Skip to content

Commit 479492c

Browse files
emlunemlun
committed
Release 2.4.0
`webauthn-server-core`: New features: - Added support for RS384 and RS512 signature algorithms. - Thanks to GitHub user JohnnyJayJay for the contribution, see #235 - Added `userHandle` field to `AssertionRequest` as part of the second bug fix below. `userHandle` is mutually exclusive with `username`. This was originally released in pre-release `1.12.3-RC3`, but was accidentally left out of the `1.12.3` release. Fixes: - During `RelyingParty.finishRegistration()` if an `attestationTrustSource` is configured, if the `aaguid` in the authenticator data is zero, the call to `AttestationTrustSource.findTrustRoots` will fall back to reading the AAGUID from the attestation certificate if possible. - Fixed bug in `RelyingParty.finishAssertion` where if `StartAssertionOptions.userHandle` was set, it did not propagate to `RelyingParty.finishAssertion` and caused an error saying username and user handle are both absent unless a user handle was returned by the authenticator. This was originally released in pre-release `1.12.3-RC3`, but was accidentally left out of the `1.12.3` release. - Fixed regression in `PublicKeyCredentialCreationOptions.toCredentialsCreateJson()`, which has not been emitting a `requireResidentKey` member since version `2.0.0`. This meant the JSON output was not backwards compatible with browsers that only support the Level 1 version of the WebAuthn spec. `webauthn-server-attestation`: Fixes: - `findEntries` and `findTrustRoots` methods in `FidoMetadataService` now attempt to read AAGUID from the attestation certificate if the `aaguid` argument is absent or zero. - Method `FidoMetadataService.Filters.allOf` now has `@SafeVarargs` annotation.
2 parents 424520f + 547389b commit 479492c

File tree

66 files changed

+2400
-1499
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+2400
-1499
lines changed

‎.github/actions/pit-results-comment/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ runs:
4949
cp "${NEW_STATS_FILE}" "${PREV_STATS_FILE}"
5050
fi
5151
52-
./.github/actions/pit-results-comment/stats-to-comment.sh "${PREV_STATS_FILE}" "${NEW_STATS_FILE}" "${{ inputs.prev-commit }}" > "${RESULTS_COMMENT_FILE}"
52+
./.github/actions/pit-results-comment/stats-to-comment.sh "${PREV_STATS_FILE}" "${NEW_STATS_FILE}" "${{ inputs.prev-commit }}" "${{ github.sha }}" > "${RESULTS_COMMENT_FILE}"
5353
5454
curl -X POST \
5555
-H "Authorization: Bearer ${{ inputs.token }}" \

‎.github/actions/pit-results-comment/stats-to-comment.sh

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,17 @@ EOF
6363
"${1}" "${2}" --raw-output
6464

6565
if [[ -n "${3}" ]]; then
66-
cat << EOF
66+
if [[ -n "${4}" ]]; then
67+
cat << EOF
68+
69+
Previous run: ${3} - [Diff](/${GITHUB_REPOSITORY}/compare/${3}...${4})
70+
EOF
71+
else
72+
cat << EOF
6773
6874
Previous run: ${3}
6975
EOF
76+
fi
7077

7178
cat << EOF
7279

‎NEWS

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,46 @@
1+
== Version 2.4.0 ==
2+
3+
`webauthn-server-core`:
4+
5+
New features:
6+
7+
* Added support for RS384 and RS512 signature algorithms.
8+
** Thanks to GitHub user JohnnyJayJay for the contribution, see
9+
https://github.com/Yubico/java-webauthn-server/pull/235
10+
* Added `userHandle` field to `AssertionRequest` as part of the second bug fix
11+
below. `userHandle` is mutually exclusive with `username`. This was originally
12+
released in pre-release `1.12.3-RC3`, but was accidentally left out of the
13+
`1.12.3` release.
14+
15+
Fixes:
16+
17+
* During `RelyingParty.finishRegistration()` if an `attestationTrustSource` is
18+
configured, if the `aaguid` in the authenticator data is zero, the call to
19+
`AttestationTrustSource.findTrustRoots` will fall back to reading the AAGUID
20+
from the attestation certificate if possible.
21+
* Fixed bug in `RelyingParty.finishAssertion` where if
22+
`StartAssertionOptions.userHandle` was set, it did not propagate to
23+
`RelyingParty.finishAssertion` and caused an error saying username and user
24+
handle are both absent unless a user handle was returned by the authenticator.
25+
This was originally released in pre-release `1.12.3-RC3`, but was accidentally
26+
left out of the `1.12.3` release.
27+
* Fixed regression in
28+
`PublicKeyCredentialCreationOptions.toCredentialsCreateJson()`, which has not
29+
been emitting a `requireResidentKey` member since version `2.0.0`. This meant
30+
the JSON output was not backwards compatible with browsers that only support
31+
the Level 1 version of the WebAuthn spec.
32+
33+
34+
`webauthn-server-attestation`:
35+
36+
Fixes:
37+
38+
* `findEntries` and `findTrustRoots` methods in `FidoMetadataService` now
39+
attempt to read AAGUID from the attestation certificate if the `aaguid`
40+
argument is absent or zero.
41+
* Method `FidoMetadataService.Filters.allOf` now has `@SafeVarargs` annotation.
42+
43+
144
== Version 2.3.0 ==
245

346
New features:

‎README

Lines changed: 42 additions & 42 deletions
Large diffs are not rendered by default.

