CmU4NlnX2GhbhqGyqKmBF4l0
-G/gthuX5+p+2wvEDnM9iycgkO1dNCU8fXnEaapPguPHyfSy7bGP4T58CgYEAwaTR
-2WOjGuUs/wq1BeSl0oWO1bqNUT4sxjuCf+AyJRazebZAvmZ0ryrTPq4EwkYhJFxz
-ozTwD0TpMl+Hx2cIBOwtlzpQ0bmXFd1gAH9zDZzcz2xHnyzQaamJGYhhIoaRcUtS
-dBt+Sb0J0QV3C+cjuEzga7NiKsTwQspPa0YkxykCgYA2CHGpTSQI3jVNxW4yGRli
-o6ttWBD9uRhSjvSd981tEBIb1zqCiO/KWeNBxHgmy9nBEzsG4+xXczHi5NA8l74F
-wNs8L0uulK54JliXkbGb4Gwb8xq66GOvtOaFx7Vrbbksm0vIN6twd83Yl3usWI/W
-/7T35bUH904YuZy31qnwpwKBgF9Cpbk7utFQTIJq0gLEKI8YBNw/maWN4JjkTZ56
-vDBiqogFkHQaEuzZNHJxSQYJWeR5VqnDMRVR4SZWuITvupIxXXw3w+poUlr/PGsC
-R6c6s6WWruUvNpfEPx3AaYiCiqohU76qh8XeqSWaeqXwXzIbH4vcAz7nAwrYW5l6
-OD2BAoGATIqTh8LXs7nzzyLA84A4L3XPptipceTKTNHJJ3Yf70g6SW87+YAXvoIs
-abRXH7Km99UwzQPJZyF3IDvycxvEoBTTXUUKWHQvqOCwBvqPKTK1Wd2hj2BAiE4G
-B+8BHUsKQHbn8re2KfQ9rCKehdlVv3oDRHSi8sjAmv07hit4Acg=
+MIIEogIBAAKCAQEApSX8xhreMenYGIuJ1Znc2ZQJJBXuAFRhCRhgBb5fOtKYAJfN
+H9/PA2ngLXKnIdy81uj+lwHobrN+eut8qUNciBJfPS3L9gZhvTi1qJh14XmbK9d1
+32ahjrSBPGZZgaVom6P/2qbpnb7jpVnl4XSetnFYtq0zuIgNwVbK9aU92KLJCJgF
+6tvEKfnwsLAvEC5x+sjEyx3ZC1ZGKw2mc8Q3ulkeMQEqCGyALNOxPV851XPY9j1V
+qkIklvvwZq9w2ljREtMkt1GyYnzj3Rbmu7CZ5TQrflk24MxELUhqp550/FDOk1AB
+Mw3kgyGjlCKkbcO0uwpYo9XteABann7YCw5Z6QIDAQABAoIBAGr2mqx41HcBnVvw
+bLqzKA6oSe9cYMVH4X1xkyfFMIq5wYeIymudmsf8OB1XiBZvkMOlLtgBfVjN2tqk
+UR6UKYdcVuEaG2NiqMVUyJvE+3ypNa6Eo6ypHXR/RsEnDUviJUnBQ8KLnv3zmCAN
+hM2sqetCqJHQxpH7VOVnYJcPimoXokMgAk9G/q4mAyZZqpvqME5crxxaK8E2wESp
+QYCEJXpTSsXhyeJQcqa0+1oZzCj9iSYvG4oJ3HJ14gJZVn9Gqr5ESWaNXd1vrv/n
+NCX1RzvJphEqekSshyvkgS68bYzXWqxGngbtBxba6GuHmhqfelBGj5axFlKRvYCe
+cIa+Yf0CgYEA2ocpyhxbG7bxQZ4A5ZHEUMKeO1nN+qBKAYcmh/0QLnFy2XVAAL4O
+vDhILfABQs2a5hN8ZfzCf2dWGcZ6J9p8DoIYfz/89kp8hjXpJNy7A8XwyeAw9sSJ
+5z/9AP3gAQYnFxVb19QT/ZBCls4IYUz22n4y5jrKayuQfsmTOnOzIUMCgYEAwXeX
+olhHs3YQOIxwz8or/AdTp1s+H/SL+o7xFlv84qctoiEULhvSmWMdS4tugzlEiSzZ
+fxCooqg8lnKwkRjS6URaB+sAfZIv7I+vwyeSEqtAKV+TZTyTJ+fKSZm9afXhTIDe
+/BlBxJ7lHASHpMBaqsArIOlF6FV+xegcjPfzP2MCgYBM1OzqdKHL0rxsN6NVE7UU
+N/juIRr8nVKnyt7PPThtO9IHhuPj3u7LWnZ2QEYROLzXW86HBSFVLf3lvhTA4l5v
+s2ntg4/rADFb9qRsI3dVUkjgkYRlnqBlv+eya5BQi9s+kHHkJlqI8imXYAUuQKMi
+GvDGZbE5kO2SxkiPapJ2hQKBgCeED9q/AVYshT+nn9sxRi6iKHoEbvoD7xtsWt3g
+SBTbZLy62O5aDHf8AJ3PivEOn2sNWBdWBbvDdSydnGbmlR3EMkdvvpfnZhaBerr3
+uCRMCjzpIqgI6V27QFwsJL4h1LTVlbYUSpSoh89jNXl3OI2r1qNQQlEkNVKjCEHa
+2zpVAoGAVVYrahxnn+jzUAkj62Z2DFZkWvf/c788vXp+gIWva7g1CoP822QukdoR
+po71a4oNeTyeOh0w055YrM8xHGjZt6ySzBK2dLVjyaQqbIz8gOzYsAwKit0mmeNw
+ZE/xL20E2hmkdh54mr2qeMzjf0D4vZR/FjXGyYaxrqhrrlSWraU=
-----END RSA PRIVATE KEY-----
=====================================
jenkins/deploy.sh deleted
=====================================
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-set -x
-
-git fetch --tags
-
-lein test
-echo "Tests passed!"
-
-lein release
-echo "Release plugin successful, pushing changes to git"
-
-git push origin --tags HEAD:$BRANCH
-
-echo "git push successful."
=====================================
project.clj
=====================================
@@ -1,29 +1,52 @@
-(defproject puppetlabs/http-client "2.1.1"
+(def i18n-version "1.0.4")
+(def slf4j-version "2.0.18")
+
+(defproject org.openvoxproject/http-client "2.3.1"
:description "HTTP client wrapper"
:license {:name "Apache License, Version 2.0"
:url "http://www.apache.org/licenses/LICENSE-2.0.html"}
:min-lein-version "2.9.1"
- :parent-project {:coords [puppetlabs/clj-parent "5.2.11"]
- :inherit [:managed-dependencies]}
-
;; Abort when version ranges or version conflicts are detected in
;; dependencies. Also supports :warn to simply emit warnings.
