Skip to content

zkclient and scalatest library updates#3

Closed
polymorphic wants to merge 3 commits intoapache:trunkfrom
polymorphic:trunk
Closed

zkclient and scalatest library updates#3
polymorphic wants to merge 3 commits intoapache:trunkfrom
polymorphic:trunk

Conversation

@polymorphic
Copy link
Copy Markdown

Following https://issues.apache.org/jira/browse/KAFKA-826 I forked the code and included fixes for 2 bugs I reported, https://issues.apache.org/jira/browse/KAFKA-807 and https://issues.apache.org/jira/browse/KAFKA-809

All tests pass except kafka.log.LogTest which fails on my Mac--I don't think it is related to the zkclient fix, I could be wrong.

hoffrocket pushed a commit to foursquare/kafka that referenced this pull request Jul 18, 2013
relango pushed a commit to relango/kafka that referenced this pull request Jun 5, 2014
granders referenced this pull request in confluentinc/kafka Jun 16, 2015
@ijuma
Copy link
Copy Markdown
Member

ijuma commented Jul 20, 2015

This pull request doesn't merge cleanly anymore, can you please close it?

Sorry for not replying to this earlier, but pull requests are not currently monitored as the Kafka project uses JIRA and Review Board for contributions. There is a plan to change this and we would like to close stale PRs before we start. Unfortunately we can't do it ourselves (a JIRA needs to be filed with Apache Infra) so your help is appreciated.

If this change is still relevant, please see http://kafka.apache.org/contributing.html. Alternatively wait until the new approach based on GitHub pull requests is in place (hopefully soon).

asfgit pushed a commit that referenced this pull request Jul 29, 2015
Initial patch for KIP-25

Note that to install ducktape, do *not* use pip to install ducktape. Instead:

```
$ git clone gitgithub.com:confluentinc/ducktape.git
$ cd ducktape
$ python setup.py install
```

Author: Geoff Anderson <geoff@confluent.io>
Author: Geoff <granders@gmail.com>
Author: Liquan Pei <liquanpei@gmail.com>

Reviewers: Ewen, Gwen, Jun, Guozhang

Closes #70 from granders/KAFKA-2276 and squashes the following commits:

a62fb6c [Geoff Anderson] fixed checkstyle errors
a70f0f8 [Geoff Anderson] Merged in upstream trunk.
8b62019 [Geoff Anderson] Merged in upstream trunk.
47b7b64 [Geoff Anderson] Created separate tools jar so that the clients package does not pull in dependencies on the Jackson JSON tools or argparse4j.
a9e6a14 [Geoff Anderson] Merged in upstream changes
d18db7b [Geoff Anderson] fixed :rat errors (needed to add licenses)
321fdf8 [Geoff Anderson] Ignore tests/ and vagrant/ directories when running rat build task
795fc75 [Geoff Anderson] Merged in changes from upstream trunk.
1d93f06 [Geoff Anderson] Updated provisioning to use java 7 in light of KAFKA-2316
2ea4e29 [Geoff Anderson] Tweaked README, changed default log collection behavior on VerifiableProducer
0eb6fdc [Geoff Anderson] Merged in system-tests
69dd7be [Geoff Anderson] Merged in trunk
4034dd6 [Geoff Anderson] Merged in upstream trunk
ede6450 [Geoff] Merge pull request #4 from confluentinc/move_muckrake
7751545 [Geoff Anderson] Corrected license headers
e6d532f [Geoff Anderson] java 7 -> java 6
8c61e2d [Geoff Anderson] Reverted jdk back to 6
f14c507 [Geoff Anderson] Removed mode = "test" from Vagrantfile and Vagrantfile.local examples. Updated testing README to clarify aws setup.
98b7253 [Geoff Anderson] Updated consumer tests to pre-populate kafka logs
e6a41f1 [Geoff Anderson] removed stray println
b15b24f [Geoff Anderson] leftover KafkaBenchmark in super call
0f75187 [Geoff Anderson] Rmoved stray allow_fail. kafka_benchmark_test -> benchmark_test
f469f84 [Geoff Anderson] Tweaked readme, added example Vagrantfile.local
3d73857 [Geoff Anderson] Merged downstream changes
42dcdb1 [Geoff Anderson] Tweaked behavior of stop_node, clean_node to generally fail fast
7f7c3e0 [Geoff Anderson] Updated setup.py for kafkatest
c60125c [Geoff Anderson] TestEndToEndLatency -> EndToEndLatency
4f476fe [Geoff Anderson] Moved aws scripts to vagrant directory
5af88fc [Geoff Anderson] Updated README to include aws quickstart
e5edf03 [Geoff Anderson] Updated example aws Vagrantfile.local
96533c3 [Geoff] Update aws-access-keys-commands
25a413d [Geoff] Update aws-example-Vagrantfile.local
884b20e [Geoff Anderson] Moved a bunch of files to kafkatest directory
fc7c81c [Geoff Anderson] added setup.py
632be12 [Geoff] Merge pull request #3 from confluentinc/verbose-client
51a94fd [Geoff Anderson] Use argparse4j instead of joptsimple. ThroughputThrottler now has more intuitive behavior when targetThroughput is 0.
a80a428 [Geoff Anderson] Added shell program for VerifiableProducer.
d586fb0 [Geoff Anderson] Updated comments to reflect that throttler is not message-specific
6842ed1 [Geoff Anderson] left out a file from last commit
1228eef [Geoff Anderson] Renamed throttler
9100417 [Geoff Anderson] Updated command-line options for VerifiableProducer. Extracted throughput logic to make it reusable.
0a5de8e [Geoff Anderson] Fixed checkstyle errors. Changed name to VerifiableProducer. Added synchronization for thread safety on println statements.
475423b [Geoff Anderson] Convert class to string before adding to json object.
bc009f2 [Geoff Anderson] Got rid of VerboseProducer in core (moved to clients)
c0526fe [Geoff Anderson] Updates per review comments.
8b4b1f2 [Geoff Anderson] Minor updates to VerboseProducer
2777712 [Geoff Anderson] Added some metadata to producer output.
da94b8c [Geoff Anderson] Added number of messages option.
07cd1c6 [Geoff Anderson] Added simple producer which prints status of produced messages to stdout.
a278988 [Geoff Anderson] fixed typos
f1914c3 [Liquan Pei] Merge pull request #2 from confluentinc/system_tests
81e4156 [Liquan Pei] Bootstrap Kafka system tests
guozhangwang referenced this pull request in confluentinc/kafka Aug 5, 2015
ymatsuda pushed a commit to ymatsuda/kafka that referenced this pull request Aug 21, 2015
Parth-Brahmbhatt pushed a commit to Parth-Brahmbhatt/kafka that referenced this pull request Oct 15, 2015
Improving documentation. Ensuring consumer path does not have acls set.
@stumped2 stumped2 closed this Feb 2, 2016
guozhangwang referenced this pull request in guozhangwang/kafka Mar 3, 2016
…reams-tech-preview

Backport recent changes from trunk/streams: batch #3
resetius added a commit to resetius/kafka that referenced this pull request Jun 7, 2016
@phderome phderome mentioned this pull request Jun 30, 2016
jasonaliyetti pushed a commit to jasonaliyetti/kafka that referenced this pull request Oct 14, 2016
Commit gradle/wrapper/ files for CI
krishkoneru pushed a commit to krishkoneru/kafka that referenced this pull request Oct 25, 2018
Add missing bat file for Windows
kehuum pushed a commit to kehuum/kafka that referenced this pull request Mar 27, 2019
…e after loading v1 offset records from __consumer_offsets (apache#3)

* KAFKA-8069: Setting expireTimestamp to None if it is the default value after loading v1 offset records from __consumer_offsets

After the 2.1 release, if the broker hasn't been upgrade to the latest inter-broker protocol version,
the committed offsets stored in the __consumer_offset topic will get cleaned up way earlier than it
should be when the offsets are loaded back from the __consumer_offset topic in GroupCoordinator, which
will happen during leadership transition or after broker bounce. This patch fixes the bug by setting
expireTimestamp to None if it is the default value after loading v1 offset records from __consumer_offsets
guozhangwang referenced this pull request in guozhangwang/kafka Jun 13, 2019
Resolving build timeout issue
obsoleted pushed a commit to obsoleted/kafka that referenced this pull request Aug 20, 2019
Create offsetSyncs topic in source cluster
soondenana added a commit to soondenana/kafka that referenced this pull request Oct 11, 2019
A partition log in initialized in following steps:

1. Fetch log config from ZK
2. Call LogManager.getOrCreateLog which creates the Log object, then
3. Registers the Log object

Step apache#3 enables Configuration update thread to deliver configuration
updates to the log. But if any update arrives between step #1 and apache#3
then that update is missed. It breaks following use case:

1. Create a topic with default configuration, and immediately after that
2. Update the configuration of topic

There is a race condition here and in random cases update made in
seocond step will get dropped.

