Uh oh!
There was an error while loading. Please reload this page.
[feature](tls) Add TLS framework - #63145
Conversation
hello-stephen
commented
May 11, 2026
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Fix clang-format and FE CheckStyle failures in the TLS scaffolding PR. ### Release note None ### Check List (For Author) - Test: ./build-support/check-format.sh with clang-format 16; cd fe && mvn clean checkstyle:check; git diff --check - Behavior changed: No - Does this need documentation: No
Hastyshell
commented
May 12, 2026
run buildall |
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Remove thirdparty brpc TLS implementation patches from the OSS scaffolding PR to keep the change focused on public extension points. ### Release note None ### Check List (For Author) - Test: git diff --check --cached - Behavior changed: No - Does this need documentation: No
Hastyshell
commented
May 12, 2026
run buildall |
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Remove cloud TLS regression cases that depend on custom TLS capabilities from the OSS scaffolding PR. ### Release note None ### Check List (For Author) - Test: git diff --check --cached - Behavior changed: No - Does this need documentation: No
Hastyshell
commented
May 12, 2026
run buildall |
hello-stephen
commented
May 12, 2026
Cloud UT Coverage ReportIncrement line coverage Increment coverage report
|
hello-stephen
commented
May 12, 2026
Cloud UT Coverage ReportIncrement line coverage Increment coverage report
|
hello-stephen
commented
May 12, 2026
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
hello-stephen
commented
May 12, 2026
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Fix FE compilation by returning the resolved UserIdentity directly instead of treating it as a list. ### Release note None ### Check List (For Author) - Test: git diff --check; cd fe && mvn -pl fe-core checkstyle:check - Behavior changed: No - Does this need documentation: No
Hastyshell
commented
May 14, 2026
run buildall |
hello-stephen
commented
May 14, 2026
Cloud UT Coverage ReportIncrement line coverage Increment coverage report
|
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Align the TlsOptions test expectation with SanEntryCodec normalization, which canonicalizes SAN types and strips trailing dots without changing value case. ### Release note None ### Check List (For Author) - Test: git diff --check; cd fe && mvn -pl fe-core checkstyle:check - Behavior changed: No - Does this need documentation: No
hello-stephen
commented
May 14, 2026
TPC-H: Total hot run time: 29842 ms |
hello-stephen
commented
May 14, 2026
TPC-DS: Total hot run time: 170568 ms |
hello-stephen
commented
May 14, 2026
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
hello-stephen
commented
May 14, 2026
FE Regression Coverage ReportIncrement line coverage |
Hastyshell
commented
May 18, 2026
run cloud_p0 |
Hastyshell
commented
May 18, 2026
run p0 |
hello-stephen
commented
May 18, 2026
FE Regression Coverage ReportIncrement line coverage |
luwei16
commented
May 19, 2026
run nonConcurrent |
luwei16
commented
May 19, 2026
run p0 |
hello-stephen
commented
May 19, 2026
FE Regression Coverage ReportIncrement line coverage |
1 similar comment
hello-stephen
commented
May 19, 2026
FE Regression Coverage ReportIncrement line coverage |
PR approved by at least one committer and no changes requested. |
PR approved by anyone and no changes requested. |
### What problem does this PR solve? Issue Number: None Related PR: selectdb/selectdb-core#8598 Problem Summary: Port the public mTLS scaffolding, configuration, protocol startup split, certificate-auth contracts, and TLS validation tests while excluding all enterprise module directories. ### Release note Add TLS configuration and certificate-auth scaffolding for optional TLS modules. ### Check List (For Author) - Test: bash -n build.sh run-fe-ut.sh run-be-ut.sh run-cloud-ut.sh; git diff --check --cached; ./run-fe-ut.sh --run org.apache.doris.analysis.TlsOptionsTest (fails on existing missing edu.umd.cs.findbugs.annotations.SuppressFBWarnings for generated ImmutableFlightAuthResult) - Behavior changed: Yes, adds TLS-related configuration and startup/auth extension points. - Does this need documentation: Yes
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Fix clang-format and FE CheckStyle failures in the TLS scaffolding PR. ### Release note None ### Check List (For Author) - Test: ./build-support/check-format.sh with clang-format 16; cd fe && mvn clean checkstyle:check; git diff --check - Behavior changed: No - Does this need documentation: No
