feat: update GoogleUtils#getCertificateTrustStore to first attempt t…#2613
feat: update GoogleUtils#getCertificateTrustStore to first attempt t…#2613
Conversation
…o load JSDK default certs
ldetmer
force-pushed
the
use-jdk-default-certs
branch
from
e20a107 to
d1f59c2
Compare
| } | ||
| } | ||
|
|
||
| throw new IOException("Unable to load default JDK cacerts file"); |
There was a problem hiding this comment.
I see this exception is swallowed later without any logging, can we just return null to simplify the logic? A null check is also slightly more performant than a try catch.
There was a problem hiding this comment.
good call, updated to return null.
I didn't add logging because technically client fails to load default certs the client continues to behave the way it does today, but if you think we should call out that we weren't able to load the certs, let me know and I'll add.
| /** Default JDK cacerts file path relative to java.home. */ | ||
| @VisibleForTesting | ||
| static String[] possibleJdkPaths = { | ||
| "lib/security/cacerts", // Java 9+ |
There was a problem hiding this comment.
Did you get a chance to test against different JDK versions and/or JDK vendors?
There was a problem hiding this comment.
I tested locally against 8. 17, 25 - they all used lib/security/cacerts (zulu, oracle)
The CI required me to add jre/lib/security/cacerts, so it seems more like a host env issue, as CI runs zulu but on linux. I removed the invalid comments attributing the different locations to differenet versions of java.
|
The PR title should probably be |
ldetmer
changed the title
Co-authored-by: Blake Li <blakeli@google.com>
3 participants
This PR is the first step in stopping maintenance for custom keystore in google-api-java-client see: go/stop-keystore-api-java-client
It updates GoogleUtils.getCertificateTrustStore() to first attempt to load java jdk default certs using logic similar to java's internal TrustStoreManager class before falling back to the custom keystore bundled with google-api-java-client. This is to alleviate issues with the bundled keystore having expired/missing certs
Deprecates GoogleUtils.getCertificateTrustStore()
Deprecates GoogleNetHttpTransport
updates documentation to refer users to NetHttpTransport
Tested using GoogleNetHttpTransport.newTrustedTransport() to make call to storage API.