[jwrosewell]

Problem

The Usage Sharing Element accepts no Evidence. It finds the values to share in the web request, which the web integration adds to Evidence as server.http-request on every request (WebRequestEvidenceServiceCore.java line 73, with every value recorded at line 150). A header that no element reads is therefore not in Evidence at all, and reaches the usage sharing message only through that web request.

The tests in UsageSharingEvidenceTests check that the web request is added and what it holds, but each builds the Usage Sharing Element with a share percentage of 0, so none of them sends anything. No test sent a header that no element reads through the web integration and found it in the message that is sent. A change that left the web request out, or left it empty, would have stopped every such header being shared with every test still passing.

What the specification says

The Accepted Evidence and Shared Evidence sections of the usage sharing element specification, at 6570727d on the specifications main branch, say how the element finds its values. Shared Evidence says "A value from the web request is given the key it would have as Evidence, for example header.user-agent for its User-Agent header", that header.cookie is never shared, "This holds for the Cookie header of the server.http-request view as well as for Evidence", and that "The server.http-request value itself is never shared, only the values read from" it.

What changed

One test, UsageSharingEvidenceTests.UnreadHeader_ReachesTheUsageSharingMessage, and nothing in any package's main code.

1. A local HTTP endpoint on the loopback address, from the JDK's com.sun.net.httpserver, keeps the body of each request it gets.
2. A Pipeline holds the Sequence Element and a Usage Sharing Element with a share percentage of 1, one entry per message, no repeat interval, and the local endpoint as its URL. The test first checks that this Pipeline does not accept header.x-test.
3. WebRequestEvidenceServiceCore.Default.addEvidenceFromRequest adds a request carrying X-Test: shared, a User-Agent and a Cookie header, as the servlet filter and the Spring interceptor do, and the FlowData is processed.
4. The test waits up to 60 seconds for the message, which is sent at once, unzips it and reads it as XML. X-Test and the User-Agent must be in it with their values, and the Cookie header must not.

The wait is an upper bound and not a time limit on the work. The message arrived in about 0.1 seconds in the green run below.

Tests

• Red, run 43520081798 on a throwaway branch holding the test and a temporary change that hands over the web request empty, by taking out the record call at line 150, with a temporary workflow that runs UsageSharingEvidenceTests on ubuntu-latest with the runner's Java and Maven. The new test failed with "The header no element reads was not shared. expected: but was:", and so did the two tests that read the web request, 3 of 6.
• Green, run 43520097455, the test on rc as it is. 6 of 6 passed.

Full build

Run 43520552583 built 328bc86 merged with rc (30e4886) on nine configurations, Ubuntu x64 with Java 8, 11, 17 and 21, Ubuntu arm64 with Java 17, and Windows with Java 8, 11, 17 and 21, and every job passed. Each of its ten Setting 'PullRequestSha' lines names 328bc86, and its Configure job printed "Left out 6 macOS entries".

macOS was left out of this draft's full build under the 9 November decision. The rc head is built with macOS before it merges into main.

What remains

Nothing in this change. The release plan of #63 counts a change under src/test as no release, so this releases nothing on its own.