This change fixes it by tracking updates arriving between step #1 and apache#3
Once a Partition is done initialzing log, it checks if it has missed any
update. If yes, then the configuration is read from ZK again.

Added unit tests to make sure a dirty configuration is refreshed. Tested
on local cluster to make sure that topic configuration and updates are
handled correctly.
hachikuji pushed a commit that referenced this pull request Oct 15, 2019
…7305)

A partition log in initialized in following steps:

1. Fetch log config from ZK
2. Call LogManager.getOrCreateLog which creates the Log object, then
3. Registers the Log object

Step #3 enables Configuration update thread to deliver configuration
updates to the log. But if any update arrives between step #1 and #3
then that update is missed. It breaks following use case:

1. Create a topic with default configuration, and immediately after that
2. Update the configuration of topic

There is a race condition here and in random cases update made in
second step will get dropped.

This change fixes it by tracking updates arriving between step #1 and #3
Once a Partition is done initializing log, it checks if it has missed any
update. If yes, then the configuration is read from ZK again.

Added unit tests to make sure a dirty configuration is refreshed. Tested
on local cluster to make sure that topic configuration and updates are
handled correctly.

Reviewers: Jason Gustafson <jason@confluent.io>
hachikuji pushed a commit that referenced this pull request Oct 15, 2019
…7305)

A partition log in initialized in following steps:

1. Fetch log config from ZK
2. Call LogManager.getOrCreateLog which creates the Log object, then
3. Registers the Log object

Step #3 enables Configuration update thread to deliver configuration
updates to the log. But if any update arrives between step #1 and #3
then that update is missed. It breaks following use case:

1. Create a topic with default configuration, and immediately after that
2. Update the configuration of topic

There is a race condition here and in random cases update made in
second step will get dropped.

This change fixes it by tracking updates arriving between step #1 and #3
Once a Partition is done initializing log, it checks if it has missed any
update. If yes, then the configuration is read from ZK again.

Added unit tests to make sure a dirty configuration is refreshed. Tested
on local cluster to make sure that topic configuration and updates are
handled correctly.

Reviewers: Jason Gustafson <jason@confluent.io>
divijvaidya referenced this pull request in divijvaidya/kafka Apr 22, 2022
Fix bug in setting ReplicaLogStartOffset when LeaderLogStartOffset is different from LeaderLocalLogStartOffset
lianetm pushed a commit to lianetm/kafka that referenced this pull request May 25, 2023
… are only closed once

Added IdempotentCloser to ensure resources are only closed once. While this class is broadly useful, it will be constrained to consumer internals until a later date.
lianetm pushed a commit to lianetm/kafka that referenced this pull request Jun 12, 2023
… are only closed once

Added IdempotentCloser to ensure resources are only closed once. While this class is broadly useful, it will be constrained to consumer internals until a later date.
FrankYang0529 referenced this pull request in FrankYang0529/kafka Aug 27, 2025
feat: deny produce request on a read-only partition
fvaleri pushed a commit to fvaleri/kafka that referenced this pull request Sep 17, 2025
blitzy Bot pushed a commit to blitzy-public-samples/blitzy-kafka that referenced this pull request Apr 18, 2026
Resolve all 9 Minor and 10 Info findings from the Checkpoint 1 code review,
correcting factual inaccuracies, citation line-range imprecisions, and cross-
artifact consistency drift. No modifications to pre-existing Kafka source,
tests, build files, or comments — Audit Only rule preserved.

