[Improvement] Automate Certificate and Keystore generation for Gravitino HTTPS/TLS tests
- Dominant language
- Java
- Stars
- 3.2k
- Forks
- 935
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 298
Description
### What would you like to be improved?
Currently, Gravitino's HTTPS/TLS tests rely on hard-coded keystore and truststore fixtures located in `server-common/src/test/resources/tls`. For future maintainability and to make it easier to expand TLS test coverage, these binary fixtures should be removed and replaced with certificates, keystores, and truststores that are generated automatically at test runtime and cleaned up afterward.
The two test classes currently using these fixtures are:
`server-common/src/test/java/org/apache/gravitino/server/web/TestHttpsServerAuthentication.java`
`clients/client-java/src/test/java/org/apache/gravitino/client/TestHTTPClientTLS.java`
Both tests access the TLS test material through the shared TestTlsServerUtils.java helper in server-common. This shared functionality must remain available so that TLS test resources can continue to be used across modules.
The expected change is to introduce automated TLS test-material generation, either directly in `TestTlsServerUtils` or in a separate utility under `server-common` that can be reused by both existing test suites. The current tests should retain the same behavior while removing their dependency on committed binary certificate fixtures and making future TLS test scenarios easier to add.
Several implementation approaches are possible, including invoking the JDK `keytool` utility, using `Bouncy Castle`, or generating certificates through Java APIs. Ideally, the solution should avoid introducing large or unnecessary dependencies. Since keytool is already distributed with the JDK required to build and test Gravitino, it is currently the preferred approach, although other implementations may be considered.
### How should we improve?
_No response_
Contributor guide
Research direction
Start by reading server-common/src/test/java/org/apache/gravitino/server/web/TestHttpsServerAuthentication.java, clients/client-java/src/test/java/org/apache/gravitino/client/TestHTTPClientTLS.java, and the shared TestTlsServerUtils.java helper. Inspect the fixtures under server-common/src/test/resources/tls and run both TLS test classes. Done means both tests retain their behavior while generating and cleaning up test certificates, keystores, and truststores at runtime without committed binary fixtures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security, testing
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100