Skip to content

Commit 3468431

Browse files
emlunemlun
committed
Release 2.1.0
`webauthn-server-core`: Changes: - Log messages on attestation certificate path validation failure now include the attestation object. Deprecations: - Deprecated method `AssertionResult.getCredentialId(): ByteArray`. Use `.getCredential().getCredentialId()` instead. - Deprecated method `AssertionResult.getUserHandle(): ByteArray`. Use `.getCredential().getUserHandle()` instead. New features: - Added method `FidoMetadataDownloader.refreshBlob()`. - Added function `COSEAlgorithmIdentifier.fromPublicKey(ByteArray)`. - Added method `AssertionResult.getCredential(): RegisteredCredential`. - Added support for the `"tpm"` attestation statement format. - Added support for ES384 and ES512 signature algorithms. - Added property `policyTreeValidator` to `TrustRootsResult`. If set, the given predicate function will be used to validate the certificate policy tree after successful attestation certificate path validation. This may be required for some JCA providers to accept attestation certificates with critical certificate policy extensions. See the JavaDoc for `TrustRootsResultBuilder.policyTreeValidator(Predicate)` for more information. - Added enum value `AttestationConveyancePreference.ENTERPRISE`. - (Experimental) Added constant `AuthenticatorTransport.HYBRID`. Fixes: - Fixed various typos and mistakes in JavaDocs. - Moved version constraints for test dependencies from meta-module `webauthn-server-parent` to unpublished test meta-module. - `yubico-util` dependency removed from downstream compile scope. - Fixed missing JavaDoc on `TrustRootsResult` getters and builder setters. `webauthn-server-attestation`: Changes: - The `AuthenticatorToBeFiltered` argument of the `FidoMetadataService` runtime filter now omits zero AAGUIDs. - Promoted log messages in `FidoMetadataDownloader` about BLOB signature failure and cache corruption from DEBUG level to WARN level. Fixes: - Fixed various typos and mistakes in JavaDocs. - `FidoMetadataDownloader` now verifies the SHA-256 hash of the cached trust root certificate, as promised in the JavaDoc of `useTrustRootCacheFile` and `useTrustRootCache`. - BouncyCastle dependency dropped. - Guava dependency dropped (but still remains in core module). - If BLOB download fails, `FidoMetadataDownloader` now correctly falls back to cache if available.
2 parents 16e0acb + 4ddf825 commit 3468431

File tree

119 files changed

+6481
-4541
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

119 files changed

+6481
-4541
lines changed

‎.github/actions/pit-results-badge/action.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Create Shields.io badge from PIT mutation test results
2+
author: Emil Lundberg <emil@yubico.com>
3+
description: |
4+
Parses a [PIT][pitest] report file and outputs a [Shields.io][shields]
5+
[endpoint badge][endpoint] definition file.
6+
7+
[endpoint]: https://shields.io/endpoint
8+
[pitest]: https://pitest.org/
9+
[shields]: https://shields.io/
10+
11+
inputs:
12+
cache-seconds:
13+
default: 3600
14+
description: Passed through as cacheSeconds to Shields.io.
15+
16+
label:
17+
default: "mutation coverage"
18+
description: Label for the left side of the badge.
19+
20+
mutations-file:
21+
default: build/reports/pitest/mutations.xml
22+
description: Path to the PIT report XML file.
23+
24+
output-file:
25+
required: true
26+
description: Path to write output file to.
27+
28+
runs:
29+
using: "composite"
30+
31+
steps:
32+
- name: Install yq (and xq)
33+
shell: bash
34+
run: pip install yq
35+
36+
- name: Create coverage badge
37+
shell: bash
38+
run: |
39+
cat ${{ inputs.mutations-file }} \
40+
| xq '.mutations.mutation
41+
| (map(select(.["@detected"] == "true")) | length) / length
42+
| {
43+
schemaVersion: 1,
44+
label: "${{ inputs.label }}",
45+
message: "\(. * 100 | floor | tostring) %",
46+
color: "hsl(\(. * 120 | floor | tostring), 100%, 40%)",
47+
cacheSeconds: ${{ inputs.cache-seconds }},
48+
}' \
49+
> ${{ inputs.output-file }}

