fix(go): support tls connections and validate over tls

go/.env.linux

@@ -12,10 +12,15 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-TRINO_DSN="http://test@localhost:8080?catalog=memory&schema=default"
+# General driver validation uses TRINO_DSN. The URI-specific tests in
+# validation/tests/trino/test_uri.py build their own connection strings from
+# the TRINO_HOST/TRINO_PORT/TRINO_CATALOG/TRINO_SCHEMA/TRINO_SSL_* variables.
+
+TRINO_DSN="https://test@localhost:8443?catalog=memory&schema=default&SSLCertPath=${PWD}/ci/docker/certs/ca.crt"
 TRINO_HOST="localhost"
-TRINO_PORT="8080"
+TRINO_PORT="8443"
 TRINO_CATALOG="memory"
 TRINO_SCHEMA="default"
+TRINO_SSL_MODE="https"
+TRINO_SSL_CERT_PATH="${PWD}/ci/docker/certs/ca.crt"
 TRINO_USERNAME="test"
-TRINO_PASSWORD="password"

go/.gitignore

@@ -18,3 +18,5 @@
 
 generated/
 validation-report.xml
+ci/docker/certs/ca.crt
+ci/docker/certs/localhost.p12

go/ci/docker/certs/generate-certs.sh

@@ -0,0 +1,103 @@
+#!/bin/sh
+
+# Copyright (c) 2026 ADBC Drivers Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Generate the self-signed CA certificate and PKCS#12 keystore used by the
+# local Trino Docker Compose HTTPS setup.
+
+set -eu
+
+CERT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+CA_CONFIG="${CERT_DIR}/openssl-ca.cnf"
+SERVER_CONFIG="${CERT_DIR}/openssl-server.cnf"
+
+CA_CERT="${CERT_DIR}/ca.crt"
+KEYSTORE="${CERT_DIR}/localhost.p12"
+
+if [ -f "${CA_CERT}" ] && [ -f "${KEYSTORE}" ] && [ "${TRINO_FORCE_REGENERATE_CERTS:-0}" != "1" ]; then
+  echo "Trino TLS assets already exist"
+  exit 0
+fi
+
+if [ ! -f "${CA_CONFIG}" ] || [ ! -f "${SERVER_CONFIG}" ]; then
+  echo "Missing OpenSSL config under ${CERT_DIR}" >&2
+  exit 1
+fi
+
+TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/trino-certs.XXXXXX")
+cleanup() {
+  rm -rf "${TMP_DIR}"
+}
+trap cleanup EXIT INT TERM
+
+run_openssl() {
+  log_file="${TMP_DIR}/openssl.log"
+  if ! openssl "$@" > /dev/null 2>"${log_file}"; then
+    cat "${log_file}" >&2
+    exit 1
+  fi
+}
+
+CA_KEY="${TMP_DIR}/ca.key"
+SERVER_KEY="${TMP_DIR}/localhost.key"
+SERVER_CSR="${TMP_DIR}/localhost.csr"
+CA_SERIAL="${TMP_DIR}/ca.srl"
+TMP_CA_CERT="${TMP_DIR}/ca.crt"
+TMP_SERVER_CERT="${TMP_DIR}/localhost.crt"
+TMP_KEYSTORE="${TMP_DIR}/localhost.p12"
+
+run_openssl req \
+  -x509 \
+  -newkey rsa:2048 \
+  -days 3650 \
+  -nodes \
+  -keyout "${CA_KEY}" \
+  -out "${TMP_CA_CERT}" \
+  -config "${CA_CONFIG}"
+
+run_openssl req \
+  -new \
+  -newkey rsa:2048 \
+  -nodes \
+  -keyout "${SERVER_KEY}" \
+  -out "${SERVER_CSR}" \
+  -config "${SERVER_CONFIG}"
+
+run_openssl x509 \
+  -req \
+  -days 3650 \
+  -in "${SERVER_CSR}" \
+  -CA "${TMP_CA_CERT}" \
+  -CAkey "${CA_KEY}" \
+  -CAcreateserial \
+  -CAserial "${CA_SERIAL}" \
+  -out "${TMP_SERVER_CERT}" \
+  -extfile "${SERVER_CONFIG}" \
+  -extensions v3_req
+
+run_openssl pkcs12 \
+  -export \
+  -out "${TMP_KEYSTORE}" \
+  -inkey "${SERVER_KEY}" \
+  -in "${TMP_SERVER_CERT}" \
+  -certfile "${TMP_CA_CERT}" \
+  -name trino-dev \
+  -passout pass:trino-dev
+
+cp "${TMP_CA_CERT}" "${CA_CERT}"
+cp "${TMP_KEYSTORE}" "${KEYSTORE}"
+chmod 0644 "${CA_CERT}" "${KEYSTORE}"
+
+echo "Generated Trino TLS assets in ${CERT_DIR}"

go/ci/docker/certs/openssl-ca.cnf

@@ -0,0 +1,32 @@
+# Copyright (c) 2026 ADBC Drivers Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# OpenSSL config for the self-signed CA certificate used to trust the local
+# Trino HTTPS endpoint during development and CI validation.
+
+[ req ]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+x509_extensions = v3_ca
+
+[ dn ]
+CN = Trino Local Test CA
+
+[ v3_ca ]
+basicConstraints = critical, CA:true
+keyUsage = critical, keyCertSign, cRLSign
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer

go/ci/docker/certs/openssl-server.cnf

@@ -0,0 +1,36 @@
+# Copyright (c) 2026 ADBC Drivers Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# OpenSSL config for the localhost server certificate signed by the local test
+# CA and packaged into the PKCS#12 keystore mounted into the Trino container.
+
+[ req ]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+req_extensions = v3_req
+
+[ dn ]
+CN = localhost
+
+[ v3_req ]
+basicConstraints = critical, CA:false
+keyUsage = critical, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+
+[ alt_names ]
+DNS.1 = localhost
+IP.1 = 127.0.0.1

go/ci/docker/trino/config.properties

@@ -0,0 +1,24 @@
+# Copyright (c) 2026 ADBC Drivers Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Keep HTTP enabled for the existing validation flow, and add HTTPS for
+# self-signed certificate testing from the host.
+coordinator=true
+node-scheduler.include-coordinator=true
+http-server.http.port=8080
+http-server.https.enabled=true
+http-server.https.port=8443
+http-server.https.keystore.path=/etc/trino/certs/localhost.p12
+http-server.https.keystore.key=trino-dev
+discovery.uri=http://localhost:8080

go/compose.yaml

@@ -24,10 +24,23 @@ services:
       trino-init:
         condition: service_completed_successfully
 
+  cert-generator:
+    image: alpine:latest
+    entrypoint: ["/bin/sh", "-ec"]
+    command:
+      - |
+        apk add --no-cache openssl >/dev/null
+        /bin/sh /work/certs/generate-certs.sh
+    volumes:
+      - "./ci/docker/certs:/work/certs"
+
   trino:
     image: trinodb/trino:latest
     environment:
       TRINO_NODE_ENVIRONMENT: development
+    depends_on:
+      cert-generator:
+        condition: service_completed_successfully
     healthcheck:
       test: ["CMD-SHELL", "/usr/lib/trino/bin/health-check"]
       interval: 5s
@@ -36,7 +49,10 @@ services:
       start_period: 20s
     ports:
       - 8080:8080
+      - 8443:8443
     volumes:
+      - "./ci/docker/trino/config.properties:/etc/trino/config.properties:ro"
+      - "./ci/docker/certs:/etc/trino/certs:ro"
       # Add a second 'memory' catalog named 'secondmemory'
       - "./ci/docker/catalog/secondmemory.properties:/etc/trino/catalog/secondmemory.properties:ro"