Findings by file:

accepted-mitigations.md
  #1 [MINOR] AclCache imports corrected: org.apache.kafka.server.immutable
              (PCollections-backed Kafka-internal) instead of Guava's
              com.google.common.collect.
  apache#2 [MINOR] API surface rewritten to reflect PCollections-style structural-
              sharing methods .updated()/.added()/.removed() instead of
              Guava builder pattern.
  apache#3 [MINOR] ZstdCompression BufferPool path split: wrap-for-output uses
              zstd-jni RecyclingBufferPool.INSTANCE (L55-L63), wrap-for-
              input uses ChunkedBytesStream (L65-L75), wrap-for-zstd-input
              uses anonymous Kafka-owned BufferPool delegating to
              BufferSupplier (L77-L98).
  apache#4 [INFO]  MAX_RECORDS_PER_USER_OP citation corrected: declaration at
              QuorumController.java:L185; AclControlManager.java:L52 is
              the static import only.
  apache#5 [INFO]  AclCache.removeAcl(Uuid) line corrected to L91-L103 (was L89+).

references.md
  apache#6 [MINOR] SafeObjectInputStream citation range tightened from L17-L25
              (class header + imports only) to L25-L62 covering the class
              declaration, DEFAULT_NO_DESERIALIZE_CLASS_NAMES blocklist
              (L27-L37), resolveClass (L43-L52), and isBlocked helper
              (L54-L62).
  apache#7 [INFO]  PropertyFileLoginModule citation corrected to L42-L50,
              pointing at the Javadoc PLAINTEXT warning (L47-L48) plus
              the class declaration (L50).

remediation-roadmap.md
  apache#8 [INFO]  Gantt markers sanitised: all :done/:active markers replaced
              with :crit (illustrative critical emphasis) or plain markers
              to avoid any visual suggestion of work already performed.
              Explanatory blockquote added clarifying the marker change.

severity-matrix.md
  apache#9 [MINOR] 7 occurrences of parenthesised '(Accepted Mitigation)'
              replaced with bracketed '[Accepted Mitigation]' per Global
              Conventions for plain-text markers. Cross-validated 9
              bracketed instances, 0 parenthesised remaining.

README.md
  apache#11 [MINOR] HEAD commit reference corrected to the pre-audit baseline
               6d16f68 (was 8a99096, a
               mid-audit snapshot); baseline attestation now refers to the
               commit immediately before the audit began.
  apache#12 [MINOR] Snapshot date unified to 2026-04-17 across all artifacts.
  apache#14 [INFO]  '25 files' claim qualified as 'planned at project completion'
               vs 'delivered at this checkpoint (15 files)'.

attack-surface-map.md
  apache#16 [MINOR] Clients module category count corrected from 'six' to 'nine'
               (actual Mermaid edges: C1, C2, C3, C4, C5, C7, C8, C9, C10).
  apache#17 [MINOR] Connect module category count corrected from 'five' to
               'seven' (actual Mermaid edges: C1, C4, C6, C7, C8, C9, C10).

oauth-jwt-validation-paths.md
  apache#18 [INFO]  Outer citation ranges tightened:
               BrokerJwtValidator.configure at L107-L138 (not L102-L134);
               OAuthBearerUnsecuredValidatorCallbackHandler.handleCallback
               at L154-L177 (not L161-L204, which spanned unrelated
               helpers); allowableClockSkewMs helper cited separately at
               L194-L207.

executive-summary.html
  Cross-ref A [MINOR] HEAD commit aligned to 6d16f68 at three sites
                       (L621, L668, L1544); methodology Mermaid node
                       re-labelled 'Baseline 6d16f68'.
  Cross-ref B [MINOR] Snapshot date aligned to 2026-04-17 at two sites
                       (L619, L1542).

Out-of-scope (Info-level forward-refs):
  apache#10, apache#13, apache#15 — Links to docs/security-audit/findings/*.md deliverables
                   not yet present at Checkpoint 1; expected per scope
                   boundary; will resolve at Checkpoint 2 when the 10
                   per-category findings files land.

