Repository navigation
fix: generated TLS certificate locality is no longer mojibake (#961) - #1003
Closed
ismisepaul wants to merge 1 commit into
Closed
ismisepaul wants to merge 1 commit into
ismisepaul wants to merge 1 commit into
Conversation
properties-maven-plugin reads .env with java.util.Properties, which decodes ISO-8859-1, so the UTF-8 "Á" in DNAME reached keytool as two characters and the certificate read L=BaileÃthaCliath. Write it as the Á escape, which Properties decodes. DNAME is only read by Maven, so docker compose is unaffected. Add a check that the generated certificate's subject matches, and run it in the build job. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused encoding fix addresses Maven’s properties decoding and includes a targeted CI regression check, with no unresolved findings.
No open issues 🎉
What changed in this PR
Fixes #961 by preserving the accented locality name in TLS certificates generated by Maven for the Docker deployment.
Changes:
- Uses a Unicode escape in
.envso Maven decodesÁcorrectly. - Adds a regression script that checks the generated certificate’s locality.
- Runs the check in CI immediately after the Maven build.
| File | Description |
|---|---|
src/test/scripts/tls-keystore-test.sh |
Checks the generated certificate contains L=BaileÁthaCliath. |
.github/workflows/test.yml |
Runs the TLS certificate check after keystore generation. |
.env |
Escapes Á in DNAME and documents the encoding requirement. |
Review effort: Balanced
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #961.
What
properties-maven-plugin(read-project-properties) loads.envwithjava.util.Properties, which decodes ISO-8859-1. The UTF-8ÁinDNAME(0xC3 0x81) reached keytool as two characters, so the generated keystore's certificate readL=BaileÃthaCliath. The plugin has no encoding setting.DNAMEnow writes it as theÁescape, whichPropertiesdecodes, with a comment explaining why. Only Maven readsDNAME, so docker compose, which reads.envliterally, isn't affected.Tests
src/test/scripts/tls-keystore-test.shreads the generated keystore and checks that the certificate owner containsL=BaileÁthaCliath. It runs in the build job straight after the Maven build.dev:FAIL: TLS certificate owner '… L=BaileÃthaCliath …' does not contain 'L=BaileÁthaCliath'PASS: TLS certificate owner is CN=OwaspShepherd, OU=SecurityShepherd, O=OWASP, L=BaileÁthaCliath, ST=Laighin, C=IEEvery step of
test.ymlpassed locally (lint, build, PGP check, compose build, Tomcat config check, unit tests, integration tests).actionlintreports nothing on the new step. Its existing notices are on line 126, which this PR doesn't touch.🤖 Generated with Claude Code