hongzhi-gao commented on PR #3606: URL: https://github.com/apache/thrift/pull/3606#issuecomment-4849586835
> One housekeeping note: for a change of this scope, it is worth making sure the JIRA ticket captures the key design decisions and rationale in addition to what is in the commit messages. Commit messages are squashed on merge and can be hard to find later; JIRA comments and the ticket description remain a stable reference for anyone reviewing the issue in future. If there is technical context currently spread across individual commit messages (e.g. the rationale for the `takeOwnership` parameter semantics, or the TLS version floor decision), copying the relevant parts into the JIRA ticket before this is merged would be a good investment. Good point — thanks. I have updated THRIFT-6073 with a *Design decisions* section covering: - why the patch was reshaped to a backend-neutral `SSLContext(SSL_CTX*)` hook (per review feedback) - ownership semantics: unconditional transfer of `SSL_CTX` ownership (replacing the earlier `takeOwnership` parameter, which was dropped in dcc2a06c4 after review) - TLS version floor: injected contexts are wrapped as-is; callers configure `SSL_OP_NO_TLSv1*` before wrapping if needed - threat-model cross-check against `doc/thrift-threat-model.md` (per AGENTS.md §6) I will squash the branch to a single commit before merge, as usual for Thrift PRs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
