Release 1.4.1

emlun · emlun · commit 6d0d310084c6 · 2019-10-04T17:24:02.000+02:00
Packaging fixes:

- Fixed dependency declarations so API dependencies are correctly
  propagated as compile-time dependencies of dependent projects.
- Fixed Specification-Version release date in webauthn-server-core jar
  manifest.
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java: [8, 10, 11, 12]
+        java: [8, 11]
 
     steps:
     - name: Check out code
diff --git a/.github/workflows/release-verify-signatures.yml b/.github/workflows/release-verify-signatures.yml
@@ -11,14 +11,9 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java: [10, 11, 12]
+        java: [11]
 
     steps:
-    - name: Download signatures
-      run: |
-        wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF}/webauthn-server-attestation-${GITHUB_REF}.jar.asc
-        wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF}/webauthn-server-core-${GITHUB_REF}.jar.asc
-
     - name: check out code
       uses: actions/checkout@v1
 
@@ -31,9 +26,24 @@ jobs:
       run: ./gradlew jar
 
     - name: Fetch keys
-      run: gpg --recv-keys 57A9DEED4C6D962A923BB691816F3ED99921835E
+      run: gpg --no-default-keyring --keyring yubico --recv-keys 57A9DEED4C6D962A923BB691816F3ED99921835E
+
+    - name: Verify signatures from GitHub release
+      run: |
+        export TAGNAME=${GITHUB_REF#refs/tags/}
 
-    - name: Verify signatures
+        wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAGNAME}/webauthn-server-attestation-${TAGNAME}.jar.asc
+        wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAGNAME}/webauthn-server-core-${TAGNAME}.jar.asc
+
+        gpg --no-default-keyring --keyring yubico --verify webauthn-server-attestation-${TAGNAME}.jar.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${TAGNAME}.jar
+        gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-${TAGNAME}.jar.asc webauthn-server-core/build/libs/webauthn-server-core-${TAGNAME}.jar
+
+    - name: Verify signatures from Maven Central
       run: |
-        gpg --verify webauthn-server-attestation-${GITHUB_REF}.jar.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${GITHUB_REF}.jar
-        gpg --verify webauthn-server-core-${GITHUB_REF}.jar.asc webauthn-server-core/build/libs/webauthn-server-core-${GITHUB_REF}.jar
+        export TAGNAME=${GITHUB_REF#refs/tags/}
+
+        wget -O webauthn-server-core-${TAGNAME}.jar.mavencentral.asc https://repo1.maven.org/maven2/com/yubico/webauthn-server-core/${TAGNAME}/webauthn-server-core-${TAGNAME}.jar.asc
+        wget -O webauthn-server-attestation-${TAGNAME}.jar.mavencentral.asc https://repo1.maven.org/maven2/com/yubico/webauthn-server-attestation/${TAGNAME}/webauthn-server-attestation-${TAGNAME}.jar.asc
+
+        gpg --no-default-keyring --keyring yubico --verify webauthn-server-attestation-${TAGNAME}.jar.mavencentral.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${TAGNAME}.jar
+        gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-${TAGNAME}.jar.mavencentral.asc webauthn-server-core/build/libs/webauthn-server-core-${TAGNAME}.jar
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java: [8, 10, 11, 12]
+        java: [8, 11]
 
     steps:
     - name: Check out code
diff --git a/.gitignore b/.gitignore
@@ -19,5 +19,4 @@ target/
 
 # Gradle
 .gradle/
-/build/
-/*/build/
+build/
diff --git a/.travis.yml b/.travis.yml
@@ -7,7 +7,6 @@ branches:
 jdk:
   - oraclejdk11
   - openjdk8
-  - openjdk10
   - openjdk11
 
 script:
diff --git a/NEWS b/NEWS
@@ -1,3 +1,12 @@
+== Version 1.4.1 ==
+
+Packaging fixes:
+
+* Fixed dependency declarations so API dependencies are correctly propagated as
+  compile-time dependencies of dependent projects.
+* Fixed Specification-Version release date in webauthn-server-core jar manifest.
+
+
 == Version 1.4.0 ==
 
 Changes:
diff --git a/build.gradle b/build.gradle
@@ -7,9 +7,9 @@ buildscript {
   }
 }
 plugins {
-  id 'com.github.kt3k.coveralls' version '2.8.2'
+  id 'com.github.kt3k.coveralls' version '2.8.4'
   id 'io.codearte.nexus-staging' version '0.9.0'
-  id 'io.franzbecker.gradle-lombok' version '1.14'
+  id 'io.franzbecker.gradle-lombok' version '3.1.0'
 }
 
 import io.franzbecker.gradle.lombok.LombokPlugin
@@ -34,14 +34,14 @@ wrapper {
 }
 
 allprojects {
+  ext.snapshotSuffix = "<count>.g<sha>-SNAPSHOT<dirty>"
+  ext.dirtyMarker = "-DIRTY"
+
   apply plugin: 'com.cinnober.gradle.semver-git'
   apply plugin: 'idea'
 
   group = 'com.yubico'
 
-  ext.snapshotSuffix = "<count>.g<sha>-SNAPSHOT<dirty>"
-  ext.dirtyMarker = "-DIRTY"
-
   idea.module {
     downloadJavadoc = true
     downloadSources = true
@@ -63,7 +63,9 @@ subprojects {
   }
 }
 
-evaluationDependsOnChildren()
+allprojects {
+  evaluationDependsOnChildren()
+}
 
 task assembleJavadoc(type: Sync) {
   from("docs/index.html") {
@@ -88,6 +90,10 @@ subprojects { project ->
     reproducibleFileOrder = true
   }
 
