Add generic server-sent events support to Azure Core - #32
Closed
XiaofeiCao wants to merge 50 commits into
Closed
Conversation
* Fix Redis Enterprise live test creation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert temporary Redis Enterprise API version Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove retired Redis Enterprise live tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Increment package versions for authorization releases * Add authorization 2.53.11 changelog Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update SQL authorization test dependency Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: azure-sdk <azuresdk@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Azure#50074) * Remove Storage Mover management test pipeline Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Warm Chaos authentication before live test Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use Resources inner client for auth warm-up Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Warm Machine Learning authentication before live test Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 --------- Copilot-Session: b6797498-e941-465a-b215-87ed36922894
* Clean up Cosmos test databases left behind by CI runs
Six live test stages in sdk/cosmos/tests.yml run against long lived shared
accounts (thin client, thin client canaries, GSI) that are never torn down and
are used by several matrix legs and pipeline runs concurrently. Databases a test
forgot to delete stayed on those accounts permanently:
- cleanupStaleTestDatabases only recognized ids starting with
"RxJava.SDKTest.SharedDatabase", so tests naming databases with raw UUIDs or
fixed literals leaked forever.
- Cleanup only ran at @AfterSuite, so a cancelled job or one hitting its
210 minute timeout killed the JVM and leaked everything it had created.
Every test created database id now carries a run id derived from System.JobId,
which lets cleanup delete exactly what the current run created without touching
resources a concurrently executing leg is still using. Cleanup runs in four
layers: an in-JVM registry plus a TestNG listener that deletes leftovers and
fails the run naming the offending test, a JVM shutdown hook, an always() post
step per stage, and a new six-hourly janitor pipeline for jobs that died before
anything in them could run.
To stop new tests reintroducing the problem, TestSuiteBase gains sanctioned
createTestDatabase helpers that name and register automatically, the arbitrary
id creators are deprecated, and TestResourceHygieneTest ratchets against direct
database creation using a checked in baseline.
Also fixes a latent NPE and an unsafe 2 hour cleanup threshold in the
azure-cosmos copy of DatabaseForTest, which the new four segment ids would
otherwise have triggered.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Declare the Cosmos test secrets variable group in janitor.yml
Linking a variable group on the pipeline definition is how sdk/cosmos/tests.yml
works, but that linkage is applied by the engineering system's pipeline
generator. janitor.yml needs a hand created definition, so declare the group in
YAML instead - creating the pipeline then only requires authorizing the group
for it.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Validate test database ids at creation, and fix cspell
The static ratchet in TestResourceHygieneTest counts creation call sites per
file, so it cannot see three ways a database can still end up with a name CI
cleanup will never find:
- an id built at runtime rather than written literally,
- an id swapped inside one of the 56 files that already carry a baseline
allowance, with the call count unchanged,
- creation through an API the scanner does not match on.
All three matter specifically when the JVM is killed - a cancelled or timed out
job - because the pipeline post step and the scheduled janitor locate databases
by name, so a wrongly named one is invisible to both and leaks permanently on a
shared account.
CosmosTestResourceRegistry now rejects, at registration time, any database id
that does not parse as a test id, failing the test immediately and naming the
offender. Containers are validated on their parent database, since deleting a
database reclaims them. Verified by reproducing all three vectors: the swapped
id inside a baselined file passes the static ratchet and is caught here.
Also add a cspell override for the two changed markdown files. The flagged
tokens are JVM system property flags (-DACCOUNT_HOST, -Dcodesnippet.skip,
-DCOSMOS...); those in dev.md are pre-existing and only surfaced because the
file is now part of the diff. Verified with the same command CI runs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address review feedback on the test resource registry and guard
- registerDatabase / registerContainer used put, so re-registering an existing
resource (createDatabaseIfNotExists, or a container recreated with the same
id) reattributed it to whichever test touched it last, defeating the point of
naming the creator in a leak report. Use putIfAbsent; a genuine
delete-then-recreate still records the new owner because unregister removes
the entry first.
- The run id hash was CRC32, and the comment claimed collisions were
"structurally impossible". CRC32 is 32 bits, so that was wrong. Use a
truncated SHA-256 (56 bits) and state the real guarantee: the job id makes the
hash input unique per leg, and a collision is negligible rather than
impossible. Id shape is unchanged - 20 chars, build id still readable.
- METHOD_DECLARATION required a leading modifier, so package-private
declarations were counted as violations. Key the match on the
<returnType> <name>(...) { shape instead, which a call never has. Regenerated
violation counts are identical to the baseline, so nothing is newly skipped.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Isolate registry state between unit test classes
CosmosDatabaseForTestTest asserted on the size of the JVM-global registry
snapshot, so it failed whenever CosmosTestResourceJanitorTest ran first and left
an entry behind. That is ordering dependent, which is why it passed locally and
on the macOS leg but failed on ubuntu2404_18.
Clear the registry before and after every method in both classes, and assert
that the specific database id is present rather than counting global entries.
Verified in both class orderings and against the full unit suite (2659 tests).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Name the test, not the helper, in leak reports
The first CI run with the janitor enabled reported leaks as "created by
com.azure.cosmos.rx.TestSuiteBase.createDatabaseInternal", which identifies the
shared helper rather than the test that leaked - useless for acting on the
report, and the report naming the offender is the whole point.
Skip the shared test infrastructure when walking the stack for an owner, and
fall back to an infrastructure frame (marked as such) only when no test frame is
on the stack at all.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Use an absolute link to the Cosmos AGENTS.md
Verify Links rejects relative links, and the anchored form was additionally
flagged as invalid format:
DO NOT use relative link AGENTS.md#test-resource-hygiene-...
