Merge pull request #114 from iExecBlockchainComputing/release/8.3.0

Release/8.3.0

Author: jbern0rd

CHANGELOG.md

@@ -2,18 +2,49 @@
 
 All notable changes to this project will be documented in this file.
 
+## [[8.3.0]](https://github.com/iExecBlockchainComputing/iexec-result-proxy/releases/tag/v8.3.0) 2024-01-10
+
+### New Features
+
+- Expose version through prometheus endpoint and through VersionController. (#111 #112)
+
+### Bug Fixes
+
+- Remove duplicated call to blockchain in `ProxyService`. (#110)
+
+### Quality
+
+- Add and use a non-root user in the dockerfile. (#106)
+
+### Dependency Upgrades
+
+- Upgrade to `eclipse-temurin:11.0.21_9-jre-focal`. (#109)
+- Upgrade to Spring Boot 2.7.17. (#108)
+- Upgrade to Spring Dependency Management Plugin 1.1.4. (#108)
+- Upgrade to Spring Doc OpenAPI 1.7.0. (#111)
+- Upgrade to `jenkins-library` 2.7.4. (#107)
+- Upgrade to `iexec-commons-poco` 3.2.0. (#113)
+- Upgrade to `iexec-common` 8.3.1. (#113)
+
 ## [[8.2.0]](https://github.com/iExecBlockchainComputing/iexec-result-proxy/releases/tag/v8.2.0) 2023-09-28
 
 ### New Features
+
 - Remove `nexus.intra.iex.ec` repository. (#94)
 - Check result hash before uploading. (#101)
+
 ### Bug Fixes
+
 - Fix and harmonize `Dockerfile entrypoint` in all Spring Boot applications. (#98)
 - Describe upload limits configuration in README.md. (#99)
+
 ### Quality
+
 - Upgrade to Gradle 8.2.1 with up-to-date plugins. (#97)
 - Remove `VersionService#isSnapshot`. (#103)
+
 ### Dependency Upgrades
+
 - Upgrade to `eclipse-temurin` 11.0.20. (#95)
 - Upgrade to Spring Boot 2.7.14. (#96)
 - Upgrade to Spring Dependency Management Plugin 1.1.3. (#96)
@@ -24,33 +55,46 @@ All notable changes to this project will be documented in this file.
 ## [[8.1.1]](https://github.com/iExecBlockchainComputing/iexec-result-proxy/releases/tag/v8.1.1) 2023-06-23
 
 ### Dependency Upgrades
+
 - Upgrade to `iexec-common` 8.2.1. (#92)
 - Upgrade to `iexec-commons-poco` 3.0.4.(#92)
 
 ## [[8.1.0]](https://github.com/iExecBlockchainComputing/iexec-result-proxy/releases/tag/v8.1.0) 2023-06-07
 
 ### New Features
+
 - Enable Prometheus actuator. (#84)
+
 ### Bug Fixes
+
 - Fix link in changelog. (#83)
 - `ChainConfig` instances are immutable. (#89)
+
 ### Dependency Upgrades
+
 - Upgrade to `expiringmap` 0.5.10. (#84)
 - Upgrade to `iexec-common` 8.2.0. (#85 #87 #88)
 - Upgrade to `iexec-commons-poco` 3.0.2. (#85 #87 #88)
 
 ## [[8.0.0]](https://github.com/iExecBlockchainComputing/iexec-result-proxy/releases/tag/v8.0.0) 2023-03-03
 
 ### New Features
+
 * Support Gramine framework for TEE tasks.
 * Add iExec banner at startup.
 * Show application version on banner.
+
 ### Bug Fixes
+
 * Sign issued JWT tokens.
 * Fix JWT tokens flow.
+
 ### Quality
+
 * Clean controllers.
+
 ### Dependency Upgrades
+
 * Replace the deprecated `openjdk` Docker base image with `eclipse-temurin` and upgrade to Java 11.0.18 patch.
 * Upgrade to Spring Boot 2.6.14.
 * Upgrade to Gradle 7.6.

Dockerfile

@@ -1,15 +1,19 @@
-FROM eclipse-temurin:11.0.20_8-jre-focal
+FROM eclipse-temurin:11.0.21_9-jre-focal
 
 ARG jar
 
 RUN test -n "$jar"
 
 RUN apt-get update \
-    && apt-get install -y curl \
+    && apt-get install -y --no-install-recommends curl \
     && rm -rf /var/lib/apt/lists/*
 
+RUN groupadd --system appuser \
+    && useradd -g appuser -s /sbin/nologin -c "Docker image user" appuser
+
+WORKDIR /app
 COPY $jar iexec-result-proxy.jar
+RUN chown -R appuser:appuser /app
 
-# For Spring-Boot project, use the entrypoint
-# below to reduce Tomcat startup time.
+USER appuser
 ENTRYPOINT [ "java", "-Djava.security.egd=file:/dev/./urandom", "-jar", "iexec-result-proxy.jar" ]

Jenkinsfile

@@ -1,7 +1,4 @@
-@Library('[email protected].3') _
+@Library('[email protected].4') _
 buildJavaProject(
-        buildInfo: getBuildInfo(),
-        integrationTestsEnvVars: [],
         shouldPublishJars: true,
-        shouldPublishDockerImages: true,
-        dockerfileDir: '.')
+        shouldPublishDockerImages: true)

build.gradle

@@ -1,8 +1,8 @@
 plugins {
     id 'java'
     id 'io.freefair.lombok' version '8.2.2'
-    id 'org.springframework.boot' version '2.7.14'
-    id 'io.spring.dependency-management' version '1.1.3'
+    id 'org.springframework.boot' version '2.7.17'
+    id 'io.spring.dependency-management' version '1.1.4'
     id 'jacoco'
     id 'org.sonarqube' version '4.2.1.3168'
     id 'maven-publish'
@@ -38,8 +38,10 @@ allprojects {
     }
     java {
         toolchain {
-            languageVersion.set(JavaLanguageVersion.of(11))
+            languageVersion.set(JavaLanguageVersion.of(17))
         }
+        sourceCompatibility = "11"
+        targetCompatibility = "11"
     }
 }
 
@@ -59,7 +61,7 @@ dependencies {
     runtimeOnly 'io.micrometer:micrometer-registry-prometheus'
 
     // Spring Doc
-    implementation 'org.springdoc:springdoc-openapi-ui:1.6.3'
+    implementation 'org.springdoc:springdoc-openapi-ui:1.7.0'
 
     // ipfs
     implementation 'com.github.ipfs:java-ipfs-http-client:1.4.0'
@@ -90,7 +92,7 @@ springBoot {
 tasks.named("bootJar") {
     manifest {
         attributes("Implementation-Title": "iExec Result Proxy",
-                   "Implementation-Version": project.version)
+                "Implementation-Version": project.version)
     }
 }
 
@@ -109,7 +111,7 @@ jacocoTestReport {
         xml.required = true
     }
 }
-tasks.test.finalizedBy    tasks.jacocoTestReport
+tasks.test.finalizedBy tasks.jacocoTestReport
 tasks.sonarqube.dependsOn tasks.jacocoTestReport
 
 publishing {
@@ -130,14 +132,13 @@ publishing {
     }
 }
 
-ext.jarPathForOCI  = relativePath(tasks.bootJar.outputs.files.singleFile)
+ext.jarPathForOCI = relativePath(tasks.bootJar.outputs.files.singleFile)
 ext.gitShortCommit = 'git rev-parse --short=8 HEAD'.execute().text.trim()
-ext.ociImageName   = 'local/' + ['bash', '-c', 'basename $(git config --get remote.origin.url) .git'].execute().text.trim()
+ext.ociImageName = 'local/' + ['bash', '-c', 'basename $(git config --get remote.origin.url) .git'].execute().text.trim()
 
 tasks.register('buildImage', Exec) {
-    group       'Build'
+    group 'Build'
     description 'Builds an OCI image from a Dockerfile.'
-    dependsOn   tasks.bootJar
-    commandLine ("sh", "-c", "docker build --build-arg jar=$jarPathForOCI -t $ociImageName:$gitShortCommit ."
-            + " && docker tag $ociImageName:$gitShortCommit $ociImageName:dev")
+    dependsOn tasks.bootJar
+    commandLine 'docker', 'build', '--build-arg', 'jar=' + jarPathForOCI, '-t', ociImageName + ':dev', '.'
 }

gradle.properties

@@ -1,6 +1,6 @@
-version=8.2.0
-iexecCommonVersion=8.3.0
-iexecCommonsPocoVersion=3.1.0
+version=8.3.0
+iexecCommonVersion=8.3.1
+iexecCommonsPocoVersion=3.2.0
 
 nexusUser
 nexusPassword

iexec-result-proxy-library/build.gradle

@@ -13,6 +13,8 @@ dependencies {
 }
 
 java {
+    sourceCompatibility = "11"
+    targetCompatibility = "11"
     withJavadocJar()
     withSourcesJar()
 }

src/main/java/com/iexec/resultproxy/OpenApiConfig.java

@@ -1,18 +1,35 @@
+/*
+ * Copyright 2023-2023 IEXEC BLOCKCHAIN TECH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package com.iexec.resultproxy;
 
-import com.iexec.resultproxy.version.VersionService;
 import io.swagger.v3.oas.models.OpenAPI;
 import io.swagger.v3.oas.models.info.Info;
+import org.springframework.boot.info.BuildProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
 @Configuration
 public class OpenApiConfig {
 
-    private final VersionService versionService;
+    public static final String TITLE = "iExec Result Proxy";
 
-    public OpenApiConfig(VersionService versionService) {
-        this.versionService = versionService;
+    private final BuildProperties buildProperties;
+
+    public OpenApiConfig(BuildProperties buildProperties) {
+        this.buildProperties = buildProperties;
     }
 
     /*
@@ -22,8 +39,8 @@ public OpenApiConfig(VersionService versionService) {
     public OpenAPI api() {
         return new OpenAPI().info(
                 new Info()
-                        .title("iExec Result Proxy")
-                        .version(versionService.getVersion())
+                        .title(TITLE)
+                        .version(buildProperties.getVersion())
         );
     }
-}
+}

src/main/java/com/iexec/resultproxy/proxy/ProxyService.java

@@ -21,7 +21,6 @@
 import com.iexec.common.utils.FileHelper;
 import com.iexec.common.worker.result.ResultUtils;
 import com.iexec.commons.poco.chain.ChainContribution;
-import com.iexec.commons.poco.chain.ChainContributionStatus;
 import com.iexec.commons.poco.chain.ChainTask;
 import com.iexec.commons.poco.chain.ChainTaskStatus;
 import com.iexec.commons.poco.task.TaskDescription;
@@ -39,6 +38,7 @@
 
 import static com.iexec.common.utils.IexecFileHelper.SLASH_IEXEC_OUT;
 import static com.iexec.common.utils.IexecFileHelper.readComputedFile;
+import static com.iexec.commons.poco.chain.ChainContributionStatus.REVEALED;
 