;; requires lein 2.2.0+.
:pedantic? :abort
- :dependencies [[org.clojure/clojure]
+ ;; Generally, try to keep version pins in :managed-dependencies and the libraries
+ ;; this project actually uses in :dependencies, inheriting the version from
+ ;; :managed-dependencies. This prevents endless version conflicts due to deps of deps.
+ ;; Renovate should keep the versions largely in sync between projects.
+ :managed-dependencies [[org.clojure/clojure "1.12.5"]
+ [cheshire "6.2.0"]
+ [commons-codec "1.22.0"]
+ [commons-io "2.22.0"]
+ [io.dropwizard.metrics/metrics-core "3.2.6"]
+ [org.apache.httpcomponents/httpasyncclient "4.1.5"]
+ [org.bouncycastle/bcpkix-jdk18on "1.84"]
+ [org.bouncycastle/bcpkix-fips "1.0.8"]
+ [org.bouncycastle/bc-fips "1.0.2.6"]
+ [org.bouncycastle/bctls-fips "1.0.19"]
+ [org.openvoxproject/i18n ~i18n-version]
+ [org.openvoxproject/kitchensink "3.5.7" :classifier "test"]
+ [org.openvoxproject/ring-middleware "2.2.0"]
+ [org.openvoxproject/ssl-utils "3.6.4"]
+ [org.openvoxproject/trapperkeeper "5.0.2"]
+ [org.openvoxproject/trapperkeeper "5.0.2" :classifier "test"]
+ [org.openvoxproject/trapperkeeper-webserver "12.0.3"]
+ [org.openvoxproject/trapperkeeper-webserver "12.0.3" :classifier "test"]
+ [org.slf4j/slf4j-api ~slf4j-version]
+ [org.slf4j/jul-to-slf4j ~slf4j-version]
+ [prismatic/schema "1.4.1"]]
- [org.apache.httpcomponents/httpasyncclient]
- [prismatic/schema]
+ :dependencies [[org.clojure/clojure]
[commons-io]
[io.dropwizard.metrics/metrics-core]
-
- [puppetlabs/ssl-utils]
- [puppetlabs/i18n]
-
- [org.slf4j/jul-to-slf4j]]
+ [org.apache.httpcomponents/httpasyncclient]
+ [org.openvoxproject/ssl-utils]
+ [org.openvoxproject/i18n]
+ [org.slf4j/jul-to-slf4j]
+ [prismatic/schema]]
:source-paths ["src/clj"]
:java-source-paths ["src/java"]
@@ -36,48 +59,56 @@
:profiles {:provided {:dependencies [[org.bouncycastle/bcpkix-jdk18on]]}
:defaults {:dependencies [[cheshire]
- [puppetlabs/kitchensink :classifier "test"]
- [puppetlabs/trapperkeeper]
- [puppetlabs/trapperkeeper :classifier "test"]
- [puppetlabs/trapperkeeper-webserver-jetty9]
- [puppetlabs/trapperkeeper-webserver-jetty9 :classifier "test"]
- [puppetlabs/ring-middleware]]
+ [org.openvoxproject/kitchensink :classifier "test"]
+ [org.openvoxproject/trapperkeeper]
+ [org.openvoxproject/trapperkeeper :classifier "test"]]
:resource-paths ["dev-resources"]
:jvm-opts ["-Djava.util.logging.config.file=dev-resources/logging.properties"]}
- :dev [:defaults
- {:dependencies [[org.bouncycastle/bcpkix-jdk18on]]}]
- :fips [:defaults
- {:dependencies [[org.bouncycastle/bcpkix-fips]
- [org.bouncycastle/bc-fips]
- [org.bouncycastle/bctls-fips]]
- ;; this only ensures that we run with the proper profiles
- ;; during testing. This JVM opt will be set in the puppet module
- ;; that sets up the JVM classpaths during installation.
- :jvm-opts ~(let [version (System/getProperty "java.version")
- [major minor _] (clojure.string/split version #"\.")
- unsupported-ex (ex-info "Unsupported major Java version. Expects 8 or 11."
- {:major major
- :minor minor})]
- (condp = (java.lang.Integer/parseInt major)
- 1 (if (= 8 (java.lang.Integer/parseInt minor))
- ["-Djava.security.properties==dev-resources/jdk8-fips-security"]
- (throw unsupported-ex))
- 11 ["-Djava.security.properties==dev-resources/jdk11-fips-security"]
- (throw unsupported-ex)))}]
+ :dev-deps {:dependencies [[org.bouncycastle/bcpkix-jdk18on]]}
+ :dev [:defaults :dev-deps :test]
+ :test {:pedantic? :warn
+ :dependencies [[org.openvoxproject/trapperkeeper-webserver]
+ [org.openvoxproject/trapperkeeper-webserver :classifier "test"]
+ [org.openvoxproject/ring-middleware]]}
+ :fips-deps {:dependencies [[org.bouncycastle/bcpkix-fips]
+ [org.bouncycastle/bc-fips]
+ [org.bouncycastle/bctls-fips]]
+ ;; this only ensures that we run with the proper profiles
+ ;; during testing. This JVM opt will be set in the puppet module
+ ;; that sets up the JVM classpaths during installation.
+ :jvm-opts ~(let [version (System/getProperty "java.version")
+ [major minor _] (clojure.string/split version #"\.")
+ unsupported-ex (ex-info "Unsupported major Java version. Expects 17, 21 or 25."
+ {:major major
+ :minor minor})]
+ (condp = (java.lang.Integer/parseInt major)
+ 17 ["-Djava.security.properties==dev-resources/jdk17-fips-security"]
+ 21 ["-Djava.security.properties==dev-resources/jdk21-fips-security"]
+ 25 ["-Djava.security.properties==dev-resources/jdk25-fips-security"]
+ (throw unsupported-ex)))}
+ :fips [:defaults :fips-deps]
:sources-jar {:java-source-paths ^:replace []
:jar-exclusions ^:replace []
:source-paths ^:replace ["src/clj" "src/java"]}}
:deploy-repositories [["releases" {:url "https://clojars.org/repo"
- :username :env/clojars_jenkins_username
- :password :env/clojars_jenkins_password
+ :username :env/CLOJARS_USERNAME
+ :password :env/CLOJARS_PASSWORD
:sign-releases false}]]
:lein-release {:scm :git
:deploy-via :lein-deploy}
- :plugins [[lein-parent "0.3.7"]
- [puppetlabs/i18n "0.8.0"]]
+ :plugins [[jonase/eastwood "1.4.3" :exclusions [org.clojure/clojure]]
+ [org.openvoxproject/i18n ~i18n-version]]
- :repositories [["puppet-releases" "https://artifactory.delivery.puppetlabs.net/artifactory/clojure-releases__local/"]
- ["puppet-snapshots" "https://artifactory.delivery.puppetlabs.net/artifactory/clojure-snapshots__local/"]])
+ :eastwood {:continue-on-exception true
+ :exclude-namespaces [;; linting this test throws and exception as test-utils/load-test-config
+ ;; requires the addition of the config in /testutils, excluding for now
+ puppetlabs.orchestrator.integration.migration-errors-test
+ ;; The BoltClient protocol has more than 20 functions and therefore an exception is thrown
+ ;; when compiling it for linting https://github.com/jonase/eastwood/issues/344
+ puppetlabs.orchestrator.bolt.client]
+ :exclude-linters [:no-ns-form-found :reflection :deprecations]
+ :ignored-faults {:def-in-def {puppetlabs.http.client.async-plaintext-test [{:line 278}]}}}
+)
=====================================
renovate.json
=====================================
@@ -0,0 +1,9 @@
+{
+ "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+ "addLabels": ["renovate", "dependencies"],
+ "assigneesFromCodeOwners": true,
+ "automerge": true,
+ "automergeType": "pr",
+ "dependencyDashboard": true,
+ "enabledManagers": ["leiningen"]
+}
=====================================
src/clj/puppetlabs/http/client/async.clj
=====================================
@@ -75,7 +75,7 @@
(schema/defn java-content-type->clj :- common/ContentType
[java-content-type :- (schema/maybe ContentType)]
- (if java-content-type
+ (when java-content-type
{:mime-type (.getMimeType java-content-type)
:charset (.getCharset java-content-type)}))
@@ -111,7 +111,8 @@
:post HttpMethod/POST
:put HttpMethod/PUT
:trace HttpMethod/TRACE
- (throw (IllegalArgumentException. ^String (trs "Unsupported request method: {0}" (:method opts))))))
+ (let [msg (trs "Unsupported request method: {0}" (:method opts))]
+ (throw (IllegalArgumentException. ^String msg)))))
(schema/defn url-uri-string->uri :- URI
[thing :- common/UrlOrUriOrString]
@@ -119,7 +120,7 @@
(= (type thing) URL) (.toURI thing)
(= (type thing) String) (-> (URIBuilder. ^String thing)
(.build))
- :default thing))
+ :else thing))
(schema/defn parse-url :- URI
[{:keys [url query-params]}]
=====================================
src/clj/puppetlabs/http/client/metrics.clj
=====================================
@@ -1,9 +1,10 @@
(ns puppetlabs.http.client.metrics
- (:require [schema.core :as schema]
- [puppetlabs.http.client.common :as common])
- (:import (com.puppetlabs.http.client.metrics Metrics$MetricType Metrics
- ClientMetricData)
- (com.codahale.metrics MetricRegistry)))
+ (:require [clojure.string :as clj-string]
+ [puppetlabs.http.client.common :as common]
+ [schema.core :as schema])
+ (:import (com.codahale.metrics MetricRegistry)
+ (com.puppetlabs.http.client.metrics ClientMetricData Metrics
+ Metrics$MetricType)))
(schema/defn get-base-metric-data :- common/BaseMetricData
[data :- ClientMetricData]
@@ -31,7 +32,7 @@
(defn uppercase-method
[method]
- (clojure.string/upper-case (name method)))
+ (clj-string/upper-case (name method)))
(defn build-metric-namespace
[metric-prefix server-id]
=====================================
src/java/com/puppetlabs/http/client/impl/JavaClient.java
=====================================
@@ -295,7 +295,23 @@ public class JavaClient {
try {
Map<String, String> headers = new HashMap<>();
for (Header h : httpResponse.getAllHeaders()) {
- headers.put(h.getName().toLowerCase(), h.getValue());
+ String headerName = h.getName().toLowerCase();
+ // the http specs allow for multiple headers with the same name,
+ // but unfortunately since headers are stored in a map, this isn't
+ // possible without breaking changes. This adds special casing for the
+ // Set-Cookie header, to add entries separated by newlines.
+ if (headerName.equals("set-cookie")) {
+ String headerValue = headers.get("set-cookie");
+ if (headerValue != null) {
+ headers.put(headerName, headerValue + "\n" + h.getValue());
+ }
+ else
+ {
+ headers.put(headerName, h.getValue());
+ }
+ } else {
+ headers.put(headerName.toLowerCase(), h.getValue());
+ }
}
String origContentEncoding = headers.get("content-encoding");
if (requestOptions.getDecompressBody()) {
@@ -328,6 +344,7 @@ public class JavaClient {
contentType,
callback);
} catch (Exception e) {
+ LOGGER.error("Processing successful request to {} raised '{}'", requestOptions.getUri().toString(), e.getMessage());
responseDeliveryDelegate.deliverResponse(requestOptions, e, callback);
}
}
@@ -463,11 +480,13 @@ public class JavaClient {
@Override
public void failed(Exception e) {
+ LOGGER.error("{} request to '{}' failed.", method.toString(), requestOptions.getUri().toString());
responseDeliveryDelegate.deliverResponse(requestOptions, e, callback);
}
@Override
public void cancelled() {
+ LOGGER.error("{} request to '{}' cancelled.", method.toString(), requestOptions.getUri().toString());
responseDeliveryDelegate.deliverResponse(requestOptions,
new HttpClientException("Request cancelled"),
callback);
=====================================
src/java/com/puppetlabs/http/client/impl/StreamingAsyncResponseConsumer.java
=====================================
@@ -1,10 +1,13 @@
package com.puppetlabs.http.client.impl;
+import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.entity.BasicHttpEntity;
import org.apache.http.nio.IOControl;
import org.apache.http.nio.client.methods.AsyncByteConsumer;
import org.apache.http.protocol.HttpContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import java.io.IOException;
import java.io.PipedInputStream;
@@ -18,6 +21,8 @@ public class StreamingAsyncResponseConsumer extends AsyncByteConsumer<HttpRespon
private volatile Deliverable<HttpResponse> promise;
private volatile Promise<IOException> ioExceptionPromise = new Promise<>();
+ private static final Logger LOGGER = LoggerFactory.getLogger(StreamingAsyncResponseConsumer.class);
+
public void setFinalResult(IOException ioException) {
ioExceptionPromise.deliver(ioException);
}
@@ -28,10 +33,16 @@ public class StreamingAsyncResponseConsumer extends AsyncByteConsumer<HttpRespon
@Override
protected void onResponseReceived(final HttpResponse response) throws IOException {
- PipedInputStream pis = new ExceptionInsertingPipedInputStream(ioExceptionPromise);
- pos = new PipedOutputStream();
- pos.connect(pis);
- ((BasicHttpEntity) response.getEntity()).setContent(pis);
+ HttpEntity entity = response.getEntity();
+ if (entity != null) {
+ PipedInputStream pis = new ExceptionInsertingPipedInputStream(ioExceptionPromise);
+ pos = new PipedOutputStream();
+ pos.connect(pis);
+ ((BasicHttpEntity) entity).setContent(pis);
+ } else {
+ // this can happen if the server sends no response, like with a 204.
