[issue-2375] [issue-2377] Re-enables PermissionTest and SecurityIT tests

[billkoch]

• Adds the verify goal to the default set of goals for the Maven failsafe plugin to ensure integration test failures are caught by mvn test
• Upgrades to otj-pg-embedded-1.0.0 to take advantage of Docker support so that embedded postgres can run on Apple Silicon

[billkoch]

Fixes #2375 and #2377.

I upgraded com.opentable.components:otj-pg-embedded because the prior version threw an java.lang.IllegalStateException: No Postgres binary found for Darwin / aarch64 on Apple Silicon. The primary difference being the 1.0.0 version uses Docker and testcontainers under the hood.

[chrisknoll]

Will this work in environments that does not have docker support? I've been keeping the OpenTable dependency on the pre-1.0 release due to the migration over to docker.

[chrisknoll]

Just as a follow up, tests fail on my Windows 11 PC:

2025-10-16 12:47:44.792 WARN main org.testcontainers.utility.TestcontainersConfiguration - [] - Attempted to read Testcontainers configuration file at file:/C:/Users/cknoll1/.testcontainers.properties but the file was not found. Exception message: FileNotFoundException: C:\Users\cknoll1\.testcontainers.properties (The system cannot find the file specified)
2025-10-16 12:47:50.233 INFO main org.testcontainers.dockerclient.DockerMachineClientProviderStrategy - [] - docker-machine executable was not found on PATH ([c:\Apps\Eclipse Adoptium\jdk-21.0.7.6-hotspot\bin, C:\Program Files (x86)\Common Files\Oracle\Java\javapath, C:\WINDOWS\system32, C:\WINDOWS, C:\WINDOWS\System32\Wbem, C:\WINDOWS\System32\WindowsPowerShell\v1.0\, C:\WINDOWS\System32\OpenSSH\, c:\Apps\TortoiseGit\bin, C:\Apps\nodejs\, C:\apps\git\bin, C:\Users\cknoll1\AppData\Local\Microsoft\WindowsApps, C:\Apps\Microsoft VS Code\bin, C:\Users\cknoll1\AppData\Roaming\npm, C:\apps\MiKTeX\miktex\bin\x64\])
2025-10-16 12:47:50.234 ERROR main org.testcontainers.dockerclient.DockerClientProviderStrategy - [] - Could not find a valid Docker environment. Please check configuration. Attempted configurations were:
2025-10-16 12:47:50.234 ERROR main org.testcontainers.dockerclient.DockerClientProviderStrategy - [] -     NpipeSocketClientProviderStrategy: failed with exception TimeoutException (org.rnorth.ducttape.TimeoutException: java.util.concurrent.TimeoutException). Root cause TimeoutException (null)
2025-10-16 12:47:50.234 ERROR main org.testcontainers.dockerclient.DockerClientProviderStrategy - [] - As no valid configuration was found, execution cannot continue
Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 7.055 s <<< FAILURE! - in org.ohdsi.webapi.check.checker.CharacterizationCheckerTest
org.ohdsi.webapi.check.checker.CharacterizationCheckerTest  Time elapsed: 7.054 s  <<< ERROR!
java.lang.IllegalStateException: Could not find a valid Docker environment. Please see logs and check configuration
	at org.testcontainers.dockerclient.DockerClientProviderStrategy.lambda$getFirstValidStrategy$4(DockerClientProviderStrategy.java:156)
	at java.util.Optional.orElseThrow(Optional.java:290)
	at org.testcontainers.dockerclient.DockerClientProviderStrategy.getFirstValidStrategy(DockerClientProviderStrategy.java:148)
	at org.testcontainers.DockerClientFactory.getOrInitializeStrategy(DockerClientFactory.java:146)

[billkoch]

@chrisknoll Thanks for looking at this!

You're right: the upgrade on the OpenTable dependency would require Docker. Is migrating to Docker a show stopper?

For awareness, I'm not able to run the tests with the OpenTable dependency as-is on Apple Silicon. I get the following exception:

java.lang.IllegalStateException: No Postgres binary found for Darwin / aarch64

	at com.opentable.db.postgres.embedded.EmbeddedPostgres.prepareBinaries(EmbeddedPostgres.java:768)
	at com.opentable.db.postgres.embedded.EmbeddedPostgres.<init>(EmbeddedPostgres.java:132)
	at com.opentable.db.postgres.embedded.EmbeddedPostgres$Builder.start(EmbeddedPostgres.java:580)
	at org.ohdsi.webapi.PostgresSingletonRule.pg(PostgresSingletonRule.java:67)
	at org.ohdsi.webapi.PostgresSingletonRule.before(PostgresSingletonRule.java:59)
	at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:46)
	at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
	at org.junit.rules.RunRules.evaluate(RunRules.java:20)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.run(SpringJUnit4ClassRunner.java:191)

[billkoch]

If migrating to Docker is a show stopper, perhaps we could switch to Zonky Embedded Postgres instead (as mentioned in this OpenTable issue)?

Zonky Embedded Postgres advertises support for a seemingly wider range of platforms and architectures at least.

[chrisknoll]

yes, Docker requirement is a show stopper.

Yes, Zonky could be a path forward. I looked throught he docs, and it seems you can choose a type of implementation (you can go with the OpenTable one that embeds the binary ie. OpenTable 0.13, or use one that does the docker, i think there are other options too.

If this can be set up to be selected via some configuration variable (to default to old-style open table pg Embed) and then when needed change the config to select the docker backed impl then that would be acceptable.

Also, might be somethign to report to Zonky that when you go with the old-style open table PG binary appraoch, it doesn't have support on that platfrom, maybe that is somethnig they can fix.

[billkoch]

@chrisknoll I updated the PR to switch to the Zonky implementation. I added profiles to pull in the appropriate Zonky binary for the following OS/architecture combinations:

• Windows x86
• macOS Apple Silicon
• Linux x86

Are there other platforms I should add?

Thanks!

[chrisknoll]

Ok, I'm checking now.

For future reference: can you refrain from force pushing branches up to the PR once the PR review starts. I had to do some git maneuvers to overwrite the branch that I pulled with the forced-pushed one, involving some fetching and hard resetting, and I'd prefer if I could just pull the branch next time and get your updates. Thank you!

And don't worry too much about what goes into the final merge into master, I typically do a squash or rebase to get a clean commit into master. It's very rare that I'll ask anyone to squash/rebase their PR after the PR review starts, although if the commit history looks confusing I will ask them to squash/rebase before the first pull is done just to get things into a cleaner state for review.

[chrisknoll]

So far looks like it's running correctly on my local env, but I just want to let everything pass through before approving.

Thanks so much for the quick turn around and the upgrade to Zonky, I think that's a much better long term solution.

[chrisknoll]

Tests ran successfully.