Skip to content

private key signer#110

Draft
anniefrchz wants to merge 182 commits intoin_memory_providerfrom
private_key_signer
Draft

private key signer#110
anniefrchz wants to merge 182 commits intoin_memory_providerfrom
private_key_signer

Conversation

@anniefrchz
Copy link
Owner

  • Split providers
  • Rename setter methods for providers
  • Fix python tests
  • Replace StaticDataProvider with InMemoryCertificateProvider
  • Remove lingering PrivateKey code on cpp api
  • Use std::move on providers for tests and fix other nits
  • Introduce legacy_certificate_provider in cpp/tls_credentials_options
  • Define a factory method for TlsServerCredentialsOptions
  • Use C++14 deprecate annotations
  • Replace StaticDataProvider with InMemoryCertificateProvider
  • Remove lingering PrivateKey code on cpp api
  • Add tests for InMemoryCertificateProvider c++ wrapper API
  • Replace StaticDataProvider with InMemoryCertificateProvider
  • Remove lingering PrivateKey code on cpp api
  • Initial merge for TLS Offload
  • Delegate TlsOffloadContext cleanup to ssl_transport_security after Cancel
  • Remove duplication for OnCertificatesChanges call
  • Replace StaticDataProvider with InMemoryCertificateProvider
  • Remove lingering PrivateKey code on cpp api
  • Add tests for InMemoryCertificateProvider c++ wrapper API
  • Replace StaticDataProvider with InMemoryCertificateProvider
  • Remove lingering PrivateKey code on cpp api
  • Fix GrpcTlsCredentialsOptionsTest
  • [TlsCRedentials]: Reapply allow using a separate cert provider for root and identity certs
  • Replace StaticDataProvider with InMemoryCertificateProvider
  • Remove lingering PrivateKey code on cpp api
  • Add tests for InMemoryCertificateProvider c++ wrapper API
  • Replace StaticDataProvider with InMemoryCertificateProvider
  • Remove lingering PrivateKey code on cpp api
  • Replace StaticDataProvider with InMemoryCertificateProvider
  • Remove lingering PrivateKey code on cpp api
  • Initial merge for TLS Offload
  • Delegate TlsOffloadContext cleanup to ssl_transport_security after Cancel
  • Define IdentityKeyOrSignerCertPair struct to avoid breaking existing API usage
  • Define IdentityKeyOrSignerCertPair and add Async end2end tests

@anniefrchz anniefrchz changed the base branch from master to in_memory_provider January 27, 2026 17:34
@anniefrchz anniefrchz force-pushed the in_memory_provider branch 2 times, most recently from 70cc832 to f05eb93 Compare January 30, 2026 20:30
yaml-cpp@0.9.0 is released at
bazelbuild/bazel-central-registry#7443

<!--

If you know who should review your pull request, please assign it to
that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the
appropriate
lang label.

-->
@anniefrchz anniefrchz force-pushed the in_memory_provider branch 2 times, most recently from b87b7f1 to 8cfae6b Compare February 10, 2026 19:18
PiperOrigin-RevId: 868250332
@anniefrchz anniefrchz force-pushed the private_key_signer branch 3 times, most recently from 4fc43a1 to 69c6913 Compare February 10, 2026 22:27
yuanweiz and others added 12 commits February 10, 2026 15:31
The `grpc_bazel_c_cpp_{opt,dbg}` tests are failing with timeout (most failures are under `//test/core/end2end` ). The exact cause isn't clear (might be bzlmod causing slower compilation). Try increasing the timeout to see if the error goes away.
 https://fusion2.corp.google.com/ci;ids=1930537984/kokoro/prod:grpc%2Fcore%2Fmaster%2Fmacos%2Fgrpc_bazel_c_cpp_dbg/activity/0d32a035-4712-49af-9f20-e90d065e3ae0/summary