Validation results (Phase 3):
  - Mermaid fences: all balanced (20 blocks total, all typed)
  - HTML tag balance: 22 sections + all 20+ tag types balanced
  - CDNs intact: reveal.js 5.1.0, Mermaid 11.4.0, Font Awesome 6.6.0
  - Emojis: zero across all 15 artifacts
  - TODOs/placeholders introduced: zero
  - Gantt markers: :crit + plain only (no :done/:active)
  - Cross-artifact consistency: zero wrong SHA/date values remaining
  - Citation ranges: 12 verified against AclCache, QuorumController,
                     AclControlManager, ZstdCompression,
                     SafeObjectInputStream, PropertyFileLoginModule,
                     BrokerJwtValidator, and
                     OAuthBearerUnsecuredValidatorCallbackHandler.

Audit Only rule verification:
  git diff --name-status 6d16f68..HEAD returns only 'A' entries,
  all under docs/security-audit/. Zero modifications, deletions, or
  renames of any pre-existing Kafka path.
blitzy Bot pushed a commit to blitzy-public-samples/blitzy-kafka that referenced this pull request Apr 18, 2026
…e 6 matrix completeness + slide 8 layout

Addresses QA Checkpoint 1 findings (3 MINOR, 0 Major, 0 Critical):

Issue #1 — native-compression-boundary.md missing snappy/lz4 2KB chunk
ceilings (Category: Functional — AAP specification deviation)
- Intro + Scope now enumerate all 3 codec ceilings: zstd=16KB, snappy=2KB,
  lz4=2KB (previously only zstd=16KB was annotated)
- Extended Mermaid flowchart to include SnappyCompression / Lz4Compression
  nodes + SnappyInputStream / Lz4BlockInputStream / libsnappy / liblz4
  native nodes
- Added dashed edges labeled 'reads in 2 KB chunks (snappy)' and
  'reads in 2 KB chunks (lz4)' parallel to the existing zstd 16 KB edge
- Added Per-Codec summary table + Key Observations for snappy/lz4 ceilings
- Updated Sources with SnappyCompression.java:L71 and Lz4Compression.java:L71
- Updated Legend to reference per-codec ceilings instead of zstd-only
- File: docs/security-audit/diagrams/native-compression-boundary.md

Issue #2a — slide 6 attack-surface matrix incomplete (9 of 12 AAP
modules shown) (Category: Visual — AAP §0.4.3 deviation)
- Added 3 missing columns between 'streams' and 'trogdor':
  coordinator, server-common, tools
- All 10 category rows expanded with 3 empty cells each (no direct
  attribution per Coordinator/server-common/tools footnote)
- Reduced table font-size 0.55em to 0.5em for 13-column fit
- Added explanatory footer note clarifying absent attributions
- File: docs/security-audit/executive-summary.html

Issue #2b — MEDIUM badge color #2563EB does not match AAP palette
#D97706 (Category: Visual — AAP color palette deviation)
- Added CSS variable --orange: #EA580C for High severity
- .badge-high now uses var(--orange) = #EA580C (was var(--blue))
- .badge-medium now uses var(--amber) = #D97706 (was var(--blue))
- Added .icon-orange utility class + .icon-card.accent-orange
- Updated heatmap cells: --heatmap-med uses amber rgba; --heatmap-high
  uses orange rgba for consistency with badge colors
- Verified at runtime: rgb(234,88,12)=#EA580C High and rgb(217,119,6)=#D97706
  Medium across 6 slide-viewport combinations
- File: docs/security-audit/executive-summary.html

Issue apache#3 — slide 8 content overflow at all viewports (Category: Visual —
responsive layout)
- Slide 8: repurposed .icon-grid-dense with scoped CSS override at
  #slide-high-findings .icon-grid-dense .icon-card to reduce card width
  (max-width 215px, font-size 0.65em H3 / 0.5em p) ensuring 5 cards fit
  in single row at 1280x800 without affecting Slide 16 4x2 layout
- Shortened citation blocks via new .card-cite class; replaced inline
  styles with class references
- Updated HIGH findings to use accent-orange + icon-orange; MEDIUM
  finding uses accent-amber + icon-amber (new classes)
- Slide 9 (Connect REST sequence diagram): tuned mermaid init config
  (fontSize 11px, actorMargin 50, messageMargin 18, boxMargin 3,
  noteMargin 2, mirrorActors:false) to eliminate container overflow
- Runtime-verified at 1280x800 / 768x1024 / 375x667 viewports; Slide 8
  scrollHeight 674px (no overflow at 800/1024/667 heights); Slide 9
  scrollHeight 807px (7px overflow at 800 — negligible, no content
  obscured)
- File: docs/security-audit/executive-summary.html

