Skip to content

Commit 235170a

Browse files
mkleenemkleene
authored
Merge branch 'main' into feature/code-coverage
2 parents 493f9b7 + f9eeb0d commit 235170a

File tree

102 files changed

+8167
-1128
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

102 files changed

+8167
-1128
lines changed

‎.github/workflows/checks.yaml‎

Lines changed: 240 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -24,17 +24,42 @@ jobs:
2424
permissions:
2525
pull-requests: read
2626
steps:
27-
- uses: amannn/action-semantic-pull-request@e9fabac35e210fea40ca5b14c0da95a099eff26f
27+
- name: Conventional Commits Check
28+
if: contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name)
29+
id: conventional-commits
30+
uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017
2831
env:
2932
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
33+
with:
34+
# Types include:
35+
# - fix: fixes
36+
# - feat: features and enhancements
37+
# - chore: non-feature or enhancement (i.e. docs, ci, linting, automated, etc)
38+
types: |
39+
fix
40+
feat
41+
chore
42+
revert
43+
# Scopes include:
44+
# - ci: anything related to ci
45+
# - cmdline: changes to @opentdf/ctl
46+
# - docs: anything related solely to documentation
47+
# - main: bot generated commits
48+
# - sdk: changes to @opentdf/sdk (was lib)
49+
# - tests: test only changes
50+
scopes: |
51+
ci
52+
cmdline
53+
docs
54+
main
55+
sdk
56+
tests
3057
3158
mavenverify:
3259
runs-on: ubuntu-latest
33-
needs:
34-
- pr
3560
steps:
3661
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
37-
- uses: bufbuild/buf-setup-action@382440cdb8ec7bc25a68d7b4711163d95f7cc3aa
62+
- uses: bufbuild/buf-setup-action@2211e06e8cf26d628cda2eea15c95f8c42b080b3
3863
with:
3964
github_token: ${{ secrets.GITHUB_TOKEN }}
4065
- name: Set up JDK
@@ -44,21 +69,54 @@ jobs:
4469
distribution: "adopt"
4570
server-id: github
4671
- name: Maven Verify
47-
run: |
48-
mvn --batch-mode clean install -DskipTests
49-
mvn --batch-mode verify
72+
run: mvn --batch-mode verify
73+
env:
74+
BUF_INPUT_HTTPS_USERNAME: opentdf-bot
75+
BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }}
76+
77+
sonarcloud:
78+
name: SonarCloud Scan
79+
runs-on: ubuntu-22.04
80+
steps:
81+
- name: Check out repository
82+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
83+
with:
84+
fetch-depth: 0
85+
- uses: bufbuild/buf-setup-action@2211e06e8cf26d628cda2eea15c95f8c42b080b3
86+
with:
87+
github_token: ${{ secrets.GITHUB_TOKEN }}
88+
- name: Set up JDK
89+
uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7
90+
with:
91+
java-version: "17"
92+
distribution: "temurin"
93+
server-id: github
94+
- name: Cache SonarCloud packages
95+
uses: actions/cache@v4
96+
with:
97+
path: ~/.sonar/cache
98+
key: ${{ runner.os }}-sonar
99+
restore-keys: ${{ runner.os }}-sonar
100+
- name: Cache Maven packages
101+
uses: actions/cache@v4
102+
with:
103+
path: ~/.m2
104+
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
105+
restore-keys: ${{ runner.os }}-m2
106+
- name: Maven Test Coverage
50107
env:
108+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
109+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
51110
BUF_INPUT_HTTPS_USERNAME: opentdf-bot
52111
BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }}
112+
run: mvn --batch-mode clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=opentdf_java-sdk -P coverage
53113

54114
platform-integration:
55115
runs-on: ubuntu-22.04
56-
needs:
57-
- pr
58116
steps:
59117
- name: Checkout Java SDK
60118
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
61-
- uses: bufbuild/buf-setup-action@382440cdb8ec7bc25a68d7b4711163d95f7cc3aa
119+
- uses: bufbuild/buf-setup-action@2211e06e8cf26d628cda2eea15c95f8c42b080b3
62120
with:
63121
github_token: ${{ secrets.GITHUB_TOKEN }}
64122
- name: Set up JDK
@@ -73,67 +131,20 @@ jobs:
73131
env:
74132
BUF_INPUT_HTTPS_USERNAME: opentdf-bot
75133
BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }}
76-
- name: Check out platform
77-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
78-
with:
79-
repository: opentdf/platform
80-
ref: main
81-
path: platform
82-
- name: Set up go
83-
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
84-
with:
85-
go-version: "1.22.3"
86-
check-latest: false
87-
cache-dependency-path: |
88-
platform/service/go.sum
89-
platform/examples/go.sum
90-
platform/protocol/go/go.sum
91-
platform/sdk/go.sum
92-
- run: go mod download
93-
working-directory: platform
94-
- run: go mod verify
95-
working-directory: platform
96-
- name: Create keys
97-
run: |
98-
.github/scripts/init-temp-keys.sh
99-
cp opentdf-dev.yaml opentdf.yaml
100-
sudo chmod -R 777 ./keys
101-
working-directory: platform
102-
- name: Trust the locally issued cert
103-
run: |
104-
keytool \
105-
-importcert \
106-
-storepass changeit \
107-
-noprompt \
108-
-file localhost.crt \
109-
-keystore $JAVA_HOME/lib/security/cacerts \
110-
-alias localhost-for-tests
111-
working-directory: platform/keys
112-
- name: Bring the services up
113-
run: docker compose up -d --wait --wait-timeout 240
114-
working-directory: platform
115-
- name: Provision keycloak
116-
run: go run ./service provision keycloak
117-
working-directory: platform
118-
- name: Provision fixtures
119-
run: go run ./service provision fixtures
120-
working-directory: platform
121-
- name: Start server in background
122-
uses: JarvusInnovations/background-action@2428e7b970a846423095c79d43f759abf979a635
134+
135+
- name: Check out and start up platform with deps/containers
136+
id: run-platform
137+
uses: opentdf/platform/test/start-up-with-containers@main
123138
with:
124-
run: |
125-
go run ./service start
126-
wait-on: |
127-
tcp:localhost:8080
128-
log-output-if: true
129-
wait-for: 90s
130-
working-directory: platform
139+
platform-ref: main
140+
131141
- name: Get grpcurl
132142
run: go install github.com/fullstorydev/grpcurl/cmd/grpcurl@v1.8.9
133143
- name: Make sure that the platform is up
134144
run: |
135145
grpcurl -plaintext localhost:8080 list && \
136146
grpcurl -plaintext localhost:8080 kas.AccessService/PublicKey
147+
137148
- name: Validate the SDK through the command line interface
138149
run: |
139150
printf 'here is some data to encrypt' > data
@@ -142,21 +153,21 @@ jobs:
142153
--client-id=opentdf-sdk \
143154
--client-secret=secret \
144155
--platform-endpoint=localhost:8080 \
145-
-i \
146-
encrypt --kas-url=localhost:8080 -f data -m 'here is some metadata' > test.tdf
156+
-h\
157+
encrypt --kas-url=localhost:8080 --mime-type=text/plain --attr https://example.com/attr/attr1/value/value1 --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
147158
148159
java -jar target/cmdline.jar \
149160
--client-id=opentdf-sdk \
150161
--client-secret=secret \
