Fix Vert.x PG PEM trust option configuration

[graemerocher]

Summary

• add explicit PEM trust option binding for the Vert.x PostgreSQL client
• resolve effective PG SSL options before pool creation so CA trust config is preserved
• document the configuration path and add focused regression coverage

Verification

• ./gradlew :micronaut-vertx-pg-client:test --tests 'io.micronaut.configuration.vertx.pg.client.PgClientConfigurationSpec'

Resolves #985

[graemerocher]

@copilot review

[Copilot]

@copilot review

Reviewed (2d89d9b). Changes made as a result:

• PgConnectOptionsResolver.applyNetClientOptions removed — the 7-branch field-by-field SSL merge was over-engineered, had no test coverage, and introduced new behaviour (propagating NetClientOptions SSL settings into connectOptions) beyond the stated fix. netClientOptions is still passed separately to createPool as before; only the PEM trust cert paths are now applied to connectOptions via applyPemTrustOptions.
• Class-level Javadoc added to PgConnectOptionsResolver explaining its role.
• Copyright year corrected in new files to 2017-2020 (matching the rest of the module).

Everything else looks good: Checkstyle, Spotless, and all 3 tests pass.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• ge.micronaut.io
  • Triggering command: /usr/lib/jvm/temurin-21-jdk-amd64/bin/java /usr/lib/jvm/temurin-21-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED -Xmx2048M -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR fixes Vert.x PostgreSQL SSL “verify-ca” behavior by ensuring PEM trust options are bound and preserved when building the effective PgConnectOptions (including URI-based configuration), and adds documentation plus regression tests.

Changes:

• Add pem-trust-options configuration binding and apply it when resolving effective PgConnectOptions.
• Centralize connect options resolution for both URI and property configuration paths before pool creation.
• Add regression tests for “verify-ca” with PEM trust and document the configuration.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
vertx-pg-client/src/test/groovy/io/micronaut/configuration/vertx/pg/client/PgClientConfigurationSpec.groovy	Adds regression tests to ensure verify-ca + PEM trust options don’t get lost (direct options + URI modes).
vertx-pg-client/src/main/java/io/micronaut/configuration/vertx/pg/client/PgPemTrustOptionsConfiguration.java	Introduces configuration properties binding for PEM trust cert paths.
vertx-pg-client/src/main/java/io/micronaut/configuration/vertx/pg/client/PgDriverFactory.java	Uses a resolver to compute effective PgConnectOptions and apply PEM trust consistently.
vertx-pg-client/src/main/java/io/micronaut/configuration/vertx/pg/client/PgConnectOptionsResolver.java	New helper to resolve connect options from URI/properties and apply PEM trust options.
vertx-pg-client/src/main/java/io/micronaut/configuration/vertx/pg/client/PgClientFactory.java	Aligns pool creation with the resolver so URI mode also preserves PEM trust.
vertx-pg-client/src/main/java/io/micronaut/configuration/vertx/pg/client/PgClientConfiguration.java	Exposes getNetClientOptions() (public accessor).
src/main/docs/guide/vertxpgclient.adoc	Documents configuring PEM trust options for verify-ca SSL.

[graemerocher]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Done in 3b520bd. Applied all four review comments:

• Dynamic port: both SSL tests now bind a ServerSocket(0) to obtain a free ephemeral port, eliminating any risk of collision with a real service on 65432.
• Exception handling: connectFailure now catches TimeoutException (returned as-is) and InterruptedException (interrupt flag restored via Thread.currentThread().interrupt(), then returned).
• Docs casing: ssl-mode: verify-ca → ssl-mode: VERIFY_CA to match the Vert.x enum name and the test values.
• Javadoc: removed the blank leading * line from getNetClientOptions().

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• ge.micronaut.io
  • Triggering command: /usr/lib/jvm/temurin-21-jdk-amd64/bin/java /usr/lib/jvm/temurin-21-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED -Xmx2048M -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[radovanradic]

Would it make more sense to do actual verification for pem trust options, something like

void "test vertx-pg-client connects with direct options when verify-ca trust options are configured"() {
        given:
        int port = findFreePort()
        when:
        ApplicationContext applicationContext = ApplicationContext.run(
                'vertx.pg.client.host': 'localhost',
                'vertx.pg.client.port': port,
                'vertx.pg.client.ssl': true,
                'vertx.pg.client.ssl-mode': 'VERIFY_CA',
                'vertx.pg.client.pem-trust-options.cert-paths[0]': 'certs/ca.crt'
        )
        PgConnectOptions options = PgConnectOptionsResolver.resolve(
                applicationContext.getBean(PgClientConfiguration),
                applicationContext.getBean(PgPemTrustOptionsConfiguration)
        )
        PemTrustOptions trustOptions = (PemTrustOptions) options.sslOptions.trustOptions

        then:
        options.host == 'localhost'
        options.port == port
        options.sslMode == SslMode.VERIFY_CA
        options.sslOptions != null
        trustOptions.certPaths == ['certs/ca.crt']

        cleanup:
        applicationContext?.stop()
    }

And the other test as well

void "test vertx-pg-client uri mode keeps verify-ca trust options during connect"() {
        given:
        int port = findFreePort()

        when:
        ApplicationContext applicationContext = ApplicationContext.run(
                'vertx.pg.client.uri': "postgresql://user:secret@localhost:${port}/the-db",
                'vertx.pg.client.ssl': true,
                'vertx.pg.client.ssl-mode': 'VERIFY_CA',
                'vertx.pg.client.pem-trust-options.cert-paths[0]': 'certs/ca.crt'
        )
        PgConnectOptions options = PgConnectOptionsResolver.resolve(
                applicationContext.getBean(PgClientConfiguration),
                applicationContext.getBean(PgPemTrustOptionsConfiguration)
        )
        PemTrustOptions trustOptions = (PemTrustOptions) options.sslOptions.trustOptions

        then:
        options.host == 'localhost'
        options.port == port
        options.database == 'the-db'
        options.user == 'user'
        options.password == 'secret'
        options.sslMode == SslMode.VERIFY_CA
        options.sslOptions != null
        trustOptions.certPaths == ['certs/ca.crt']

        cleanup:
        applicationContext?.stop()
    }

which seems to fail as ssl options are not being set properly (which is issue probably existed before this PR)

[radovanradic]

Suggested change

	* @since 6.7.0
	* @since 7.0.0