You are viewing a plain text version of this content. The canonical link for it is here.

Posted to builds@flink.apache.org by GitBox <gi...@apache.org> on 2026/08/19 17:58:46 UTC

[GH] (flink-kubernetes-operator/harden-artifact-fetch-timeouts): Workflow run "Flink Kubernetes Operator CI" is working again!

The GitHub Actions job "Flink Kubernetes Operator CI" on flink-kubernetes-operator.git/harden-artifact-fetch-timeouts has succeeded.
Run started by GitHub user spuru9 (triggered by gyfora).

Head commit for run:
51c14cd2b0bfacaed0b6c3bbe8a145dcc78745fe / Purushottam Sinha <ps...@confluent.io>
[FLINK-40402] Pin resolved address during artifact fetch to close DNS-rebinding gap.

Resolve the artifact host once and connect to that address for the duration
of each redirect hop, instead of letting HttpURLConnection re-resolve at
connect time. This removes the TOCTOU window in which a host that passed the
restricted-host check could rebind to an internal address before the socket
is opened. The original hostname is preserved for the Host header and, over
HTTPS, for TLS SNI and certificate verification, so pinning to an IP literal
does not break virtual hosting or the handshake.

Generated-by: Claude Code

Report URL: https://github.com/apache/flink-kubernetes-operator/actions/runs/32260468583

With regards,
GitHub Actions via GitBox