(m)TLS to PG - #627

Draft

shortishly wants to merge 380 commits into

623-support-postgresql-mtls-client-authentication-for-backend-connectionsfrom

This pull request is big! We're only showing the most recent 250 commits

Commits on May 9, 2026

cargo update
shortishly
committed
bd656a7

Commits on May 16, 2026

Merge pull request #428 from tansu-io/423-client-group-consumer
shortishly
authored
ae28fa7

Commits on May 17, 2026

include member assignments in group assignment
shortishly
committed
35dfdab

Commits on May 25, 2026

join/sync: delay and retry request for members without an assignment
shortishly
committed
98b0c7f

Commits on May 28, 2026

wip consumer
shortishly
committed
8baca4b
round out remaining assignors
shortishly
committed
4321edb
assignor determined on join
shortishly
committed
40da338
client group consumer functional with apache 39
shortishly
committed
b6dacbd

Commits on Jun 9, 2026

fix: populate SyncGroupResponse member_assignment payload
shortishly
committed
4ce7c46
update with tests
shortishly
committed
9b50583

Commits on Jun 10, 2026

slate: implement txn_add_offsets and SCRAM credential storage

shortishly
and
claude
committed
09a37b8
slate: apply delete and compact cleanup policies in maintain

shortishly
and
claude
committed
2096072
sans-io: retain keyless records in batch compaction

shortishly
and
claude
committed
6db7a49

Commits on Jun 11, 2026

Commits on Jun 12, 2026

txn end
shortishly
committed
76addff
add franz-go compatibility test suite

shortishly
and
claude
committed
2768008
storage: return the batch containing a mid-batch fetch offset

shortishly
and
claude
committed
87db6ea

Commits on Jun 13, 2026

fix: header_fetch.sql used the requested fetch offset for the first record
shortishly
committed
ac708cb

Commits on Jun 16, 2026

Commits on Jun 18, 2026

fencing offset commit
shortishly
committed
5b8853d

Commits on Jun 21, 2026

fix group coordinator generation_id and sync_group assignment validation

shortishly
and
claude
committed
50e5666
storage: don't log out-of-order/duplicate sequence number as errors

shortishly
and
claude
committed
413ad63
Merge branch 'integration-fable'
shortishly
committed
50818f6

Commits on Jun 22, 2026

Commits on Jun 24, 2026

run librdkafka integration on sqlite, s3 and postgres. temporarily
shortishly
committed
6d43d43
fix some missing environment
shortishly
committed
307bb6f
allow continue on error for compat integration tests for the moment
shortishly
committed
0a9fc31

Commits on Jun 25, 2026

Commits on Jun 27, 2026

tansu -> nisshi
shortishly
committed
7bbbb75

Commits on Jun 28, 2026

refactor(storage): split the timeout sweep into maintain_transactions
OrHayat
committed
cf82d41

Commits on Jul 3, 2026

Merge pull request #692 from OrHayat/feat/storage-maintain-transactions
shortishly
authored
510f3e2

Commits on Jul 11, 2026

fix(auth): require a validated identity to treat SASL as authenticated
HarrisonCentner
committed
0cc3ac9

Commits on Jul 12, 2026

Merge pull request #696 from HarrisonCentner/fix/sasl-scram-enforcement
shortishly
authored
37f5de5

Commits on Jul 14, 2026

feat(storage): add Storage::aborted_transactions trait method + backend stubs
OrHayat
committed
0aff2e6

Commits on Jul 27, 2026

Merge pull request #698 from OrHayat/feat/aborted-txn-trait-stub
shortishly
authored
f85b528
add: apt-get update
shortishly
committed
f52eb6d
matrix.storage.enabled
shortishly
committed
771eab6
matrix.storage.experimental
shortishly
committed
f24ab7d
test: apt-get update
shortishly
committed
4ba6985
librdkafka apt-get update
shortishly
committed
56ad99c

Commits on Jul 28, 2026

pivot integration report
shortishly
committed
5a49576
duckdb cli location
shortishly
committed
bb7a889
fix report path
shortishly
committed
104facb
pivot franz go report card
shortishly
committed
9901901

Commits on Jul 29, 2026

Commits on Jul 30, 2026

Commits on Jul 31, 2026

v0.7.0-pre.2 metadata
shortishly
committed
77bf1d3
metadata without 'v'
shortishly
committed
fc439ea
Merge pull request #702 from nisshi-io/dependabot/github_actions/main/actions/checkout-7
shortishly
authored
939be10

