Skip to content

Add java25 checks #1244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
loosebazooka wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add java25 checks #1244

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
strategy:
matrix:
# sigstore-java still supports Java 11, however, we test it with conformance-tests only
java-version: [17, 21]
java-version: [17, 21, 25]
fail-fast: false

concurrency:
Expand Down
2 changes: 1 addition & 1 deletion build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ tasks.configureEach<JavaExec> {

spotless {
java {
googleJavaFormat("1.24.0")
googleJavaFormat("1.35.0")
licenseHeaderFile("$rootDir/config/licenseHeader")
// Note if submodule needs to add more exclusions, it should list ALL of them since
// Spotless does not have "addTargetExclude" method
Expand Down
3 changes: 3 additions & 0 deletions build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,7 @@ tasks.withType<Test>().configureEach {
if (project.hasProperty("skipStaging")) {
systemProperty("sigstore-java.test.skipStaging", project.findProperty("skipStaging")!!)
}
if (buildParameters.testJdkVersion >= 23) {
jvmArgs("--sun-misc-unsafe-memory-access=deny")
}
}
3 changes: 2 additions & 1 deletion fuzzing/oss_fuzz_build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@
# TODO: this should be a gradle plugin

# build the fuzzing classes and extract dependencies into $OUT
./gradlew :fuzzing:copyToFuzzOut -x test -PfuzzOut="$OUT"
# Exclude spotlessCheck because GJF 1.35.0+ requires JDK 21+ to run, which would crash the build in CIFuzz (currently running on JDK 17).
./gradlew :fuzzing:copyToFuzzOut -x test -x spotlessCheck -PfuzzOut="$OUT"
ALL_JARS=""
for jarfile in $(find $OUT -name *.jar)
do
Expand Down
14 changes: 11 additions & 3 deletions sigstore-java/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,14 @@ plugins {

description = "A Java client for signing and verifying using Sigstore"

// allow java17 test dependencies even if test java version is < 17 (like 11)
configurations.testCompileClasspath {
attributes.attribute(TargetJvmVersion.TARGET_JVM_VERSION_ATTRIBUTE, 17)
}
configurations.testRuntimeClasspath.configure {
attributes.attribute(TargetJvmVersion.TARGET_JVM_VERSION_ATTRIBUTE, 17)
}

dependencies {
compileOnly("org.immutables:gson:2.12.2")
compileOnly("org.immutables:value-annotations:2.12.2")
Expand Down Expand Up @@ -50,7 +58,7 @@ dependencies {
testImplementation("org.mockito:mockito-core")
testImplementation("org.mockito:mockito-junit-jupiter")

testImplementation("no.nav.security:mock-oauth2-server:0.5.10")
testImplementation("no.nav.security:mock-oauth2-server:5.0.2")
testImplementation("com.squareup.okhttp3:mockwebserver:5.4.0")
testImplementation("net.sourceforge.htmlunit:htmlunit:2.70.0")

Expand Down Expand Up @@ -91,12 +99,12 @@ spotless {
)
}
format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) {
googleJavaFormat("1.24.0")
googleJavaFormat("1.35.0")
licenseHeaderFile("$rootDir/config/conscryptLicenseHeader")
target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java")
}
format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) {
googleJavaFormat("1.24.0")
googleJavaFormat("1.35.0")
licenseHeaderFile("$rootDir/config/webPKILicenseHeader")
target("src/*/java/dev/sigstore/json/canonicalizer/*.java")
}
Expand Down
3 changes: 3 additions & 0 deletions sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,13 @@
import java.util.function.Function;
import java.util.stream.Stream;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.condition.EnabledForJreRange;
import org.junit.jupiter.api.condition.JRE;
import org.junit.jupiter.api.extension.ExtendWith;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.MethodSource;

@EnabledForJreRange(min = JRE.JAVA_17)
public class FulcioClientTest {

static Stream<org.junit.jupiter.api.Named<Function<FulcioWrapper, FulcioClient>>> clients() {
Expand Down
24 changes: 9 additions & 15 deletions sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientNonceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,34 +18,25 @@
import com.gargoylesoftware.htmlunit.WebClient;
import com.google.common.io.Resources;
import dev.sigstore.trustroot.Service;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.Map;
import no.nav.security.mock.oauth2.MockOAuth2Server;
import no.nav.security.mock.oauth2.OAuth2Config;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.condition.EnabledForJreRange;
import org.junit.jupiter.api.condition.JRE;

@EnabledForJreRange(min = JRE.JAVA_17)
public class WebOidcClientNonceTest {

private MockOAuth2Server server;

@AfterEach
void teardown() throws IOException {
if (server != null) {
server.shutdown();
}
}

@Test
void testNonceVerificationSuccess() throws Exception {
String config =
Resources.toString(
Resources.getResource("dev/sigstore/oidc/server/config.json"), StandardCharsets.UTF_8);
server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config));
var server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config));
server.start();

try (var webClient = new WebClient()) {
var oidcClient =
WebOidcClient.builder()
Expand All @@ -55,6 +46,8 @@ void testNonceVerificationSuccess() throws Exception {

var token = oidcClient.getIDToken(Map.of());
Assertions.assertNotNull(token.getIdToken());
} finally {
server.shutdown();
}
}

Expand All @@ -64,9 +57,8 @@ void testNonceVerificationFailure_MismatchedNonce() throws Exception {
Resources.toString(
Resources.getResource("dev/sigstore/oidc/server/config-bad-nonce.json"),
StandardCharsets.UTF_8);
server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config));
var server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config));
server.start();

try (var webClient = new WebClient()) {
var oidcClient =
WebOidcClient.builder()
Expand All @@ -81,6 +73,8 @@ void testNonceVerificationFailure_MismatchedNonce() throws Exception {
oidcClient.getIDToken(Map.of());
});
Assertions.assertTrue(exception.getMessage().contains("nonce in id token does not match"));
} finally {
server.shutdown();
}
}
}
3 changes: 3 additions & 0 deletions sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,12 @@
import java.util.Map;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.condition.EnabledForJreRange;
import org.junit.jupiter.api.condition.JRE;
import org.junit.jupiter.api.extension.RegisterExtension;
import org.slf4j.event.Level;

@EnabledForJreRange(min = JRE.JAVA_17)
public class WebOidcClientTest {

@RegisterExtension
Expand Down
4 changes: 2 additions & 2 deletions sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@
"tokenExpiry": 120,
"requestMappings": [
{
"requestParam": "scope",
"match": "openid email",
"requestParam": "client_id",
"match": "sigstore",
"claims": {
"audience": "sigstore",
"email": "test.person@test.com",
Expand Down
4 changes: 2 additions & 2 deletions sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@
"tokenExpiry": 120,
"requestMappings": [
{
"requestParam": "scope",
"match": "openid email",
"requestParam": "client_id",
"match": "sigstore",
"claims": {
"audience": "sigstore",
"email": "test.person@test.com",
Expand Down
Loading