'sdk/cosmos/dev.md' has 1 broken link(s)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Delete the databases three CosmosDiagnosticsTest tests created
The janitor's first CI run found these, which is what it is for:
negativeE2ETimeoutWithPointOperation
negativeE2ETimeoutWithQueryOperation
responseStatisticRequestStartTimeUTCForDirectCall
Each creates a database and its finally block only closes the client, so the
database survives the run. Harmless on the emulator, but these tests also run
against the shared fixed accounts, where it is a permanent leak.
Delete the database before closing the client that owns it.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Shorten generated test database ids
ThroughputControlTests fails on this branch with
ThroughputControlInitializationException
caused by CosmosException 400, body "<h2>Bad Request - Invalid URL</h2>"
and the failure count tracked the length of the shared database id: 1 failure at
a 103 character id, 12 at 108. The same tests pass on main, where the id is 82
characters (build 6635933, 124 successful invocations), so this is caused by
this branch, not pre-existing.
The database id is not used only as a database name. Throughput control derives
a group id of <database>/<container>/<group>/<suffix>, base64 encodes it and
appends a UUID to form a control item id, so every character added here is
amplified. I could not pin the exact limit from the logs - the arithmetic says
main should already exceed 255 characters, yet main passes - so rather than
guess at a threshold, bring the id back well under the length that is known to
work.
shared database id: 109 -> 71 characters
worst case with a label: 81 characters
Achieved by replacing the UUID random suffix with 8 alphanumerics, capping the
run id at 16 characters and labels at 10, and dropping the label from the shared
database. Uniqueness is unaffected: the timestamp and run id already scope the
id, and 36^8 random values sit underneath. Both limits are pinned by assertions
so this cannot silently regrow.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix the cleanup post step, and the leak it found on the live accounts
First live run of this change (build 6646150): 68 of 76 legs green, including
every thin client, GSI, Spring and Spark leg. Two real problems in the other 8.
1. The always-run cleanup post step never deleted anything. It failed with
Could not find artifact com.azure:azure-cosmos:jar:4.82.0-beta.1
because it did not pass DefaultOptions, so Maven resolved against the agent's
default ~/.m2 instead of $(MAVEN_CACHE_FOLDER) where the built jar lives.
continueOnError masked it as SucceededWithIssues. Pass DefaultOptions in both
cleanup-test-resources.yml and janitor.yml, and align janitor.yml's build step
so install and exec:java share one local repository.
This is the layer that covers a dead JVM, so it was the least visible and the
most important to fix.
2. PermissionCrudTest created a database in @BeforeClass and only closed the
client in @afterclass, leaking it on every "fast" leg - 6 of the 8 failures,
all attributed to before_PermissionCrudTest by the janitor. Delete it.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Never let cleanup turn a live test job red
Build 6651706 failed ~50 of 76 legs, up from 8. The underlying cause is
infrastructure: the agents cannot resolve the fixed Cosmos account hosts.
java.net.UnknownHostException: sdkci-multiregion-strong.documents.azure.com
[ERROR] Tests run: 78, Failures: 1, Errors: 0, Skipped: 77
The 77 skips are the tell - the account is unreachable, so the tests never run.
The cleanup post step then added a second error to every one of those legs. That
part is mine. Making it resolve artifacts correctly (previous commit) meant it
finally reached the account, where it hit the same DNS failure, and a failing
Maven task reports ##[error] even with continueOnError.
Cleanup failing says nothing about the code under test, and it fails precisely
when the tests were already broken, so it must not be able to fail a job. Run it
through a script that reports problems as warnings and always exits 0. Anything
it cannot delete is left to the scheduled janitor, which is the actual backstop.
Also passes the account host and key as environment variables rather than on the
command line, so the key is not echoed into the log.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Apply Cosmos account capabilities on create, not just on reconcile
Provisioning a fresh tenant produced 18 accounts with no capabilities at all,
so every vector-search test failed with
A Container Vector Policy has been provided, but the capability has not been
enabled on your account
New-AzCosmosDBAccount -Capabilities is silently ignored by some Az.CosmosDB
versions (seen on Az 12.2.0). The script only reconciled capabilities on its
already-exists path, so the fix was to run the whole script a second time -
easy to miss, and it makes every 90 day tenant rotation a two pass job.
Stop passing capabilities to New-AzCosmosDBAccount and always reconcile through
ARM PATCH after the account exists, on both the create and the exists path. The
outcome no longer depends on module behaviour, and the PATCH is now verified
(polled for up to 5 minutes) so a run cannot report success while leaving
accounts the tests will fail against.
Verified against the live sdk-ci accounts: -WhatIf still PATCHes nothing and
emits only stubbed keys, and a real run is idempotent - 15 accounts report
"capabilities up to date" with zero unnecessary PATCH calls.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Provision the GSI account in the region its tests prefer
The GSI live stage was failing with
java.net.UnknownHostException: gsi-pipeline.documents.azure.com
java.net.UnknownHostException: gsi-pipeline-eastus2.documents.azure.com
Tests run: 22, Failures: 1, Errors: 0, Skipped: 21
because those accounts went away with the old ephemeral tenant. The definition
already had a gsi-single-session entry, but it inherited regionDefaults.singleRegion
(Central US), while live-gsi-platform-matrix.json runs GSI single-region with
PREFERRED_LOCATIONS=["East US 2"]. An account without the preferred region leaves
the client with nothing to prefer, which is presumably why the original account
lived in East US 2.
Let a definition entry pin its own regions, and use it for gsi-single-session.
Recreated sdkci-gsi-single-session in East US 2 (the Central US one was empty and
unreferenced - the stage still points at the old gsi-pipeline-* secrets).
