Skip to content

Fix datanode PowerMock tests failing when user_encrypt_token is set - #19008

Merged
JackieTien97 merged 1 commit into
apache:masterfrom
JackieTien97:fix-powermock-ignore-javax-crypto
Oct 24, 2026
Merged

JackieTien97 merged 1 commit into
apache:masterfrom
JackieTien97:fix-powermock-ignore-javax-crypto

Conversation

@JackieTien97

Copy link
Copy Markdown
Contributor

Description

When the user_encrypt_token environment variable is set (the TsFile encryption token, see
IoTDBStartCheck), 12 of the 14 PowerMock test classes in iotdb-core/datanode fail, on JDK 17 and
JDK 21 alike:

java.lang.IllegalAccessError: class javax.crypto.Mac (in unnamed module @...) cannot access class sun.security.util.Debug (in module java.base) because module java.base does not export sun.security.util to unnamed module @...
	at javax.crypto.Mac.<clinit>(Mac.java:77)
	at org.apache.tsfile.encrypt.EncryptUtils.getPRFLength(EncryptUtils.java:159)
	...
	at org.apache.tsfile.common.conf.TSFileDescriptor.overwriteConfigByCustomSettings(TSFileDescriptor.java:93)
	...
	at org.apache.tsfile.utils.FSUtils.<clinit>(FSUtils.java:36)

The rest of each class then fails with NoClassDefFoundError: Could not initialize class org.apache.tsfile.utils.FSUtils (or IoTDBDescriptor$IoTDBDescriptorHolder).

TSFileDescriptor derives the TsFile encryption key from user_encrypt_token with
javax.crypto.Mac while it initializes. PowerMock 2.0.9 defers only java.*,
javax.accessibility.*, sun.* and a few test packages to the system class loader, so inside a
PowerMock test javax.crypto.Mac is defined by PowerMock's MockClassLoader in an unnamed module,
and its static initializer cannot access java.base internals. CI does not set the variable, so it
is not affected, but anyone who keeps the variable in their shell (for example to work on TsFile
encryption) cannot run these tests locally.

Changes

Add iotdb-core/datanode/src/test/resources/org/powermock/extensions/configuration.properties with
powermock.global-ignore=javax.crypto.*. PowerMock merges this global list with each class's
@PowerMockIgnore, so every PowerMock test in the module (including future ones) loads
javax.crypto from the JDK. No test mocks javax.crypto.

Verification

All 14 PowerMock test classes in iotdb-core/datanode, run with
mvn test -pl iotdb-core/datanode -am -Dtest=<the 14 classes>:

Before After
JDK 21, user_encrypt_token set 12 classes fail (50 of 65 tests error or never run) 65/65 pass
JDK 17, user_encrypt_token set 12 classes fail (50 of 65 tests error or never run) 65/65 pass
JDK 21, unset 65/65 pass 65/65 pass
JDK 17, unset 65/65 pass 65/65 pass

The RAT license check passes for the new file.

🤖 Generated with Claude Code

When the user_encrypt_token environment variable is set, TSFileDescriptor
derives the TsFile encryption key with javax.crypto.Mac while it
initializes. PowerMock does not defer javax.crypto to the system class
loader, so inside a PowerMock test Mac is defined by PowerMock's class
loader in an unnamed module, and its static initializer fails because
java.base does not export sun.security.util. 12 of the 14 PowerMock test
classes in datanode then fail, on JDK 17 and JDK 21 alike.

Add a PowerMock global ignore for javax.crypto.* to the datanode test
resources so that these classes always come from the JDK.
@JackieTien97
JackieTien97 merged commit 20bb3a0 into apache:master Oct 24, 2026
38 of 40 checks passed
@JackieTien97
JackieTien97 deleted the fix-powermock-ignore-javax-crypto branch October 24, 2026 00:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant