imbajin commented on code in PR #3126:
URL: https://github.com/apache/hugegraph/pull/3126#discussion_r3677166740
##########
hugegraph-server/hugegraph-dist/src/assembly/static/bin/hugegraph-server.sh:
##########
@@ -143,7 +143,9 @@ esac
JVM_OPTIONS="-Dlog4j.configurationFile=${CONF}/log4j2.xml"
if [[ ${OPEN_SECURITY_CHECK} == "true" ]]; then
- JVM_OPTIONS="${JVM_OPTIONS}
-Djava.security.manager=org.apache.hugegraph.security.HugeSecurityManager"
+ JVM_OPTIONS="${JVM_OPTIONS} \
+ -Djava.security.properties=${CONF}/java-security.properties \
Review Comment:
⚠️ Fail fast when this bundled security-properties file is absent. Existing
deployments can retain or mount a pre-upgrade `conf/` directory without this
new file; a controlled JDK invocation accepted a missing
`-Djava.security.properties=...`, exited 0, and left
`Security.getProperty("networkaddress.cache.ttl")` as `null`, silently
restoring the indefinite DNS cache this change is meant to prevent. Please
validate the default file before launch (unless a later explicit operator
override is present), or place the default outside operator-replaceable
configuration, and add a missing-file launcher regression.
##########
.github/workflows/server-ci.yml:
##########
@@ -89,6 +89,7 @@ jobs:
mvn package -Dmaven.test.skip=true -pl
hugegraph-server/hugegraph-dist -am -ntp
VERSION=$(mvn help:evaluate -Dexpression=project.version -q
-DforceStdout)
SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
+ $TRAVIS_DIR/test-java-security-properties.sh $SERVER_DIR
Review Comment:
⚠️ Keep this DNS regression independent of unrelated startup prerequisites.
This call is inside a step gated by a preflight requiring `lsof`, `crontab`,
`curl`, and `java`; if any of the first three is unavailable, CI emits a notice
and succeeds without running the new Java-only test. Please run
`test-java-security-properties.sh` in a separate rocksdb/Java step—the current
exact-head log shows it passes—and leave only `test-start-hugegraph.sh` behind
the broader startup gate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