151162
--platform-endpoint=localhost:8080 \
152-
-i \
163+
-h\
153164
decrypt -f test.tdf > decrypted
154165
155166
java -jar target/cmdline.jar \
156167
--client-id=opentdf-sdk \
157168
--client-secret=secret \
158169
--platform-endpoint=localhost:8080 \
159-
-i \
170+
-h\
160171
metadata -f test.tdf > metadata
161172
162173
if ! diff -q data decrypted; then
@@ -169,10 +180,171 @@ jobs:
169180
exit 1
170181
fi
171182
working-directory: cmdline
183+
184+
- name: Encrypt/Decrypt NanoTDF
185+
run: |
186+
echo 'here is some data to encrypt' > data
187+
188+
java -jar target/cmdline.jar \
189+
--client-id=opentdf-sdk \
190+
--client-secret=secret \
191+
--platform-endpoint=localhost:8080 \
192+
-h\
193+
encryptnano --kas-url=http://localhost:8080 --attr https://example.com/attr/attr1/value/value1 -f data -m 'here is some metadata' > nano.ntdf
194+
195+
java -jar target/cmdline.jar \
196+
--client-id=opentdf-sdk \
197+
--client-secret=secret \
198+
--platform-endpoint=localhost:8080 \
199+
-h\
200+
decryptnano -f nano.ntdf > decrypted
201+
202+
if ! diff -q data decrypted; then
203+
printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
204+
exit 1
205+
fi
206+
working-directory: cmdline
207+
208+
- name: Encrypt/Decrypt Assertions
209+
run: |
210+
echo "basic assertions"
211+
echo 'here is some data to encrypt' > data
212+
213+
ASSERTIONS='[{"id":"assertion1","type":"handling","scope":"tdo","appliesToState":"encrypted","statement":{"format":"json+stanag5636","schema":"urn:nato:stanag:5636:A:1:elements:json","value":"{\"ocl\":\"2024-10-21T20:47:36Z\"}"}}]'
214+
215+
java -jar target/cmdline.jar \
216+
--client-id=opentdf-sdk \
217+
--client-secret=secret \
218+
--platform-endpoint=localhost:8080 \
219+
-h\
220+
encrypt --kas-url=localhost:8080 --mime-type=text/plain --with-assertions=$ASSERTIONS --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
221+
222+
java -jar target/cmdline.jar \
223+
--client-id=opentdf-sdk \
224+
--client-secret=secret \
225+
--platform-endpoint=localhost:8080 \
226+
-h\
227+
decrypt -f test.tdf > decrypted
228+
229+
if ! diff -q data decrypted; then
230+
printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
231+
exit 1
232+
fi
233+
234+
HS256_KEY=$(openssl rand -base64 32)
235+
openssl genpkey -algorithm RSA -out rs_private_key.pem -pkeyopt rsa_keygen_bits:2048
236+
openssl rsa -pubout -in rs_private_key.pem -out rs_public_key.pem
237+
RS256_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' rs_private_key.pem)
238+
RS256_PUBLIC_KEY=$(awk '{printf "%s\\n", $0}' rs_public_key.pem)
239+
SIGNED_ASSERTIONS_HS256='[{"id":"assertion1","type":"handling","scope":"tdo","appliesToState":"encrypted","statement":{"format":"json+stanag5636","schema":"urn:nato:stanag:5636:A:1:elements:json","value":"{\"ocl\":\"2024-10-21T20:47:36Z\"}"},"signingKey":{"alg":"HS256","key":"'$HS256_KEY'"}}]'
240+
SIGNED_ASSERTION_VERIFICATON_HS256='{"keys":{"assertion1":{"alg":"HS256","key":"'$HS256_KEY'"}}}'
241+
SIGNED_ASSERTIONS_RS256='[{"id":"assertion1","type":"handling","scope":"tdo","appliesToState":"encrypted","statement":{"format":"json+stanag5636","schema":"urn:nato:stanag:5636:A:1:elements:json","value":"{\"ocl\":\"2024-10-21T20:47:36Z\"}"},"signingKey":{"alg":"RS256","key":"'$RS256_PRIVATE_KEY'"}}]'
242+
SIGNED_ASSERTION_VERIFICATON_RS256='{"keys":{"assertion1":{"alg":"RS256","key":"'$RS256_PUBLIC_KEY'"}}}'