+ LOGGER.debug("Null entity when processing response");
+ }
this.response = response;
promise.deliver(response);
}
=====================================
test/puppetlabs/http/client/async_plaintext_test.clj
=====================================
@@ -1,22 +1,22 @@
(ns puppetlabs.http.client.async-plaintext-test
- (:import (com.puppetlabs.http.client Async RequestOptions ClientOptions ResponseBodyType)
- (org.apache.http.impl.nio.client HttpAsyncClients)
- (java.net URI SocketTimeoutException ServerSocket URL)
- (java.util Locale)
- (java.util.concurrent CountDownLatch TimeUnit))
- (:require [clojure.test :refer :all]
- [clojure.set :as set]
- [puppetlabs.http.client.test-common :refer :all]
+ (:require [clojure.set :as set]
+ [clojure.test :refer :all]
+ [puppetlabs.http.client.async :as async]
+ [puppetlabs.http.client.common :as common]
+ [puppetlabs.http.client.test-common :as test-common]
[puppetlabs.i18n.core :as i18n]
[puppetlabs.trapperkeeper.core :as tk]
+ [puppetlabs.trapperkeeper.services.webserver.jetty-service :as jetty]
[puppetlabs.trapperkeeper.testutils.bootstrap :as testutils]
[puppetlabs.trapperkeeper.testutils.logging :as testlogging]
[puppetlabs.trapperkeeper.testutils.webserver :as testwebserver]
- [puppetlabs.trapperkeeper.services.webserver.jetty9-service :as jetty9]
- [puppetlabs.http.client.common :as common]
- [puppetlabs.http.client.async :as async]
- [schema.test :as schema-test]
- [ring.middleware.cookies :refer [wrap-cookies]]))
+ [ring.middleware.cookies :refer [wrap-cookies]]
+ [schema.test :as schema-test])
+ (:import (com.puppetlabs.http.client Async ClientOptions RequestOptions ResponseBodyType)
+ (java.net ServerSocket SocketTimeoutException URI URL)
+ (java.util Locale)
+ (java.util.concurrent CountDownLatch TimeUnit)
+ (org.apache.http.impl.nio.client HttpAsyncClients)))
(use-fixtures :once schema-test/validate-schemas)
@@ -71,7 +71,7 @@
(deftest persistent-async-client-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:port 10000}}
(testing "java async client"
(let [request-options (RequestOptions. (URI. "http://localhost:10000/hello/"))
@@ -171,7 +171,7 @@
(deftest java-api-cookie-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-cookie-service]
+ [jetty/jetty-service test-cookie-service]
{:webserver {:port 10000}}
(let [client (Async/createClient (ClientOptions.))]
(testing "Set a cookie using Java API"
@@ -184,7 +184,7 @@
(deftest clj-api-cookie-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-cookie-service]
+ [jetty/jetty-service test-cookie-service]
{:webserver {:port 10000}}
(let [client (async/create-client {})]
(testing "Set a cookie using Clojure API"
@@ -197,7 +197,7 @@
(deftest request-with-client-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:port 10000}}
(let [client (HttpAsyncClients/createDefault)
opts {:method :get :url "http://localhost:10000/hello/"}]
@@ -215,7 +215,7 @@
(deftest query-params-test-async
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-params-web-service]
+ [jetty/jetty-service test-common/test-params-web-service]
{:webserver {:port 8080}}
(testing "URI Query Parameters work with the Java client"
(let [client (Async/createClient (ClientOptions.))]
@@ -224,37 +224,37 @@
(URI. "http://localhost:8080/params?foo=bar&baz=lux"))
response (.get client request-options)]
(is (= 200 (.getStatus (.deref response))))
- (is (= queryparams (read-string (slurp (.getBody
- (.deref response)))))))
+ (is (= test-common/queryparams (read-string (slurp (.getBody
+ (.deref response)))))))
(finally
(.close client)))))
(testing "string URL Query Parameters work with the clojure client"
(with-open [client (async/create-client {})]
(let [opts {:method :get
:url "http://localhost:8080/params/"
- :query-params queryparams
+ :query-params test-common/queryparams
:as :text}
response (common/get client "http://localhost:8080/params" opts)]
(is (= 200 (:status @response)))
- (is (= queryparams (read-string (:body @response)))))))
+ (is (= test-common/queryparams (read-string (:body @response)))))))
(testing "URL based Query Parameters work with the clojure client"
(with-open [client (async/create-client {})]
(let [opts {:method :get
:url (URL. "http://localhost:8080/params/")
- :query-params queryparams
+ :query-params test-common/queryparams
:as :text}
response (common/get client "http://localhost:8080/params" opts)]
(is (= 200 (:status @response)))
- (is (= queryparams (read-string (:body @response)))))))
+ (is (= test-common/queryparams (read-string (:body @response)))))))
(testing "URI based Query Parameters work with the clojure client"
(with-open [client (async/create-client {})]
(let [opts {:method :get
:url (.toURI (URL. "http://localhost:8080/params/"))
- :query-params queryparams
+ :query-params test-common/queryparams
:as :text}
response (common/get client "http://localhost:8080/params" opts)]
(is (= 200 (:status @response)))
- (is (= queryparams (read-string (:body @response)))))))
+ (is (= test-common/queryparams (read-string (:body @response)))))))
(testing "string URL Query Parameters can be set directly in the URL"
(with-open [client (async/create-client {})]
(let [response (common/get client
@@ -267,19 +267,20 @@
(with-open [client (async/create-client {})]
(let [response (common/get client
"http://localhost:8080/params?paramone=one&foo=lux"
- query-options)]
+ test-common/query-options)]
(is (= 200 (:status @response)))
- (is (= queryparams (read-string (:body @response))))))))))
+ (is (= test-common/queryparams (read-string (:body @response))))))))))
(defn create-redirect-web-service
[state]
+ #_{:clj-kondo/ignore [:inline-def]}
(tk/defservice redirect-web-service-with-state
[[:WebserverService add-ring-handler]]
(init [this context]
(add-ring-handler
(fn
- [{:keys [uri headers] :as req}]
+ [{:keys [uri headers]}]
(try
(swap! state #(conj % {:uri uri :headers headers}))
(condp = uri
@@ -287,24 +288,24 @@
:headers {"Location" "http://localhost:8082/world"}
:body ""}
"/hello/foo" {:status 302
- :headers {"Location" "/hello/bar"}
- :body ""}
+ :headers {"Location" "/hello/bar"}
+ :body ""}
"/hello/bar" {:status 200 :body "It's me, I'm still here ...and I'm still me."}
{:status 404 :body "D'oh"})
- (catch Throwable e
- (prn e))))
+ (catch Throwable e
+ (prn e))))
"/hello"
{:server-id :hello})
(add-ring-handler
(fn
- [{:keys [uri headers] :as req}]
+ [{:keys [uri headers]}]
(try
(swap! state #(conj % {:uri uri :headers headers}))
(condp = uri
"/world" {:status 200 :body "Hello, World!"}
{:status 404 :body "D'oh"})
- (catch Throwable e
- (prn e))))
+ (catch Throwable e
+ (prn e))))
"/world"
{:server-id :world})
context)))
@@ -323,7 +324,7 @@
"WWW-Authenticate", "Proxy-Authorization", "Proxy-Authenticate"}]
(create-redirect-web-service state)
(testutils/with-app-with-config app
- [jetty9/jetty9-service redirect-web-service-with-state]
+ [jetty/jetty-service redirect-web-service-with-state]
{:webserver {:hello {:port 8081} :world {:port 8082}}}
(testing "default redirect policy does not include authorization headers"
(let [client (Async/createClient (ClientOptions.))
