Skip to content

Commit ad75050

Browse files
windauerwindauer
authored
Merge pull request eXist-db#6431 from duncdrum/dp-release-fixes
2 parents eb660eb + b640c7b commit ad75050

3 files changed

Lines changed: 179 additions & 0 deletions

File tree

‎.github/workflows/ci-oidc-smoke.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: Release signing smoke (Azure OIDC + Key Vault JAR sign)
2+
3+
# Exercises the Azure federated credential AND the Key Vault JCA jarsigner
4+
# path without dispatching a full release. Triggered by tags matching
5+
# `eXist-*-oidc-smoke` — a pattern that ci-release.yml does NOT match, so
6+
# the full release pipeline never starts.
7+
#
8+
# Validates:
9+
# 1. Federated credential's matching expression accepts eXist-* tag subject
10+
# (Azure OIDC login succeeds).
11+
# 2. Key Vault Crypto User RBAC propagated to the App Registration
12+
# (jarsigner can read the cert metadata).
13+
# 3. Cert is usable for signing (no DigiCert HSM non-exportable key issue
14+
# — Azure SDK #44085 — would surface here).
15+
# 4. TSA timestamping reachable (Sectigo URL responds).
16+
#
17+
# Usage:
18+
# git tag -a eXist-99.0.0-oidc-smoke -m "release signing smoke"
19+
# git push origin eXist-99.0.0-oidc-smoke
20+
# # watch Actions → Release signing smoke (~2-3 min)
21+
# git push origin :eXist-99.0.0-oidc-smoke # cleanup
22+
#
23+
# Mirrors ci-release.yml build-windows signing commands. Runs on
24+
# ubuntu-latest because jarsigner + the Azure JCA library are platform-
25+
# independent; this catches the same cert/RBAC failures the real Windows
26+
# job would. Authenticode .exe signing (AzureSignTool) is Windows-only
27+
# and not exercised here.
28+
29+
on:
30+
push:
31+
tags:
32+
- 'eXist-*-oidc-smoke'
33+
workflow_dispatch:
34+
35+
permissions:
36+
id-token: write
37+
contents: read
38+
39+
jobs:
40+
smoke:
41+
name: OIDC login + Key Vault JAR sign
42+
runs-on: ubuntu-latest
43+
timeout-minutes: 10
44+
steps:
45+
- uses: actions/checkout@v6
46+
47+
- uses: actions/setup-java@v5
48+
with:
49+
distribution: temurin
50+
java-version: '21'
51+
52+
- name: Azure login (OIDC)
53+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
54+
with:
55+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
56+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
57+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
58+
59+
- name: Confirm token + tenant
60+
run: |
61+
az account show --query "{tenantId:tenantId,user:user.name}" -o table
62+
echo "OIDC login succeeded — federated credential expression matches eXist-* tag subject."
63+
64+
- name: Build throwaway JAR to sign
65+
run: |
66+
mkdir -p /tmp/smoke && cd /tmp/smoke
67+
echo "smoke canary" > canary.txt
68+
jar cf smoke.jar canary.txt
69+
ls -la smoke.jar
70+
71+
- name: Sign smoke JAR with Azure Key Vault JCA
72+
env:
73+
AZURE_KEYVAULT_URI: ${{ vars.AZURE_KEYVAULT_URI }}
74+
AZURE_KEYVAULT_CERT_NAME: ${{ vars.AZURE_KEYVAULT_CERT_NAME }}
75+
run: |
76+
# Mirrors ci-release.yml:223-247 (Sign installer JAR step)
77+
KV_JCA_JAR="$HOME/.m2/azure-keyvault-jca.jar"
78+
if [ ! -f "$KV_JCA_JAR" ]; then
79+
mvn -q dependency:get \
80+
-Dartifact=com.azure:azure-security-keyvault-jca:2.10.0:jar \
81+
-Ddest="$KV_JCA_JAR"
82+
fi
83+
ls -la "$KV_JCA_JAR"
84+
jarsigner \
85+
-keystore NONE \
86+
-storetype AzureKeyVault \
87+
-providerClass com.azure.security.keyvault.jca.KeyVaultJcaProvider \
88+
-providerArg "-J-Dazure.keyvault.uri=${AZURE_KEYVAULT_URI}" \
89+
-J-cp "$KV_JCA_JAR" \
90+
-tsa http://timestamp.sectigo.com/ \
91+
/tmp/smoke/smoke.jar "$AZURE_KEYVAULT_CERT_NAME"
92+
93+
- name: Verify smoke JAR signature
94+
run: |
95+
jarsigner -verify -strict -verbose /tmp/smoke/smoke.jar | tail -20
96+
echo "Key Vault JCA signing succeeded — Crypto User RBAC + cert + TSA all working."