243+
244+
echo "hs256 assertions"
245+
246+
java -jar target/cmdline.jar \
247+
--client-id=opentdf-sdk \
248+
--client-secret=secret \
249+
--platform-endpoint=localhost:8080 \
250+
-h\
251+
encrypt --kas-url=localhost:8080 --mime-type=text/plain --with-assertions="$SIGNED_ASSERTIONS_HS256" --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
252+
253+
java -jar target/cmdline.jar \
254+
--client-id=opentdf-sdk \
255+
--client-secret=secret \
256+
--platform-endpoint=localhost:8080 \
257+
-h\
258+
decrypt --with-assertion-verification-keys="$SIGNED_ASSERTION_VERIFICATON_HS256" -f test.tdf > decrypted
259+
260+
if ! diff -q data decrypted; then
261+
printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
262+
exit 1
263+
fi
264+
265+
echo "rs256 assertions"
266+
267+
java -jar target/cmdline.jar \
268+
--client-id=opentdf-sdk \
269+
--client-secret=secret \
270+
--platform-endpoint=localhost:8080 \
271+
-h\
272+
encrypt --kas-url=localhost:8080 --mime-type=text/plain --with-assertions "$SIGNED_ASSERTIONS_RS256" --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
273+
274+
java -jar target/cmdline.jar \
275+
--client-id=opentdf-sdk \
276+
--client-secret=secret \
277+
--platform-endpoint=localhost:8080 \
278+
-h\
279+
decrypt --with-assertion-verification-keys "$SIGNED_ASSERTION_VERIFICATON_RS256" -f test.tdf > decrypted
280+
281+
if ! diff -q data decrypted; then
282+
printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
283+
exit 1
284+
fi
285+
working-directory: cmdline
286+
287+
- name: Start additional kas
288+
uses: opentdf/platform/test/start-additional-kas@main
289+
with:
290+
kas-port: 8282
291+
kas-name: beta
292+
293+
- name: Make sure that the second platform is up
294+
run: |
295+
grpcurl -plaintext localhost:8282 kas.AccessService/PublicKey
296+
- name: Validate multikas through the command line interface
297+
run: |
298+
printf 'here is some data to encrypt' > data
299+
300+
java -jar target/cmdline.jar \
301+
--client-id=opentdf-sdk \
302+
--client-secret=secret \
303+
--platform-endpoint=localhost:8080 \
304+
-h\
305+
encrypt --kas-url=localhost:8080,localhost:8282 -f data -m 'here is some metadata' > test.tdf
306+
307+
java -jar target/cmdline.jar \
308+
--client-id=opentdf-sdk \
309+
--client-secret=secret \
310+
--platform-endpoint=localhost:8080 \
311+
-h\
312+
decrypt -f test.tdf > decrypted
313+
314+
java -jar target/cmdline.jar \
315+
--client-id=opentdf-sdk \
316+
--client-secret=secret \
317+
--platform-endpoint=localhost:8080 \
318+
-h\
319+
metadata -f test.tdf > metadata
320+
321+
if ! diff -q data decrypted; then
322+
printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
323+
exit 1
324+
fi
325+
326+
if [ "$(< metadata)" != 'here is some metadata' ]; then
327+
printf 'metadata is incorrect [%s]\n' "$(< metadata)"
328+
exit 1
329+
fi
330+
working-directory: cmdline
331+
332+
platform-xtest:
333+
permissions:
334+
contents: read
335+
packages: read
336+
needs: platform-integration
337+
uses: opentdf/tests/.github/workflows/xtest.yml@main
338+
with:
339+
focus-sdk: java
340+
java-ref: ${{ github.ref }}
341+
172342
ci:
173343
needs:
174344
- platform-integration
345+
- platform-xtest
175346
- mavenverify
347+
- sonarcloud
176348
- pr
177349
runs-on: ubuntu-latest
178350
if: always()

0 commit comments

Comments
 (0)