You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Marton Greber (Code Review)" <ge...@cloudera.org> on 2026/01/08 16:47:49 UTC
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Marton Greber has uploaded this change for review. ( http://gerrit.cloudera.org:8080/23841
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
[Java] Fix TLS truststore init for FIPS providers
In some field deployments running with a proprietary FIPS-compliant
crypto provider, the default KeyStore implementation rejects
KeyStore.load((LoadStoreParameter) null) with
IllegalArgumentException("'param' arg cannot be null"), causing TLS
trust-store construction in SecurityContext.trustCertificates() to fail.
Fix SecurityContext to initialize the in-memory KeyStore via
load(null, new char[0]) instead of the 1-arg overload, avoiding the
null-parameter path while preserving "empty keystore" semantics.
This is not a breaking change: both calls are valid KeyStore
initialization forms and for JDK keystores load(null, ...) is the
documented way [1] to create an empty KeyStore. We only make the
initialization more compatible with FIPS-oriented providers.
[1]: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/security/KeyStore.html#load(java.io.InputStream,char%5B%5D)
Change-Id: I361341146c9115a17df182c397dbf4119ec68464
---
M java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/41/23841/1
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1: Code-Review+1
(1 comment)
http://gerrit.cloudera.org:8080/#/c/23841/1/java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java
File java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java:
http://gerrit.cloudera.org:8080/#/c/23841/1/java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java@420
PS1, Line 420: new char[0]
It seems this argument might be null as well at least for java.security.KeyStore, per the documentation page [1] in the description of this changelist. Did you find null as the second parameter isn't accepted by some particular security provider, so an empty string is used instead?
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
Gerrit-Comment-Date: Thu, 08 Jan 2026 17:48:27 +0000
Gerrit-HasComments: Yes
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
[Java] Fix TLS truststore init for FIPS providers
In some field deployments running with a proprietary FIPS-compliant
crypto provider, the default KeyStore implementation rejects
KeyStore.load((LoadStoreParameter) null) with
IllegalArgumentException("'param' arg cannot be null"), causing TLS
trust-store construction in SecurityContext.trustCertificates() to fail.
Fix SecurityContext to initialize the in-memory KeyStore via
load(null, new char[0]) instead of the 1-arg overload, avoiding the
null-parameter path while preserving "empty keystore" semantics.
This is not a breaking change: both calls are valid KeyStore
initialization forms and for JDK keystores load(null, ...) is the
documented way [1] to create an empty KeyStore. We only make the
initialization more compatible with FIPS-oriented providers.
[1]: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/security/KeyStore.html#load(java.io.InputStream,char%5B%5D)
Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Reviewed-on: http://gerrit.cloudera.org:8080/23841
Tested-by: Marton Greber <gr...@gmail.com>
Reviewed-by: Zoltan Chovan <zc...@cloudera.com>
Reviewed-by: Alexey Serbin <al...@apache.org>
---
M java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java
1 file changed, 1 insertion(+), 1 deletion(-)
Approvals:
Marton Greber: Verified
Zoltan Chovan: Looks good to me, approved
Alexey Serbin: Looks good to me, approved
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 2
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/23841/1/java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java
File java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java:
http://gerrit.cloudera.org:8080/#/c/23841/1/java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java@420
PS1, Line 420: new char[0]
> It seems this argument might be null as well at least for java.security.Key
Yes, I tested null for the password as well and it works with both JDK/FIPS provider. Either null or an empty char[] correctly initialises an empty in-memory KeyStore when the InputStream is null.
I chose new char[0] intentionally to avoid relying on provider-specific null handling. Although the Java API allows null (both for LoadStoreParameter in the 1-arg overload and for password in the 2-arg overload), I’ve seen that some stricter/FIPS provider implementations reject nulls even when the spec permits them (e.g. the original 'param' arg cannot be null failure).
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
Gerrit-Comment-Date: Fri, 09 Jan 2026 10:52:18 +0000
Gerrit-HasComments: Yes
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1: -Verified
Build Started http://jenkins.kudu.apache.org/job/pre_commit/2201/
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
Gerrit-Comment-Date: Thu, 08 Jan 2026 17:40:06 +0000
Gerrit-HasComments: No
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Zoltan Chovan (Code Review)" <ge...@cloudera.org>.
Zoltan Chovan has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1: Code-Review+2
Thanks for looking into this and for the clarification to Alexey's question!
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
Gerrit-Comment-Date: Fri, 09 Jan 2026 11:29:31 +0000
Gerrit-HasComments: No
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1: Code-Review+2
(1 comment)
http://gerrit.cloudera.org:8080/#/c/23841/1/java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java
File java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java:
http://gerrit.cloudera.org:8080/#/c/23841/1/java/kudu-client/src/main/java/org/apache/kudu/client/SecurityContext.java@420
PS1, Line 420: new char[0]
> Yes, I tested null for the password as well and it works with both JDK/FIPS
I see: the good news is that an empty string works for all the providers, IIUC. Thank you for the clarification.
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
Gerrit-Comment-Date: Fri, 09 Jan 2026 18:57:45 +0000
Gerrit-HasComments: Yes
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/2201/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
Gerrit-Comment-Date: Thu, 08 Jan 2026 18:24:29 +0000
Gerrit-HasComments: No
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1: Verified+1
unrelated test failure:
tsan: org.apache.kudu.spark.kudu.DefaultSourceTest
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
Gerrit-Comment-Date: Fri, 09 Jan 2026 11:20:01 +0000
Gerrit-HasComments: No
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has removed a vote on this change.
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Removed Verified-1 by Kudu Jenkins (120)
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: deleteVote
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/2200/
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Thu, 08 Jan 2026 16:47:59 +0000
Gerrit-HasComments: No
[kudu-CR] [Java] Fix TLS truststore init for FIPS providers
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23841 )
Change subject: [Java] Fix TLS truststore init for FIPS providers
......................................................................
Patch Set 1: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/2200/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/23841
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I361341146c9115a17df182c397dbf4119ec68464
Gerrit-Change-Number: 23841
Gerrit-PatchSet: 1
Gerrit-Owner: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Zoltan Chovan <zc...@cloudera.com>
Gerrit-Comment-Date: Thu, 08 Jan 2026 17:35:51 +0000
Gerrit-HasComments: No