Skip to content

Commit 248d0b1

Browse files
emlunemlun
committed
Release 1.4.0
Changes: - Class `com.yubico.internal.util.WebAuthnCodecs` is no longer public. The package `com.yubico.internal.util` was already declared non-public in JavaDoc, but this is now also enforced via Java visibility rules. - Class `com.yubico.webauthn.meta.Specification.SpecificationBuilder` is no longer public. It was never intended to be, although this was not documented explicitly. - Default value for `RelyingParty.preferredPubKeyParams` changed from `[ES256, RS256]` to `[ES256, EdDSA, RS256]` - Data classes no longer use `Optional` internally in field types. This should not meaningfully affect the public API, but might improve compatibility with frameworks that use reflection. New features: - Added support for Ed25519 signatures. - New constants `COSEAlgorithmIdentifier.EdDSA` and `PublicKeyCredentialParameters.EdDSA` - Artifacts are now built reproducibly; fresh builds from source should now be verifiable by signature files from Maven Central. Security fixes: - Bumped Jackson dependency to version 2.9.9.3 which has patched CVE-2019-12814, CVE-2019-14439, CVE-2019-14379
2 parents 6ade42d + 440f7af commit 248d0b1

File tree

85 files changed

+1674
-745
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

85 files changed

+1674
-745
lines changed

‎.github/workflows/master.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# This name is shown in the status badge in the README
2+
name: build
3+
4+
on:
5+
push:
6+
branches:
7+
- master
8+
9+
jobs:
10+
test:
11+
name: JDK ${{matrix.java}}
12+
13+
runs-on: ubuntu-latest
14+
strategy:
15+
matrix:
16+
java: [8, 10, 11, 12]
17+
18+
steps:
19+
- name: Check out code
20+
uses: actions/checkout@v1
21+
22+
- name: Set up JDK
23+
uses: actions/setup-java@v1
24+
with:
25+
java-version: ${{ matrix.java }}
26+
27+
- name: Run tests
28+
run: ./gradlew check
29+
30+
- name: Build JavaDoc
31+
run: ./gradlew assembleJavadoc

‎.github/workflows/release-verify-signatures.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Verify release signatures
2+
3+
on:
4+
release:
5+
types: [published, created, edited, prereleased]
6+
7+
jobs:
8+
verify:
9+
name: Verify signatures (JDK ${{matrix.java}})
10+
11+
runs-on: ubuntu-latest
12+
strategy:
13+
matrix:
14+
java: [10, 11, 12]
15+
16+
steps:
17+
- name: Download signatures
18+
run: |
19+
wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF}/webauthn-server-attestation-${GITHUB_REF}.jar.asc
20+
wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF}/webauthn-server-core-${GITHUB_REF}.jar.asc
21+
22+
- name: check out code
23+
uses: actions/checkout@v1
24+
25+
- name: Set up JDK
26+
uses: actions/setup-java@v1
27+
with:
28+
java-version: ${{ matrix.java }}
29+
30+
- name: Build jars
31+
run: ./gradlew jar
32+
33+
- name: Fetch keys
34+
run: gpg --recv-keys 57A9DEED4C6D962A923BB691816F3ED99921835E
35+
36+
- name: Verify signatures
37+
run: |
38+
gpg --verify webauthn-server-attestation-${GITHUB_REF}.jar.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${GITHUB_REF}.jar
39+
gpg --verify webauthn-server-core-${GITHUB_REF}.jar.asc webauthn-server-core/build/libs/webauthn-server-core-${GITHUB_REF}.jar

‎.github/workflows/test.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: test
2+
3+
on:
4+
push:
5+
branches:
6+
- '*'
7+
- '!master'
8+
tags:
9+
- '*'
10+
pull_request:
11+
branches:
12+
- '*'
13+
- '!master'
14+
tags:
15+
- '*'
16+
17+
jobs:
18+
test:
19+
name: JDK ${{matrix.java}}
20+
21+
runs-on: ubuntu-latest
22+
strategy:
23+
matrix:
24+
java: [8, 10, 11, 12]
25+
26+
steps:
27+
- name: Check out code
28+
uses: actions/checkout@v1
29+
30+
- name: Set up JDK
31+
uses: actions/setup-java@v1
32+
with:
33+
java-version: ${{ matrix.java }}
34+
35+
- name: Run tests
36+
run: ./gradlew check
37+
38+
- name: Build JavaDoc
39+
run: ./gradlew assembleJavadoc