Static validation:
- 22 open section = 22 close section (balanced)
- 12 pre.mermaid = 12 close pre (balanced)
- 0 emojis; 104 Font Awesome icons
- All 13 dependency versions preserved

Runtime re-verification:
- 9 screenshots captured across 3 slides x 3 viewports (375/768/1280)
- 0 console errors on fresh load at 1280x800
- 12/12 Mermaid blocks render with SVG (data-processed=true)
- All 6 AAP palette colors verified at runtime
- Issue #2a: 13-column matrix (Category + 12 modules) confirmed at all
  three viewports with horizontalOverflow=false

Audit-only compliance:
- Zero modifications outside docs/security-audit/
- No Kafka source files, tests, build configs, or existing docs modified
- Only 2 files changed: native-compression-boundary.md (diagram update)
  and executive-summary.html (deck fixes)
- Both files are within docs/security-audit/ (the audit-only scope)
blitzy Bot pushed a commit to blitzy-public-samples/blitzy-kafka that referenced this pull request Apr 18, 2026
QA Checkpoint #1 identified 9 MINOR documentation-quality findings
in the Apache Kafka 4.2 security audit deliverables. All 9 findings
are documentation corrections confined to the docs/security-audit/
tree; no source code, tests, or build configuration touched — fully
compliant with the Audit Only rule.

FIXES APPLIED (by QA finding number):

Issue #1 [MINOR] — findings/07-external-function-callback-misuse.md L247
  Validation Checklist cited legacy path
  'internals/secured/BrokerJwtValidator.java'. Updated to current
  Kafka 4.2 canonical path
  'clients/src/main/java/org/apache/kafka/common/security/oauthbearer/BrokerJwtValidator.java'
  with an explanatory note that the class was reorganized out of the
  internals/secured sub-package in a prior Kafka refactor.

Issue apache#2 [MINOR] — findings/08-deserialization-attacks.md L305
  Same pattern as #1 — Validation Checklist updated from
  'internals/secured/{Broker,Client}JwtValidator.java' to
  'clients/.../oauthbearer/{Broker,Client}JwtValidator.java' with
  explanatory note.

Issue apache#3 [MINOR] — findings/09-information-leakage.md L245
  Validation Checklist cited legacy path
  'connect/runtime/src/main/java/org/apache/kafka/connect/runtime/RecordRedactor.java'.
  Updated to current canonical path
  'metadata/src/main/java/org/apache/kafka/metadata/util/RecordRedactor.java'
  with explanatory note.

Issue apache#4 [MINOR] — findings/09-information-leakage.md L248
  Validation Checklist BrokerJwtValidator and ClientJwtValidator paths
  updated to current 'oauthbearer/' canonical paths with explanatory
  note.

Issue apache#5 [MINOR] — findings/10-public-api-developer-misuse.md L298
  Validation Checklist BrokerJwtValidator path updated to current
  'oauthbearer/BrokerJwtValidator.java:L131' canonical path with
  explanatory note.

Issue apache#6 [MINOR] — findings/10-public-api-developer-misuse.md L302
  Validation Checklist cited legacy path
  'server-common/src/main/java/org/apache/kafka/server/config/ReplicationConfigs.java'.
  Updated to current canonical path
  'server/src/main/java/org/apache/kafka/server/config/ReplicationConfigs.java'
  with explanatory note that the file moved from the server-common
  module to the server module in a prior Kafka refactor.

Issue apache#7 [MINOR] — references.md Section 3.1 Configuration
  Added missing entry for 'AllowedPaths.java'
  ('clients/src/main/java/org/apache/kafka/common/config/internals/AllowedPaths.java'),
  inserted between the DirectoryConfigProvider and EnvVarConfigProvider
  entries. Finding 01 cites AllowedPaths 14 times; this bibliography
  gap is now closed.

Issue apache#8 [MINOR] — references.md Section 7 Server Module
  Added missing entry for 'SocketServerConfigs.java'
  ('server/src/main/java/org/apache/kafka/network/SocketServerConfigs.java'),
  inserted after the ReplicationConfigs entry with an inline note
  about the 'org.apache.kafka.network' vs 'org.apache.kafka.server.config'
  package mismatch. Findings 03 (11 cites) and 10 (5 cites) reference
  SocketServerConfigs; this bibliography gap is now closed.