‎.github/actions/pit-results-comment/action.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Post PIT mutation test results comment
2+
author: Emil Lundberg <emil@yubico.com>
3+
description: |
4+
Parses a [PIT][pitest] report file, compares it to a previous report,
5+
and posts a summary as a commit comment to the commit that triggered the workflow.
6+
7+
[pitest]: https://pitest.org/
8+
9+
inputs:
10+
mutations-file:
11+
default: build/reports/pitest/mutations.xml
12+
description: Path to the PIT report XML file.
13+
14+
prev-commit:
15+
default: ''
16+
description: |
17+
The full commit SHA of the previous run of this action.
18+
If set, the comment will include a link to the previous commit.
19+
20+
prev-mutations-file:
21+
required: true
22+
description: Path to the PIT report XML file from the previous run of this action.
23+
24+
token:
25+
default: ${{ github.token }}
26+
description: GITHUB_TOKEN or a PAT with permission to write commit comments.
27+
28+
runs:
29+
using: "composite"
30+
31+
steps:
32+
- name: Install yq (and xq)
33+
shell: bash
34+
run: pip install yq
35+
36+
- name: Post results comment
37+
shell: bash
38+
run: |
39+
RESULTS_COMMENT_FILE=$(mktemp)
40+
NEW_STATS_FILE=$(mktemp)
41+
PREV_STATS_FILE=$(mktemp)
42+
43+
./.github/actions/pit-results-comment/compute-stats.sh "${{ inputs.mutations-file }}" > "${NEW_STATS_FILE}"
44+
45+
if [[ -f "${{ inputs.prev-mutations-file }}" ]]; then
46+
./.github/actions/pit-results-comment/compute-stats.sh "${{ inputs.prev-mutations-file }}" > "${PREV_STATS_FILE}"
47+
else
48+
echo 'Previous mutations file not found, using current as placeholder.'
49+
cp "${NEW_STATS_FILE}" "${PREV_STATS_FILE}"
50+
fi
51+
52+
./.github/actions/pit-results-comment/stats-to-comment.sh "${PREV_STATS_FILE}" "${NEW_STATS_FILE}" "${{ inputs.prev-commit }}" > "${RESULTS_COMMENT_FILE}"
53+
54+
curl -X POST \
55+
-H "Authorization: Bearer ${{ inputs.token }}" \
56+
${{ github.api_url }}/repos/${{ github.repository }}/commits/${{ github.sha }}/comments -d @"${RESULTS_COMMENT_FILE}"

‎.github/actions/pit-results-comment/compute-stats.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
xq '.mutations.mutation
4+
| group_by(.mutatedClass | split(".") | .[:-1])
5+
| INDEX(.[0].mutatedClass | split(".") | .[:-1] | join("."))
6+
| map_values({
7+
detected: (map(select(.["@detected"] == "true")) | length),
8+
mutations: length,
9+
})
10+
' "${1}"