‎.travis.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ branches:
55
- /^tmp-?.*/
66

77
jdk:
8-
- oraclejdk8
98
- oraclejdk11
109
- openjdk8
1110
- openjdk10
@@ -21,5 +20,8 @@ stages:
2120
jobs:
2221
include:
2322
- stage: mutation-test
24-
jdk: oraclejdk8
23+
jdk: oraclejdk11
2524
script: ./gradlew pitest coveralls
25+
26+
# Workaround to TLS issues in JDK 11, see https://github.com/kt3k/coveralls-gradle-plugin/issues/85
27+
after_success: curl -F 'json_file=@build/coveralls/report.json' 'https://coveralls.io/api/v1/jobs'

‎NEWS

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,33 @@
1+
== Version 1.4.0 ==
2+
3+
Changes:
4+
5+
* Class `com.yubico.internal.util.WebAuthnCodecs` is no longer public. The
6+
package `com.yubico.internal.util` was already declared non-public in JavaDoc,
7+
but this is now also enforced via Java visibility rules.
8+
* Class `com.yubico.webauthn.meta.Specification.SpecificationBuilder` is no
9+
longer public. It was never intended to be, although this was not documented
10+
explicitly.
11+
* Default value for `RelyingParty.preferredPubKeyParams` changed from `[ES256,
12+
RS256]` to `[ES256, EdDSA, RS256]`
13+
* Data classes no longer use `Optional` internally in field types. This should
14+
not meaningfully affect the public API, but might improve compatibility with
15+
frameworks that use reflection.
16+
17+
New features:
18+
19+
* Added support for Ed25519 signatures.
20+
* New constants `COSEAlgorithmIdentifier.EdDSA` and
21+
`PublicKeyCredentialParameters.EdDSA`
22+
* Artifacts are now built reproducibly; fresh builds from source should now be
23+
verifiable by signature files from Maven Central.
24+
25+
Security fixes:
26+
27+
* Bumped Jackson dependency to version 2.9.9.3 which has patched CVE-2019-12814,
28+
CVE-2019-14439, CVE-2019-14379
29+
30+
131
== Version 1.3.0 ==
232

333
Security fixes:

‎README

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ java-webauthn-server
55
:toc-title:
66

77
image:https://travis-ci.org/Yubico/java-webauthn-server.svg?branch=master["Build Status", link="https://travis-ci.org/Yubico/java-webauthn-server"]
8+
image:https://github.com/Yubico/java-webauthn-server/workflows/build/badge.svg["Build Status", link="https://github.com/Yubico/java-webauthn-server/actions"]
89
image:https://coveralls.io/repos/github/Yubico/java-webauthn-server/badge.svg["Coverage Status", link="https://coveralls.io/github/Yubico/java-webauthn-server"]
910

1011
Server-side https://www.w3.org/TR/webauthn/[Web Authentication] library for
@@ -327,13 +328,33 @@ version is derived from the most recent Git tag. Builds done on a tagged commit
327328
will have a plain `x.y.z` version number, while a build on any other commit will
328329
result in a version number containing the abbreviated commit hash.
329330

331+
Starting in version `1.4.0-RC2`, artifacts are built reproducibly. Fresh builds from
332+
tagged commits should therefore be verifiable by signatures from Maven Central:
333+
334+
```
335+
$ git checkout 1.4.0-RC2
336+
$ ./gradlew :webauthn-server-core:jar
337+
$ wget https://repo1.maven.org/maven2/com/yubico/webauthn-server-core/1.4.0-RC2/webauthn-server-core-1.4.0-RC2.jar.asc
338+
$ gpg --verify webauthn-server-core-1.4.0-RC2.jar.asc webauthn-server-core/build/libs/webauthn-server-core-1.4.0-RC2.jar
339+
```
340+
341+
Note that building with a different JDK may produce a different artifact. To
342+
ensure binary reproducibility, please build with the same JDK as specified in
343+
the release notes.
344+
345+
Official Yubico software signing keys are listed on the
346+
https://developers.yubico.com/Software_Projects/Software_Signing.html[Yubico
347+
Developers site].
348+
349+
330350
To run the tests:
331351

332352
----------
333353
$ ./gradlew check
334354
----------
335355

336-
To run the http://pitest.org/[PIT mutation tests]:
356+
To run the http://pitest.org/[PIT mutation tests] (this may take upwards of 30
357+
minutes):
337358

338359
----------
339360
$ ./gradlew pitest

0 commit comments

Comments
 (0)