@@ -448,7 +449,7 @@
(deftest redirect-test-async
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service redirect-web-service]
+ [jetty/jetty-service test-common/redirect-web-service]
{:webserver {:port 8080}}
(testing (str "redirects on POST not followed by persistent Java client "
"when forceRedirects option not set to true")
@@ -531,12 +532,12 @@
(Async/createClient))]
(let [request-options (RequestOptions. "http://127.0.0.255:65535")
time-before-connect (System/currentTimeMillis)]
- (is (connect-exception-thrown? (-> client
- (.get request-options)
- (.deref)
- (.getError)))
+ (is (test-common/connect-exception-thrown? (-> client
+ (.get request-options)
+ (.deref)
+ (.getError)))
"Unexpected result for connection attempt")
- (is (elapsed-within-range? time-before-connect 2000)
+ (is (test-common/elapsed-within-range? time-before-connect 2000)
"Connection attempt took significantly longer than timeout")))))
(deftest short-connect-timeout-persistent-clojure-test-async
@@ -545,12 +546,12 @@
(with-open [client (async/create-client
{:connect-timeout-milliseconds 250})]
(let [time-before-connect (System/currentTimeMillis)]
- (is (connect-exception-thrown? (-> @(common/get
- client
- "http://127.0.0.255:65535")
- :error))
+ (is (test-common/connect-exception-thrown? (-> @(common/get
+ client
+ "http://127.0.0.255:65535")
+ :error))
"Unexpected result for connection attempt")
- (is (elapsed-within-range? time-before-connect 2000)
+ (is (test-common/elapsed-within-range? time-before-connect 2000)
"Connection attempt took significantly longer than timeout")))))
(deftest longer-connect-timeout-test-async
@@ -590,7 +591,7 @@
(.deref)
(.getError)))
"Unexpected result for get attempt")
- (is (elapsed-within-range? time-before-connect 2000)
+ (is (test-common/elapsed-within-range? time-before-connect 2000)
"Get attempt took significantly longer than timeout")))))
(deftest short-socket-timeout-persistent-clojure-test-async
@@ -605,7 +606,7 @@
(-> @(common/get client url)
:error))
"Unexpected result for get attempt")
- (is (elapsed-within-range? time-before-connect 2000)
+ (is (test-common/elapsed-within-range? time-before-connect 2000)
"Get attempt took significantly longer than timeout")))))
(deftest longer-socket-timeout-test-async
@@ -675,7 +676,7 @@
(let [url (str "http://localhost:" port "/hello")]
(testing "clojure persistent async client"
(with-open [client (async/create-client {})]
- (dotimes [n 10] (future (common/get client url {:as :text})))
+ (dotimes [_n 10] (future (common/get client url {:as :text})))
(is (= false (.await countdown 1 TimeUnit/SECONDS)))
(is (= 2 @actual-count))
;; Clear the latch so the webserver can shutdown
@@ -695,7 +696,7 @@
(let [url (str "http://localhost:" port "/hello")]
(testing "clojure persistent async client"
(with-open [client (async/create-client {:max-connections-per-route 0})]
- (dotimes [n 10] (future (common/get client url {:as :text})))
+ (dotimes [_n 10] (future (common/get client url {:as :text})))
(is (= false (.await countdown 1 TimeUnit/SECONDS)))
(is (= 2 @actual-count))
;; Clear the latch so the webserver can shutdown
@@ -716,7 +717,7 @@
(let [url (str "http://localhost:" port "/hello")]
(testing "clojure persistent async client"
(with-open [client (async/create-client {:max-connections-per-route 3})]
- (dotimes [n 10] (future (common/get client url {:as :text})))
+ (dotimes [_n 10] (future (common/get client url {:as :text})))
(is (= false (.await countdown 1 TimeUnit/SECONDS)))
(is (= 3 @actual-count))
;; Clear the latch so the webserver can shutdown
@@ -736,7 +737,7 @@
(let [url (str "http://localhost:" port "/hello")]
(testing "clojure persistent async client"
(with-open [client (async/create-client {:max-connections-per-route 11})]
- (dotimes [n 10] (future (common/get client url {:as :text})))
+ (dotimes [_n 10] (future (common/get client url {:as :text})))
(is (= true (.await countdown 5 TimeUnit/SECONDS)))
(is (= 10 @actual-count)))))))))
@@ -755,7 +756,7 @@
(testing "clojure persistent async client"
(with-open [client (async/create-client {:max-connections-per-route 11
:max-connections-total 3})]
- (dotimes [n 10] (future (common/get client url {:as :text})))
+ (dotimes [_n 10] (future (common/get client url {:as :text})))
(is (= false (.await countdown 1 TimeUnit/SECONDS)))
(is (= 3 @actual-count))
;; Clear the latch so the webserver can shutdown
=====================================
test/puppetlabs/http/client/async_unbuffered_test.clj
=====================================
@@ -1,16 +1,15 @@
(ns puppetlabs.http.client.async-unbuffered-test
- (:import (com.puppetlabs.http.client Async RequestOptions ClientOptions ResponseBodyType)
- (java.net SocketTimeoutException ConnectException)
- (java.io PipedInputStream PipedOutputStream)
- (java.util.concurrent TimeoutException)
- (java.util UUID))
(:require [clojure.test :refer :all]
- [puppetlabs.http.client.test-common :refer :all]
+ [puppetlabs.http.client.async :as async]
+ [puppetlabs.http.client.common :as common]
[puppetlabs.trapperkeeper.testutils.logging :as testlogging]
[puppetlabs.trapperkeeper.testutils.webserver :as testwebserver]
- [puppetlabs.http.client.common :as common]
- [puppetlabs.http.client.async :as async]
- [schema.test :as schema-test]))
+ [schema.test :as schema-test])
+ (:import (com.puppetlabs.http.client Async ClientOptions RequestOptions ResponseBodyType)
+ (java.io PipedInputStream PipedOutputStream)
+ (java.net ConnectException SocketTimeoutException)
+ (java.util UUID)
