Skip to content

Commit 6f49f01

Browse files
loosebazookaloosebazooka
authored
fix: Update maven helper plugin build (#3746)
# Summary Attempt to fix #3663 (comment) Update the build definition for the maven slsa-hashing-plugin. It seems to be pretty old and slightly misconfigured. @ianlewis @ramonpetgrave64 This might fix the testing issue? I'm not exactly sure how to trigger the original failure though. If after merging the fix doesn't work, then we will revert. ## Testing Process We were able to partially test the fix locally, but we can't be 100% sure until after merging. We have an new pre-submit e2e test workflow that we can invoke from within this repo to test the changes, though a more full test should still be invoked from example-package. ## Checklist - [x] Review the contributing [guidelines](https://github.com/slsa-framework/slsa-github-generator/blob/main/CONTRIBUTING.md) - [x] Add a reference to related issues in the PR description. - [x] Update documentation if applicable. - [x] Add unit tests if applicable. - [ ] Add changes to the [CHANGELOG](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md) if applicable. Signed-off-by: Appu Goundan <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>
1 parent 8a5fca8 commit 6f49f01

File tree

7 files changed

+271
-2
lines changed

7 files changed

+271
-2
lines changed

‎.github/workflows/pre-submit.e2e.maven.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Copyright 2023 SLSA Authors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: pre-submit e2e maven
16+
17+
on:
18+
# builder_maven_slsa3.yml relies on .github/actions/verify-token, which does not support merge_group and pull_request events.
19+
push:
20+
workflow_dispatch:
21+
22+
permissions: read-all
23+
24+
env:
25+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26+
27+
jobs:
28+
build:
29+
permissions:
30+
id-token: write # For signing.
31+
contents: read # For repo checkout of private repos.
32+
actions: read # For getting workflow run on private repos.
33+
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_maven_slsa3.yml@main
34+
with:
35+
directory: ./e2e/maven/workflow_dispatch
36+
37+
verify:
38+
runs-on: ubuntu-latest
39+
needs: [build]
40+
steps:
41+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
42+
- uses: slsa-framework/slsa-github-generator/actions/maven/secure-download-attestations@main
43+
with:
44+
name: "${{ needs.build.outputs.provenance-download-name }}"
45+
sha256: "${{ needs.build.outputs.provenance-download-sha256 }}"
46+
path: ./
47+
- uses: slsa-framework/slsa-github-generator/actions/maven/secure-download-target@main
48+
with:
49+
name: "${{ needs.build.outputs.target-download-name }}"
50+
sha256: "${{ needs.build.outputs.target-download-sha256 }}"
51+
path: ./
52+
- uses: slsa-framework/slsa-verifier/actions/[email protected]
53+
- name: Verify artifact
54+
env:
55+
PROVENANCE_PATH: ${{ needs.build.outputs.provenance-download-name }}
56+
TARGET_PATH: ${{ needs.build.outputs.target-download-name }}
57+
run: slsa-verifier verify-artifact "$TARGET_PATH" --provenance-path "$PROVENANCE_PATH"

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@
1818
vendor/
1919
node_modules/
2020

21+
# maven
22+
target/
23+
2124
# Go workspace file
2225
go.work
2326
go.work.sum

‎actions/maven/publish/slsa-hashing-plugin/pom.xml‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
<name>Jarfile Hashing Maven Mojo</name>
1212
<url>http://maven.apache.org</url>
13+
<description>A slsa maven helper plugin</description>
1314

1415
<properties>
1516
<maven.compiler.target>1.8</maven.compiler.target>
@@ -21,6 +22,7 @@
2122
<groupId>org.apache.maven</groupId>
2223
<artifactId>maven-plugin-api</artifactId>
2324
<version>3.9.8</version>
25+
<scope>provided</scope>
2426
</dependency>
2527
<dependency>
2628
<groupId>org.apache.maven.plugin-tools</groupId>
@@ -30,13 +32,39 @@
3032
</dependency>
3133
<dependency>
3234
<groupId>org.apache.maven</groupId>
33-
<artifactId>maven-project</artifactId>
34-
<version>2.2.1</version>
35+
<artifactId>maven-core</artifactId>
36+
<version>3.9.8</version>
37+
<scope>provided</scope>
3538
</dependency>
3639
<dependency>
3740
<groupId>org.json</groupId>
3841
<artifactId>json</artifactId>
3942
<version>20231013</version>
4043
</dependency>
4144
</dependencies>
45+
46+
<build>
47+
<plugins>
48+
<plugin>
49+
<groupId>org.apache.maven.plugins</groupId>
50+
<artifactId>maven-plugin-plugin</artifactId>
51+
<version>3.6.0</version>
52+
<configuration>
53+
<skipErrorNoDescriptorsFound>true</skipErrorNoDescriptorsFound>
54+
</configuration>
55+
<executions>
56+
<execution>
57+
<id>default-descriptor</id>
58+
<phase>process-classes</phase>
59+
</execution>
60+
<execution>
61+
<id>help-goal</id>
62+
<goals>
63+
<goal>helpmojo</goal>
64+
</goals>
65+
</execution>
66+
</executions>
67+
</plugin>
68+
</plugins>
69+
</build>
4270
</project>

‎e2e/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# E2E Tests
2+
3+
This folder contains test data for some end-to-end (E2E) tests.

‎e2e/maven/workflow_dispatch/pom.xml‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>io.github.adamkorcz</groupId>
5+
<artifactId>test-java-project</artifactId>
6+
<version>1.21.97</version>
7+
<packaging>jar</packaging>
8+
<name>Adams test java project</name>
9+
<description>A test java project.</description>
10+
<url>https://github.com/AdamKorcz/test-java-project</url>
11+
<properties>
12+
<maven.compiler.source>1.8</maven.compiler.source>
13+
<maven.compiler.target>1.8</maven.compiler.target>
14+
</properties>
15+
<distributionManagement>
16+
<snapshotRepository>
17+
<id>ossrh</id>
18+
<url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
19+
</snapshotRepository>
20+
<repository>
21+
<id>ossrh</id>
22+
<url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
23+
</repository>
24+
</distributionManagement>
25+
<licenses>
26+
<license>
27+
<name>MIT License</name>
28+
<url>http://www.opensource.org/licenses/mit-license.php</url>
29+
</license>
30+
</licenses>
31+
<developers>
32+
<developer>
33+
<name>Adam K</name>
34+
<email>[email protected]</email>
35+
<organization>Ada Logics</organization>
36+
<organizationUrl>http://www.adalogics.com</organizationUrl>
37+
</developer>
38+
</developers>
39+
<scm>
40+
<connection>scm:git:git://github.com/adamkorcz/test-java-project.git</connection>
41+
<developerConnection>scm:git:ssh://github.com:simpligility/test-java-project.git</developerConnection>
42+
<url>http://github.com/adamkorcz/test-java-project/tree/main</url>
43+
</scm>
44+
<build>
45+
<plugins>
46+
<plugin>
47+
<groupId>org.apache.maven.plugins</groupId>
48+
<artifactId>maven-source-plugin</artifactId>
49+
<version>3.3.1</version>
50+
<executions>
51+
<execution>
52+
<id>attach-sources</id>
53+
<phase>package</phase>
54+
<goals>
55+
<goal>jar-no-fork</goal>
56+
</goals>
57+
</execution>
58+
</executions>
59+
</plugin>
60+
<plugin>
61+
<groupId>org.apache.maven.plugins</groupId>
62+
<artifactId>maven-javadoc-plugin</artifactId>
63+
<version>3.6.3</version>
64+
<configuration>
65+
<javadocExecutable>${java.home}/bin/javadoc</javadocExecutable>
66+
</configuration>
67+
<executions>
68+
<execution>
69+
<id>attach-javadocs</id>
70+
<goals>
71+
<goal>jar</goal>
72+
</goals>
73+
</execution>
74+
</executions>
75+
</plugin>
76+
<plugin>
77+
<groupId>org.apache.maven.plugins</groupId>
78+
<artifactId>maven-shade-plugin</artifactId>
79+
<version>3.5.1</version>
80+
<executions>
81+
<execution>
82+
<phase>package</phase>
83+
<goals>
84+
<goal>shade</goal>
85+
</goals>
86+
<configuration>
87+
<transformers>
88+
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
89+
<mainClass>hello.HelloWorld</mainClass>
90+
</transformer>
91+
</transformers>
92+
</configuration>
93+
</execution>
94+
</executions>
95+
</plugin>
96+
<plugin>
97+
<groupId>org.sonatype.plugins</groupId>
98+
<artifactId>nexus-staging-maven-plugin</artifactId>
99+
<version>1.6.13</version>
100+
<extensions>true</extensions>
101+
<configuration>
102+
<serverId>ossrh</serverId>
103+
<nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
104+
<autoReleaseAfterClose>false</autoReleaseAfterClose>
105+
</configuration>
106+
</plugin>
107+
<plugin>
108+
<groupId>org.apache.maven.plugins</groupId>
109+
<artifactId>maven-gpg-plugin</artifactId>
110+
<version>3.1.0</version>
111+
<executions>
112+
<execution>
113+
<id>sign-artifacts</id>
114+
<phase>verify</phase>
115+
<goals>
116+
<goal>sign</goal>
117+
</goals>
118+
</execution>
119+
</executions>
120+
<configuration>
121+
<gpgArguments>
122+
<argument>--pinentry-mode</argument>
123+
<argument>loopback</argument>
124+
</gpgArguments>
125+
</configuration>
126+
</plugin>
127+
<plugin>
128+
<groupId>org.apache.maven.plugins</groupId>
129+
<artifactId>maven-deploy-plugin</artifactId>
130+
<version>3.1.2</version>
131+
<executions>
132+
<execution>
133+
<id>deploy-file</id>
134+
<phase>deploy</phase>
135+
<goals>
136+
<goal>deploy-file</goal>
137+
</goals>
138+
<configuration>
139+
<file>textfile.txt</file>
140+
<url>https://s01.oss.sonatype.org/</url>
141+
<repositoryId>io.github.adamkorcz</repositoryId>
142+
</configuration>
143+
</execution>
144+
</executions>
145+
</plugin>
146+
<plugin>
147+
<groupId>io.github.slsa-framework.slsa-github-generator</groupId>
148+
<artifactId>hash-maven-plugin</artifactId>
149+
<version>0.0.1</version>
150+
<executions>
151+
<execution>
152+
<goals>
153+
<goal>hash-jarfile</goal>
154+
</goals>
155+
</execution>
156+
</executions>
157+
<configuration>
158+
<outputJsonPath>${SLSA_OUTPUTS_ARTIFACTS_FILE}</outputJsonPath>
159+
</configuration>
160+
</plugin>
161+
</plugins>
162+
</build>
163+
</project>

‎e2e/maven/workflow_dispatch/src/main/java/hello/Greeter.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
package hello;
2+
3+
public class Greeter {
4+
public String sayHello() {
5+
return "Hello world!";
6+
}
7+
}

‎e2e/maven/workflow_dispatch/src/main/java/hello/HelloWorld.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
package hello;
2+
3+
public class HelloWorld {
4+
public static void main(String[] args) {
5+
Greeter greeter = new Greeter();
6+
System.out.println(greeter.sayHello());
7+
}
8+
}

0 commit comments

Comments
 (0)