The stage reads $(gsi-pipeline-uri)/$(gsi-pipeline-key) rather than the account
resolver, so those two secrets still have to be repointed at the new account by
hand; that is a separate change from this script.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Give each Scala module its own compiler-bridge cache
java - cosmos - ci has been red for over a week on main with
[ERROR] ## Exception when compiling 134 sources to .../azure-cosmos-spark_3-3_2-12/target/classes
java.lang.ClassNotFoundException: xsbt.CompilerInterface
at sbt.internal.inc.AnalyzingCompiler.getBridgeClass(AnalyzingCompiler.scala:372)
with the module and the missing class varying between runs (main build 6631046
failed on azure-cosmos-spark_3-4_2-12 with xsbt/WeakLog instead).
scala-maven-plugin's secondaryCacheDir defaults to the shared, global
~/.sbt/1.0/zinc/org.scala-sbt. sbt_inc.CompilerBridgeFactory installs the bridge
by checking targetJar.exists(), compiling into a temp dir, then calling
sbt.io.IO.jar() straight onto the final path - no lock, no temp-then-rename.
cosmos-sdk-client.yml builds with -T 2, so two Scala modules of the same Scala
version both see "not installed yet", both compile, and both write the same jar.
Whichever module reads it mid-write gets a truncated zip, which surfaces as
whichever xsbt class happened to be missing. ~/.sbt is not covered by the Maven
pipeline cache, so the bridge is cold on every run and the race fires nearly
every time.
Point secondaryCacheDir at ${project.build.directory} so no two modules share a
bridge jar. This also makes concurrent Maven processes on one agent safe.
Costs one bridge compile per Scala module (~7-8s) instead of one per Scala
version. Upgrading doesn't help - 4.9.10 still has no lock and no atomic rename.
Verified with -T 2 and a cold cache on the two modules that raced: each used its
own target/scala-compiler-bridge, ~/.sbt/1.0/zinc was never created, and
help:effective-pom confirms all nine Scala-compiling modules resolve to their own
target dir (including the grandchildren under azure-cosmos-spark_3-5 and
azure-cosmos-spark_4, which redefine the build-scala profile).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Keep the new cosmos spellings in the cosmos cspell config
The Maven flag fragments picked up from AGENTS.md and dev.md (DACCOUNT,
Dcodesnippet, DCOSMOS) belong with the other cosmos-only words rather than in the
repo-wide dictionary, so fold them into the existing "**/sdk/cosmos/*" override
and leave .vscode/cspell.json untouched.
check-spelling.yml passes CspellConfigPath: .vscode/cspell.json, but cspell still
discovers sdk/cosmos/cspell.yaml for files under sdk/cosmos and that file imports
../../.vscode/cspell.json, so the repo-wide dictionary is not lost. Verified with
the pinned cspell 10.0.1 using the same invocation Invoke-Cspell.ps1 makes
(lint --config .vscode/cspell.json --no-must-find-files --root <repo> --file-list
stdin): 0 issues with the words here, and 8 unknown-word errors with them removed
from both configs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Drop the scheduled janitor pipeline for now
janitor.yml never had an ADO pipeline definition created for it, in either the
internal or the public project, so it was inert YAML describing a sweep that has
never run. Rather than ship a layer that only looks like it works, take it out
and add it back with the definition.
That leaves the age based sweep with no automated caller, so remove it too:
--older-than, CosmosDatabaseForTest.cleanupTestDatabasesOlderThan, and the unit
test pinning it. The per-job post step deletes by run id and needs none of it.
parse() keeps parsing the timestamp - a malformed one is what makes an id "not
ours" and therefore skipped - but no longer stores it, since deletion is only
ever run scoped. ParsedId.createdTime and the now unused idFor overload go with
it.
The remaining three layers are unchanged and confirmed working in CI. The gap
this leaves is a cancelled or timed out job, where the post step can be cut off
by cancelTimeoutInMinutes; nothing reclaims those orphans until the scheduled
sweep comes back. AGENTS.md, cleanup-test-resources.yml and the PR description
say so rather than implying a backstop that no longer exists.
Nothing here deletes another run's resources, so removing the sweep cannot
introduce a cross-run delete: cleanupDatabasesForRun still rejects an empty run
id and still matches with StringUtils.equals, so a legacy id (runId null) can
never match a run scoped delete.
Unit suite: 2658 tests, one fewer than before, matching the single removed test.
The three affected classes pass 22/22.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…chain completion (Azure#47977) * Initial plan * Add test to verify certificate chain ordering Co-authored-by: rujche <171773178+rujche@users.noreply.github.com> * Implement certificate chain ordering fix for jarsigner compatibility Co-authored-by: rujche <171773178+rujche@users.noreply.github.com> * Address code review feedback - improve test assertions Co-authored-by: rujche <171773178+rujche@users.noreply.github.com> * Fix SpotBugs warning - remove redundant null check Co-authored-by: rujche <171773178+rujche@users.noreply.github.com> * Complete certificate chain via AIA extension for non-exportable certificates When a non-exportable Azure Key Vault certificate is used with jarsigner, the /secrets/ endpoint returns only the leaf certificate (no intermediate CAs). This causes jarsigner -verify to fail with: PKIX path building failed: unable to find valid certification path to requested target Fix: after loading certificates from the AKV secret bundle, walk the chain upward from the current top. If the top cert is not self-signed (i.e. the chain is incomplete), parse the AIA (Authority Information Access) extension (OID 1.3.6.1.5.5.7.1.1) to find the CA Issuers URL and download the missing intermediate CA certificate. Repeat until the chain reaches a self-signed root CA. Changes: - CertificateUtil: add completeChainViaAia() and downloadIssuerCertificateFromAia() methods; call completeChainViaAia() from loadCertificatesFromSecretBundleValue() after ordering - HttpUtil: add getBytes(String url) for binary (DER) certificate downloads - AiaCertificateChainTest: 10 unit tests including two PKIX path-building tests that reproduce the exact reported error and confirm it is resolved Fixes: Azure#44267 * Update CHANGELOG for AIA certificate chain fix * Add INFO/WARNING logs for AIA chain completion cases * Address code review feedback - orderCertificateChain: append any unplaced certificates (e.g. cross-signed roots) after the ordered chain so nothing is silently dropped - completeChainViaAia: validate downloaded cert's subject DN matches the expected issuer DN, and skip if already present in chain (duplicate guard) - AiaCertificateChainTest: replace System.currentTimeMillis() serial numbers with AtomicLong counter to avoid duplicate serials in back-to-back cert generation * fix: Apply code review feedback on certificate chain completion - Use String.valueOf() to guard against null getMessage() across different JDKs/providers - Use X500Principal equality for DN comparison instead of string-based comparison - Add connect/response timeouts (10s) to HTTP request to prevent indefinite hangs during AIA chain download * fix: Rename test methods to follow camelCase naming convention - Rename all AIA and PKIX test methods from underscore_separated style to camelCase - Maintains java.util.logging.Logger consistent with KeyVaultClient and project patterns - Resolves checkstyle MethodNameCheck violations * refactor: Change AIA chain completion logs to DEBUG level Convert AIA certificate chain completion logs to FINE (DEBUG) level: - Certificate chain completion status logs → FINE - Download success/progress logs → FINE - Download failure logs → FINE (non-critical fallback) - DN mismatch validation errors → WARNING (kept as critical error signal) This reduces log noise for normal users while keeping detailed diagnostics available for debugging when explicitly enabled via logging configuration. * feat: Add debug logging for certificate chains Add detailed DEBUG-level logging to print certificate chains at key points: - After ordering certificate chain (leaf → intermediate(s) → root) - After AIA completion (with missing intermediates downloaded) For each certificate, logs: - Subject DN - Issuer DN - Whether it's self-signed This helps with troubleshooting certificate chain issues by showing: - Correct leaf identification and ordering - AIA download progress and results - Full chain completion before jarsigner verification Example output: Certificate chain after ordering [3 certs]: [0] Subject: CN=leaf | Issuer: CN=intermediate | Self-Signed: false [1] Subject: CN=intermediate | Issuer: CN=root | Self-Signed: false [2] Subject: CN=root | Issuer: CN=root | Self-Signed: true * fix: Address security and accuracy issues in certificate chain completion Fixes three issues raised in code review: 1. Remove unused INFO import (was causing compilation warnings) 2. Improve self-signed certificate detection: - Replace simple 'subject == issuer' check with actual signature verification - Add isSelfSignedCertificate() method that verifies the certificate's signature using its own public key to confirm it's truly self-signed - Prevents early termination on self-issued certificates not actually signed by themselves 3. Strengthen issuer certificate validation: - Add isValidIssuer() method to verify downloaded certificates can actually sign the current certificate (not just have matching subject DN) - Verify issuer's signature on the current certificate before adding to chain - Check issuer has CA capabilities (self-signed or basicConstraints.CA=true) - Prevents incorrect/malicious certificates from being added due to DN collision - Protects against HTTP-based AIA attacks These changes ensure only cryptographically valid certificate chains are built. * fix: Handle cross-signed certificates and improve exception handling Addresses two code review issues: 1. Fix orderCertificateChain to handle multiple certificates with same subject DN: - Replace Map<String, X509Certificate> with Map<X500Principal, List<X509Certificate>> - Preserves multiple candidates per subject (e.g. cross-signed roots) - Selects issuer that can actually verify the current certificate's signature - Uses final reference for lambda expressions to comply with Java closures 2. Improve exception handling in HttpUtil.getBytes: - Change from catching only IOException to catching all Exceptions - Handles IllegalArgumentException from malformed AIA URLs - Prevents uncaught exceptions from breaking jarsigner/signing operations - Gracefully skips AIA completion on any HTTP error These changes ensure the certificate chain completion mechanism is robust against edge cases like cross-signed intermediates and malformed URLs. * fix: Address remaining Checkstyle and design issues in certificate chain code Fixes four code review issues: 1. Remove duplicate Collectors import that will fail Checkstyle check 2. Preserve unplaced certificates in orderCertificateChain: - Append any certificates not included in the primary chain to the result - Prevents silent dropping of cross-signed roots or extra intermediates - Ensures all loaded certificates are preserved in the output 3. Split long line exceeding 120-character Checkstyle limit: - Move inline comment explaining basicConstraints to separate comment line - Keeps code within repository's 120-character LineLength constraint 4. Remove trailing whitespace from