+ (java.util.concurrent TimeoutException)))
(use-fixtures :once schema-test/validate-schemas)
@@ -32,7 +31,7 @@
(.write outstream (.getBytes data))
; Block until the client confirms it has read the first few bytes
; :socket-timeout-milliseconds on the client ensures we can't really get stuck here, even if the test fails
- (if send-more-data (deref send-more-data))
+ (when send-more-data (deref send-more-data))
; Write the last of the data
(.write outstream (.getBytes "yyyy"))
(.close outstream))
@@ -76,8 +75,8 @@
(is (nil? error))
;; Consume the body to get the exception
(is (thrown? SocketTimeoutException (slurp body)))))
- (deliver send-more-data true))
- (catch TimeoutException e
+ (deliver send-more-data true))
+ (catch TimeoutException _e
;; Expected whenever a server-side failure is generated
nil))))
@@ -125,8 +124,8 @@
(let [response @(common/get client (str "http://localhost:" port "/hello") opts)
{:keys [error]} response]
(is (instance? SocketTimeoutException error))))
- (deliver send-more-data true))
- (catch TimeoutException e
+ (deliver send-more-data true))
+ (catch TimeoutException _e
;; Expected whenever a server-side failure is generated
nil))))
@@ -215,7 +214,7 @@
;; Consume the body to get the exception
(is (thrown? SocketTimeoutException (slurp body)))))
(deliver send-more-data true))
- (catch TimeoutException e
+ (catch TimeoutException _e
;; Expected whenever a server-side failure is generated
nil))))
@@ -281,7 +280,7 @@
error (.getError response)]
(is (instance? SocketTimeoutException error))))
(deliver send-more-data true))
- (catch TimeoutException e
+ (catch TimeoutException _e
;; Expected whenever a server-side failure is generated
nil))))
@@ -325,3 +324,13 @@
(deftest java-existing-streaming-with-large-payload-with-decompression
(testing "java :stream with 1M payload and decompression"
(java-blocking-streaming (generate-data (* 1024 1024)) ResponseBodyType/STREAM true)))
+
+(deftest java-204-streaming
+ (testing "client handles a webserver that returns a 204 response and no body correctly"
+ (testwebserver/with-test-webserver-and-config
+ (constantly {:status 204}) port {:shutdown-timeout-seconds 1}
+ (with-open [client (async/create-client {:connect-timeout-milliseconds 100})]
+ (let [response @(common/post client (str "http://localhost:" port "/something") {:method :post
+ :as :unbuffered-stream})]
+ (is (= 204 (:status response))))))))
+
=====================================
test/puppetlabs/http/client/gzip_request_test.clj
=====================================
@@ -10,7 +10,7 @@
[cheshire.core :as cheshire]
[schema.test :as schema-test]
[puppetlabs.http.client.sync :as http-client]
- [puppetlabs.http.client.test-common :refer :all]
+ [puppetlabs.http.client.test-common :refer [connect-exception-thrown?]]
[puppetlabs.trapperkeeper.testutils.webserver :as testwebserver]))
(use-fixtures :once schema-test/validate-schemas)
=====================================
test/puppetlabs/http/client/metrics_test.clj
=====================================
@@ -1,22 +1,22 @@
(ns puppetlabs.http.client.metrics-test
(:require [clojure.test :refer :all]
+ [puppetlabs.http.client.async :as async]
[puppetlabs.http.client.async-unbuffered-test :as unbuffered-test]
- [puppetlabs.trapperkeeper.services.webserver.jetty9-service :as jetty9]
+ [puppetlabs.http.client.common :as common]
+ [puppetlabs.http.client.metrics :as metrics]
+ [puppetlabs.http.client.sync :as sync]
+ [puppetlabs.trapperkeeper.core :as tk]
+ [puppetlabs.trapperkeeper.services.webserver.jetty-service :as jetty]
[puppetlabs.trapperkeeper.testutils.bootstrap :as testutils]
[puppetlabs.trapperkeeper.testutils.logging :as testlogging]
[puppetlabs.trapperkeeper.testutils.webserver :as testwebserver]
- [puppetlabs.http.client.async :as async]
- [puppetlabs.http.client.sync :as sync]
- [puppetlabs.http.client.common :as common]
- [puppetlabs.trapperkeeper.core :as tk]
- [puppetlabs.http.client.metrics :as metrics]
[schema.test :as schema-test])
- (:import (com.puppetlabs.http.client Async RequestOptions
- ClientOptions ResponseBodyType Sync)
- (com.codahale.metrics MetricRegistry)
+ (:import (com.codahale.metrics MetricRegistry)
+ (com.puppetlabs.http.client Async ClientOptions
+ RequestOptions ResponseBodyType Sync)
+ (com.puppetlabs.http.client.metrics ClientMetricData ClientTimer Metrics)
(java.net SocketTimeoutException)
- (java.util.concurrent TimeoutException)
- (com.puppetlabs.http.client.metrics Metrics ClientTimer ClientMetricData)))
+ (java.util.concurrent TimeoutException)))
(use-fixtures :once schema-test/validate-schemas)
@@ -28,14 +28,12 @@
(add-ring-handler
(fn [_] {:status 200 :body "Hello, World!"}) "/hello")
(add-ring-handler (fn [_]
- (do
- (Thread/sleep 5)
- {:status 200 :body "short"}))
+ (Thread/sleep 5)
+ {:status 200 :body "short"})
"/short")
(add-ring-handler (fn [_]
- (do
(Thread/sleep 100)
- {:status 200 :body "long"}))
+ {:status 200 :body "long"})
"/long")
context))
@@ -69,7 +67,7 @@
(testlogging/with-test-logging
(testutils/with-app-with-config
app
- [jetty9/jetty9-service test-metric-web-service]
+ [jetty/jetty-service test-metric-web-service]
{:webserver {:port 10000}}
(let [metric-registry (MetricRegistry.)
hello-request-opts (RequestOptions. hello-url)
@@ -167,7 +165,7 @@
(testlogging/with-test-logging
(testutils/with-app-with-config
app
- [jetty9/jetty9-service test-metric-web-service]
+ [jetty/jetty-service test-metric-web-service]
{:webserver {:port 10000}}
(let [metric-registry (MetricRegistry.)]