Closes grpc#41596

COPYBARA_INTEGRATE_REVIEW=grpc#41596 from yuanweiz:fix-macos-ci bf8754f
PiperOrigin-RevId: 868346260
Changes in parser:
- add support for max recursion depth limit
- add support for keep_matching
- check if field is unset
- eliminate unnecessary `ParseStringMatcher()` function

Changes in matcher:
- fix edge case in `XdsMatcherPrefixMap`
- add `ForEachAction()` method, which will be needed by composite filter
- split matcher and matcher context into separate build targets

b/431645556
b/431645620

Closes grpc#41500

COPYBARA_INTEGRATE_REVIEW=grpc#41500 from markdroth:xds_matcher_polish f41a36e
PiperOrigin-RevId: 868440217
PiperOrigin-RevId: 868492036
…ficates independently (grpc#41484)

<!--

If you know who should review your pull request, please assign it to that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the appropriate
lang label.

-->

Closes grpc#41484

COPYBARA_INTEGRATE_REVIEW=grpc#41484 from anniefrchz:in_memory_provider d5c64b9
PiperOrigin-RevId: 868750621
…rpc#41597)

These tests don't work with the `Chttp2SocketPair` or `Chttp2SocketPair1ByteAtATime` fixtures, since they use direct channels.

Closes grpc#41597

COPYBARA_INTEGRATE_REVIEW=grpc#41597 from markdroth:connection_scaling_test_fix 6a5c84f
PiperOrigin-RevId: 868763207
yaml-cpp@0.9.0 is released at
bazelbuild/bazel-central-registry#7443

<!--

If you know who should review your pull request, please assign it to
that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the
appropriate
lang label.

-->
PiperOrigin-RevId: 868250332
The `grpc_bazel_c_cpp_{opt,dbg}` tests are failing with timeout (most failures are under `//test/core/end2end` ). The exact cause isn't clear (might be bzlmod causing slower compilation). Try increasing the timeout to see if the error goes away.
 https://fusion2.corp.google.com/ci;ids=1930537984/kokoro/prod:grpc%2Fcore%2Fmaster%2Fmacos%2Fgrpc_bazel_c_cpp_dbg/activity/0d32a035-4712-49af-9f20-e90d065e3ae0/summary

Closes grpc#41596

COPYBARA_INTEGRATE_REVIEW=grpc#41596 from yuanweiz:fix-macos-ci bf8754f
PiperOrigin-RevId: 868346260
Changes in parser:
- add support for max recursion depth limit
- add support for keep_matching
- check if field is unset
- eliminate unnecessary `ParseStringMatcher()` function

Changes in matcher:
- fix edge case in `XdsMatcherPrefixMap`
- add `ForEachAction()` method, which will be needed by composite filter
- split matcher and matcher context into separate build targets

b/431645556
b/431645620

Closes grpc#41500

COPYBARA_INTEGRATE_REVIEW=grpc#41500 from markdroth:xds_matcher_polish f41a36e
PiperOrigin-RevId: 868440217
anniefrchz and others added 26 commits February 25, 2026 21:50
PiperOrigin-RevId: 875435890
1. Define : `GetSocketNode` , `StartWatch` , `StopWatch` , `NotifyStateWatcherOnDisconnectLocked` , `ProcessOneIncomingFrame` , `ProcessMetadata` , `ParseAndDiscardHeaders` ,

2. Partially Define : `ProcessIncomingFrame` - for many types of frames

3. Private : Move the functions watcher function to private section

4. Constructor : Initialize essential data members in the Constructor

5.

PiperOrigin-RevId: 875482792
…der a flag.

- [tcp_frame_transport] Add instrumentation to collect newly added Xprof profiling specific metrics
- [tcp_ztrace_collector.h] Update existing events and add new events to support detailed xprof profiling.

PiperOrigin-RevId: 875538952
1. Removing stale functions

2. Refactor UntilTransportClosed

PiperOrigin-RevId: 875582778
This adopts grpc#40660.