‎.github/actions/pit-results-comment/stats-to-comment.sh‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#!/bin/bash
2+
3+
make-contents() {
4+
cat << EOF
5+
## Mutation test results
6+
7+
Package | Coverage | Stats | Prev | Prev |
8+
------- | --------:|:-----:| ----:|:----:|
9+
EOF
10+
11+
jq -s '.[0] as $old | .[1] as $new
12+
| {
13+
packages: (
14+
$old | keys
15+
| map({
16+
("`\(.)`"): {
17+
before: {
18+
detected: $old[.].detected,
19+
mutations: $old[.].mutations,
20+
},
21+
after: {
22+
detected: $new[.].detected,
23+
mutations: $new[.].mutations,
24+
},
25+
percentage_diff: (($new[.].detected / $new[.].mutations - $old[.].detected / $old[.].mutations) * 100 | round),
26+
},
27+
})
28+
| add
29+
),
30+
overall: {
31+
before: {
32+
detected: [($old[] | .detected)] | add,
33+
mutations: [($old[] | .mutations)] | add,
34+
},
35+
after: {
36+
detected: [($new[] | .detected)] | add,
37+
mutations: [($new[] | .mutations)] | add,
38+
},
39+
percentage_diff: (
40+
(
41+
([($new[] | .detected)] | add) / ([($new[] | .mutations)] | add)
42+
- ([($old[] | .detected)] | add) / ([($old[] | .mutations)] | add)
43+
) * 100 | round
44+
),
45+
},
46+
}
47+
| { ("**Overall**"): .overall } + .packages
48+
| to_entries
49+
| .[]
50+
| def difficon:
51+
if .after.detected == .after.mutations then ":trophy:"
52+
elif .percentage_diff > 0 then ":green_circle:"
53+
elif .percentage_diff < 0 then ":small_red_triangle_down:"
54+
else ":small_blue_diamond:"
55+
end;
56+
def triangles:
57+
if . > 0 then ":small_red_triangle:"
58+
elif . < 0 then ":small_red_triangle_down:"
59+
else ":small_blue_diamond:"
60+
end;
61+
"\(.key) | **\(.value.after.detected / .value.after.mutations * 100 | floor) %** \(.value | difficon) | \(.value.after.detected) \(.value.after.detected - .value.before.detected | triangles) / \(.value.after.mutations) \(.value.after.mutations - .value.before.mutations | triangles)| \(.value.before.detected / .value.before.mutations * 100 | floor) % | \(.value.before.detected) / \(.value.before.mutations)"
62+
' \
63+
"${1}" "${2}" --raw-output
64+
65+
if [[ -n "${3}" ]]; then
66+
cat << EOF
67+
68+
Previous run: ${3}
69+
EOF
70+
71+
cat << EOF
72+
73+
Detailed reports: [workflow run #${GITHUB_RUN_NUMBER}](/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID})
74+
EOF
75+
fi
76+
77+
}
78+
79+
make-contents "$@" | python -c 'import json; import sys; print(json.dumps({"body": sys.stdin.read()}))'

‎.github/dependabot.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,13 @@ updates:
66
directory: "/"
77
schedule:
88
interval: "daily"
9+
10+
ignore:
11+
# Spotless patch updates are too noisy
12+
- dependency-name: "spotless-plugin-gradle"
13+
update-types: ["version-update:semver-patch"]
14+
15+
- package-ecosystem: "github-actions"
16+
directory: "/"
17+
schedule:
18+
interval: "weekly"

‎.github/workflows/build.yml‎

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,58 @@
11
# This name is shown in the status badge in the README
22
name: build
33

4-
on: [push, pull_request]
4+
on:
5+
push:
6+
branches-ignore:
7+
- 'tmp**'
8+
pull_request:
9+
branches-ignore:
10+
- 'tmp**'
511

612
jobs:
713
test:
8-
name: JDK ${{matrix.java}}
14+
name: JDK ${{ matrix.java }} ${{ matrix.distribution }}
915

1016
runs-on: ubuntu-latest
1117
strategy:
1218
matrix:
13-
java: [8, 11, 16]
19+
java: [8, 11, 17, 18]
20+
distribution: [temurin]
21+
include:
22+
- java: 17
23+
distribution: zulu
24+
- java: 17
25+
distribution: microsoft
26+
27+
outputs:
28+
report-java: 17
29+
report-dist: temurin
1430

1531
steps:
1632
- name: Check out code
17-
uses: actions/checkout@v1
33+
uses: actions/checkout@v3
1834

1935
- name: Set up JDK
20-
uses: actions/setup-java@v1
36+
uses: actions/setup-java@v3
2137
with:
2238
java-version: ${{ matrix.java }}
39+
distribution: ${{ matrix.distribution }}
2340

2441
- name: Run tests
2542
run: ./gradlew cleanTest test
2643

2744
- name: Archive HTML test report
2845
if: ${{ always() }}
29-
uses: actions/upload-artifact@v2
46+
uses: actions/upload-artifact@v3
3047
with:
31-
name: test-reports-java${{ matrix.java }}-html
48+
name: test-reports-java${{ matrix.java }}-${{ matrix.distribution }}-html
3249
path: "*/build/reports/**"
3350

3451
- name: Archive JUnit test report
3552
if: ${{ always() }}
36-
uses: actions/upload-artifact@v2
53+
uses: actions/upload-artifact@v3
3754
with:
38-
name: test-reports-java${{ matrix.java }}-xml
55+
name: test-reports-java${{ matrix.java }}-${{ matrix.distribution }}-xml
3956
path: "*/build/test-results/**/*.xml"
4057

4158
- name: Build JavaDoc
@@ -47,11 +64,17 @@ jobs:
4764
runs-on: ubuntu-latest
4865
if: ${{ always() && github.event_name == 'pull_request' }}
4966

67+
permissions:
68+
checks: write
69+
pull-requests: write
70+
5071
steps:
5172
- name: Download artifacts
52-
uses: actions/download-artifact@v2
73+
uses: actions/download-artifact@v3
74+
with:
75+
name: test-reports-java${{ needs.test.outputs.report-java }}-${{ needs.test.outputs.report-dist }}-xml
5376

5477
- name: Publish test results
55-
uses: EnricoMi/publish-unit-test-result-action@v1
78+
uses: EnricoMi/publish-unit-test-result-action@v2
5679
with:
5780
files: "**/*.xml"

‎.github/workflows/code-formatting.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
# This name is shown in the status badge in the README
22
name: code-formatting
33

4-
on: [push, pull_request]
4+
on:
5+
push:
6+
branches-ignore:
7+
- 'tmp**'
8+
pull_request:
9+
branches-ignore:
10+
- 'tmp**'
511

612
jobs:
713
test:
@@ -10,16 +16,18 @@ jobs:
1016
runs-on: ubuntu-latest
1117
strategy:
1218
matrix:
13-
java: [11]
19+
java: [17]
20+
distribution: [temurin]
1421

1522
steps:
1623
- name: Check out code
17-
uses: actions/checkout@v1
24+
uses: actions/checkout@v3
1825

1926
- name: Set up JDK
20-
uses: actions/setup-java@v1
27+
uses: actions/setup-java@v3
2128
with:
2229
java-version: ${{ matrix.java }}
30+
distribution: ${{ matrix.distribution }}
2331

2432
- name: Check code formatting
2533
run: ./gradlew spotlessCheck

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,12 @@ name: "Code scanning - action"
22

33
on:
44
push:
5-
branches-ignore: 'dependabot/**'
5+
branches-ignore:
6+
- 'dependabot/**'
7+
- 'tmp**'
68
pull_request:
9+
branches-ignore:
10+
- 'tmp**'
711
schedule:
812
- cron: '0 12 * * 2'
913

@@ -12,17 +16,21 @@ jobs:
1216

1317
runs-on: ubuntu-latest
1418

19+
permissions:
20+
security-events: write
21+
1522
steps:
1623
- name: Checkout repository
17-
uses: actions/checkout@v2
24+
uses: actions/checkout@v3
1825

19-
- uses: actions/setup-java@v1
26+
- uses: actions/setup-java@v3
2027
with:
21-
java-version: '11'
28+
java-version: 17
29+
distribution: temurin
2230

2331
# Initializes the CodeQL tools for scanning.
2432
- name: Initialize CodeQL
25-
uses: github/codeql-action/init@v1
33+
uses: github/codeql-action/init@v2
2634
with:
2735
languages: java
2836

@@ -31,4 +39,4 @@ jobs:
3139
./gradlew jar
3240
3341
- name: Perform CodeQL Analysis
34-
uses: github/codeql-action/analyze@v1
42+
uses: github/codeql-action/analyze@v2

0 commit comments

Comments
 (0)