(with-open [client (async/create-client
@@ -255,7 +253,7 @@
(testlogging/with-test-logging
(testutils/with-app-with-config
app
- [jetty9/jetty9-service test-metric-web-service]
+ [jetty/jetty-service test-metric-web-service]
{:webserver {:port 10000}}
(let [metric-registry (MetricRegistry.)
hello-request-opts (RequestOptions. hello-url)
@@ -354,7 +352,7 @@
(testlogging/with-test-logging
(testutils/with-app-with-config
app
- [jetty9/jetty9-service test-metric-web-service]
+ [jetty/jetty-service test-metric-web-service]
{:webserver {:port 10000}}
(let [metric-registry (MetricRegistry.)]
(with-open [client (sync/create-client {:metric-registry metric-registry})]
@@ -531,7 +529,7 @@
(is (<= 200 (.getMean full-response-data)))
(is (<= 200 (.getAggregate full-response-data)))))))
(deliver send-more-data true)))
- (catch TimeoutException e
+ (catch TimeoutException _e
;; Expected whenever a server-side failure is generated
)))))))
@@ -614,7 +612,7 @@
(is (<= 200 (:mean full-response-data)))
(is (<= 200 (:aggregate full-response-data))))))
(deliver send-more-data true)))
- (catch TimeoutException e
+ (catch TimeoutException _e
;; Expected whenever a server-side failure is generated
)))))))
@@ -632,7 +630,7 @@
(testlogging/with-test-logging
(testutils/with-app-with-config
app
- [jetty9/jetty9-service test-metric-web-service]
+ [jetty/jetty-service test-metric-web-service]
{:webserver {:port 10000}}
(testing "custom metric namespace works for java async client"
(testing "metric prefix works"
@@ -746,7 +744,7 @@
(testlogging/with-test-logging
(testutils/with-app-with-config
app
- [jetty9/jetty9-service test-metric-web-service]
+ [jetty/jetty-service test-metric-web-service]
{:webserver {:port 10000}}
(testing "url-metrics can be disabled for clojure async client"
(with-open [client (async/create-client {:metric-registry (MetricRegistry.)
=====================================
test/puppetlabs/http/client/sync_plaintext_test.clj
=====================================
@@ -1,22 +1,22 @@
(ns puppetlabs.http.client.sync-plaintext-test
- (:import (com.puppetlabs.http.client Sync RequestOptions SimpleRequestOptions
- ResponseBodyType ClientOptions
- HttpClientException)
- (java.io ByteArrayInputStream InputStream)
- (org.apache.http.impl.nio.client HttpAsyncClients)
- (java.net ConnectException ServerSocket SocketTimeoutException URI))
- (:require [clojure.test :refer :all]
+ (:require [clojure.java.io :as io]
+ [clojure.test :refer :all]
+ [puppetlabs.http.client.common :as common]
+ [puppetlabs.http.client.sync :as sync]
[puppetlabs.http.client.test-common :refer :all]
[puppetlabs.trapperkeeper.core :as tk]
+ [puppetlabs.trapperkeeper.services.webserver.jetty-service :as jetty]
[puppetlabs.trapperkeeper.testutils.bootstrap :as testutils]
[puppetlabs.trapperkeeper.testutils.logging :as testlogging]
[puppetlabs.trapperkeeper.testutils.webserver :as testwebserver]
- [puppetlabs.trapperkeeper.services.webserver.jetty9-service :as jetty9]
- [puppetlabs.http.client.sync :as sync]
- [puppetlabs.http.client.common :as common]
- [schema.test :as schema-test]
- [clojure.java.io :as io]
- [ring.middleware.cookies :refer [wrap-cookies]]))
+ [ring.middleware.cookies :refer [wrap-cookies]]
+ [schema.test :as schema-test])
+ (:import (com.puppetlabs.http.client ClientOptions HttpClientException RequestOptions
+ ResponseBodyType SimpleRequestOptions
+ Sync)
+ (java.io ByteArrayInputStream InputStream)
+ (java.net ConnectException ServerSocket SocketTimeoutException URI)
+ (org.apache.http.impl.nio.client HttpAsyncClients)))
(use-fixtures :once schema-test/validate-schemas)
@@ -29,7 +29,8 @@
[_]
{:status 200
:body "cookie has been set"
- :cookies {"session_id" {:value "session-id-hash"}}})
+ :cookies {"session_id" {:value "session-id-hash"}
+ "someothercookie" {:value "somevalue" :path "/" :secure true}}})
(defn check-cookie-handler
[req]
@@ -57,7 +58,7 @@
(testing (format "sync client: HTTP method: '%s'" http-method)
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:port 10000}}
(testing "java sync client"
(let [request-options (SimpleRequestOptions. (URI. "http://localhost:10000/hello/"))
@@ -74,7 +75,7 @@
(deftest sync-client-head-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:port 10000}}
(testing "java sync client"
(let [request-options (SimpleRequestOptions. (URI. "http://localhost:10000/hello/"))
@@ -114,7 +115,7 @@
(deftest sync-client-persistent-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:port 10000}}
(testing "persistent java client"
(let [request-options (RequestOptions. "http://localhost:10000/hello/")
@@ -208,7 +209,7 @@
(deftest sync-client-as-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:port 10000}}
(testing "java sync client: :as unspecified"
(let [request-options (SimpleRequestOptions. (URI. "http://localhost:10000/hello/"))
@@ -249,7 +250,7 @@
(deftest request-with-client-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:port 10000}}
(let [client (HttpAsyncClients/createDefault)
opts {:method :get :url "http://localhost:10000/hello/"}]
@@ -267,11 +268,12 @@
(deftest java-api-cookie-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-cookie-service]
+ [jetty/jetty-service test-cookie-service]
{:webserver {:port 10000}}
(let [client (Sync/createClient (ClientOptions.))]
(testing "Set a cookie using Java API"
(let [response (.get client (RequestOptions. "http://localhost:10000/cookietest"))]
+ (is (= "session_id=session-id-hash\nsomeothercookie=somevalue; Path=/; Secure" (.get (.getHeaders response) "set-cookie")))
(is (= 200 (.getStatus response)))))
(testing "Check if cookie still exists"
(let [response (.get client (RequestOptions. "http://localhost:10000/cookiecheck"))]
@@ -280,7 +282,7 @@
(deftest clj-api-cookie-test
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-cookie-service]
+ [jetty/jetty-service test-cookie-service]
{:webserver {:port 10000}}
(let [client (sync/create-client {})]
(testing "Set a cookie using Clojure API"
@@ -306,7 +308,7 @@
(deftest sync-client-request-headers-test
(testlogging/with-test-logging
(testutils/with-app-with-config header-app
- [jetty9/jetty9-service test-header-web-service]
+ [jetty/jetty-service test-header-web-service]
{:webserver {:port 10000}}
(testing "java sync client"
(let [request-options (-> (SimpleRequestOptions. (URI. "http://localhost:10000/hello/"))
@@ -324,8 +326,8 @@
(defn req-body-app
[req]
{:status 200
- :headers (if-let [content-type (:content-type req)]
- {"Content-Type" (:content-type req)})
+ :headers (when-let [content-type (:content-type req)]
+ {"Content-Type" content-type})
:body (slurp (:body req))})
(tk/defservice test-body-web-service
@@ -358,7 +360,7 @@
(deftest sync-client-request-body-test
(testlogging/with-test-logging
(testutils/with-app-with-config req-body-app
- [jetty9/jetty9-service test-body-web-service]
+ [jetty/jetty-service test-body-web-service]
{:webserver {:port 10000}}
(testing "java sync client: string body for post request with explicit
content type and UTF-8 encoding uses UTF-8 encoding"
@@ -446,7 +448,7 @@
[desc opts accept-encoding content-encoding content-should-match?]
