Patch OkHttp's Platform class to avoid eager call to Security.getProviders()#10714
Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 3 commits intomasterfrom Mar 3, 2026
Merged
Conversation
mcculls
added
comp: core
mcculls
changed the title
Security.getProviders()Security.getProviders()
mcculls
force-pushed
the
mcculls/avoid-okhttp-conscrypt-check
branch
from
f2f15c6 to
d1d45a0
Compare
…iders() We want to avoid this call because it can lead to unwanted side-effects, such as initialization of java-util-logging on IBM JDKs that bundle the IBMSASL provider. The only reason for this call is to check for the Conscrypt module, which is only available on Android and is not applicable to how the tracer uses OkHttp. Patched class is based on https://raw.githubusercontent.com/DataDog/okhttp/refs/heads/java7/okhttp/src/main/java/okhttp3/internal/platform/Platform.java with the following sections of code removed: ``` public static boolean isConscryptPreferred() { // mainly to allow tests to run cleanly if ("conscrypt".equals(System.getProperty("okhttp.platform"))) { return true; } // check if Provider manually installed String preferredProvider = Security.getProviders()[0].getName(); return "Conscrypt".equals(preferredProvider); } ``` ``` if (isConscryptPreferred()) { Platform conscrypt = ConscryptPlatform.buildIfSupported(); if (conscrypt != null) { return conscrypt; } } ```
mcculls
force-pushed
the
mcculls/avoid-okhttp-conscrypt-check
branch
from
d1d45a0 to
71a9f37
Compare
amarziali
approved these changes
Mar 2, 2026
Contributor
amarziali
left a comment
amarziali
left a comment
There was a problem hiding this comment.
pre-approving. thanks for the fix
mcculls
force-pushed
the
mcculls/avoid-okhttp-conscrypt-check
branch
from
d0dc9e0 to
04e998f
Compare
BenchmarksStartupParameters
See matching parameters
SummaryFound 14 performance improvements and 1 performance regressions! Performance is the same for 47 metrics, 9 unstable metrics.
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.60.0-SNAPSHOT~4b338b00c7, baseline=1.60.0-SNAPSHOT~1c44c6f9a7
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.065 s) : 0, 1065181
Total [baseline] (8.739 s) : 0, 8738565
Agent [candidate] (1.062 s) : 0, 1061801
Total [candidate] (8.898 s) : 0, 8898132
section iast
Agent [baseline] (1.242 s) : 0, 1241892
Total [baseline] (9.432 s) : 0, 9431699
Agent [candidate] (1.226 s) : 0, 1226487
Total [candidate] (9.558 s) : 0, 9558194
gantt
title insecure-bank - break down per module: candidate=1.60.0-SNAPSHOT~4b338b00c7, baseline=1.60.0-SNAPSHOT~1c44c6f9a7
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.191 ms) : 0, 1191
crashtracking [candidate] (1.191 ms) : 0, 1191
BytebuddyAgent [baseline] (627.577 ms) : 0, 627577
BytebuddyAgent [candidate] (629.829 ms) : 0, 629829
AgentMeter [baseline] (29.072 ms) : 0, 29072
AgentMeter [candidate] (29.135 ms) : 0, 29135
GlobalTracer [baseline] (257.775 ms) : 0, 257775
GlobalTracer [candidate] (258.508 ms) : 0, 258508
AppSec [baseline] (32.945 ms) : 0, 32945
AppSec [candidate] (31.569 ms) : 0, 31569
Debugger [baseline] (62.995 ms) : 0, 62995
Debugger [candidate] (58.104 ms) : 0, 58104
Remote Config [baseline] (618.4 µs) : 0, 618
Remote Config [candidate] (596.227 µs) : 0, 596
Telemetry [baseline] (11.369 ms) : 0, 11369
Telemetry [candidate] (8.763 ms) : 0, 8763
Flare Poller [baseline] (5.421 ms) : 0, 5421
Flare Poller [candidate] (7.958 ms) : 0, 7958
section iast
crashtracking [baseline] (1.208 ms) : 0, 1208
crashtracking [candidate] (1.192 ms) : 0, 1192
BytebuddyAgent [baseline] (804.16 ms) : 0, 804160
BytebuddyAgent [candidate] (796.127 ms) : 0, 796127
AgentMeter [baseline] (11.6 ms) : 0, 11600
AgentMeter [candidate] (11.315 ms) : 0, 11315