Some extra change: force pip_parse() to use py3.11 via `python_interpreter_target` since it defaults to use system python.

<!--

If you know who should review your pull request, please assign it to that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the appropriate
lang label.

-->

Closes grpc#41684

PiperOrigin-RevId: 875648982
1. Moved the Endpoint Read/Write section because they need to be above the promises that use them

2. Copied from http_client_transport.h,cc - `MaybeGetWindowUpdateFrames` , `ReportDisconnection` , `ReportDisconnectionLocked` , `SetOnDone`

PiperOrigin-RevId: 875682984
…ks (grpc#41683)

When the process forks with the `event_engine_fork` experiment enabled, the poller in the fork child calls `ShutdownHandle` on each existing handle in the list `poll_handles_list_head_`. The assumption seems to be that the callbacks scheduled by that `ShutdownHandle` call will eventually call `OrphanHandle`, which removes the handle from the list. This log line in the `Work` method is triggered when the poller tries to poll on its handles and there are still handles in that list that are from before the fork. It seems likely to me that this condition will be met in normal operation, because that `OrphanHandle` call can race with calls to `Work`, and the log does not seem to indicate that anything incorrect is happening, because the poller doesn't actually try to poll on that handle. However, this could potentially indicate that there is a bug that causes the handle to never be removed from the list. So, I think warning is an appropriate severity level.

If any users report that they are getting unreasonable floods of these logs, then that would indicate that  there is a bug that is causing handles to never be removed from the list, and at that point we should investigate further.

Edit: After discussing this with Mark, I downgraded the log severity further to INFO, because it is not meaningfully actionable by the user.

<!--

If you know who should review your pull request, please assign it to that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the appropriate
lang label.

-->

Closes grpc#41683

COPYBARA_INTEGRATE_REVIEW=grpc#41683 from murgatroid99:fork_fd_error_log_change 5907928
PiperOrigin-RevId: 875843018
Related Issue: grpc#41703

This PR mainly updates the name resolution logic in `artifact_gen`, so canonical names (such as `abseil-cpp`) can be mapped to their apparent names (e.g. `com_google_absl`).

This should (almost) make `generate_projects.sh` (and by extension, cmake/php pear etc) work with bzlmod fully enabled. The only part that can't be migrated yet is this query:

```
tools/bazel query --noimplicit_deps --output=xml 'kind(http_archive, //external:*)'
```

Which relies on `//external:*`, a pseudo-target that is no longer available in bzlmod.

Next:
* Find a way to retrieve `http_archive` metadata without using `//external`.
* Remove the override options (`--[no]enable_bzlmod`, `--[no]enable_workspace`) and use `tools/bazel.rc` as single source of truth.

Closes grpc#41687

PiperOrigin-RevId: 875865572
An Options struct is added to allow configuration of connection shards and reserved threads.

A CancelAllPendingTimers method is added to allow canceling all timers during shutdown.

PiperOrigin-RevId: 875920787
PiperOrigin-RevId: 876025941
Closes grpc#41662

COPYBARA_INTEGRATE_REVIEW=grpc#41662 from rishesh007:header_mutation_rules cdb6a49
PiperOrigin-RevId: 876105954
…nting negative active_rpcs count (grpc#41532)

## Summary

The `_ConcurrentRpcLimiter` only increments `_active_rpcs` when a request is accepted, but `decrease_once_finished()` was always called for all requests. This caused the counter to go negative when rejected requests finished, effectively disabling the `maximum_concurrent_rpcs` limit.

## Fix

Only register the decrement callback for requests that were actually counted (when `concurrency_exceeded` is `False`).

Fixes grpc#41531

Closes grpc#41532

COPYBARA_INTEGRATE_REVIEW=grpc#41532 from robinvd:fix-concurrent-rpc-limiter-underflow 5047e25
PiperOrigin-RevId: 876177526
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.