From 35e748b48b06c2c8eb73f75c9d52012ee2e35a63 Mon Sep 17 00:00:00 2001 From: Craig Perkins Date: Wed, 17 Sep 2025 16:10:29 -0400 Subject: [PATCH 1/4] [Flakey Test] Fix flakey tests in SecureReactorNetty4HttpServerTransportTests Signed-off-by: Craig Perkins --- .../org/opensearch/test/KeyStoreUtils.java | 39 ++++++++++++------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/test/framework/src/main/java/org/opensearch/test/KeyStoreUtils.java b/test/framework/src/main/java/org/opensearch/test/KeyStoreUtils.java index c90b2b872f8ba..9018bf575f0ab 100644 --- a/test/framework/src/main/java/org/opensearch/test/KeyStoreUtils.java +++ b/test/framework/src/main/java/org/opensearch/test/KeyStoreUtils.java @@ -22,6 +22,8 @@ import java.security.KeyStore; import java.security.cert.X509Certificate; import java.util.Date; +import java.util.Locale; +import java.util.TimeZone; public class KeyStoreUtils { @@ -49,20 +51,31 @@ private static X500PrivateCredential createCredential() throws Exception { } private static X509CertificateHolder generateCert(KeyPair pair) throws Exception { - var baseTime = System.currentTimeMillis(); - // 10 years in milliseconds - var validityPeriod = 10L * 365 * 24 * 60 * 60 * 1000; + // Use UTC timezone and ROOT locale to avoid locale-specific date formatting issues + var originalLocale = Locale.getDefault(); + var originalTimeZone = TimeZone.getDefault(); + try { + Locale.setDefault(Locale.ROOT); + TimeZone.setDefault(TimeZone.getTimeZone("UTC")); - var certBuilder = new JcaX509v1CertificateBuilder( - new X500Principal("CN=Test CA Certificate"), - BigInteger.valueOf(1), - new Date(baseTime), - new Date(baseTime + validityPeriod), - new X500Principal("CN=Test CA Certificate"), - pair.getPublic() - ); - var signer = new JcaContentSignerBuilder("SHA256withRSA").build(pair.getPrivate()); - return certBuilder.build(signer); + var baseTime = System.currentTimeMillis(); + // 10 years in milliseconds + var validityPeriod = 10L * 365 * 24 * 60 * 60 * 1000; + + var certBuilder = new JcaX509v1CertificateBuilder( + new X500Principal("CN=Test CA Certificate"), + BigInteger.valueOf(1), + new Date(baseTime), + new Date(baseTime + validityPeriod), + new X500Principal("CN=Test CA Certificate"), + pair.getPublic() + ); + var signer = new JcaContentSignerBuilder("SHA256withRSA").build(pair.getPrivate()); + return certBuilder.build(signer); + } finally { + Locale.setDefault(originalLocale); + TimeZone.setDefault(originalTimeZone); + } } } From fd5bc29b6619ea3eaac33d07dcdc8e40b8b564f4 Mon Sep 17 00:00:00 2001 From: Craig Perkins Date: Wed, 17 Sep 2025 16:12:38 -0400 Subject: [PATCH 2/4] Add to CHANGELOG Signed-off-by: Craig Perkins --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c9c5287f9bffc..774ee06bd5931 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - Fix QueryPhaseResultConsumer incomplete callback loops ([#19231](https://github.com/opensearch-project/OpenSearch/pull/19231)) - Fix the `scaled_float` precision issue ([#19188](https://github.com/opensearch-project/OpenSearch/pull/19188)) - Fix Using an excessively large reindex slice can lead to a JVM OutOfMemoryError on coordinator.([#18964](https://github.com/opensearch-project/OpenSearch/pull/18964)) +- [Flakey Test] Fix flakey tests in SecureReactorNetty4HttpServerTransportTests ([#19327](https://github.com/opensearch-project/OpenSearch/pull/19327)) ### Dependencies - Bump `com.netflix.nebula.ospackage-base` from 12.0.0 to 12.1.0 ([#19019](https://github.com/opensearch-project/OpenSearch/pull/19019)) From ffc88bfeea8763fc09ee7b13adff6dba2bd4f5a4 Mon Sep 17 00:00:00 2001 From: Craig Perkins Date: Thu, 18 Sep 2025 09:50:09 -0400 Subject: [PATCH 3/4] Address review comments Signed-off-by: Craig Perkins --- CHANGELOG.md | 2 +- .../org/opensearch/test/KeyStoreUtils.java | 43 ++++++++----------- 2 files changed, 18 insertions(+), 27 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 774ee06bd5931..7a9c2a3380d6a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,7 +51,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - Fix QueryPhaseResultConsumer incomplete callback loops ([#19231](https://github.com/opensearch-project/OpenSearch/pull/19231)) - Fix the `scaled_float` precision issue ([#19188](https://github.com/opensearch-project/OpenSearch/pull/19188)) - Fix Using an excessively large reindex slice can lead to a JVM OutOfMemoryError on coordinator.([#18964](https://github.com/opensearch-project/OpenSearch/pull/18964)) -- [Flakey Test] Fix flakey tests in SecureReactorNetty4HttpServerTransportTests ([#19327](https://github.com/opensearch-project/OpenSearch/pull/19327)) +- [Flaky Test] Fix flakey tests in SecureReactorNetty4HttpServerTransportTests ([#19327](https://github.com/opensearch-project/OpenSearch/pull/19327)) ### Dependencies - Bump `com.netflix.nebula.ospackage-base` from 12.0.0 to 12.1.0 ([#19019](https://github.com/opensearch-project/OpenSearch/pull/19019)) diff --git a/test/framework/src/main/java/org/opensearch/test/KeyStoreUtils.java b/test/framework/src/main/java/org/opensearch/test/KeyStoreUtils.java index 9018bf575f0ab..fac7c96825acd 100644 --- a/test/framework/src/main/java/org/opensearch/test/KeyStoreUtils.java +++ b/test/framework/src/main/java/org/opensearch/test/KeyStoreUtils.java @@ -8,9 +8,11 @@ package org.opensearch.test; +import org.bouncycastle.asn1.x500.X500Name; +import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo; import org.bouncycastle.cert.X509CertificateHolder; +import org.bouncycastle.cert.X509v1CertificateBuilder; import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; -import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; import javax.security.auth.x500.X500Principal; @@ -23,7 +25,6 @@ import java.security.cert.X509Certificate; import java.util.Date; import java.util.Locale; -import java.util.TimeZone; public class KeyStoreUtils { @@ -51,31 +52,21 @@ private static X500PrivateCredential createCredential() throws Exception { } private static X509CertificateHolder generateCert(KeyPair pair) throws Exception { - // Use UTC timezone and ROOT locale to avoid locale-specific date formatting issues - var originalLocale = Locale.getDefault(); - var originalTimeZone = TimeZone.getDefault(); - try { - Locale.setDefault(Locale.ROOT); - TimeZone.setDefault(TimeZone.getTimeZone("UTC")); + var baseTime = System.currentTimeMillis(); + // 10 years in milliseconds + var validityPeriod = 10L * 365 * 24 * 60 * 60 * 1000; - var baseTime = System.currentTimeMillis(); - // 10 years in milliseconds - var validityPeriod = 10L * 365 * 24 * 60 * 60 * 1000; - - var certBuilder = new JcaX509v1CertificateBuilder( - new X500Principal("CN=Test CA Certificate"), - BigInteger.valueOf(1), - new Date(baseTime), - new Date(baseTime + validityPeriod), - new X500Principal("CN=Test CA Certificate"), - pair.getPublic() - ); - var signer = new JcaContentSignerBuilder("SHA256withRSA").build(pair.getPrivate()); - return certBuilder.build(signer); - } finally { - Locale.setDefault(originalLocale); - TimeZone.setDefault(originalTimeZone); - } + var certBuilder = new X509v1CertificateBuilder( + X500Name.getInstance(new X500Principal("CN=Test CA Certificate").getEncoded()), + BigInteger.valueOf(1), + new Date(baseTime), + new Date(baseTime + validityPeriod), + Locale.ROOT, + X500Name.getInstance(new X500Principal("CN=Test CA Certificate").getEncoded()), + SubjectPublicKeyInfo.getInstance(pair.getPublic().getEncoded()) + ); + var signer = new JcaContentSignerBuilder("SHA256withRSA").build(pair.getPrivate()); + return certBuilder.build(signer); } } From 11ef71dde73adc911c17205c80975d885bf2a414 Mon Sep 17 00:00:00 2001 From: Craig Perkins Date: Thu, 18 Sep 2025 09:50:47 -0400 Subject: [PATCH 4/4] Address review comments Signed-off-by: Craig Perkins --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7a9c2a3380d6a..e6616149af2dd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,7 +51,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - Fix QueryPhaseResultConsumer incomplete callback loops ([#19231](https://github.com/opensearch-project/OpenSearch/pull/19231)) - Fix the `scaled_float` precision issue ([#19188](https://github.com/opensearch-project/OpenSearch/pull/19188)) - Fix Using an excessively large reindex slice can lead to a JVM OutOfMemoryError on coordinator.([#18964](https://github.com/opensearch-project/OpenSearch/pull/18964)) -- [Flaky Test] Fix flakey tests in SecureReactorNetty4HttpServerTransportTests ([#19327](https://github.com/opensearch-project/OpenSearch/pull/19327)) +- [Flaky Test] Fix flaky test in SecureReactorNetty4HttpServerTransportTests with reproducible seed ([#19327](https://github.com/opensearch-project/OpenSearch/pull/19327)) ### Dependencies - Bump `com.netflix.nebula.ospackage-base` from 12.0.0 to 12.1.0 ([#19019](https://github.com/opensearch-project/OpenSearch/pull/19019))