Merge branch 'main' into dependabot/gradle/test/fixtures/hdfs-fixture/ch.qos.logback-logback-classic-1.5.18

Signed-off-by: Craig Perkins <[email protected]>

Author: cwperks

.github/workflows/links.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: lychee Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@v2.3.0
+        uses: lycheeverse/lychee-action@v2.4.0
         with:
           args: --accept=200,403,429 --exclude-mail **/*.html **/*.md **/*.txt **/*.json --exclude-file .lychee.excludes
           fail: true

CHANGELOG.md

@@ -9,10 +9,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - [Rule Based Auto-tagging] Add rule schema for auto tagging ([#17238](https://github.com/opensearch-project/OpenSearch/pull/17238))
 - Renaming the node role search to warm ([#17573](https://github.com/opensearch-project/OpenSearch/pull/17573))
 - Introduce a new search node role to hold search only shards ([#17620](https://github.com/opensearch-project/OpenSearch/pull/17620))
-- Fix systemd integTest on deb regarding path ownership check ([#17641](https://github.com/opensearch-project/OpenSearch/pull/17641)) 
+- Fix systemd integTest on deb regarding path ownership check ([#17641](https://github.com/opensearch-project/OpenSearch/pull/17641))
 - Add dfs transformation function in XContentMapValues ([#17612](https://github.com/opensearch-project/OpenSearch/pull/17612))
 - Added Kinesis support as a plugin for the pull-based ingestion ([#17615](https://github.com/opensearch-project/OpenSearch/pull/17615))
 - [Security Manager Replacement] Create initial Java Agent to intercept Socket::connect calls ([#17724](https://github.com/opensearch-project/OpenSearch/pull/17724))
+- Add ingestion management APIs for pause, resume and get ingestion state ([#17631](https://github.com/opensearch-project/OpenSearch/pull/17631))
+- [Security Manager Replacement] Enhance Java Agent to intercept System::exit ([#17746](https://github.com/opensearch-project/OpenSearch/pull/17746))
 
 ### Changed
 - Migrate BC libs to their FIPS counterparts ([#14912](https://github.com/opensearch-project/OpenSearch/pull/14912))
@@ -21,13 +23,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `com.nimbusds:nimbus-jose-jwt` from 9.41.1 to 10.0.2 ([#17607](https://github.com/opensearch-project/OpenSearch/pull/17607), [#17669](https://github.com/opensearch-project/OpenSearch/pull/17669))
 - Bump `com.google.api:api-common` from 1.8.1 to 2.46.1 ([#17604](https://github.com/opensearch-project/OpenSearch/pull/17604))
 - Bump `ch.qos.logback:logback-core` from 1.5.16 to 1.5.17 ([#17609](https://github.com/opensearch-project/OpenSearch/pull/17609))
-- Bump `org.jruby.joni:joni` from 2.2.3 to 2.2.5 ([#17608](https://github.com/opensearch-project/OpenSearch/pull/17608))
+- Bump `org.jruby.joni:joni` from 2.2.3 to 2.2.6 ([#17608](https://github.com/opensearch-project/OpenSearch/pull/17608), [#17732](https://github.com/opensearch-project/OpenSearch/pull/17732))
 - Bump `dangoslen/dependabot-changelog-helper` from 3 to 4 ([#17498](https://github.com/opensearch-project/OpenSearch/pull/17498))
 - Bump `com.google.api:gax` from 2.35.0 to 2.63.1 ([#17465](https://github.com/opensearch-project/OpenSearch/pull/17465))
 - Bump `com.azure:azure-storage-blob` from 12.29.1 to 12.30.0 ([#17667](https://github.com/opensearch-project/OpenSearch/pull/17667))
 - Bump `tj-actions/changed-files` from 46.0.1 to 46.0.3 ([#17666](https://github.com/opensearch-project/OpenSearch/pull/17666))
 - Bump `com.google.code.gson:gson` from 2.11.0 to 2.12.1 ([#17668](https://github.com/opensearch-project/OpenSearch/pull/17668))
 - Bump `com.github.luben:zstd-jni` from 1.5.5-1 to 1.5.6-1 ([#17674](https://github.com/opensearch-project/OpenSearch/pull/17674))
+- Bump `lycheeverse/lychee-action` from 2.3.0 to 2.4.0 ([#17731](https://github.com/opensearch-project/OpenSearch/pull/17731))
+- Bump `com.netflix.nebula.ospackage-base` from 11.11.1 to 11.11.2 ([#17734](https://github.com/opensearch-project/OpenSearch/pull/17734))
 - Bump `ch.qos.logback:logback-classic` from 1.5.17 to 1.5.18 ([#17730](https://github.com/opensearch-project/OpenSearch/pull/17730))
 