GlobalTracer [baseline] (249.478 ms) : 0, 249478
GlobalTracer [candidate] (247.48 ms) : 0, 247480
AppSec [baseline] (34.717 ms) : 0, 34717
AppSec [candidate] (26.199 ms) : 0, 26199
Debugger [baseline] (64.828 ms) : 0, 64828
Debugger [candidate] (63.89 ms) : 0, 63890
Remote Config [baseline] (533.564 µs) : 0, 534
Remote Config [candidate] (540.979 µs) : 0, 541
Telemetry [baseline] (8.615 ms) : 0, 8615
Telemetry [candidate] (13.968 ms) : 0, 13968
Flare Poller [baseline] (3.488 ms) : 0, 3488
Flare Poller [candidate] (4.603 ms) : 0, 4603
IAST [baseline] (27.093 ms) : 0, 27093
IAST [candidate] (25.19 ms) : 0, 25190
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.60.0-SNAPSHOT~4b338b00c7, baseline=1.60.0-SNAPSHOT~1c44c6f9a7
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.065 s) : 0, 1065082
Total [baseline] (10.997 s) : 0, 10997179
Agent [candidate] (1.057 s) : 0, 1056997
Total [candidate] (11.022 s) : 0, 11022223
section appsec
Agent [baseline] (1.248 s) : 0, 1247588
Total [baseline] (11.133 s) : 0, 11133214
Agent [candidate] (1.26 s) : 0, 1259715
Total [candidate] (11.197 s) : 0, 11197355
section iast
Agent [baseline] (1.244 s) : 0, 1244425
Total [baseline] (11.287 s) : 0, 11286942
Agent [candidate] (1.226 s) : 0, 1226025
Total [candidate] (11.307 s) : 0, 11307130
section profiling
Agent [baseline] (1.194 s) : 0, 1194439
Total [baseline] (10.992 s) : 0, 10991723
Agent [candidate] (1.188 s) : 0, 1187700
Total [candidate] (11.103 s) : 0, 11102978
gantt
title petclinic - break down per module: candidate=1.60.0-SNAPSHOT~4b338b00c7, baseline=1.60.0-SNAPSHOT~1c44c6f9a7
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.193 ms) : 0, 1193
crashtracking [candidate] (1.187 ms) : 0, 1187
BytebuddyAgent [baseline] (627.556 ms) : 0, 627556
BytebuddyAgent [candidate] (628.288 ms) : 0, 628288
AgentMeter [baseline] (28.975 ms) : 0, 28975
AgentMeter [candidate] (28.993 ms) : 0, 28993
GlobalTracer [baseline] (257.535 ms) : 0, 257535
GlobalTracer [candidate] (257.339 ms) : 0, 257339
AppSec [baseline] (32.977 ms) : 0, 32977
AppSec [candidate] (31.536 ms) : 0, 31536
Debugger [baseline] (66.462 ms) : 0, 66462
Debugger [candidate] (58.592 ms) : 0, 58592
Remote Config [baseline] (606.045 µs) : 0, 606
Remote Config [candidate] (587.461 µs) : 0, 587
Telemetry [baseline] (9.185 ms) : 0, 9185
Telemetry [candidate] (8.698 ms) : 0, 8698
Flare Poller [baseline] (4.508 ms) : 0, 4508
Flare Poller [candidate] (5.738 ms) : 0, 5738
section appsec
crashtracking [baseline] (1.199 ms) : 0, 1199
crashtracking [candidate] (1.205 ms) : 0, 1205
BytebuddyAgent [baseline] (663.567 ms) : 0, 663567
BytebuddyAgent [candidate] (667.124 ms) : 0, 667124
AgentMeter [baseline] (12.029 ms) : 0, 12029
AgentMeter [candidate] (12.108 ms) : 0, 12108
GlobalTracer [baseline] (260.016 ms) : 0, 260016
GlobalTracer [candidate] (260.572 ms) : 0, 260572
AppSec [baseline] (168.59 ms) : 0, 168590
AppSec [candidate] (178.696 ms) : 0, 178696
Debugger [baseline] (66.802 ms) : 0, 66802
Debugger [candidate] (65.918 ms) : 0, 65918
Remote Config [baseline] (683.393 µs) : 0, 683
Remote Config [candidate] (577.039 µs) : 0, 577
Telemetry [baseline] (9.294 ms) : 0, 9294
Telemetry [candidate] (9.064 ms) : 0, 9064
Flare Poller [baseline] (3.672 ms) : 0, 3672
Flare Poller [candidate] (3.588 ms) : 0, 3588
IAST [baseline] (25.527 ms) : 0, 25527
IAST [candidate] (24.377 ms) : 0, 24377
section iast
crashtracking [baseline] (1.206 ms) : 0, 1206
crashtracking [candidate] (1.193 ms) : 0, 1193
BytebuddyAgent [baseline] (804.319 ms) : 0, 804319
BytebuddyAgent [candidate] (794.939 ms) : 0, 794939
AgentMeter [baseline] (11.619 ms) : 0, 11619
AgentMeter [candidate] (11.263 ms) : 0, 11263
GlobalTracer [baseline] (249.326 ms) : 0, 249326
GlobalTracer [candidate] (247.461 ms) : 0, 247461
AppSec [baseline] (34.071 ms) : 0, 34071
AppSec [candidate] (26.184 ms) : 0, 26184
Debugger [baseline] (67.544 ms) : 0, 67544
Debugger [candidate] (69.523 ms) : 0, 69523
Remote Config [baseline] (547.407 µs) : 0, 547
Remote Config [candidate] (522.623 µs) : 0, 523
Telemetry [baseline] (8.732 ms) : 0, 8732
Telemetry [candidate] (10.17 ms) : 0, 10170
Flare Poller [baseline] (3.522 ms) : 0, 3522
Flare Poller [candidate] (3.509 ms) : 0, 3509
IAST [baseline] (27.349 ms) : 0, 27349
IAST [candidate] (25.145 ms) : 0, 25145
section profiling
crashtracking [baseline] (1.161 ms) : 0, 1161
crashtracking [candidate] (1.171 ms) : 0, 1171
BytebuddyAgent [baseline] (683.426 ms) : 0, 683426
BytebuddyAgent [candidate] (685.607 ms) : 0, 685607
AgentMeter [baseline] (8.645 ms) : 0, 8645
AgentMeter [candidate] (8.657 ms) : 0, 8657
GlobalTracer [baseline] (217.385 ms) : 0, 217385
GlobalTracer [candidate] (217.247 ms) : 0, 217247
AppSec [baseline] (32.848 ms) : 0, 32848
AppSec [candidate] (32.179 ms) : 0, 32179
Debugger [baseline] (67.781 ms) : 0, 67781
Debugger [candidate] (65.535 ms) : 0, 65535
Remote Config [baseline] (626.845 µs) : 0, 627
Remote Config [candidate] (573.17 µs) : 0, 573
Telemetry [baseline] (8.908 ms) : 0, 8908
Telemetry [candidate] (8.302 ms) : 0, 8302
Flare Poller [baseline] (3.741 ms) : 0, 3741
Flare Poller [candidate] (3.511 ms) : 0, 3511
ProfilingAgent [baseline] (99.082 ms) : 0, 99082
ProfilingAgent [candidate] (94.043 ms) : 0, 94043
Profiling [baseline] (99.657 ms) : 0, 99657
Profiling [candidate] (94.604 ms) : 0, 94604
LoadParameters
See matching parameters
SummaryFound 2 performance improvements and 3 performance regressions! Performance is the same for 15 metrics, 16 unstable metrics.
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.60.0-SNAPSHOT~4b338b00c7, baseline=1.60.0-SNAPSHOT~1c44c6f9a7
dateFormat X
axisFormat %s
section baseline
no_agent (1.175 ms) : 1164, 1186
. : milestone, 1175,
iast (3.139 ms) : 3097, 3181
. : milestone, 3139,
iast_FULL (5.991 ms) : 5930, 6052
. : milestone, 5991,
iast_GLOBAL (3.446 ms) : 3392, 3501
. : milestone, 3446,
profiling (2.067 ms) : 2047, 2086
. : milestone, 2067,
tracing (1.791 ms) : 1777, 1806
. : milestone, 1791,
section candidate
no_agent (1.192 ms) : 1181, 1204
. : milestone, 1192,
iast (3.236 ms) : 3191, 3280
. : milestone, 3236,
iast_FULL (5.803 ms) : 5745, 5860
. : milestone, 5803,
iast_GLOBAL (3.791 ms) : 3730, 3851
. : milestone, 3791,
profiling (2.092 ms) : 2071, 2113
. : milestone, 2092,
tracing (1.759 ms) : 1744, 1774
. : milestone, 1759,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.60.0-SNAPSHOT~4b338b00c7, baseline=1.60.0-SNAPSHOT~1c44c6f9a7
dateFormat X
axisFormat %s
section baseline
no_agent (18.108 ms) : 17924, 18293
. : milestone, 18108,
appsec (18.994 ms) : 18804, 19183
. : milestone, 18994,
code_origins (17.765 ms) : 17590, 17941
. : milestone, 17765,
iast (17.433 ms) : 17263, 17604
. : milestone, 17433,
profiling (19.326 ms) : 19133, 19518
. : milestone, 19326,
tracing (17.7 ms) : 17526, 17874
. : milestone, 17700,
section candidate
no_agent (18.286 ms) : 18098, 18474
. : milestone, 18286,
appsec (18.53 ms) : 18342, 18718
. : milestone, 18530,
code_origins (18.825 ms) : 18638, 19011
. : milestone, 18825,
iast (17.717 ms) : 17541, 17894
. : milestone, 17717,
profiling (18.535 ms) : 18348, 18723
. : milestone, 18535,
tracing (17.72 ms) : 17548, 17891
. : milestone, 17720,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.60.0-SNAPSHOT~4b338b00c7, baseline=1.60.0-SNAPSHOT~1c44c6f9a7
dateFormat X
axisFormat %s
section baseline
no_agent (15.709 s) : 15709000, 15709000
