Wangchong Zhou comments

Results 195 comments of


                                            Wangchong Zhou

Can't start postgresql 16 over tls

We are working on fix right now : ) Thanks for you patience.

fix(cmd): move unix domain sockets to /var/run

> it is common practice to store socket files in /var/run which is cleaned up automatically on server restart. Note this only applies to containers, as /var/run is a volatile...

fix(cmd): move unix domain sockets to /var/run

Please also consider use cases when user doesn't start Kong through `systemd` (e.g. a plain `kong start`). In such case, even the ReadWritePaths I mentioned above won't work because no...

Fix: ssl_protocols does not rely on ssl_cipher_suite property

@d19dotca Thanks for the PR. But I don't think the obversation is correct. ``` (kong-dev) ~/D/K/kong-ee $ KONG_SSL_PROTOCOLS=whatever kong prepare 2023/11/30 15:13:22 [warn] ulimit is currently set to "256". For...

Fix: ssl_protocols does not rely on ssl_cipher_suite property

@d19dotca ah that's because openssl 3.x disables TLSv1.1 and lower by default (See https://www.openssl.org/docs/man3.1/man3/SSL_CTX_set_security_level.html, we are on SecLevel=1). We will need to update document around it.

Fix: ssl_protocols does not rely on ssl_cipher_suite property

@bungle it does not anymore after we move to openssl 3.x. For `old`, even if we set `TLSv1.1` in `ssl_protocols` it will not be effective. That means we will need...

chore(conf): disable TLSv1.1 and lower in openssl 3.x

> 0old is working correctly to those clients with OpenSSL 1.x whether the OpenSSL version is 3.x on server side. let's mention this in the kong.conf.default comments, so it will...

fix(build): hermetic install of files after build

good run https://github.com/Kong/kong/actions/runs/8964918449/job/24617728938?pr=12882

fix(cd): add tests to ensure wasm filters are in place

see https://github.com/Kong/kong/actions/runs/9092877617/job/24990612395?pr=13033 for result

chore(ci): add s390x arch support

It feels easier to do with a cross-compile, then you don't need to wait for nfpm etc to release s390x artifacts. Just duplicate what exist for aarch64 to s390x would...