apache / apache/gravitino

[Improvement] Automate Certificate and Keystore generation for Gravitino HTTPS/TLS tests

Open
#12,463 0 comments 0 reactions 0 assignees View on GitHub
improvement
Dominant language
Java
Stars
3.2k
Forks
935
Avg merge
1d 16h
Merged PRs (30d)
298

Description

### What would you like to be improved?

Currently, Gravitino's HTTPS/TLS tests rely on hard-coded keystore and truststore fixtures located in `server-common/src/test/resources/tls`. For future maintainability and to make it easier to expand TLS test coverage, these binary fixtures should be removed and replaced with certificates, keystores, and truststores that are generated automatically at test runtime and cleaned up afterward.

The two test classes currently using these fixtures are:

`server-common/src/test/java/org/apache/gravitino/server/web/TestHttpsServerAuthentication.java`
`clients/client-java/src/test/java/org/apache/gravitino/client/TestHTTPClientTLS.java`

Both tests access the TLS test material through the shared TestTlsServerUtils.java helper in server-common. This shared functionality must remain available so that TLS test resources can continue to be used across modules.

The expected change is to introduce automated TLS test-material generation, either directly in `TestTlsServerUtils` or in a separate utility under `server-common` that can be reused by both existing test suites. The current tests should retain the same behavior while removing their dependency on committed binary certificate fixtures and making future TLS test scenarios easier to add.

Several implementation approaches are possible, including invoking the JDK `keytool` utility, using `Bouncy Castle`, or generating certificates through Java APIs. Ideally, the solution should avoid introducing large or unnecessary dependencies. Since keytool is already distributed with the JDK required to build and test Gravitino, it is currently the preferred approach, although other implementations may be considered.

### How should we improve?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reading server-common/src/test/java/org/apache/gravitino/server/web/TestHttpsServerAuthentication.java, clients/client-java/src/test/java/org/apache/gravitino/client/TestHTTPClientTLS.java, and the shared TestTlsServerUtils.java helper. Inspect the fixtures under server-common/src/test/resources/tls and run both TLS test classes. Done means both tests retain their behavior while generating and cleaning up test certificates, keystores, and truststores at runtime without committed binary fixtures.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security, testing
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.