+  tasks.withType(Sign) {
+    it.dependsOn check
+  }
+
   test {
     testLogging {
       showStandardStreams = isCiBuild
diff --git a/doc/releasing.md b/doc/releasing.md
@@ -0,0 +1,120 @@
+Release procedure
+====================
+
+Release candidate versions
+---
+
+ 1. Make sure release notes in `NEWS` are up to date.
+
+ 2. Run the tests one more time:
+
+    ```
+    $ ./gradlew clean check
+    ```
+
+ 3. Tag the head commit with an `X.Y.Z-RCN` tag:
+
+    ```
+    $ git tag -a -s 1.4.0-RC1 -m "Pre-release 1.4.0-RC1"
+    ```
+
+    No tag body needed.
+
+ 4. Publish to Sonatype Nexus:
+
+    ```
+    $ ./gradlew publish closeAndReleaseRepository
+    ```
+
+ 5. Push to GitHub:
+
+    ```
+    $ git push origin master 1.4.0-RC1
+    ```
+
+ 6. Make GitHub release.
+
+    - Use the new tag as the release tag
+    - Check the pre-release checkbox
+    - Copy the release notes from `NEWS` into the GitHub release notes; reformat
+      from ASCIIdoc to Markdown and remove line wraps. Include only
+      changes/additions since the previous release or pre-release.
+    - Attach the signature files from
+      `webauthn-server-attestation/build/libs/webauthn-server-attestation-X.Y.Z-RCN.jar.asc`
+      and
+      `webauthn-server-core/build/libs/webauthn-server-core-X.Y.Z-RCN.jar.asc`.
+    - Note which JDK version was used to build the artifacts.
+
+
+Release versions
+---
+
+ 1. Make sure release notes in `NEWS` are up to date.
+
+ 2. Make a no-fast-forward merge from the last (non release candidate) release
+    to the commit to be released:
+
+    ```
+    $ git checkout 1.3.0
+    $ git checkout -b release-1.4.0
+    $ git merge --no-ff master
+    ```
+
+    Copy the release notes for this version from `NEWS` into the merge commit
+    message; reformat it from ASCIIdoc to Markdown and re-wrap line widths at
+    the conventional 72 columns (see
+    [this](https://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)
+    and [this](https://chris.beams.io/posts/git-commit/)). See previous release
+    commits for examples.
+
+    ```
+    $ git checkout master
+    $ git merge --ff-only release-1.4.0
+    $ git branch -d release-1.4.0
+    ```
+
+ 3. Remove the "(unreleased)" tag from `NEWS`.
+
+ 4. Amend this change into the merge commit:
+
+    ```
+    $ git add NEWS
+    $ git commit --amend --reset-author
+    ```
+
+ 5. Run the tests one more time:
+
+    ```
+    $ ./gradlew clean check
+    ```
+
+ 6. Tag the merge commit with an `X.Y.Z` tag:
+
+    ```
+    $ git tag -a -s 1.4.0 -m "Release 1.4.0"
+    ```
+
+    No tag body needed since that's included in the commit.
+
+ 7. Publish to Sonatype Nexus:
+
+    ```
+    $ ./gradlew publish closeAndReleaseRepository
+    ```
+
+ 8. Push to GitHub:
+
+    ```
+    $ git push origin master 1.4.0
+    ```
+
+ 9. Make GitHub release.
+
+    - Use the new tag as the release tag
+    - Copy the release notes from `NEWS` into the GitHub release notes; reformat
+      from ASCIIdoc to Markdown and remove line wraps. Include all changes since
+      the previous release (not just changes since the previous pre-release).
+    - Attach the signature files from
+      `webauthn-server-attestation/build/libs/webauthn-server-attestation-X.Y.Z.jar.asc`
+      and `webauthn-server-core/build/libs/webauthn-server-core-X.Y.Z.jar.asc`.
+    - Note which JDK version was used to build the artifacts.
diff --git a/settings.gradle b/settings.gradle
@@ -4,3 +4,7 @@ include ':webauthn-server-core'
 include ':webauthn-server-demo'
 include ':yubico-util'
 include ':yubico-util-scala'
+
+include ':test-dependent-projects:java-dep-webauthn-server-attestation'
+include ':test-dependent-projects:java-dep-webauthn-server-core'
+include ':test-dependent-projects:java-dep-yubico-util'
diff --git a/test-dependent-projects/build.gradle.kts b/test-dependent-projects/build.gradle.kts
@@ -0,0 +1,4 @@
+plugins {
+    // This is needed because the root project needs the sourceCompatibility property to exist.
+    `java-library`
+}
diff --git a/test-dependent-projects/java-dep-webauthn-server-attestation/build.gradle.kts b/test-dependent-projects/java-dep-webauthn-server-attestation/build.gradle.kts
@@ -0,0 +1,8 @@
+plugins {
+    `java-library`
+}
+
+dependencies {
+    implementation(project(":webauthn-server-attestation"))
+}
+
diff --git a/test-dependent-projects/java-dep-webauthn-server-attestation/src/main/java/com/yubico/test/compilability/ThisShouldCompile.java b/test-dependent-projects/java-dep-webauthn-server-attestation/src/main/java/com/yubico/test/compilability/ThisShouldCompile.java
@@ -0,0 +1,24 @@
+package com.yubico.test.compilability;
+
+import com.yubico.webauthn.attestation.AttestationResolver;
+import java.security.cert.X509Certificate;