Issue apache#9 [MINOR] — findings/01 and findings/10 section header numbering
  Harmonized H2 section headers to match the numbered 1-10 pattern
  used by findings 02-09. Applied 20 header replacements total:
  10 in finding 01 ('## Category' -> '## 1. Category', etc.),
  10 in finding 10 (same pattern). Validation Checklist and Key
  Insights remain unnumbered per the existing majority convention.
  Content substance is unchanged; only section prefixes updated.

VALIDATION RESULTS:

  - All 6 canonical file paths verified via 'test -f' to exist in
    the Kafka source tree at HEAD.
  - Zero stale 'internals/secured/', 'connect/runtime/.../RecordRedactor',
    or 'server-common/.../ReplicationConfigs' references remain across
    the audit corpus.
  - All 10 findings now have exactly 10 numbered H2 section headers
    (verified via 'grep -cE "^## [0-9]+\. "').
  - Markdown fence balance intact (all diagram files: 4 fences each;
    findings: all balanced).
  - Cross-referenced anchors (DISALLOW_NONE, ALLOW_LEADING_ZEROS,
    AllowedPaths, MAX_RECORDS_PER_USER_OP) preserved.
  - references.md entries verified present (AllowedPaths=1 match,
    SocketServerConfigs=1 match).

AUDIT ONLY RULE COMPLIANCE:

  Modifications confined exclusively to documentation artifacts under
  docs/security-audit/. Zero source code, test, build-configuration,
  or inline-comment modifications. The untracked 'blitzy/' directory
  (pre-existing baseline) is NOT part of this commit.

Files changed: 6 (+46 / -26 lines)
  M docs/security-audit/findings/01-filesystem-access-path-traversal.md
  M docs/security-audit/findings/07-external-function-callback-misuse.md
  M docs/security-audit/findings/08-deserialization-attacks.md
  M docs/security-audit/findings/09-information-leakage.md
  M docs/security-audit/findings/10-public-api-developer-misuse.md
  M docs/security-audit/references.md
blitzy Bot pushed a commit to blitzy-public-samples/blitzy-kafka that referenced this pull request Apr 19, 2026
…apache#3)

Remediates 3 MINOR QA findings — all broken anchor fragments in
docs/security-audit/findings/07-external-function-callback-misuse.md.

The previous anchor fragments used MkDocs-style semantic IDs that do
not resolve against GitHub-flavored markdown auto-generated heading
slugs. This commit aligns each fragment to the GitHub-computed slug
for the target heading.

Fixes:
  * Line 197: #oauth -> apache#32-security--oauth
      Target: ### 3.2 Security - OAuth (accepted-mitigations.md:201)
      (double-hyphen comes from the two spaces around the em-dash;
       the em-dash itself is stripped by the GitHub slug algorithm)

  * Line 227: #oauth -> apache#32-security--oauth (both visible text and URL)
      Target: same as Line 197 (second occurrence in the
      'Cross-References' section)

  * Line 232: apache#62-restclient-forwarding -> apache#42-connect-restclient-
      forwards-the-inbound-authorization-header-to-outbound-worker-
      peer-calls-062
      Target: ### 4.2 Connect RestClient forwards the inbound
      Authorization header to outbound worker-peer calls (06.2)
      (findings/06-network-subprocess-access.md:90)
      (URL fragment updated; visible short identifier retained for
       readability per QA suggested-fix guidance)

Validation:
  * Runtime re-verification: all 88 anchor-bearing links across the
    24 audit markdown files now resolve (0 broken anchors).
  * File inventory unchanged: 25 files, surgical 6-line diff
    (3 insertions, 3 deletions).
  * Visual Architecture Documentation rule preserved: all 7 diagrams
    still referenced by name across findings and supporting docs.
  * Audit Only rule preserved: zero source-code modifications; only
    the audit deliverable under docs/security-audit/ is touched.

QA report: QA Final Checkpoint apache#3 - Link Integrity + Cross-References
+ License Headers (Issues 1-3, all MINOR, all in findings/07).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants