Hey one check on my PR is failing due to the use of a potent Apache Druid #dev

Hey, one check on my PR is failing due to the use ...

Ashi Bhardwaj

07/31/2025, 2:01 PM

Hey, one check on my PR is failing due to the use of a potentially broken or risky cryptographic algorithm in

processing/src/main/java/org/apache/druid/crypto/CryptoService.java

. I have only made changes to pac4j extension in this PR and didn't change the algorithm and fixing this unrelated check will require significant change and testing in the other module. How can I get my PR merged in such a scenario? CC: @Lucas Capistrant (since you've been reviewing the PR)

Gian Merlino

08/02/2025, 9:08 AM

Hard to say without looking at the PR. Which one is it?

Ashi Bhardwaj

08/02/2025, 9:09 AM

https://github.com/apache/druid/pull/18259

Ashi Bhardwaj

08/21/2025, 1:42 PM

Hey folks, can I please get some help here? I also want to mention that we have pushed this upgrade to production without any issues.

Ashi Bhardwaj

08/21/2025, 1:55 PM

I also want to reiterate that the failing check is unrelated to my change and is only getting triggered because the placement of code lines have changed. I do not have enough context on which crypto algo we should be using instead either.

Ashi Bhardwaj

08/23/2025, 4:42 PM

I have excluded the

potentially-weak-cryptographic-algorithm

codeQL check for my PR and now all github checks are passing. I will add it back as soon as my PR is merged as mentioned in the PR description as well. Can I please get this reviewed and merged? We have been running this pac4j upgrade in our production clusters at Confluent without any issues for a while now and it significantly improves the security posture of Druid by fixing severe vulnerabilities. cc: @Lucas Capistrant @Gian Merlino

Ashi Bhardwaj

09/01/2025, 9:05 AM

The PR has been reviewed and approved. Can we please merge it now? Thanks

Open in Slack

Previous Next