Commits on Aug 3, 2026

Commits on Aug 9, 2026

Commits on Aug 10, 2026

Merge pull request #712 from OrHayat/txn/pg-a-maintain-transactions
shortishly
authored
dd96e47

Commits on Aug 11, 2026

fix(storage): stop postgres fetch stalling on unrelated open transactions
OrHayat
committed
ccab851

Commits on Aug 17, 2026

Merge pull request #713 from OrHayat/fix/pg-fetch-stall-on-concurrent-txn
shortishly
authored
2fdff41

Commits on Aug 24, 2026

fix(storage): scope topic delete to the named topic
OrHayat
committed
e241219

Commits on Aug 26, 2026

Commits on Aug 28, 2026

Update nisshi-broker integration tests and doctests to build
shortishly
committed
0e51f82

Commits on Aug 31, 2026

fix(storage): keep record headers in produce order
OrHayat
committed
dc7c49a

Commits on Sep 1, 2026

Merge pull request #715 from OrHayat/fix/pg-header-order
shortishly
authored
b3d0cea

Commits on Sep 11, 2026

rama 0.4.0
shortishly
committed
b7313b3

Commits on Sep 16, 2026

Commits on Sep 17, 2026

Commits on Sep 18, 2026

ci: start compat infra before the franz-go compatibility suite

solace-aross
and
claude
committed
faa7eee
Merge pull request #733 from nisshi-io/fix/ci-compat-franz-go-infra
solace-aross
authored
27a9be4
fix(storage): keep the producer's codec and stop fetch looping per record on pg and lite

solace-aross
and
claude
committed
9df9259
Merge pull request #734 from nisshi-io/fix/compat-batch-compression-hang
solace-aross
authored
870ba9f
fix(compat): fail fast when the broker never starts listening

solace-aross
and
claude
committed
1f1e924
ci: add CodeQL advanced-setup workflow

solace-aross
and
claude
committed
8da894a
fix(broker): serve TLS on the listener when --cert and --key are given

sgamelin
and
claude
committed
8ebc5f9
fix(broker): bound the tls handshake and name the failing file on startup

sgamelin
and
claude
committed
ed0ce3e
fix(cli): validate tls before the schema registry so bad config fails first

sgamelin
and
claude
committed
c3daa32
build(deps): bump crate-ci/typos from 1.48.0 to 1.50.2
dependabot[bot]
authored
4578d7e

Commits on Sep 21, 2026

Commits on Sep 22, 2026

Commits on Sep 23, 2026

ci: add fast dependency and workflow-security gates, pin all actions to SHA

solace-aross
and
claude
committed
6d0cc2f
ci: dedup cache-save-if comment, trim workflow-lint/deny headers
solace-aross
committed
2c754cd
ci: pin codeql.yml action refs, pin build-storage's just-version

solace-aross
and
claude
committed
f66d90f
fix(service,broker): stop accept-loop wedge on a transient accept() error

solace-aross
and
claude
committed
30763bf
review: fix misleading backoff comment, restore addr log, un-orphan spinner

solace-aross
and
claude
committed
abfedee
Merge remote-tracking branch 'origin/main' into fix/tls-listener

sgamelin
and
claude
committed
f541a4e
test(cli): scaffold --key-passphrase-file for encrypted PKCS#8 keys

sgamelin
and
claude
committed
ccc2b21
feat(cli): accept passphrase-protected PKCS#8 keys via --key-passphrase-file

sgamelin
and
claude
committed
ba0bd79
fix(cli): name an unsupported key encryption algorithm instead of blaming the passphrase

sgamelin
and
claude
committed
bd95fe9
test(cli): keep the encrypted bundle build test independent of SCHEMA_REGISTRY

sgamelin
and
claude
committed
54f8990
test(otel): cover service.name precedence and OTEL_RESOURCE_ATTRIBUTES for the metrics resource

sgamelin
and
claude
committed
4c38ea3
feat(otel): honor OTEL_SERVICE_NAME and OTEL_RESOURCE_ATTRIBUTES in the metrics resource

sgamelin
and
claude
committed
f49f50e
refactor(broker): build the metrics resource through nisshi-otel

sgamelin
and
claude
committed
3265b06
docs: document OTLP metrics resource environment variables

sgamelin
and
claude
committed
5f88066
fix(otel): append v1/metrics to prefixed endpoints and surface resource problems

sgamelin
and
claude
committed
f4e4703
fix(broker): flush OTLP metrics on shutdown and drop the dead exporter error

sgamelin
and
claude
committed
a3a92ad
docs: note endpoint path, credentials and upgrade impact for OTLP metrics

sgamelin
and
claude
committed
3fc0a32
Merge pull request #726 from nisshi-io/ci/fast-fundamentals-foundation
solace-aross
authored
7f1baed
fix(broker): reject empty JoinGroup protocols instead of panicking

solace-aross
and
claude
committed
1444835
review: fix truncated frame from non-nullable protocol_name on <v7

solace-aross
and
claude
committed
7d5d9b6
fix(schema): validate tansu.lake.generate.* expressions before execution

solace-aross
and
claude
committed
a1db3dd
fix(storage): deliver correct per-producer offsets and errors in batch coalescing

solace-aross
and
claude
committed
07b3366
build: cache dependency compilation in the Docker image

sgamelin
and
claude
committed
bedbbbb
Merge origin/main into worktree-739
sgamelin
committed
021d6ee
fix(schema): use exact column references in generated-column write path

solace-aross
and
claude
committed
9b14414
ci: silence shellcheck SC2016 false positive in toolchain-check step

sgamelin
and
claude
committed
666ed30
Merge pull request #727 from nisshi-io/fix/accept-loop-error-handling
solace-aross
authored
2ddcd8b
fix(broker): use the shared storage() test helper for the empty-protocols test

solace-aross
and
claude
committed
7e32d95
fix(schema,storage): redact passwords from connection URLs before logging

solace-aross
and
claude
committed
8d2e13e
fix(storage): bound Postgres pool acquisition and query execution

solace-aross
and
claude
committed
18e0857
review: correct connect_timeout doc comment scope

solace-aross
and
claude
committed
6647c71
test(broker): resume real clock before Postgres I/O in session-delay test
solace-aross
committed
c76fb6d
test(broker): pause the clock only around the session-timeout jump

solace-aross
and
claude
committed
e6adddf
fix(service): bound idle connections and stalled transfers with timeouts

solace-aross
and
claude
committed
7404b2e
Merge pull request #731 from nisshi-io/fix/compat-readiness-check
solace-aross
authored
12aed4f
Merge remote-tracking branch 'origin/main' into fix/tls-listener

sgamelin
and
claude
committed
da28ccb
Merge remote-tracking branch 'origin/fix/tls-listener' into feat/tls-key-passphrase

sgamelin
and
claude
committed
567a631
Merge remote-tracking branch 'origin/feat/tls-key-passphrase' into feat/otel-metrics-resource

sgamelin
and
claude
committed
e452dcb
Merge origin/main into worktree-739
sgamelin
committed
22ccfe4
style: reflow accept_error_does_not_wedge_the_loop after removing tokio::time:: prefix

solace-aross
and
claude
committed
39462bb

Commits on Sep 24, 2026

Merge pull request #745 from nisshi-io/fix/delta-lake-generated-column-injection
solace-aross
authored
a463123
Merge pull request #743 from nisshi-io/fix/batch-coalescing-offsets
solace-aross
authored
15b1f17
Merge pull request #747 from nisshi-io/fix/redact-storage-url-passwords-in-logs
solace-aross
authored
42d0de1
Merge pull request #728 from nisshi-io/fix/join-group-empty-protocols
solace-aross
authored
5049c46
Merge pull request #730 from nisshi-io/fix/postgres-pool-query-timeout
solace-aross
authored
9a3596b
ci(compat): drop flaky 0086_purge_remote from the librdkafka allowlist

solace-aross
and
claude
committed
ce1b651
Merge pull request #729 from nisshi-io/fix/tcp-idle-timeout
solace-aross
authored
bb16689
build: lock the shared registry cache mount against concurrent extraction

sgamelin
and
claude
committed
391cc7d
Merge remote-tracking branch 'origin/main' into fix/tls-listener

sgamelin
and
claude
committed
305c2cf
Merge remote-tracking branch 'origin/fix/tls-listener' into feat/tls-key-passphrase

sgamelin
and
claude
committed
39f0d58
Merge remote-tracking branch 'origin/feat/tls-key-passphrase' into feat/otel-metrics-resource

sgamelin
and
claude
committed
c2db4d6
ci: pull minio from Chainguard and fix codeql pin comments