HTTP utility exception handler: - Ensures Checkstyle passes on whitespace validation All changes maintain backward compatibility and improve code robustness. * fix: Properly handle extra certificates in AIA chain completion Addresses critical issue where orderCertificateChain appends unplaced certificates to the result, causing completeChainViaAia to incorrectly operate on wrong certs. Changes: 1. Add findValidChainEnd() helper method to identify the end of the contiguous issuer path (leaf → issuer → ...) rather than using array end. - Walks the chain verifying issuer relationships - Stops at first broken link or self-signed cert - Excludes any extra/unplaced certificates appended at end 2. Update completeChainViaAia() to use valid chain end: - Finds effective chain end before AIA completion loop - Only operates on the valid chain, not extra certs - Inserts downloaded issuers immediately after valid chain end - Preserves extra certificates at the end of array 3. Improve duplicate detection to use isValidIssuer(): - Previous logic (subject-DN equality only) could miss cross-signed certs - New logic verifies existing cert can actually validate the issuer - Checks both subject DN match AND signature verification capability This ensures: - AIA completion works only on the true chain - Cross-signed intermediates don't cause false duplicates - Extra/unplaced certs remain preserved but don't interfere with completion - Malformed AIA on extra certs won't break chain completion * fix: Correct duplicate certificate detection in AIA chain completion Previously, duplicate detection checked if an existing cert could sign the downloaded issuer cert (isValidIssuer), which typically fails because: - Both are often intermediate certs - Intermediates usually don't sign other intermediates - This allows the same issuer to be downloaded and inserted repeatedly until maxDownloads limit is hit Fixes duplicate detection to simply check if a cert with matching subject-DN already exists in the valid chain. This: - Correctly identifies when an issuer is already present - Prevents wasteful repeated downloads of the same cert - Stops AIA completion once the same issuer is encountered - Is semantically clearer: 'is this certificate already in the chain?' * fix: Improve leaf certificate selection to avoid order-dependency Previously, orderCertificateChain picked the first certificate that is not the issuer of any other cert. With multiple such candidates (e.g., leaf + self-signed root when intermediate is missing), this caused order-dependency: - First candidate found becomes 'leaf' and breaks immediately - In worst case, a root gets selected as leaf - completeChainViaAia then stops early (root is self-signed, chain 'complete') - Skips downloading missing intermediates, leaving chain invalid Improved logic now prioritizes: 1. Certs not issuing others whose issuer EXISTS in chain (true leaf/end-entity) 2. Falls back to first non-issuer if no issuer present (missing intermediate case) This ensures: - True leaves are selected when issuer is available - Order-independent: same cert chosen regardless of input order - Missing intermediates trigger AIA completion, not stopped by self-signed root - Self-signed roots only selected if no other non-issuer candidates exist * fix: Add system property to disable AIA chain completion for security Addresses security concern: completeChainViaAia can trigger outbound HTTP(S) requests to URLs embedded in certificate AIA extensions. In locked-down environments or when loading untrusted certificates, this creates potential SSRF-style attack vector or unexpected network side effects during signing. Changes: 1. Add DISABLE_AIA_DOWNLOAD_PROPERTY constant = 'azure.keyvault.jca.disableAiaDownload' Following azure.keyvault.* naming convention for system properties 2. Check system property at start of completeChainViaAia() - If set to 'true', skip AIA completion and return original chain - Log informational message that AIA is disabled - Fails closed: defaults to completing chain (existing behavior) 3. Update javadoc with security note - Document that AIA downloads can trigger outbound requests - Explain how to disable via system property - Recommend disabling in locked-down/untrusted cert scenarios This allows administrators to: - Disable AIA chain completion in secure environments - Still use the JCA provider without network-side effects - Avoid SSRF attacks from malicious certificates - Maintain backward compatibility (enabled by default) * docs: Update CHANGELOG and README with AIA disable option Add documentation for the new azure.keyvault.jca.disableAiaDownload system property in both CHANGELOG.md and README.md: - CHANGELOG: Document the new system property and security advisory - README: Add property to Exposed Options section with detailed explanation of when and how to use it for locked-down environments This completes documentation for the SSRF protection feature. * style: Rename system property to use hyphens for consistency Rename azure.keyvault.jca.disableAiaDownload to azure.keyvault.jca.disable-aia-download to follow naming convention used by other azure.keyvault properties like azure.keyvault.disable-challenge-resource-verification and azure.keyvault.jca.certificates-refresh-interval. Updates: - CertificateUtil.java: Property constant - README.md: Exposed Options documentation - CHANGELOG.md: Property description - JavaDoc: Security note * test: Add unit test for disable-aia-download system property Adds aiaDownloadDisabledBySystemProperty() test to verify: 1. System property azure.keyvault.jca.disable-aia-download=true disables AIA 2. Chain is returned unchanged (no intermediates downloaded) 3. No HTTP requests are made (HttpUtil.getBytes never called) 4. System property is properly cleaned up after test Total AIA tests: 10 → 11 All 94 module tests pass * fix: Address review comments - heading hierarchy and improved JavaDoc - Fix CHANGELOG.md heading hierarchy: 'Security Advisory' should be ### not ## - Improve isValidIssuer() JavaDoc to clarify it checks signature verification and CA authorization - Improve completeChainViaAia() JavaDoc with better security notes - Update CHANGELOG.md Security Advisory section to use hyphenated property name - Remove unnecessary legacy property support (this is a new feature in this PR) All 94 tests pass * fix: Wrap long JavaDoc line to comply with 120-char line limit Fix Checkstyle LineLength violation in isValidIssuer() JavaDoc. Wrap the second list item onto multiple lines to stay within 120-character limit. All 94 tests pass * fix: Improve error handling and eliminate property name duplication - Add FINE-level logging in orderCertificateChain exception handler to prevent silent failures This helps diagnose issues when certificate chain ordering fails unexpectedly - Change DISABLE_AIA_DOWNLOAD_PROPERTY visibility from private to package-visible (default access) Tests in the same package can now reference the constant instead of hardcoding the property