. : milestone, 15709000,
appsec (15.133 s) : 15133000, 15133000
. : milestone, 15133000,
iast (18.36 s) : 18360000, 18360000
. : milestone, 18360000,
iast_GLOBAL (18.202 s) : 18202000, 18202000
. : milestone, 18202000,
profiling (14.842 s) : 14842000, 14842000
. : milestone, 14842000,
tracing (14.755 s) : 14755000, 14755000
. : milestone, 14755000,
section candidate
no_agent (15.547 s) : 15547000, 15547000
. : milestone, 15547000,
appsec (15.029 s) : 15029000, 15029000
. : milestone, 15029000,
iast (17.928 s) : 17928000, 17928000
. : milestone, 17928000,
iast_GLOBAL (17.689 s) : 17689000, 17689000
. : milestone, 17689000,
profiling (14.656 s) : 14656000, 14656000
. : milestone, 14656000,
tracing (14.832 s) : 14832000, 14832000
. : milestone, 14832000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.60.0-SNAPSHOT~4b338b00c7, baseline=1.60.0-SNAPSHOT~1c44c6f9a7
dateFormat X
axisFormat %s
section baseline
no_agent (1.473 ms) : 1462, 1485
. : milestone, 1473,
appsec (2.524 ms) : 2469, 2579
. : milestone, 2524,
iast (2.269 ms) : 2199, 2338
. : milestone, 2269,
iast_GLOBAL (2.31 ms) : 2239, 2380
. : milestone, 2310,
profiling (2.108 ms) : 2053, 2164
. : milestone, 2108,
tracing (2.07 ms) : 2016, 2124
. : milestone, 2070,
section candidate
no_agent (1.484 ms) : 1472, 1495
. : milestone, 1484,
appsec (3.81 ms) : 3589, 4031
. : milestone, 3810,
iast (2.264 ms) : 2194, 2333
. : milestone, 2264,
iast_GLOBAL (2.304 ms) : 2234, 2374
. : milestone, 2304,
profiling (2.113 ms) : 2057, 2170
. : milestone, 2113,
tracing (2.072 ms) : 2018, 2126
. : milestone, 2072,
|
Contributor
Author
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
The merge request has been interrupted because the build 99952881 took longer than expected. The current limit for the base branch 'master' is 120 minutes. |
bric3
approved these changes
Mar 3, 2026
Contributor
bric3
left a comment
bric3
left a comment
There was a problem hiding this comment.
Side note it's not only for Android. JVM users can also use Security.insertProviderAt(Conscrypt.newProvider(), 1);, but indeed it's likely done early in the app's main and not before.
Refs: [on okhttp 3.x], [on okhttp 5x]
communication/src/main/java/okhttp3/internal/platform/PatchPlatform.java
Show resolved
Hide resolved
communication/src/main/java/okhttp3/internal/platform/PatchPlatform.java
Show resolved
Hide resolved
communication/src/main/java/okhttp3/internal/platform/PatchPlatform.java
Show resolved
Hide resolved
Contributor
Author
Right, but that is more about the application's use of Conscrypt - we're using OkHttp in a way that is isolated from the application, so we shouldn't be picking up things from the application environment. |
Contributor
Author
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
gh-worker-dd-mergequeue-cf854d
bot
deleted the
mcculls/avoid-okhttp-conscrypt-check
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
We want to avoid this call because it can lead to unwanted side-effects, such as initialization of java-util-logging on IBM JDKs that bundle the IBMSASL provider. The only reason for this call is to check for the Conscrypt module, which is only available on Android and is not applicable to how the tracer uses OkHttp.
Patched class is based on https://raw.githubusercontent.com/DataDog/okhttp/refs/heads/java7/okhttp/src/main/java/okhttp3/internal/platform/Platform.java with the following sections of code removed:
Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueJira ticket: [PROJ-IDENT]
Note: Once your PR is ready to merge, add it to the merge queue by commenting
/merge./merge -ccancels the queue request./merge -f --reason "reason"skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.