‎exist-distribution/pom.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1034,6 +1034,26 @@
10341034
</arguments>
10351035
</configuration>
10361036
</execution>
1037+
<execution>
1038+
<!--
1039+
Signs the lz4-java native binaries (Apple notarization #4000 cause)
1040+
-->
1041+
<id>mac-codesign-lz4-native</id>
1042+
<phase>package</phase>
1043+
<goals>
1044+
<goal>exec</goal>
1045+
</goals>
1046+
<configuration>
1047+
<useMavenLogger>true</useMavenLogger>
1048+
<executable>${project.basedir}/src/main/scripts/codesign-lz4-mac.sh</executable>
1049+
<arguments>
1050+
<argument>${mac.bundle.java.dir}</argument>
1051+
<argument>1.11.0</argument>
1052+
<argument>${project.build.directory}/lz4-native</argument>
1053+
<argument>${mac.codesign.identity}</argument>
1054+
</arguments>
1055+
</configuration>
1056+
</execution>
10371057
<execution>
10381058
<id>mac-codesign-app</id>
10391059
<phase>package</phase>

‎exist-distribution/src/main/scripts/codesign-lz4-mac.sh‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/usr/bin/env bash
2+
#
3+
# eXist-db Open Source Native XML Database
4+
# Copyright (C) 2001 The eXist-db Authors
5+
#
6+
# info@exist-db.org
7+
# http://www.exist-db.org
8+
#
9+
# This library is free software; you can redistribute it and/or
10+
# modify it under the terms of the GNU Lesser General Public
11+
# License as published by the Free Software Foundation; either
12+
# version 2.1 of the License, or (at your option) any later version.
13+
#
14+
# This library is distributed in the hope that it will be useful,
15+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17+
# Lesser General Public License for more details.
18+
#
19+
# You should have received a copy of the GNU Lesser General Public
20+
# License along with this library; if not, write to the Free Software
21+
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
22+
#
23+
24+
25+
# $1 is .app/Contents/Java dir
26+
# $2 is the lz4-java version
27+
# $3 is temp work directory
28+
# $4 is the mac codesign identity
29+
30+
31+
set -e
32+
#set -x ## enable to help debug
33+
34+
jar="${1}/lz4-java-${2}.jar"
35+
36+
# ensure a clean temp work directory
37+
if [ -d "${3}/net" ]
38+
then
39+
rm -rf "${3}/net"
40+
fi
41+
42+
# lz4-java's darwin natives live under net/jpountz/util/darwin/<arch>/liblz4-java.dylib
43+
archs=('aarch64' 'x86_64')
44+
for arch in "${archs[@]}"
45+
do
46+
mkdir -p "${3}/net/jpountz/util/darwin/${arch}"
47+
48+
pushd "${3}"
49+
50+
# extract the native file
51+
jar -xf "${jar}" "net/jpountz/util/darwin/${arch}/liblz4-java.dylib"
52+
53+
# test if signed; sign if not (mirrors codesign-jansi-mac.sh pattern)
54+
/usr/bin/codesign --verbose --test-requirement="=anchor trusted" \
55+
--verify "net/jpountz/util/darwin/${arch}/liblz4-java.dylib" || \
56+
/usr/bin/codesign --verbose --force --timestamp --sign "${4}" \
57+
"net/jpountz/util/darwin/${arch}/liblz4-java.dylib"
58+
59+
# overwrite the file in the jar
60+
jar -uf "${jar}" "net/jpountz/util/darwin/${arch}/liblz4-java.dylib"
61+
62+
popd
63+
done

0 commit comments

Comments
 (0)