name Reduces drift risk and ensures consistency across code, tests, and documentation - Update test to use CertificateUtil.DISABLE_AIA_DOWNLOAD_PROPERTY constant instead of hardcoded string All 94 tests pass * fix: Improve duplicate detection and DN comparison in logging - Extend duplicate detection to scan the entire chain, not just the valid portion This prevents inserting duplicate certificates that already exist as 'unplaced' certs appended by orderCertificateChain() - Use X500Principal.equals() instead of string comparison in logCertificateChain() DN string formatting can vary, causing misleading 'Self-Signed' logs when principals are equal Ensures consistent and reliable debug output All 94 tests pass * fix: Use signature-based issuer check instead of subject-DN-only duplicate detection Previously, AIA downloads were skipped whenever any certificate with the same subject DN was already present in the chain. This is too aggressive: if the chain contains a re-issued or cross-signed intermediate with the same subject DN but a different key, it cannot validate x509Top's signature, yet the correct AIA-downloaded issuer would be silently ignored and the PKIX error would persist. New logic: before attempting an AIA download, scan the entire chain for a certificate that (a) has the expected issuer subject DN AND (b) can actually verify x509Top's signature via isValidIssuer(). Only skip the download if such a valid issuer already exists; otherwise proceed with the download regardless of subject DN collisions. All 94 tests pass * fix: Add GoodLoggingCheck suppression for CertificateUtil.java CertificateUtil.java uses java.util.logging.Logger consistent with all other files in this module (AccessTokenUtil, HttpUtil, KeyVaultClient, etc.), all of which have the same suppression. Add the equivalent entry for CertificateUtil.java to pass Checkstyle linting. * fix: Remove string concatenation from LOGGER.log calls; restore suppression - Remove string concatenation from LOGGER.log message strings in CertificateUtil.java and HttpUtil.java for cleaner, lint-friendly log statements - Restore GoodLoggingCheck suppression for CertificateUtil.java: the rule fires on any use of java.util.logging.Logger (not just string concat), and all other files in this module (AccessTokenUtil, HttpUtil, KeyVaultClient, etc.) have the same suppression for the same reason. Removing it requires migrating to ClientLogger, which is a broader module-wide refactoring outside the scope of this PR. All 94 tests pass, 0 Checkstyle violations * fix: Log caught exception in getBytes() to aid AIA failure diagnosis Previously the catch block only logged the URL, silently discarding the exception. This is inconsistent with other HttpUtil methods (e.g. get()) which log the Throwable. Log the exception so AIA download failures can be debugged from logs. * fix: Improve orderCertificateChain to handle incomplete [root, leaf] chains - Previously, when input was [root, leaf] (missing intermediate), orderCertificateChain could incorrectly select the self-signed root as the leaf because root's issuer (itself) appeared in the chain, causing an early break and incorrect ordering [root, leaf] - Now uses a two-pass approach: prioritize non-self-signed leaves, use self-signed roots only as fallback. This correctly identifies the leaf even in incomplete chains. - Added regression test testOrderCertificateChainIncompleteRootFirst to prevent future regressions of this scenario. Addresses review comments from PR Azure#47977 review 4652380612 * fix: Add @AfterEach cleanup for system property in AiaCertificateChainTest The aiaDownloadDisabledBySystemProperty test sets the system property azure.keyvault.jca.disable-aia-download to 'true' for testing. While the test has a finally block to restore the property, adding an @AfterEach method that unconditionally clears the property ensures proper cleanup regardless of test execution order. This fixes intermittent test failures where the disabled property could leak into other tests, causing them to skip AIA downloads when they shouldn't. Fixes sporadic test flakiness in AiaCertificateChainTest. * fix: Improve leaf selection and chain ordering with signature-based validation Addresses review comments from PR Azure#47977 review 4652501161: 1. **Leaf selection with cross-signed intermediates**: Previously used subject-DN matching only. Now verifies that potential issuers can actually validate the certificate's signature using isValidIssuer(). This prevents misselection when cross-signed/re-issued intermediates share a subject DN but have different keys. 2. **Self-signed detection in leaf selection**: Changed from subject==issuer check to signature-verified isSelfSignedCertificate(). This correctly distinguishes self-issued certs (same DN but not self-signed) from true self-signed roots. 3. **Chain-building root detection**: Changed from subject==issuer check to signature-verified isSelfSignedCertificate() when detecting chain end. Prevents early termination on self-issued-but-not-self-signed certs. 4. **Test mock timing**: Moved HttpUtil mock setup before completeChainViaAia invocation in aiaDownloadDisabledBySystemProperty test. Ensures property check regression would not trigger real network I/O. 5. **Incomplete chain completion**: When valid issuer already exists in array but at wrong position (e.g., appended as unplaced cert), now moves it to make chain contiguous. Continues loop to download next issuer instead of stopping early. All 95 tests pass. * fix: Address Copilot review comments on maxDownloads logic and logging - Fix maxDownloads counter to only decrement on actual HTTP downloads, not during certificate reordering. This prevents premature loop exit when reorganizing existing issuer certificates. - Replace string concatenation with parameterized logging in HttpUtil.getBytes() to satisfy GoodLoggingCheck. - Restore GoodLoggingCheck suppressions for CertificateUtil.java and HttpUtil.java (module requires java.util.logging for JCA provider bootstrap). Addresses: maxDownloads safety limit, GoodLoggingCheck violation in exception logging * fix: Force sequential execution in AiaCertificateChainTest to prevent system property pollution * fix: Address Copilot review comments - remove unused variables, log exception, fix comments * fix: Address Copilot review comments - remove unused variables, log exception, fix comments * fix: validate issuer key usage and select matching cert from AIA bundles * fix: align certificate chain self-signed diagnostics with verification * fix: narrow issuer validation catch for spotbugs * fix: split long AIA log messages for checkstyle line length * fix: align chain-end docs and strengthen single-cert edge-case test * Only an incomplete chain needs the missing intermediate CA certificates downloaded via the AIA extension. * Cached certificates * Guard chain completion against unbounded iteration and out-of-bounds reposition * Reject expired issuer certificates downloaded via AIA * Move AIA