Skip to content

fix(workloadapi): safely publish JWT bundle updates#429

Open
maxlambrecht wants to merge 2 commits intospiffe:mainfrom
maxlambrecht:fix/jwt-bundle-publication
Open

fix(workloadapi): safely publish JWT bundle updates#429
maxlambrecht wants to merge 2 commits intospiffe:mainfrom
maxlambrecht:fix/jwt-bundle-publication

Conversation

@maxlambrecht
Copy link
Copy Markdown
Member

What

  • Mark DefaultJwtSource and CachedJwtSource JWT bundle-set references as volatile.
  • Preserve existing watcher, lifecycle, and public API behavior.

Why

  • Watcher callbacks update JWT bundles on one thread while getBundleForTrustDomain reads them on another.
  • Volatile publication establishes the needed Java Memory Model happens-before relationship and matches the source snapshot pattern used by X.509 source state.

How tested

  • ./gradlew :java-spiffe-core:test --tests io.spiffe.workloadapi.DefaultJwtSourceTest --tests io.spiffe.workloadapi.CachedJwtSourceTest

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>
@maxlambrecht maxlambrecht requested a review from rturner3 as a code owner May 9, 2026 19:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant