diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 4b3542b..44fd170 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -15,7 +15,7 @@ jobs: suite: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Unit suite run: docker build --target test . - name: Live iya-sts diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 1d39fa6..c5bc1bc 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -57,7 +57,7 @@ jobs: fi # Every tag: the last release's tag is what the decision compares with. - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 if: steps.gate.outputs.publish == 'true' with: ref: ${{ github.event.workflow_run.head_sha }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 3525a9c..98a7dc0 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -15,5 +15,5 @@ jobs: name: Library tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - run: docker build --target test . diff --git a/CLAUDE.md b/CLAUDE.md index 39c98f8..7a05de3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -5,7 +5,7 @@ SPDX-License-Identifier: MIT # wsfed-caep -Java 17 port of the server-side WS-Federation relying party. Group `com.iyasec`, artifact `wsfed-caep`, packages under `com.iyasec.wsfed`. License MIT (`LICENSE`). A pull request merged into `main` publishes the library (`library/` only; the demo never) to Maven Central after the test workflow succeeds on that commit. A direct push does not. `publish.yml` runs `mvn -Prelease -f library/pom.xml deploy` in the Maven container: the `release` profile adds the sources and javadoc jars, a GPG signature on every file, and the Central publishing plugin, which uploads, publishes and waits until the release is live. Maven Central has no trusted publishing, so the job uses four repository secrets: `CENTRAL_TOKEN_USERNAME` and `CENTRAL_TOKEN_PASSWORD` (a Central Portal user token) and `GPG_PRIVATE_KEY` and `GPG_PASSPHRASE` (the release signing key, whose public half is on a public key server). A release happens when the library's files changed since the last release's tag: `publish.yml` takes one patch above the highest published version, publishes it, and creates the matching tag and GitHub Release. A change to tests, the demo, or the docs releases nothing. To choose a version or start a new minor, raise `VERSION`; the version is stamped in CI and is not committed, so the manifests can trail what is published. `-Dcentral.skipPublishing=true` builds and signs everything and uploads nothing. When this tree is published, `develop` and `main` are the same commit. +Java 25 port of the server-side WS-Federation relying party. Group `com.iyasec`, artifact `wsfed-caep`, packages under `com.iyasec.wsfed`. License MIT (`LICENSE`). A pull request merged into `main` publishes the library (`library/` only; the demo never) to Maven Central after the test workflow succeeds on that commit. A direct push does not. `publish.yml` runs `mvn -Prelease -f library/pom.xml deploy` in the Maven container: the `release` profile adds the sources and javadoc jars, a GPG signature on every file, and the Central publishing plugin, which uploads, publishes and waits until the release is live. Maven Central has no trusted publishing, so the job uses four repository secrets: `CENTRAL_TOKEN_USERNAME` and `CENTRAL_TOKEN_PASSWORD` (a Central Portal user token) and `GPG_PRIVATE_KEY` and `GPG_PASSPHRASE` (the release signing key, whose public half is on a public key server). A release happens when the library's files changed since the last release's tag: `publish.yml` takes one patch above the highest published version, publishes it, and creates the matching tag and GitHub Release. A change to tests, the demo, or the docs releases nothing. To choose a version or start a new minor, raise `VERSION`; the version is stamped in CI and is not committed, so the manifests can trail what is published. `-Dcentral.skipPublishing=true` builds and signs everything and uploads nothing. When this tree is published, `develop` and `main` are the same commit. ## Usage @@ -29,7 +29,7 @@ Omitted or `true` means on. The resolved configuration leaves `signals` null in docker build --target test . ``` -The `test` stage runs `mvn -B test` in `maven:3.9.9-eclipse-temurin-17`. GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. +The `test` stage runs `mvn -B test` in `maven:3.9-eclipse-temurin-26`. GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. JUnit 5 covers the stub IdP (a signed SAML assertion the library accepts), replay, metadata, the self-signed certificate, the SSF poll receiver, the demo handler, and the trust chain (`TrustChainTest`: the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path, the handshake fallback keeps every block, the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). The test stage installs python3 and openssl for it. The stub tests do not start iya-sts. `python3 scripts/live_iya_sts.py` does, unless `IYA_STS_URL` names one that is already running. It signs the demo in and checks two Shared Signals events on `GET /live-status`. iya-sts main sets the assertion SessionIndex to the assertion id, so a session-revoked subject that names the sign-on session matches nobody. The demo ends its one session from that handler. The nightly workflow, cron `51 6 * * *` plus workflow_dispatch, runs the unit image and that script. It never binds port 3000, 8081 or 18481-18495; its defaults are 18553 (iya-sts) and 18653 (the demo). It builds the demo the way a user does: install script first (writing the chain), then the image build, then the run with only `rp.key`, `rp.crt` and `idp-metadata.xml` mounted. No CA mount, no `idpCa` rewrite. Secrets go to docker as `-e NAME`; no log line carries a sign-in URL. `scripts/configure_iya_sts.py` is the same registration script as the Python tree; its plan is exercised there. Configure is host Python and does not import this library. diff --git a/Dockerfile b/Dockerfile index 04660d4..86328fa 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ # `docker build --target test` runs the suite in this image. # The demo image below does not run it. -FROM maven:3.9.9-eclipse-temurin-17 AS test +FROM maven:3.9-eclipse-temurin-26 AS test # TrustChainTest runs the install script's trust-chain code: python3, and the # openssl CLI it reads certificate names with. RUN apt-get update && apt-get install -y --no-install-recommends python3 openssl && rm -rf /var/lib/apt/lists/* @@ -18,7 +18,7 @@ COPY scripts ./scripts COPY demo/wsfed.json demo/wsfed.json RUN mvn -B test -FROM maven:3.9.9-eclipse-temurin-17 AS build +FROM maven:3.9-eclipse-temurin-26 AS build WORKDIR /src COPY pom.xml . COPY library library @@ -26,7 +26,7 @@ COPY demo/pom.xml demo/pom.xml COPY demo/src demo/src # The demo module copies its runtime dependencies, the library among them, to demo/target/dependency. RUN mvn -B -DskipTests package -FROM eclipse-temurin:17-jre +FROM eclipse-temurin:25-jre WORKDIR /app RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/* # The demo's jar under the name the image has always run, and beside it every diff --git a/demo/pom.xml b/demo/pom.xml index fff0a49..b7fb4ae 100644 --- a/demo/pom.xml +++ b/demo/pom.xml @@ -27,7 +27,7 @@ maven-compiler-plugin - 3.8.1 + 3.16.0 maven-surefire-plugin @@ -42,7 +42,7 @@ They are compiled into the test classpaths only, never into a published jar. --> org.codehaus.mojo build-helper-maven-plugin - 3.6.0 + 3.6.2 test-fixtures @@ -58,14 +58,14 @@ org.codehaus.mojo exec-maven-plugin - 3.1.0 + 3.6.4 com.iyasec.wsfed.demo.Demo maven-dependency-plugin - 3.6.1 + 3.11.0 copy-dependencies diff --git a/library/pom.xml b/library/pom.xml index 897034d..e8015b1 100644 --- a/library/pom.xml +++ b/library/pom.xml @@ -39,12 +39,12 @@ org.apache.santuario xmlsec - 2.3.4 + 4.0.4 com.nimbusds nimbus-jose-jwt - 10.0.2 + 10.10 org.junit.jupiter @@ -57,7 +57,7 @@ maven-compiler-plugin - 3.8.1 + 3.16.0 maven-surefire-plugin @@ -68,7 +68,7 @@ They are compiled into the test classpaths only, never into a published jar. --> org.codehaus.mojo build-helper-maven-plugin - 3.6.0 + 3.6.2 test-fixtures @@ -98,7 +98,7 @@ org.apache.maven.plugins maven-source-plugin - 3.3.1 + 3.4.0 attach-sources @@ -109,7 +109,7 @@ org.apache.maven.plugins maven-javadoc-plugin - 3.11.2 + 3.12.0 all,-missing @@ -124,7 +124,7 @@ org.apache.maven.plugins maven-gpg-plugin - 3.2.7 + 3.2.8 bc