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Remove thirdparty brpc TLS implementation patches from the OSS scaffolding PR to keep the change focused on public extension points. ### Release note None ### Check List (For Author) - Test: git diff --check --cached - Behavior changed: No - Does this need documentation: No
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Remove cloud TLS regression cases that depend on custom TLS capabilities from the OSS scaffolding PR. ### Release note None ### Check List (For Author) - Test: git diff --check --cached - Behavior changed: No - Does this need documentation: No
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Fix FE compilation by returning the resolved UserIdentity directly instead of treating it as a list. ### Release note None ### Check List (For Author) - Test: git diff --check; cd fe && mvn -pl fe-core checkstyle:check - Behavior changed: No - Does this need documentation: No
### What problem does this PR solve? Issue Number: None Related PR: apache#63145 Problem Summary: Align the TlsOptions test expectation with SanEntryCodec normalization, which canonicalizes SAN types and strips trailing dots without changing value case. ### Release note None ### Check List (For Author) - Test: git diff --check; cd fe && mvn -pl fe-core checkstyle:check - Behavior changed: No - Does this need documentation: No
52f8c63 to
5faef1bCompareluwei16
commented
May 21, 2026
run buildall |
hello-stephen
commented
May 21, 2026
FE UT Coverage ReportIncrement line coverage |
hello-stephen
commented
May 21, 2026
TPC-H: Total hot run time: 30878 ms |
hello-stephen
commented
May 21, 2026
TPC-DS: Total hot run time: 169049 ms |
hello-stephen
commented
May 21, 2026
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
hello-stephen
commented
May 21, 2026
FE Regression Coverage ReportIncrement line coverage |
gavinchou
commented
Jun 3, 2026
close due to #64016 |
Related PR: #63145 Problem Summary: This re-submits the OSS mTLS framework work from #63145 under my account and rebases it onto the latest apache/doris master. The change ports the public mTLS scaffolding, configuration, protocol startup split, certificate-auth contracts, and TLS validation tests while excluding enterprise module directories. After the rebase, the previous FE UT failures were fixed: the ALTER/CREATE USER TLS unit tests now use Mockito static mocking instead of external JMockit parameter injection, and the MetaServiceProxy success-path test now stubs the mock client as using the latest channel configuration so the proxy does not replace it before executing the request. --------- Co-authored-by: Siyang Tang <tangsiyang@selectdb.com>
Related PR: apache#63145 Problem Summary: This re-submits the OSS mTLS framework work from apache#63145 under my account and rebases it onto the latest apache/doris master. The change ports the public mTLS scaffolding, configuration, protocol startup split, certificate-auth contracts, and TLS validation tests while excluding enterprise module directories. After the rebase, the previous FE UT failures were fixed: the ALTER/CREATE USER TLS unit tests now use Mockito static mocking instead of external JMockit parameter injection, and the MetaServiceProxy success-path test now stubs the mock client as using the latest channel configuration so the proxy does not replace it before executing the request. --------- Co-authored-by: Siyang Tang <tangsiyang@selectdb.com>
What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary: Port the public mTLS scaffolding, configuration, protocol startup split, certificate-auth contracts, and TLS validation tests while excluding all enterprise module directories.
Release note
Add TLS configuration and certificate-auth scaffolding for optional TLS modules.
Check List (For Author)
Test: bash -n build.sh run-fe-ut.sh run-be-ut.sh run-cloud-ut.sh; git diff --check --cached; ./run-fe-ut.sh --run org.apache.doris.analysis.TlsOptionsTest (fails on existing missing edu.umd.cs.findbugs.annotations.SuppressFBWarnings for generated ImmutableFlightAuthResult)
Behavior changed: Yes, adds TLS-related configuration and startup/auth extension points.
Does this need documentation: Yes
Release note
None
Check List (For Author)
Test
Behavior changed:
Does this need documentation?
Check List (For Reviewer who merge this PR)