chain completion into a dedicated AiaCertificateChainUtil * Do not log a cached or root issuer as a downloaded intermediate completeChainViaAia() logged "Downloaded intermediate CA certificate via AIA" for every issuer it added, but the message was wrong on both counts: the certificate is served from the response cache whenever the URL was already fetched, and the last hop of a chain is a root rather than an intermediate. A production trace showed the message emitted 6 times while only 2 HTTP requests were made, which overstates AIA outbound traffic three-fold when diagnosing network issues. Report the issuer as resolved instead, and assert the download and resolution counts stay distinct across a cached second run. * Stop writing secrets to FINER level logs LOGGER.entering() renders every parameter it is given, so enabling FINER logging wrote the client secret in clear text, along with every Key Vault JSON response body and the private key PEM. A production trace captured at that level held the client secret, 3 access tokens and 6 PKCS12 key bundles. Pass only non-secret parameters. The char[] passwords elsewhere are left untouched: they render as "[C@hash" and reveal nothing. * Update sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md Co-authored-by: vcolin7 <vicolina@microsoft.com> * Update sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/utils/AiaCertificateChainUtil.java Co-authored-by: vcolin7 <vicolina@microsoft.com> * Update sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md Co-authored-by: vcolin7 <vicolina@microsoft.com> * Test that private key PEM stays out of logs * Complete contiguous certificate chains via AIA A contiguous chain may still be missing issuers above its terminal certificate. Invoke cache-first AIA completion whenever the valid chain does not end in a self-signed root, so multi-level PKI chains can be completed without repeating HTTP requests on subsequent loads. * Format doc * Improve AIA response caching * Keep valid AIA issuers cached independently of expired extras Let HTTP freshness control the URL response cache while validating each candidate certificate independently. An expired unrelated certificate in an AIA bundle no longer forces repeated downloads of a valid issuer. * Refresh cached AIA responses for rotated issuers * Prevent stale AIA refreshes and improve diagnostics * Stabilize cross-generation AIA refresh test --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rujche <171773178+rujche@users.noreply.github.com> Co-authored-by: Rujun Chen <rujche@microsoft.com> Co-authored-by: Moary Chen <v-shilichen@microsoft.com> Co-authored-by: vcolin7 <vicolina@microsoft.com>
* Disable IoT Hub live test with insufficient quota Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Fix management live test authentication Warm federated authentication before older fluent operations and update the retired Batch Ubuntu node agent SKU. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Fix remaining management live tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Wait for Network Analytics provider registration Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Limit Device Provisioning live-test matrix Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Re-enable Device Provisioning live tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Remove deprecated Network Analytics test pipeline Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Remove deprecated Network Analytics live test Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Refine management list smoke tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use Ubuntu 24.04 for Batch live test Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Explain management test credential warm-up Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use globally unique Batch storage names Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Explain remaining credential warm-ups Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Remove Cosmos DB for PostgreSQL live tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 --------- Copilot-Session: b6797498-e941-465a-b215-87ed36922894
…rom-SDK Generation - Java-6684529 (Azure#50089) * Configurations: 'specification/deviceprovisioningservices/resource-manager/Microsoft.Devices/DeviceProvisioningServices/tspconfig.yaml', and CommitSHA: '4644db6c0fd2362255f7680da79bdd01d9813b31' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6684039 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. * Configurations: 'specification/deviceprovisioningservices/resource-manager/Microsoft.Devices/DeviceProvisioningServices/tspconfig.yaml', and CommitSHA: '1fd9cbd7c532d433d7c7afbca90efaa4e633d827' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6684138 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. * Configurations: 'specification/deviceprovisioningservices/resource-manager/Microsoft.Devices/DeviceProvisioningServices/tspconfig.yaml', and CommitSHA: '5b2dad5eaffd232f4cd7f19e32f47d582773fd52' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6684246 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. * Configurations: 'specification/deviceprovisioningservices/resource-manager/Microsoft.Devices/DeviceProvisioningServices/tspconfig.yaml', and CommitSHA: '9eb0993333857ef0ffb2863ccc76f8b123cae90b' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6684529 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. --------- Co-authored-by: azure-sdk <azuresdk@microsoft.com> Co-authored-by: Weidong Xu <weidxu@microsoft.com>
Co-authored-by: azure-sdk <azuresdk@microsoft.com>
* Exclude manually provisioned Device Registry test Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Remove retired management live tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use West US 3 for capacity-sensitive tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Stabilize Fluid Relay and Storage Actions tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use list smoke test for Provider Hub Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use Provider Hub resource list smoke test Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use supported Kusto SKU in West US 3 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use explicit Burstable SKU for MySQL test Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Stabilize Kusto and MySQL live tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 * Use list-only Kusto live coverage Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6797498-e941-465a-b215-87ed36922894 --------- Copilot-Session: b6797498-e941-465a-b215-87ed36922894
…zure#50091) Co-authored-by: azure-sdk <azuresdk@microsoft.com>
* Update dependencies * Fix two testing APIs
…pp/NetApp/tspconfig.yaml', SDK Release Type: beta, and CommitSHA: 'c97fe996d4a10f7d583b7951b07bd4b52b3a1be0' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6620665 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. (Azure#49939) Co-authored-by: azure-sdk <azuresdk@microsoft.com>