(testlogging/with-test-logging
(testutils/with-app-with-config req-body-app
- [jetty9/jetty9-service test-compression-web-service]
+ [jetty/jetty-service test-compression-web-service]
{:webserver {:port 10000}}
(testing (str "java sync client: compression headers / response: " desc)
(let [request-opts (cond-> (SimpleRequestOptions. (URI. "http://localhost:10000/hello/"))
@@ -484,13 +486,13 @@
(deftest query-params-test-sync
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-params-web-service]
+ [jetty/jetty-service test-params-web-service]
{:webserver {:port 8080}}
(testing "URL Query Parameters work with the Java client"
- (let [request-options (SimpleRequestOptions. (URI. "http://localhost:8080/params?foo=bar&baz=lux"))]
- (let [response (Sync/get request-options)]
+ (let [request-options (SimpleRequestOptions. (URI. "http://localhost:8080/params?foo=bar&baz=lux"))
+ response (Sync/get request-options)]
(is (= 200 (.getStatus response)))
- (is (= queryparams (read-string (slurp (.getBody response))))))))
+ (is (= queryparams (read-string (slurp (.getBody response)))))))
(testing "URL Query Parameters work with the clojure client"
(let [opts {:method :get
@@ -504,7 +506,7 @@
(deftest redirect-test-sync
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service redirect-web-service]
+ [jetty/jetty-service redirect-web-service]
{:webserver {:port 8080}}
(testing (str "redirects on POST not followed by Java client "
"when forceRedirects option not set to true")
=====================================
test/puppetlabs/http/client/sync_ssl_test.clj
=====================================
@@ -1,24 +1,23 @@
(ns puppetlabs.http.client.sync-ssl-test
- (:import (com.puppetlabs.http.client Sync
- HttpClientException
- SimpleRequestOptions)
- (javax.net.ssl SSLHandshakeException SSLException)
- (java.net URI ConnectException)
- (org.apache.http ConnectionClosedException)
- (com.puppetlabs.ssl_utils SSLUtils))
(:require [clojure.test :refer :all]
+ [puppetlabs.http.client.sync :as sync]
[puppetlabs.trapperkeeper.core :as tk]
+ [puppetlabs.trapperkeeper.services.webserver.jetty-service :as jetty]
[puppetlabs.trapperkeeper.testutils.bootstrap :as testutils]
[puppetlabs.trapperkeeper.testutils.logging :as testlogging]
- [puppetlabs.trapperkeeper.services.webserver.jetty9-service :as jetty9]
- [puppetlabs.http.client.sync :as sync]
- [schema.test :as schema-test]
- [clojure.tools.logging :as log]))
+ [schema.test :as schema-test])
+ (:import (com.puppetlabs.http.client HttpClientException
+ SimpleRequestOptions
+ Sync)
+ (com.puppetlabs.ssl_utils SSLUtils)
+ (java.net URI)
+ (javax.net.ssl SSLException SSLHandshakeException)
+ (org.apache.http ConnectionClosedException)))
(use-fixtures :once schema-test/validate-schemas)
(defn app
- [req]
+ [_req]
{:status 200
:body "Hello, World!"})
@@ -31,7 +30,7 @@
(deftest sync-client-test-from-pems
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:ssl-host "0.0.0.0"
:ssl-port 10080
:ssl-ca-cert "./dev-resources/ssl/ca.pem"
@@ -56,7 +55,7 @@
(deftest sync-client-test-from-ca-cert
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:ssl-host "0.0.0.0"
:ssl-port 10080
:ssl-ca-cert "./dev-resources/ssl/ca.pem"
@@ -78,7 +77,7 @@
(deftest sync-client-test-with-invalid-ca-cert
(testlogging/with-test-logging
(testutils/with-app-with-config app
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver {:ssl-host "0.0.0.0"
:ssl-port 10081
:ssl-ca-cert "./dev-resources/ssl/ca.pem"
@@ -113,7 +112,7 @@
[server-protocols server-cipher-suites & body]
`(testlogging/with-test-logging
(testutils/with-app-with-config app#
- [jetty9/jetty9-service test-web-service]
+ [jetty/jetty-service test-web-service]
{:webserver (merge
{:ssl-host "0.0.0.0"
:ssl-port 10080
@@ -149,9 +148,9 @@
(setSslCert "./dev-resources/ssl/cert.pem")
(setSslKey "./dev-resources/ssl/key.pem")
(setSslCaCert "./dev-resources/ssl/ca.pem"))]
- (if client-protocols
+ (when client-protocols
(.setSslProtocols request-options (into-array String client-protocols)))
- (if client-cipher-suites
+ (when client-cipher-suites
(.setSslCipherSuites request-options (into-array String client-cipher-suites)))
(Sync/get request-options)))
@@ -160,9 +159,9 @@
(let [ssl-opts (merge {:ssl-cert "./dev-resources/ssl/cert.pem"
:ssl-key "./dev-resources/ssl/key.pem"
:ssl-ca-cert "./dev-resources/ssl/ca.pem"}
- (if client-protocols
+ (when client-protocols
{:ssl-protocols client-protocols})
- (if client-cipher-suites
+ (when client-cipher-suites
{:cipher-suites client-cipher-suites}))]
(sync/get "https://localhost:10080/hello/" ssl-opts)))
@@ -185,4 +184,3 @@
(java-https-get-with-protocols ["TLSv1.2"] nil))))
(testing "clojure sync client"
(is (java-unsupported-protocol-exception? (clj-https-get-with-protocols ["TLSv1.2"] nil)))))))
-
View it on GitLab: https://salsa.debian.org/clojure-team/puppetlabs-http-client-clojure/-/compare/58415ed3f745f5714ea6107926fc1b7fe7de6e21...73cfbb35d88f0a08a40f2e69008a6cf12f35c463
--
View it on GitLab: https://salsa.debian.org/clojure-team/puppetlabs-http-client-clojure/-/compare/58415ed3f745f5714ea6107926fc1b7fe7de6e21...73cfbb35d88f0a08a40f2e69008a6cf12f35c463
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20260730/886f7a9c/attachment.htm>
More information about the pkg-java-commits
mailing list