+import java.util.List;
+import java.util.Optional;
+
+public class ThisShouldCompile {
+
+    public AttestationResolver getResolver() {
+        return new AttestationResolver() {
+            @Override
+            public Optional<com.yubico.webauthn.attestation.Attestation> resolve(X509Certificate attestationCertificate, List<X509Certificate> certificateChain) {
+                return Optional.empty();
+            }
+
+            @Override
+            public com.yubico.webauthn.attestation.Attestation untrustedFromCertificate(X509Certificate attestationCertificate) {
+                return null;
+            }
+        };
+    }
+
+}
diff --git a/test-dependent-projects/java-dep-webauthn-server-core/build.gradle.kts b/test-dependent-projects/java-dep-webauthn-server-core/build.gradle.kts
@@ -0,0 +1,8 @@
+plugins {
+    `java-library`
+}
+
+dependencies {
+    implementation(project(":webauthn-server-core"))
+}
+
diff --git a/test-dependent-projects/java-dep-webauthn-server-core/src/main/java/com/yubico/test/compilability/ThisShouldCompile.java b/test-dependent-projects/java-dep-webauthn-server-core/src/main/java/com/yubico/test/compilability/ThisShouldCompile.java
@@ -0,0 +1,44 @@
+package com.yubico.test.compilability;
+
+import com.yubico.webauthn.CredentialRepository;
+import com.yubico.webauthn.RegisteredCredential;
+import com.yubico.webauthn.RelyingParty;
+import com.yubico.webauthn.data.ByteArray;
+import com.yubico.webauthn.data.PublicKeyCredentialDescriptor;
+import com.yubico.webauthn.data.PublicKeyCredentialType;
+import com.yubico.webauthn.data.RelyingPartyIdentity;
+import java.util.Optional;
+import java.util.Set;
+
+public class ThisShouldCompile {
+
+    public RelyingParty getRp() {
+        return RelyingParty.builder()
+                .identity(RelyingPartyIdentity.builder()
+                        .id("localhost")
+                        .name("Example RP")
+                        .build())
+                .credentialRepository(new CredentialRepository() {
+                    @Override public Set<PublicKeyCredentialDescriptor> getCredentialIdsForUsername(String username) { return null; }
+                    @Override public Optional<ByteArray> getUserHandleForUsername(String username) { return Optional.empty(); }
+                    @Override public Optional<String> getUsernameForUserHandle(ByteArray userHandle) { return Optional.empty(); }
+                    @Override public Optional<RegisteredCredential> lookup(ByteArray credentialId, ByteArray userHandle) { return Optional.empty(); }
+                    @Override public Set<RegisteredCredential> lookupAll(ByteArray credentialId) { return null; }
+                })
+            .build();
+    }
+
+    public ByteArray getByteArray() {
+        ByteArray a = new ByteArray(new byte[] {1, 2, 3, 4});
+        byte[] b = a.getBytes();
+        return a;
+    }
+
+    public PublicKeyCredentialType getPublicKeyCredentialType() {
+        PublicKeyCredentialType a = PublicKeyCredentialType.PUBLIC_KEY;
+        String b = a.toJsonString();
+        return a;
+    }
+
+
+}
diff --git a/test-dependent-projects/java-dep-yubico-util/build.gradle.kts b/test-dependent-projects/java-dep-yubico-util/build.gradle.kts
@@ -0,0 +1,8 @@
+plugins {
+    `java-library`
+}
+
+dependencies {
+    implementation(project(":yubico-util"))
+}
+
diff --git a/test-dependent-projects/java-dep-yubico-util/src/main/java/com/yubico/test/compilability/ThisShouldCompile.java b/test-dependent-projects/java-dep-yubico-util/src/main/java/com/yubico/test/compilability/ThisShouldCompile.java
@@ -0,0 +1,12 @@
+package com.yubico.test.compilability;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.yubico.internal.util.JacksonCodecs;
+
+public class ThisShouldCompile {
+
+    public String getEncodedValue() throws JsonProcessingException {
+        return JacksonCodecs.json().writeValueAsString("hej");
+    }
+
+}
diff --git a/webauthn-server-attestation/build.gradle b/webauthn-server-attestation/build.gradle
@@ -11,8 +11,11 @@ evaluationDependsOn(':webauthn-server-core')
 
 dependencies {
 
-  implementation(
+  api(
     project(':webauthn-server-core'),
+  )
+
+  implementation(
     project(':yubico-util'),
     'com.fasterxml.jackson.core:jackson-databind:2.9.9.3',
     'com.google.guava:guava:19.0',
diff --git a/webauthn-server-core/build.gradle b/webauthn-server-core/build.gradle
diff --git a/webauthn-server-demo/README b/webauthn-server-demo/README
diff --git a/webauthn-server-demo/build.gradle b/webauthn-server-demo/build.gradle
diff --git a/webauthn-server-demo/gretty-2.2.0.plugin b/webauthn-server-demo/gretty-2.2.0.plugin
diff --git a/yubico-util/build.gradle b/yubico-util/build.gradle