 /**
  * Service class to manage all the results. If the result is public, it will be stored on IPFS. If there is a dedicated
@@ -59,17 +59,18 @@ public ProxyService(IexecHubService iexecHubService,
 
 
     boolean canUploadResult(String chainTaskId, String walletAddress, byte[] zip) {
-        if (iexecHubService.isTeeTask(chainTaskId)){
-            Optional<ChainTask> chainTask = iexecHubService.getChainTask(chainTaskId);//TODO Add requester field to getChainTask
-            if (chainTask.isEmpty()){
+        if (iexecHubService.isTeeTask(chainTaskId)) {
+            //TODO Add requester field to getChainTask
+            Optional<ChainTask> chainTask = iexecHubService.getChainTask(chainTaskId);
+            if (chainTask.isEmpty()) {
                 log.error("Trying to upload result for TEE but getChainTask failed [chainTaskId:{}, uploader:{}]",
                         chainTaskId, walletAddress);
                 return false;
             }
-            boolean isActive = chainTask.get().getStatus().equals(ChainTaskStatus.ACTIVE);
+            boolean isActive = chainTask.get().getStatus() == ChainTaskStatus.ACTIVE;
 
             Optional<TaskDescription> taskDescription = iexecHubService.getTaskDescriptionFromChain(chainTaskId);
-            if (taskDescription.isEmpty()){
+            if (taskDescription.isEmpty()) {
                 log.error("Trying to upload result for TEE but getTaskDescription failed [chainTaskId:{}, uploader:{}]",
                         chainTaskId, walletAddress);
                 return false;
@@ -85,15 +86,6 @@ boolean canUploadResult(String chainTaskId, String walletAddress, byte[] zip) {
                 return false;
             }
 
-            // ContributionStatus of chainTask should be REVEALED
-            boolean isChainContributionStatusSetToRevealed = iexecHubService.isStatusTrueOnChain(chainTaskId,
-                    walletAddress, ChainContributionStatus.REVEALED);
-            if (!isChainContributionStatusSetToRevealed) {
-                log.error("Trying to upload result even though ChainContributionStatus is not REVEALED [chainTaskId:{}, uploadRequester:{}]",
-                        chainTaskId, walletAddress);
-                return false;
-            }
-
             return isResultValid(chainTaskId, walletAddress, zip);
         }
     }
@@ -102,7 +94,8 @@ boolean canUploadResult(String chainTaskId, String walletAddress, byte[] zip) {
      * A result for a standard task is considered as valid if:
      * <ul>
      * <li>It has an associated on-chain contribution
-     * <li>The on-chain contribution result hash is the one we compute here again.
+     * <li>The associated on-chain contribution status is {@code REVEALED}
+     * <li>The on-chain contribution result hash is the one we compute here again
      * </ul>
      *
      * @param chainTaskId   ID of the task
@@ -116,8 +109,13 @@ boolean isResultValid(String chainTaskId, String walletAddress, byte[] zip) {
         final String zipDestinationPath = resultFolderPath + SLASH_IEXEC_OUT;
         try {
             final Optional<ChainContribution> oChainContribution = iexecHubService.getChainContribution(chainTaskId, walletAddress);
-            if (oChainContribution.isEmpty()) {
-                log.error("Trying to upload result but no on-chain contribution [chainTaskId:{}, uploader:{}]",
+            // ContributionStatus of chainTask should be REVEALED
+            boolean isChainContributionStatusSetToRevealed = oChainContribution
+                    .map(ChainContribution::getStatus)
+                    .filter(chainStatus -> chainStatus == REVEALED)
+                    .isPresent();
+            if (!isChainContributionStatusSetToRevealed) {
+                log.error("Trying to upload result even though ChainContributionStatus is not REVEALED [chainTaskId:{}, uploadRequester:{}]",
                         chainTaskId, walletAddress);
                 return false;
             }
@@ -129,7 +127,7 @@ boolean isResultValid(String chainTaskId, String walletAddress, byte[] zip) {
                 log.error("Can't write result file [chainTaskId:{}, uploader:{}]", chainTaskId, walletAddress);
                 return false;
             }
-             FileHelper.unZipFile(resultZipPath, zipDestinationPath);
+            FileHelper.unZipFile(resultZipPath, zipDestinationPath);
 
             final ComputedFile computedFile = readComputedFile(chainTaskId, zipDestinationPath);
             final String resultDigest = ResultUtils.computeWeb2ResultDigest(computedFile, resultFolderPath);