sgamelin
and
claude
committed
7ab2c2c
Merge remote-tracking branch 'origin/fix/tls-listener' into feat/tls-key-passphrase

sgamelin
and
claude
committed
3735a6c
Merge remote-tracking branch 'origin/feat/tls-key-passphrase' into feat/otel-metrics-resource

sgamelin
and
claude
committed
89485f5
Merge pull request #740 from nisshi-io/feat/otel-metrics-resource
sgamelin
authored
a883f21
Merge origin/main into worktree-739
sgamelin
committed
9dd562f
Merge pull request #748 from nisshi-io/fix/flaky-0086-purge-test
solace-aross
authored
4a4f729
Merge pull request #744 from nisshi-io/worktree-739
sgamelin
authored
b6fc4df
build: build MinIO from source instead of depending on a registry mirror

sgamelin
and
claude
committed
7470d8b
build: build release binaries natively; Dockerfile only packages them

sgamelin
and
claude
committed
6186f1e
ci: add ci-gate fan-in job for branch protection (#751)

solace-aross
and
claude
authored
78ef33b
governance: add CODEOWNERS (#752)

solace-aross
and
claude
authored
639e68e

Commits on Sep 25, 2026

build(minio): also build the mc client, not just the server

sgamelin
and
claude
committed
5b47c0c
test(broker): build integration tests as one binary

sgamelin
and
claude
committed
4bf25c8
test(sans-io): build integration tests as one binary

sgamelin
and
claude
committed
aa58fc9
test(service): build integration tests as one binary

sgamelin
and
claude
committed
d3b37f6
docs: describe the tests/it layout in CLAUDE.md

sgamelin
and
claude
committed
c7542e2
Merge origin/main into worktree-746

sgamelin
and
claude
committed
e992588
Merge pull request #754 from nisshi-io/fix/minio-build-from-source
shortishly
authored
bfc1e3b
Merge pull request #755 from nisshi-io/worktree-746
sgamelin
authored
f2f13e4
ci: split into two tiers and add merge_group trigger for a merge queue

solace-aross
and
claude
committed
f9919c0
ci: key non-PR concurrency on ref@sha, assert Tier A ran on PRs

solace-aross
and
claude
committed
c06e840
ci: keep smoke in the ci-gate

solace-aross
and
claude
committed
fbf6676
fix(slatedb): treat update_group without a version as create-only

sgamelin
and
claude
committed
139af87
Merge origin/main into 757-slatedb-update-group-create-only

sgamelin
and
claude
committed
55dd08e
ci: MERGE_QUEUE rollback switch, named ci-gate failures, pin example-java

solace-aross
and
claude
committed
b26d8a2
ci: keep the fork-PR guard on package push and smoke

solace-aross
and
claude
committed
7fc3cf0
Merge pull request #756 from nisshi-io/753-single-test-binary-per-crate
sgamelin
authored
f7b8d49
test: cover restart, stale versions and racing group updates

sgamelin
and
claude
committed
11fcb82
Merge remote-tracking branch 'origin/main' into 757-slatedb-update-group-create-only
sgamelin
committed
6d690f6
test(broker): move group update tests into the it binary

sgamelin
and
claude
committed
6b45c1f
Merge pull request #759 from nisshi-io/ci/merge-queue-two-tier
solace-aross
authored
73f2e22
docs: CLAUDE.md toolchain is 1.98, CI pipeline is two-tier

solace-aross
and
claude
committed
e724e43
Merge pull request #763 from nisshi-io/757-slatedb-update-group-create-only
sgamelin
authored
76129a1
Merge pull request #767 from nisshi-io/docs/claude-md-toolchain-ci
solace-aross
authored
0822346

Commits on Sep 27, 2026

build(deps): bump taiki-e/install-action from 2.87.13 to 2.87.18

dependabot[bot]
authored and
solace-aross
committed
c8ec9f0
build(deps): bump actions-rust-lang/setup-rust-toolchain

dependabot[bot]
authored and
solace-aross
committed
27717ab
ci: preserve release job's warning-denial opt-out under setup-rust-toolchain v2.0.0

solace-aross
and
claude
committed
2cb9391
Merge pull request #758 from nisshi-io/dependabot/github_actions/main/taiki-e/install-action-2.87.18
solace-aross
authored
09d1d75

Commits on Sep 28, 2026

Commits on Sep 29, 2026

Commits on Sep 30, 2026