‎build.gradle

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ buildscript {
44
}
55
dependencies {
66
classpath 'com.cinnober.gradle:semver-git:2.5.0'
7-
classpath 'com.diffplug.spotless:spotless-plugin-gradle:6.12.1'
7+
classpath 'com.diffplug.spotless:spotless-plugin-gradle:6.13.0'
88
classpath 'io.github.cosmicsilence:gradle-scalafix:0.1.13'
99
}
1010
}
@@ -144,6 +144,8 @@ subprojects { project ->
144144
}
145145

146146
tasks.withType(JavaCompile) {
147+
options.compilerArgs += '-Xlint:unchecked'
148+
options.deprecation = true
147149
options.encoding = 'UTF-8'
148150
}
149151
tasks.withType(ScalaCompile) {

‎doc/Migrating_from_v1.adoc

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,12 @@ Here is a high-level outline of what needs to be updated:
2626
- Update `getUserVerification()` and `getResidentKey()` calls
2727
to expect `Optional` values.
2828
29-
This migration guide is written for version `2.0.0` of the
29+
Although the next section references version `2.4.0-RC2` for reasons detailed there,
30+
this migration guide is written for version `2.0.0` of the
3031
`webauthn-server-core` module. Later `2.x` versions may introduce new features
31-
but should remain compatible without further changes; consult the release notes
32-
for a full list of new features.
32+
but should remain compatible without further changes; please consult the
33+
link:https://developers.yubico.com/java-webauthn-server/Release_Notes.html[release notes]
34+
for an up to date list of new features.
3335

3436

3537
== Replace dependency on `webauthn-server-core-minimal`
@@ -46,7 +48,7 @@ Maven example:
4648
- <artifactId>webauthn-server-core-minimal</artifactId>
4749
- <version>1.12.2</version>
4850
+ <artifactId>webauthn-server-core</artifactId>
49-
+ <version>2.0.0</version>
51+
+ <version>2.4.0-RC2</version>
5052
<scope>compile</scope>
5153
</dependency>
5254
----------
@@ -56,10 +58,30 @@ Gradle:
5658
[source,diff]
5759
----------
5860
-compile 'com.yubico:webauthn-server-core-minimal:1.12.2'
59-
+compile 'com.yubico:webauthn-server-core:2.0.0'
61+
+compile 'com.yubico:webauthn-server-core:2.4.0-RC2'
6062
----------
6163

6264

65+
[WARNING]
66+
.*Backwards-incompatible regression in versions 2.0.0 to 2.4.0-RC1*
67+
==========
68+
Versions in the inclusive range `2.0.0` to `2.4.0-RC1` have
69+
a backwards-incompatible regression in
70+
link:https://developers.yubico.com/java-webauthn-server/JavaDoc/webauthn-server-core/latest/com/yubico/webauthn/data/PublicKeyCredentialCreationOptions.html#toCredentialsCreateJson()[`PublicKeyCredentialCreationOptions.toCredentialsCreateJson()`]:
71+
When the
72+
link:https://developers.yubico.com/java-webauthn-server/JavaDoc/webauthn-server-core/2.3.0/com/yubico/webauthn/StartRegistrationOptions.StartRegistrationOptionsBuilder.html#authenticatorSelection(com.yubico.webauthn.data.AuthenticatorSelectionCriteria)[`authenticatorSelection`].link:https://developers.yubico.com/java-webauthn-server/JavaDoc/webauthn-server-core/2.3.0/com/yubico/webauthn/data/AuthenticatorSelectionCriteria.AuthenticatorSelectionCriteriaBuilder.html#residentKey(com.yubico.webauthn.data.ResidentKeyRequirement)[`residentKey`]
73+
parameter is set, a corresponding
74+
link:https://www.w3.org/TR/webauthn-2/#dom-authenticatorselectioncriteria-requireresidentkey[`requireResidentKey`]
75+
member is not emitted in the JSON output.
76+
This is not backwards compatible with browsers that only support the
77+
link:https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#authenticatorSelection[Level 1 version of the WebAuthn spec].
78+
The regression is fixed in version `2.4.0-RC2` and greater.
79+
We therefore urge users to upgrade from versions `1.x` directly to `2.4.0-RC2` or greater to maintain backwards compatibility.
80+
Please consult the link:https://developers.yubico.com/java-webauthn-server/Release_Notes.html[release notes]
81+
for an up to date list of additional changes and new features added since version `2.0.0`.
82+
==========
83+
84+
6385
== Add JCA provider for EdDSA
6486

6587
The library no longer depends explicitly on BouncyCastle for cryptography back-ends.

‎doc/releasing.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ Release candidate versions
5454
- Note which JDK version was used to build the artifacts.
5555
5656
7. Check that the ["Reproducible binary"
57-
workflow](/Yubico/java-webauthn-server/actions/workflows/release-verify-signatures.yml)
57+
workflow](https://github.com/Yubico/java-webauthn-server/actions/workflows/release-verify-signatures.yml)
5858
runs and succeeds.
5959
6060
@@ -133,5 +133,5 @@ Release versions
133133
- Note which JDK version was used to build the artifacts.
134134
135135
12. Check that the ["Reproducible binary"
136-
workflow](/Yubico/java-webauthn-server/actions/workflows/release-verify-signatures.yml)
136+
workflow](https://github.com/Yubico/java-webauthn-server/actions/workflows/release-verify-signatures.yml)
137137
runs and succeeds.

0 commit comments

Comments
 (0)