Skip to content

Commit b682288

Browse files
emlunemlun
committed
Merge branch 'main' into feature/more-rsapkcs-algs
2 parents 6fa3f77 + 2ba3d99 commit b682288

File tree

98 files changed

+8364
-3787
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+8364
-3787
lines changed

‎.github/workflows/release-verify-signatures.yml

Lines changed: 57 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,42 @@
11
name: Reproducible binary
22

3+
# This workflow waits for release signatures to appear on Maven Central,
4+
# then rebuilds the artifacts and verifies them against those signatures,
5+
# and finally uploads the signatures to the GitHub release.
6+
37
on:
48
release:
5-
types: [published, created, edited, prereleased]
9+
types: [published]
610

711
jobs:
8-
verify:
9-
name: Verify signatures (JDK ${{matrix.java}})
12+
download:
13+
name: Download keys and signatures
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Fetch keys
18+
run: gpg --no-default-keyring --keyring ./yubico.keyring --keyserver hkps://keys.openpgp.org --recv-keys 57A9DEED4C6D962A923BB691816F3ED99921835E
1019

20+
- name: Download signatures from Maven Central
21+
timeout-minutes: 60
22+
run: |
23+
until wget https://repo1.maven.org/maven2/com/yubico/webauthn-server-attestation/${{ github.ref_name }}/webauthn-server-attestation-${{ github.ref_name }}.jar.asc; do sleep 180; done
24+
until wget https://repo1.maven.org/maven2/com/yubico/webauthn-server-core/${{ github.ref_name }}/webauthn-server-core-${{ github.ref_name }}.jar.asc; do sleep 180; done
25+
26+
- name: Store keyring and signatures as artifact
27+
uses: actions/upload-artifact@v3
28+
with:
29+
name: keyring-and-signatures
30+
retention-days: 1
31+
path: |
32+
yubico.keyring
33+
*.jar.asc
34+
35+
verify:
36+
name: Verify signatures (JDK ${{ matrix.java }} ${{ matrix.distribution }})
37+
needs: download
1138
runs-on: ubuntu-latest
39+
1240
strategy:
1341
matrix:
1442
java: [17]
@@ -17,6 +45,8 @@ jobs:
1745
steps:
1846
- name: check out code
1947
uses: actions/checkout@v3
48+
with:
49+
ref: ${{ github.ref_name }}
2050

2151
- name: Set up JDK
2252
uses: actions/setup-java@v3
@@ -29,25 +59,34 @@ jobs:
2959
java --version
3060
./gradlew jar
3161
32-
- name: Fetch keys
33-
run: gpg --no-default-keyring --keyring yubico --keyserver hkps://keys.openpgp.org --recv-keys 57A9DEED4C6D962A923BB691816F3ED99921835E
62+
- name: Retrieve keyring and signatures
63+
uses: actions/download-artifact@v3
64+
with:
65+
name: keyring-and-signatures
3466

35-
- name: Verify signatures from GitHub release
67+
- name: Verify signatures from Maven Central
3668
run: |
37-
export TAGNAME=${GITHUB_REF#refs/tags/}
69+
gpg --no-default-keyring --keyring ./yubico.keyring --verify webauthn-server-attestation-${{ github.ref_name }}.jar.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${{ github.ref_name }}.jar
70+
gpg --no-default-keyring --keyring ./yubico.keyring --verify webauthn-server-core-${{ github.ref_name }}.jar.asc webauthn-server-core/build/libs/webauthn-server-core-${{ github.ref_name }}.jar
3871
39-
wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAGNAME}/webauthn-server-attestation-${TAGNAME}.jar.asc
40-
wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAGNAME}/webauthn-server-core-${TAGNAME}.jar.asc
72+
upload:
73+
name: Upload signatures to GitHub
74+
needs: verify
75+
runs-on: ubuntu-latest
4176

42-
gpg --no-default-keyring --keyring yubico --verify webauthn-server-attestation-${TAGNAME}.jar.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${TAGNAME}.jar
43-
gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-${TAGNAME}.jar.asc webauthn-server-core/build/libs/webauthn-server-core-${TAGNAME}.jar
77+
permissions:
78+
contents: write # Allow uploading release artifacts
4479

45-
- name: Verify signatures from Maven Central
46-
run: |
47-
export TAGNAME=${GITHUB_REF#refs/tags/}
80+
steps:
81+
- name: Retrieve signatures
82+
uses: actions/download-artifact@v3
83+
with:
84+
name: keyring-and-signatures
4885

49-
wget -O webauthn-server-core-${TAGNAME}.jar.mavencentral.asc https://repo1.maven.org/maven2/com/yubico/webauthn-server-core/${TAGNAME}/webauthn-server-core-${TAGNAME}.jar.asc
50-
wget -O webauthn-server-attestation-${TAGNAME}.jar.mavencentral.asc https://repo1.maven.org/maven2/com/yubico/webauthn-server-attestation/${TAGNAME}/webauthn-server-attestation-${TAGNAME}.jar.asc
86+
- name: Upload signatures to GitHub
87+
run: |
88+
RELEASE_DATA=$(curl -H "Authorization: Bearer ${{ github.token }}" ${{ github.api_url }}/repos/${{ github.repository }}/releases/tags/${{ github.ref_name }})
89+
UPLOAD_URL=$(jq -r .upload_url <<<"${RELEASE_DATA}" | sed 's/{?name,label}//')
5190
52-
gpg --no-default-keyring --keyring yubico --verify webauthn-server-attestation-${TAGNAME}.jar.mavencentral.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${TAGNAME}.jar
53-
gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-${TAGNAME}.jar.mavencentral.asc webauthn-server-core/build/libs/webauthn-server-core-${TAGNAME}.jar
91+
curl -X POST -H "Authorization: Bearer ${{ github.token }}" -H 'Content-Type: text/plain' --data-binary @webauthn-server-attestation-${{ github.ref_name }}.jar.asc "${UPLOAD_URL}?name=webauthn-server-attestation-${{ github.ref_name }}.jar.asc"
92+
curl -X POST -H "Authorization: Bearer ${{ github.token }}" -H 'Content-Type: text/plain' --data-binary @webauthn-server-core-${{ github.ref_name }}.jar.asc "${UPLOAD_URL}?name=webauthn-server-core-${{ github.ref_name }}.jar.asc"

‎NEWS

Lines changed: 148 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,162 @@
1-
== Version 2.1.0 (unreleased) ==
1+
== Version 2.3.1 (unreleased) ==
2+
3+
`webauthn-server-core`:
4+
5+
Fixes:
6+
7+
* During `RelyingParty.finishRegistration()` if an `attestationTrustSource` is
8+
configured, if the `aaguid` in the attestation data is zero, the call to
9+
`AttestationTrustSource.findTrustRoots` will fall back to reading the AAGUID
10+
from the attestation certificate if possible.
11+
12+
`webauthn-server-attestation`:
13+
14+
Fixes:
15+
16+
* `findEntries` and `findTrustRoots` methods in `FidoMetadataService` now
17+
attempt to read AAGUID from the attestation certificate if the `aaguid`
18+
argument is absent or zero.
19+
* Method `FidoMetadataService.Filters.allOf` now has `@SafeVarargs` annotation.
20+
21+
22+
== Version 2.3.0 ==
23+
24+
New features:
25+
26+
* (Experimental) Added `authenticatorAttachment` property to response objects:
27+
** NOTE: Experimental features may receive breaking changes without a major
28+
version increase.
29+
** Added method `getAuthenticatorAttachment()` to `PublicKeyCredential` and
30+
corresponding builder method
31+
`authenticatorAttachment(AuthenticatorAttachment)`.
32+
** Added method `getAuthenticatorAttachment()` to `RegistrationResult` and
33+
`AssertionResult`, which echo `getAuthenticatorAttachment()` from the
34+
corresponding `PublicKeyCredential`.
35+
** Thanks to GitHub user luisgoncalves for the contribution, see
36+
https://github.com/Yubico/java-webauthn-server/pull/250
37+
38+
Other:
39+
40+
* Fixed the README description of SemVer exceptions: `@Deprecated` features are
41+
still part of the public API unless they also have an `EXPERIMENTAL:` tag in
42+
JavaDoc.
43+
* Brought `com.yubico.webauthn` package JavaDoc up to date with new library
44+
features.
45+
46+
47+
== Version 2.2.0 ==
48+
49+
`webauthn-server-core`:
50+
51+
Changes:
52+
53+
* Changed internal structure of `RegistrationResult` and `AssertionResult`. This
54+
may affect you if you use Jackson or similar tools to serialize these values
55+
to JSON, for example. This is not an officially supported use case and thus
56+
does not warrant a major version bump.
57+
* Removed methods `RegistrationResult.toBuilder()` and
58+
`AssertionResult.toBuilder()`. Both had package-private return types, and thus
59+
were not usable by outside callers.
60+
61+
New features:
62+
63+
* (Experimental) Added support for the new `BE` (backup eligible) and `BS`
64+
(backup state) flags in authenticator data:
65+
** NOTE: Experimental features may receive breaking changes without a major
66+
version increase.
67+
** Added `BE` and `BS` properties to `AuthenticatorDataFlags`, reflecting the
68+
respective flags (bits 0x08 and 0x10).
69+
** Added methods `isBackupEligible()` and `isBackedUp()` to
70+
`RegistrationResult` and `AssertionResult`, reflecting respectively the `BE`
71+
and `BS` flags.
72+
** Added properties `backupEligible` and `backupState`, getters
73+
`isBackupEligible()` and `isBackedUp()`, and corresponding builder methods
74+
to `RegisteredCredential`. `RelyingParty.finishAssertion(...)` will now
75+
validate that if `RegisteredCredential.isBackupEligible()` is present, then
76+
the `BE` flag of any assertion of that credential must match the stored
77+
value.
78+
79+
Fixes:
80+
81+
* Fixed TPM attestation verification rejecting attestation certificates with TPM
82+
Device Attributes split between multiple RelativeDistinguishedName structures
83+
in the Subject Alternative Names extension.
84+
** Thanks to Oussama Zgheb for the contribution, see
85+
https://github.com/Yubico/java-webauthn-server/pull/241
86+
* Fixed various errors in JavaDoc.
87+
88+
89+
`webauthn-server-attestation`:
90+
91+
Fixes:
92+
93+
* Improved documentation of guarantees provided by `FidoMetadataDownloader` and
94+
required of its parameters.
95+
96+
97+
== Version 2.1.0 ==
98+
99+
`webauthn-server-core`:
2100

3101
Changes:
4102

5103
* Log messages on attestation certificate path validation failure now include
6104
the attestation object.
7105

106+
Deprecations:
107+
108+
* Deprecated method `AssertionResult.getCredentialId(): ByteArray`. Use
109+
`.getCredential().getCredentialId()` instead.
110+
* Deprecated method `AssertionResult.getUserHandle(): ByteArray`. Use
111+
`.getCredential().getUserHandle()` instead.
112+
113+
New features:
114+
115+
* Added function `COSEAlgorithmIdentifier.fromPublicKey(ByteArray)`.
116+
* Added method `AssertionResult.getCredential(): RegisteredCredential`.
117+
* Added support for the `"tpm"` attestation statement format.
118+
* Added support for ES384 and ES512 signature algorithms.
119+
* Added property `policyTreeValidator` to `TrustRootsResult`. If set, the given
120+
predicate function will be used to validate the certificate policy tree after
121+
successful attestation certificate path validation. This may be required for
122+
some JCA providers to accept attestation certificates with critical
123+
certificate policy extensions. See the JavaDoc for
124+
`TrustRootsResultBuilder.policyTreeValidator(Predicate)` for more information.
125+
* Added enum value `AttestationConveyancePreference.ENTERPRISE`.
126+
* (Experimental) Added constant `AuthenticatorTransport.HYBRID`.
127+
8128
Fixes:
9129

10130
* Fixed various typos and mistakes in JavaDocs.
11131
* Moved version constraints for test dependencies from meta-module
12132
`webauthn-server-parent` to unpublished test meta-module.
133+
* `yubico-util` dependency removed from downstream compile scope.
134+
* Fixed missing JavaDoc on `TrustRootsResult` getters and builder setters.
135+
136+
137+
`webauthn-server-attestation`:
138+
139+
Changes:
140+
141+
* The `AuthenticatorToBeFiltered` argument of the `FidoMetadataService` runtime
142+
filter now omits zero AAGUIDs.
143+
* Promoted log messages in `FidoMetadataDownloader` about BLOB signature failure
144+
and cache corruption from DEBUG level to WARN level.
145+
146+
New features:
147+
148+
* Added method `FidoMetadataDownloader.refreshBlob()`.
149+
150+
Fixes:
151+
152+
* Fixed various typos and mistakes in JavaDocs.
153+
* `FidoMetadataDownloader` now verifies the SHA-256 hash of the cached trust
154+
root certificate, as promised in the JavaDoc of `useTrustRootCacheFile` and
155+
`useTrustRootCache`.
156+
* BouncyCastle dependency dropped.
157+
* Guava dependency dropped (but still remains in core module).
158+
* If BLOB download fails, `FidoMetadataDownloader` now correctly falls back to
159+
cache if available.
13160

14161

15162
== Version 2.0.0 ==

0 commit comments

Comments
 (0)