Merge branch 'release/v1.20.0-4'

dnschwarzer · cesmarvin · commit bedca5776e1a · 2025-04-10T09:25:31.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [v1.20.0-4] - 2025-04-10
+### Changed
+- Update Tomcat to 9.0.102 [#197]
+### Security
+- [#243] Fix [CVE-2025-24813](https://nvd.nist.gov/vuln/detail/CVE-2025-24813)
+
 ## [v1.20.0-3] - 2025-02-21
 ### Changed
 - Renamed table headline key from "Date" to "Date of import" (en/de)
diff --git a/Dockerfile b/Dockerfile
@@ -1,6 +1,6 @@
 ARG TOMCAT_MAJOR_VERSION=9
-ARG TOMCAT_VERSION=9.0.96
-ARG TOMCAT_TARGZ_SHA512=ef3ac81debbc3a519c43d1fdb1c88ab26a8052af424d81bceccfbd6e663050a06d7aad7960fd5d11c17849829daebbebf33d92ac1158902283d0e534514aab93
+ARG TOMCAT_VERSION=9.0.102
+ARG TOMCAT_TARGZ_SHA512=cbe407f17c813d9f83cab459e603df171f2e5782c3a0cdb4cfa00b0391a89cedf865c6d8972fc7e12210c69a8467ede5939f35bb0f3b41fa173b9ee83199768a
 
 FROM timbru31/java-node:8-jdk-18 as builder
 
@@ -75,7 +75,7 @@ FROM registry.cloudogu.com/official/java:8u432-1
 ARG TOMCAT_VERSION
 
 LABEL NAME="official/usermgt" \
-   VERSION="1.20.0-3" \
+   VERSION="1.20.0-4" \
    maintainer="hello@cloudogu.com"
 
 # mark as webapp for nginx
diff --git a/Jenkinsfile b/Jenkinsfile
@@ -1,5 +1,5 @@
 #!groovy
-@Library(['github.com/cloudogu/dogu-build-lib@v3.0.0', 'github.com/cloudogu/ces-build-lib@4.0.1'])
+@Library(['github.com/cloudogu/ces-build-lib@4.2.0', 'github.com/cloudogu/dogu-build-lib@v3.1.0'])
 import com.cloudogu.ces.cesbuildlib.*
 import com.cloudogu.ces.dogubuildlib.*
 
@@ -293,10 +293,10 @@ void stageStaticAnalysisSonarQube() {
             sh "${scannerHome}/bin/sonar-scanner -Dsonar.branch.name=${env.BRANCH_NAME}"
         } else {
             echo "This branch has been detected as a miscellaneous branch."
-            sh "${scannerHome}/bin/sonar-scanner -Dsonar.branch.name=${env.BRANCH_NAME} "
+            sh "${scannerHome}/bin/sonar-scanner -Dsonar.branch.name=${env.BRANCH_NAME}"
         }
     }
-    timeout(time: 2, unit: 'MINUTES') { // Needed when there is no webhook for example
+    timeout(time: 5, unit: 'MINUTES') { // Needed when there is no webhook for example
         def qGate = waitForQualityGate()
         if (qGate.status != 'OK') {
             unstable("Pipeline unstable due to SonarQube quality gate failure")
diff --git a/Makefile b/Makefile
@@ -1,13 +1,13 @@
 # Set these to the desired values
 ARTIFACT_ID=usermgt
-VERSION=1.20.0-3
+VERSION=1.20.0-4
 # overwrite ADDITIONAL_LDFLAGS to disable static compilation
 # this should fix https://github.com/golang/go/issues/13470
 ADDITIONAL_LDFLAGS=""
 NPM_REGISTRY_RELEASE=https://ecosystem.cloudogu.com/nexus/repository/npm-releases/
 NPM_REGISTRY_RC=https://ecosystem.cloudogu.com/nexus/repository/npm-releasecandidates/
 UI_SRC=app/src/main/ui
-MAKEFILES_VERSION=9.5.2
+MAKEFILES_VERSION=9.9.0
 .DEFAULT_GOAL:=default
 
 include build/make/variables.mk
diff --git a/build/make/build.mk b/build/make/build.mk
@@ -3,7 +3,7 @@
 ADDITIONAL_LDFLAGS?=-extldflags -static
 LDFLAGS?=-ldflags "$(ADDITIONAL_LDFLAGS) -X main.Version=$(VERSION) -X main.CommitID=$(COMMIT_ID)"
 GOIMAGE?=golang
-GOTAG?=1.23
+GOTAG?=1.24
 GOOS?=linux
 GOARCH?=amd64
 PRE_COMPILE?=
diff --git a/build/make/k8s-crd.mk b/build/make/k8s-crd.mk
@@ -1,4 +1,10 @@
-ARTIFACT_CRD_ID = $(ARTIFACT_ID)-crd
+# we set this default to maintain compatibility with CRDs that are still inside monorepos
+APPEND_CRD_SUFFIX ?= true
+ifeq ($(APPEND_CRD_SUFFIX), true)
+	ARTIFACT_CRD_ID = $(ARTIFACT_ID)-crd
+else ifeq ($(APPEND_CRD_SUFFIX), false)
+	ARTIFACT_CRD_ID = $(ARTIFACT_ID)
+endif
 DEV_CRD_VERSION ?= ${VERSION}-dev
 HELM_CRD_SOURCE_DIR ?= ${WORKDIR}/k8s/helm-crd
 HELM_CRD_TARGET_DIR ?= $(K8S_RESOURCE_TEMP_FOLDER)/helm-crd
@@ -28,7 +34,7 @@ crd-add-labels: $(BINARY_YQ)
 	@echo "Adding labels to CRD..."
 	@for file in ${HELM_CRD_SOURCE_DIR}/templates/*.yaml ; do \
 		$(BINARY_YQ) -i e ".metadata.labels.app = \"ces\"" $${file} ;\
-		$(BINARY_YQ) -i e ".metadata.labels.\"app.kubernetes.io/name\" = \"${ARTIFACT_ID}\"" $${file} ;\
+		$(BINARY_YQ) -i e ".metadata.labels.\"app.kubernetes.io/name\" = \"${ARTIFACT_CRD_ID}\"" $${file} ;\
 	done
 
 .PHONY: crd-helm-generate ## Generates the Helm CRD chart
diff --git a/build/make/k8s.mk b/build/make/k8s.mk
@@ -36,11 +36,11 @@ K3S_LOCAL_REGISTRY_PORT?=30099
 
 # The URL of the container-registry to use. Defaults to the registry of the local-cluster.
 # If RUNTIME_ENV is "remote" it is "registry.cloudogu.com/testing"
-CES_REGISTRY_HOST?="${K3S_CLUSTER_FQDN}:${K3S_LOCAL_REGISTRY_PORT}"
+CES_REGISTRY_HOST?=${K3S_CLUSTER_FQDN}:${K3S_LOCAL_REGISTRY_PORT}
 CES_REGISTRY_NAMESPACE ?=
 ifeq (${RUNTIME_ENV}, remote)
-	CES_REGISTRY_HOST="registry.cloudogu.com"
-	CES_REGISTRY_NAMESPACE="/testing"
+	CES_REGISTRY_HOST=registry.cloudogu.com
+	CES_REGISTRY_NAMESPACE=/testing
 endif
 $(info CES_REGISTRY_HOST=$(CES_REGISTRY_HOST))
 
diff --git a/build/make/mocks.mk b/build/make/mocks.mk
@@ -1,7 +1,7 @@
 ##@ Mocking
 
 MOCKERY_BIN=${UTILITY_BIN_PATH}/mockery
-MOCKERY_VERSION?=v2.42.1
+MOCKERY_VERSION?=v2.53.3
 MOCKERY_YAML=${WORKDIR}/.mockery.yaml
 
 ${MOCKERY_BIN}: ${UTILITY_BIN_PATH}
diff --git a/build/make/release.mk b/build/make/release.mk
@@ -14,6 +14,10 @@ node-release: ## Start a node package release
 go-release: ## Start a go tool release
 	build/make/release.sh go-tool
 
+.PHONY: image-release
+image-release: ## Start a go tool release
+	build/make/release.sh image
+
 .PHONY: dogu-cve-release
 dogu-cve-release: ## Start a dogu release of a new build if the local build fixes critical CVEs
 	@bash -c "build/make/release_cve.sh \"${REGISTRY_USERNAME}\" \"${REGISTRY_PASSWORD}\" \"${TRIVY_IMAGE_SCAN_FLAGS}\" \"${DRY_RUN}\" \"${CVE_SEVERITY}\""
diff --git a/build/make/self-update.mk b/build/make/self-update.mk
@@ -24,4 +24,9 @@ copy-new-files:
 .PHONY: update-build-libs
 update-build-libs:
 	@echo "Check for newer Build-Lib versions"
-	build/make/self-update.sh buildlibs
+	build/make/self-update.sh buildlibs
+
+.PHONY: set-dogu-version
+set-dogu-version:
+	@echo "Set Version of Dogu without Release"
+	build/make/self-update.sh versions
diff --git a/build/make/self-update.sh b/build/make/self-update.sh
@@ -3,6 +3,10 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
+
+# shellcheck disable=SC1090
+source "$(pwd)/build/make/release_functions.sh"
+
 TYPE="${1}"
 
 update_build_libs() {
@@ -37,9 +41,20 @@ update_jenkinsfile() {
   sed -i "s/dogu-build-lib@v[[:digit:]].[[:digit:]].[[:digit:]]/dogu-build-lib@v$(get_highest_version dogu)/g" Jenkinsfile
 }
 
+# Patch Dogu Version without Release
+set_dogu_version() {
+  CURRENT_TOOL_VERSION=$(get_current_version_by_dogu_json)
+  echo "$(tput setaf 1)ATTENTION: Make sure that the new version corresponds to the current software version$(tput sgr0)"
+  NEW_RELEASE_VERSION="$(read_new_version)"
+  validate_new_version "${NEW_RELEASE_VERSION}"
+  update_versions "${NEW_RELEASE_VERSION}"
+}
+
 # switch for script entrypoint
 if [[ "${TYPE}" == "buildlibs" ]];then
   update_build_libs
+elif [[ "${TYPE}" == "versions" ]];then
+  set_dogu_version
 else
   echo "Unknown target ${TYPE}"
 fi
diff --git a/build/make/static-analysis.mk b/build/make/static-analysis.mk
@@ -2,12 +2,12 @@
 
 STATIC_ANALYSIS_DIR=$(TARGET_DIR)/static-analysis
 GOIMAGE?=golang
-GOTAG?=1.23
+GOTAG?=1.24
 CUSTOM_GO_MOUNT?=-v /tmp:/tmp
 
 REVIEW_DOG=$(TMP_DIR)/bin/reviewdog
 LINT=$(TMP_DIR)/bin/golangci-lint
-LINT_VERSION?=v1.61.0
+LINT_VERSION?=v1.64.8
 # ignore tests and mocks
 LINTFLAGS=--tests=false --exclude-files="^.*_mock.go$$" --exclude-files="^.*/mock.*.go$$" --timeout 10m --issues-exit-code 0
 ADDITIONAL_LINTER=-E bodyclose -E containedctx -E contextcheck -E decorder -E dupl -E errname -E forcetypeassert -E funlen -E unparam
diff --git a/docs/development/Developers_Guide_de.md b/docs/development/Developers_Guide_de.md
@@ -12,6 +12,10 @@ Um das Usermgt-Backend lokal zu starten oder zu debuggen ist die Verbindung zu e
 Dieses LDAP kann entweder auch lokal in einen Docker-Container betrieben werden, oder es kann das LDAP aus dem CES
 verwendet werden.
 
+Um das Dogu zu bauen, ist authentifizierter Zugriff auf ein internes Package Repository notwendig.  
+Die Credentials müssen mittels einer `.npmrc` Datei zur Verfügung gestellt werden.
+Um diese Datei zu generieren, führe das make target `gen-npmrc-release` aus.
+
 ### Lokales LDAP in einem Docker-Container einrichten
 
 Folgende Schritte sind zum Starten des LDAP im Docker-Container nötig:
diff --git a/docs/development/Developers_Guide_en.md b/docs/development/Developers_Guide_en.md
@@ -13,6 +13,9 @@ The following requirements must be met to develop the Usermgt backend:
 To start or debug the Usermgt backend locally, a connection to an LDAP is required.
 This LDAP can either be operated locally in a Docker container, or the LDAP from the CES can be used.
 
+To build the Dogu, authenticated access to an internal package repository is required.  
+The credentials must be provided via a `.npmrc` file. To generate the file, run the make target `gen-npmrc-release`.
+
 ### Setting up a local LDAP in a Docker container
 
 The following steps are required to start the LDAP in the Docker container:
diff --git a/docs/gui/release_notes_de.md b/docs/gui/release_notes_de.md
@@ -6,6 +6,11 @@ Technische Details zu einem Release finden Sie im zugehörigen [Changelog](https
 
 ## [Unreleased]
 
+## [v1.20.0-4] - 2025-04-10
+### Security
+* Das Release behebt die kritische Sicherheitslücke [CVE-2025-24813](https://nvd.nist.gov/vuln/detail/CVE-2025-24813).
+  Ein Update ist daher empfohlen.
+
 ## [v1.20.0-3] - 2025-02-21
 ### Changed
 - Der Tabellenheader "Datum" wurde in "Importdatum" umbenannt
diff --git a/docs/gui/release_notes_en.md b/docs/gui/release_notes_en.md
@@ -6,6 +6,11 @@ Technical details on a release can be found in the corresponding [Changelog](htt
 
 ## [Unreleased]
 
+## [v1.20.0-4] - 2025-04-10
+### Security
+* This release fixes the critical security vulnerability [CVE-2025-24813](https://nvd.nist.gov/vuln/detail/CVE-2025-24813).
+  An update is therefore recommended.
+
 ## [v1.20.0-3] - 2025-02-21
 ### Changed
 - Renamed table headline key "from" Date to "Date of import"
diff --git a/dogu.json b/dogu.json
@@ -1,6 +1,6 @@
 {
   "Name": "official/usermgt",
-  "Version": "1.20.0-3",
+  "Version": "1.20.0-4",
   "DisplayName": "User Management",
   "Description": "User and Group Management.",
   "Category": "Administration Apps",
diff --git a/package.json b/package.json
@@ -3,5 +3,5 @@
     "cypress": "^13.13.1",
     "yarn": "^1.22.22"
   },
-  "version": "1.20.0-3"
+  "version": "1.20.0-4"
 }