 ### Changed

distribution/packages/build.gradle

@@ -63,7 +63,7 @@ import java.util.regex.Pattern
  */
 
 plugins {
-  id "com.netflix.nebula.ospackage-base" version "11.11.1"
+  id "com.netflix.nebula.ospackage-base" version "11.11.2"
 }
 
 void addProcessFilesTask(String type, boolean jdk) {

doc-tools/missing-doclet/src/main/java/org/opensearch/missingdoclet/MissingDoclet.java

@@ -235,6 +235,7 @@ private void check(Element element) {
             case INTERFACE:
             case ENUM:
             case ANNOTATION_TYPE:
+            case RECORD:
                 if (level(element) >= CLASS) {
                     checkComment(element);
                     for (var subElement : element.getEnclosedElements()) {
@@ -343,7 +344,7 @@ private boolean isGenerated(Element element) {
         if (!isGenerated && element.getEnclosingElement() != null) {
             // check if enclosing element is generated
             return isGenerated(element.getEnclosingElement());
-        } 
+        }
 
         return isGenerated;
     }

gradle/libs.versions.toml

@@ -72,7 +72,7 @@ junit             = "4.13.2"
 hamcrest          = "2.1"
 mockito           = "5.16.1"
 objenesis         = "3.3"
-bytebuddy         = "1.17.4"
+bytebuddy         = "1.17.5"
 
 # benchmark dependencies
 jmh               = "1.35"

libs/agent-sm/agent/build.gradle

@@ -13,6 +13,9 @@ dependencies {
   implementation project(":libs:agent-sm:bootstrap")
   implementation "net.bytebuddy:byte-buddy:${versions.bytebuddy}"
   compileOnly "com.google.code.findbugs:jsr305:3.0.2"
+
+  testImplementation "junit:junit:${versions.junit}"
+  testImplementation "org.hamcrest:hamcrest:${versions.hamcrest}"
 }
 
 var bootClasspath = configurations.bootstrap.incoming.artifactView { }.files
@@ -35,8 +38,8 @@ compileJava {
   options.compilerArgs -= '-Werror'
 }
 
-test.enabled = false
 testingConventions.enabled = false
+tasks.named('forbiddenApisTest').configure { onlyIf { false } }
 
 tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures'
@@ -62,3 +65,12 @@ thirdPartyAudit {
 tasks.named('validateNebulaPom') {
   dependsOn prepareAgent
 }
+
+tasks.test {
+  dependsOn prepareAgent
+  jvmArgs += ["-javaagent:" + project.jar.archiveFile.get()]
+}
+
+tasks.check {
+  dependsOn test
+}

libs/agent-sm/agent/licenses/byte-buddy-1.17.4.jar.sha1

@@ -0,0 +1 @@
+88450f120903b7e72470462cdbd2b75a3842223c

libs/agent-sm/agent/licenses/byte-buddy-1.17.5.jar.sha1

@@ -77,7 +77,13 @@ private static AgentBuilder createAgentBuilder(Instrumentation inst) throws Exce
             .with(AgentBuilder.TypeStrategy.Default.REDEFINE)
             .ignore(ElementMatchers.none())
             .type(systemType)
-            .transform(transformer);
+            .transform(transformer)
+            .type(ElementMatchers.is(java.lang.System.class))
+            .transform(
+                (b, typeDescription, classLoader, module, pd) -> b.visit(
+                    Advice.to(SystemExitInterceptor.class).on(ElementMatchers.named("exit"))
+                )
+            );
 
         return agentBuilder;
     }

libs/agent-sm/agent/src/main/java/org/opensearch/javaagent/Agent.java

@@ -0,0 +1,40 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.javaagent;
+
+import org.opensearch.javaagent.bootstrap.AgentPolicy;
+
+import java.lang.StackWalker.Option;
+
+import net.bytebuddy.asm.Advice;
+
+/**
+ * {@link System#exit} interceptor
+ */
+public class SystemExitInterceptor {
+    /**
+     * SystemExitInterceptor
+     */
+    public SystemExitInterceptor() {}
+
+    /**
+     * Interceptor
+     * @param code exit code
+     * @throws Exception exceptions
+     */
+    @Advice.OnMethodEnter()
+    public static void intercept(int code) throws Exception {
+        final StackWalker walker = StackWalker.getInstance(Option.RETAIN_CLASS_REFERENCE);
+        final Class<?> caller = walker.getCallerClass();
+
+        if (!AgentPolicy.isClassThatCanExit(caller.getName())) {
+            throw new SecurityException("The class " + caller + " is not allowed to call System::exit(" + code + ")");
+        }
+    }
+}