Deprecate EnableArrow — Arrow always enabled except on AIX/IBM Power … #716
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # =================================================================== | |
| # GitHub Action: SSL Certificate Validation Test with Squid Proxy | |
| # | |
| # Purpose: | |
| # This workflow simulates real-world SSL trust chain configurations | |
| # to validate JDBC driver support for: | |
| # - Custom trust stores | |
| # - System trust stores | |
| # - Self-signed certificate handling | |
| # - Revocation and fallback behavior | |
| # | |
| # How: | |
| # - Generates a Root CA, Intermediate CA, and signs a server cert (mirroring real world use-cases) | |
| # - Starts a Squid HTTPS proxy using the signed cert | |
| # - Creates a Java truststore with the correct anchors | |
| # - Optionally installs the Root CA into system trust store | |
| # - Runs targeted JDBC integration tests using SSLTest.java | |
| # ===================================================================1 | |
| name: SSL Certificate Validation Test with Squid Proxy | |
| on: | |
| push: | |
| branches: [ main ] | |
| workflow_dispatch: | |
| inputs: | |
| branch: | |
| description: 'Branch to checkout' | |
| required: false | |
| default: 'main' | |
| repository: | |
| description: 'Repository to checkout (e.g., user/repo)' | |
| required: false | |
| default: 'databricks/databricks-jdbc' | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| ssl-test: | |
| runs-on: | |
| group: databricks-protected-runner-group | |
| labels: linux-ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.ref || inputs.branch }} | |
| repository: ${{ github.event.pull_request.head.repo.full_name || inputs.repository }} | |
| - name: Set Up Java | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 | |
| with: | |
| java-version: "21" | |
| distribution: "adopt" | |
| - name: Get JFrog OIDC token | |
| run: | | |
| set -euo pipefail | |
| # Get GitHub OIDC ID token | |
| ID_TOKEN=$(curl -sLS \ | |
| -H "User-Agent: actions/oidc-client" \ | |
| -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \ | |
| "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq .value | tr -d '"') | |
| echo "::add-mask::${ID_TOKEN}" | |
| # Exchange for JFrog access token | |
| ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \ | |
| "https://databricks.jfrog.io/access/api/v1/oidc/token" \ | |
| -d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq .access_token | tr -d '"') | |
| echo "::add-mask::${ACCESS_TOKEN}" | |
| if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then | |
| echo "FAIL: Could not extract JFrog access token" | |
| exit 1 | |
| fi | |
| echo "JFROG_ACCESS_TOKEN=${ACCESS_TOKEN}" >> "$GITHUB_ENV" | |
| echo "JFrog OIDC token obtained successfully" | |
| - name: Configure maven | |
| run: | | |
| set -euo pipefail | |
| mkdir -p ~/.m2 | |
| cat > ~/.m2/settings.xml << EOF | |
| <settings> | |
| <mirrors> | |
| <mirror> | |
| <id>jfrog-central</id> | |
| <mirrorOf>*</mirrorOf> | |
| <url>https://databricks.jfrog.io/artifactory/db-maven/</url> | |
| </mirror> | |
| </mirrors> | |
| <servers> | |
| <server> | |
| <id>jfrog-central</id> | |
| <username>gha-service-account</username> | |
| <password>${JFROG_ACCESS_TOKEN}</password> | |
| </server> | |
| </servers> | |
| </settings> | |
| EOF | |
| echo "Maven configured to use JFrog registry" | |
| - name: Set Environment Variables | |
| env: | |
| DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }} | |
| DATABRICKS_HOST: ${{ secrets.DATABRICKS_HOST }} | |
| DATABRICKS_HTTP_PATH: ${{ secrets.DATABRICKS_HTTP_PATH }} | |
| HTTP_PROXY_URL: "http://localhost:3128" | |
| HTTPS_PROXY_URL: "https://localhost:3129" | |
| TRUSTSTORE_PATH: "/tmp/ssl-certs/test-truststore.jks" | |
| TRUSTSTORE_PASSWORD: "changeit" | |
| run: | | |
| echo "DATABRICKS_TOKEN=${DATABRICKS_TOKEN}" >> $GITHUB_ENV | |
| echo "DATABRICKS_HOST=${DATABRICKS_HOST}" >> $GITHUB_ENV | |
| echo "DATABRICKS_HTTP_PATH=${DATABRICKS_HTTP_PATH}" >> $GITHUB_ENV | |
| echo "HTTP_PROXY_URL=${HTTP_PROXY_URL}" >> $GITHUB_ENV | |
| echo "HTTPS_PROXY_URL=${HTTPS_PROXY_URL}" >> $GITHUB_ENV | |
| echo "TRUSTSTORE_PATH=${TRUSTSTORE_PATH}" >> $GITHUB_ENV | |
| echo "TRUSTSTORE_PASSWORD=${TRUSTSTORE_PASSWORD}" >> $GITHUB_ENV | |
| - name: Install Squid and SSL Tools | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y squid openssl libnss3-tools ca-certificates | |
| - name: Create Root CA and Certificates | |
| run: | | |
| mkdir -p /tmp/ssl-certs | |
| cd /tmp/ssl-certs | |
| # Generate Root CA | |
| openssl genrsa -out rootCA.key 4096 | |
| openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 365 -out rootCA.crt \ | |
| -subj "/C=US/ST=California/L=San Francisco/O=Databricks Test/OU=Testing/CN=Databricks Test Root CA" | |
| # Generate Intermediate CA | |
| openssl genrsa -out intermediateCA.key 4096 | |
| openssl req -new -key intermediateCA.key -out intermediateCA.csr \ | |
| -subj "/C=US/ST=California/L=San Francisco/O=Databricks Test/OU=Testing/CN=Databricks Test Intermediate CA" | |
| # Create extension file for intermediate CA | |
| cat > intermediate_ext.cnf << EOF | |
| [ v3_ca ] | |
| subjectKeyIdentifier = hash | |
| authorityKeyIdentifier = keyid:always,issuer | |
| basicConstraints = critical, CA:true, pathlen:0 | |
| keyUsage = critical, digitalSignature, cRLSign, keyCertSign | |
| EOF | |
| # Sign Intermediate CA with Root CA | |
| openssl x509 -req -in intermediateCA.csr -CA rootCA.crt -CAkey rootCA.key \ | |
| -CAcreateserial -out intermediateCA.crt -days 365 -sha256 \ | |
| -extfile intermediate_ext.cnf -extensions v3_ca | |
| # Generate Squid Proxy Certificate | |
| openssl genrsa -out squid.key 2048 | |
| openssl req -new -key squid.key -out squid.csr \ | |
| -subj "/C=US/ST=California/L=San Francisco/O=Databricks Test/OU=Testing/CN=localhost" | |
| # Create extension file for Squid certificate | |
| cat > squid_ext.cnf << EOF | |
| [ v3_req ] | |
| basicConstraints = CA:FALSE | |
| keyUsage = digitalSignature, keyEncipherment | |
| extendedKeyUsage = serverAuth | |
| subjectAltName = @alt_names | |
| [alt_names] | |
| DNS.1 = localhost | |
| IP.1 = 127.0.0.1 | |
| EOF | |
| # Sign Squid certificate with Intermediate CA | |
| openssl x509 -req -in squid.csr -CA intermediateCA.crt -CAkey intermediateCA.key \ | |
| -CAcreateserial -out squid.crt -days 365 -sha256 \ | |
| -extfile squid_ext.cnf -extensions v3_req | |
| # Create PEM file for Squid | |
| cat squid.crt squid.key > squid.pem | |
| chmod 400 squid.pem | |
| # Copy to appropriate locations | |
| sudo cp squid.pem /etc/squid/ | |