* Remove unmaintained /samples folder * Fix script usage of removed folder * Fix incorrect POM version
…way V1 when resource tokens are used. (Azure#50084) * Fix Gateway V2 resource token routing * Link resource token fix changelog
Co-authored-by: Connie Yau <conniey@microsoft.com>
… Java-6593184 (Azure#49868) * Configurations: 'specification/iothub/resource-manager/Microsoft.Devices/IoTHub/tspconfig.yaml', SDK Release Type: beta, and CommitSHA: '87b246496a1e5347f8527e1e01a45b4cd7632036' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6589428 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. * Configurations: 'specification/iothub/resource-manager/Microsoft.Devices/IoTHub/tspconfig.yaml', and CommitSHA: 'b6c5dbafe5fae7584e95266840371ace84be41dc' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6591264 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. * Configurations: 'specification/iothub/resource-manager/Microsoft.Devices/IoTHub/tspconfig.yaml', and CommitSHA: '81261972e09ae6977caf311750928c7a42876ad8' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6591356 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. * Configurations: 'specification/iothub/resource-manager/Microsoft.Devices/IoTHub/tspconfig.yaml', SDK Release Type: beta, and CommitSHA: '81261972e09ae6977caf311750928c7a42876ad8' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6591390 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. * Configurations: 'specification/iothub/resource-manager/Microsoft.Devices/IoTHub/tspconfig.yaml', SDK Release Type: beta, and CommitSHA: 'e242531106b574c3f98fb7306dbceedd82b05f69' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6593184 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. --------- Co-authored-by: azure-sdk <azuresdk@microsoft.com> Co-authored-by: Xiaofei Cao (from Dev Box) <xiaofeicao@microsoft.com> Co-authored-by: Weidong Xu <weidxu@microsoft.com> Co-authored-by: Davide Montanari <damontan@microsoft.com>
* Refactor management AutoPR reviewer evals Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update relocated eval configuration Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Align management reviewer eval names Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add management review anti-trigger evals Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix management review comment formatting Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… Java-6689270 (Azure#50060) * Configurations: 'specification/fabric/resource-manager/Microsoft.Fabric/Fabric/tspconfig.yaml', SDK Release Type: stable, and CommitSHA: 'a11c8d40bf2ab8aed7c8debec9528bff36a7ae2a' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6670681 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. * Reset generated branch contents to main Prepare the branch for clean SDK regeneration without rewriting remote history. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5b0c2647-cf46-49ff-8668-99878a1851ed * Configurations: 'specification/fabric/resource-manager/Microsoft.Fabric/Fabric/tspconfig.yaml', and CommitSHA: 'a11c8d40bf2ab8aed7c8debec9528bff36a7ae2a' in SpecRepo: 'https://github.com/Azure/azure-rest-api-specs' Pipeline run: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6689270 Refer to https://eng.ms/docs/products/azure-developer-experience/develop/sdk-release/sdk-release-prerequisites to prepare for SDK release. --------- Co-authored-by: azure-sdk <azuresdk@microsoft.com> Co-authored-by: Samarth Shah <43150750+samarths-msft@users.noreply.github.com> Co-authored-by: weidongxu-microsoft <weidongxu@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5b0c2647-cf46-49ff-8668-99878a1851ed
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c39d2731-1481-4dba-9327-033d382a7b55
Co-authored-by: azure-sdk <azuresdk@microsoft.com>
* Preparing August 2026 Core Release * Update azure-core dependency version to 1.59.0 across multiple modules Updating Changelog dates * Fixing typo * Update azure-core dependency version to 1.59.0 * Removing empty changelog secitions
* Move inlined scripts to checked in files * PR feedback and make scripts standalone capable * Small script fixes * Fix param
Add @j7nw4r, @sagar0207, @SwayGom, @sjkwak, and @hmlam as owners of the core AMQP library. The current owners keep their review rights.
) * Support pool-specific PR job batch sizes Amp-Thread-ID: https://ampcode.com/threads/T-019fc928-8629-77e7-9030-1412de6b8f36 Co-authored-by: Amp <amp@ampcode.com> * Provide better error message when pool override isn't an integer Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Wei Lim <weilim@microsoft.com> Co-authored-by: Amp <amp@ampcode.com> Co-authored-by: Wei Lim <weikanglim@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…e#50120) * Updating the skill and tooling for the analyze + fetch artifacts workflow. Also updating an out of date reference to the analyze tool in the sdk-ai-bot. * Updated qa bot instructions and fixed skills formatted. --------- Co-authored-by: ReilleyMilne <reilleymilne@gmail.com>
) * Use shallow checkout for SDK regeneration jobs The regeneration jobs do not read repository history. Fetch only the checked-out commit and skip tags to reduce checkout time and aggregate agent consumption. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Clarify shallow checkout constraint Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Wei Hu <live1206@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: azure-sdk <azuresdk@microsoft.com>
Co-authored-by: azure-sdk <azuresdk@microsoft.com>
* Remove WireMock from azure-core-management * remove WireMock from azure-core-perf * Fix linting
github-actions
Bot
added
Batch
Communication
Communication - Call Automation
Communication - Calling Server
Communication - Chat
Communication - Common
Communication - Phone Numbers
Cosmos
Device Update
Document Intelligence
Event Grid
Event Hubs
KeyVault
Mgmt
common
AI Agents
AI Model Inference
AI Projects
clientcore
Cognitive - Content Understanding
Azure.Core.V2
OpenTelemetry
Health Deidentification
Models Repository
Monitor - Autoconfigure
Online Experimentation
OpenAI
Planetary Computer
labels
Owner
Author
|
Closing to rebuild the branch directly on this fork's main so the PR contains only the intended Azure Core SSE changes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds minimal, single-response server-sent events support to
azure-core, based on Azure#50081.ServerSentEvent<T>,ServerSentEventListener<T>, andServerSentEventStreamsfor synchronous listener and asynchronousFluxconsumption.text/event-streamresponses and supports optional service-defined terminal-event predicates.Response<BinaryData>implementation for streaming responses.HttpLoggingPolicyfrom buffering SSE response bodies.Scope
This PR intentionally handles one established HTTP response. It does not reconnect, replay requests, or send
Last-Event-Id. Search client APIs, generated models, and emitter work remain separate.Validation
azure-coretest suite: 11,881 tests, 0 failures, 3 skipped