| sudo chown proxy:proxy /etc/squid/squid.pem | |
| # Extract the Databricks workspace certificate | |
| echo -n | openssl s_client -connect ${DATABRICKS_HOST}:443 -showcerts 2>/dev/null | \ | |
| sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > databricks_workspace.crt | |
| # Create Java Keystore from Root CA - with proper trust anchors | |
| rm -f test-truststore.jks | |
| # Create a truststore with the root CA as a trusted certificate entry | |
| keytool -importcert -noprompt -trustcacerts -alias rootca -file rootCA.crt \ | |
| -keystore test-truststore.jks -storepass changeit | |
| # Also add the intermediate CA to the trust store | |
| keytool -importcert -noprompt -trustcacerts -alias intermediateca -file intermediateCA.crt \ | |
| -keystore test-truststore.jks -storepass changeit | |
| # Add the Databricks workspace certificate to the trust store | |
| keytool -importcert -noprompt -trustcacerts -alias databricksworkspace -file databricks_workspace.crt \ | |
| -keystore test-truststore.jks -storepass changeit | |
| chmod 644 test-truststore.jks | |
| - name: Configure Squid with Standard SSL | |
| run: | | |
| sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.orig | |
| echo " | |
| # Basic Configuration | |
| http_port 3128 | |
| # Plain HTTPS port with certificate | |
| https_port 3129 tls-cert=/etc/squid/squid.pem | |
| # Access Control - very permissive for testing | |
| http_access allow all | |
| always_direct allow all | |
| # Avoid DNS issues in test environment | |
| dns_v4_first on | |
| # Disable caching for testing | |
| cache deny all | |
| # Logging | |
| debug_options ALL,1 | |
| logfile_rotate 0 | |
| cache_log /var/log/squid/cache.log | |
| access_log /var/log/squid/access.log squid | |
| " | sudo tee /etc/squid/squid.conf | |
| sudo mkdir -p /var/log/squid | |
| sudo chown -R proxy:proxy /var/log/squid | |
| sudo chmod 755 /var/log/squid | |
| sudo squid -k parse || echo "Configuration has issues but we'll try to run it anyway" | |
| - name: Start Squid Proxy | |
| run: | | |
| sudo systemctl stop squid || true | |
| sudo pkill squid || true | |
| sudo squid -N -d 3 -f /etc/squid/squid.conf & | |
| sleep 5 | |
| ps aux | grep squid | |
| - name: Wait for Squid to be Ready | |
| run: | | |
| for i in {1..5}; do | |
| if curl -v -x http://localhost:3128 http://databricks.com -m 10 -o /dev/null; then | |
| echo "HTTP proxy on 3128 is working!" | |
| break | |
| fi | |
| sleep 3 | |
| done | |
| if ps aux | grep -v grep | grep squid > /dev/null; then | |
| echo "Squid is running" | |
| else | |
| echo "Squid is not running! Attempting restart..." | |
| sudo squid -N -d 3 -f /etc/squid/squid.conf & | |
| sleep 5 | |
| fi | |
| - name: Install Root CA in System Trust Store | |
| run: | | |
| sudo cp /tmp/ssl-certs/rootCA.crt /usr/local/share/ca-certificates/databricks-test-rootca.crt | |
| sudo update-ca-certificates | |
| - name: Maven Build | |
| run: | | |
| mvn -pl jdbc-core clean package -DskipTests | |
| - name: Run SSL Tests | |
| run: | | |
| mvn -pl jdbc-core test -Dtest=**/SSLTest.java | |
| - name: Cleanup | |
| if: always() | |
| run: | | |
| sudo systemctl stop squid | |
| sudo systemctl disable squid | |
| sudo pkill squid | |
| sudo rm -f /usr/local/share/ca-certificates/databricks-test-rootca.crt | |
| sudo update-ca-certificates --fresh |