diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ff1a03469..baba51f60 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -20,7 +20,7 @@ jobs: strategy: matrix: # sigstore-java still supports Java 11, however, we test it with conformance-tests only - java-version: [17, 21] + java-version: [17, 21, 25] fail-fast: false concurrency: diff --git a/build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts b/build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts index 657775ebf..2808da816 100644 --- a/build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts +++ b/build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts @@ -25,7 +25,7 @@ tasks.configureEach { spotless { java { - googleJavaFormat("1.24.0") + googleJavaFormat("1.35.0") licenseHeaderFile("$rootDir/config/licenseHeader") // Note if submodule needs to add more exclusions, it should list ALL of them since // Spotless does not have "addTargetExclude" method diff --git a/build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts b/build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts index d12777a87..c769fe8cd 100644 --- a/build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts +++ b/build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts @@ -22,4 +22,7 @@ tasks.withType().configureEach { if (project.hasProperty("skipStaging")) { systemProperty("sigstore-java.test.skipStaging", project.findProperty("skipStaging")!!) } + if (buildParameters.testJdkVersion >= 23) { + jvmArgs("--sun-misc-unsafe-memory-access=deny") + } } diff --git a/fuzzing/oss_fuzz_build.sh b/fuzzing/oss_fuzz_build.sh index b5e8d41cc..700b55f4e 100755 --- a/fuzzing/oss_fuzz_build.sh +++ b/fuzzing/oss_fuzz_build.sh @@ -3,7 +3,8 @@ # TODO: this should be a gradle plugin # build the fuzzing classes and extract dependencies into $OUT -./gradlew :fuzzing:copyToFuzzOut -x test -PfuzzOut="$OUT" +# Exclude spotlessCheck because GJF 1.35.0+ requires JDK 21+ to run, which would crash the build in CIFuzz (currently running on JDK 17). +./gradlew :fuzzing:copyToFuzzOut -x test -x spotlessCheck -PfuzzOut="$OUT" ALL_JARS="" for jarfile in $(find $OUT -name *.jar) do diff --git a/sigstore-java/build.gradle.kts b/sigstore-java/build.gradle.kts index f074fd404..86023b425 100644 --- a/sigstore-java/build.gradle.kts +++ b/sigstore-java/build.gradle.kts @@ -10,6 +10,22 @@ plugins { description = "A Java client for signing and verifying using Sigstore" +// allow java17 test dependencies +configurations.testCompileClasspath.configure { + attributes.attribute( + org.gradle.api.attributes.Attribute + .of("org.gradle.jvm.version", Int::class.javaObjectType), + 17, + ) +} +configurations.testRuntimeClasspath.configure { + attributes.attribute( + org.gradle.api.attributes.Attribute + .of("org.gradle.jvm.version", Int::class.javaObjectType), + 17, + ) +} + dependencies { compileOnly("org.immutables:gson:2.12.2") compileOnly("org.immutables:value-annotations:2.12.2") @@ -50,7 +66,7 @@ dependencies { testImplementation("org.mockito:mockito-core") testImplementation("org.mockito:mockito-junit-jupiter") - testImplementation("no.nav.security:mock-oauth2-server:0.5.10") + testImplementation("no.nav.security:mock-oauth2-server:5.0.2") testImplementation("com.squareup.okhttp3:mockwebserver:5.4.0") testImplementation("net.sourceforge.htmlunit:htmlunit:2.70.0") @@ -91,12 +107,12 @@ spotless { ) } format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) { - googleJavaFormat("1.24.0") + googleJavaFormat("1.35.0") licenseHeaderFile("$rootDir/config/conscryptLicenseHeader") target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java") } format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) { - googleJavaFormat("1.24.0") + googleJavaFormat("1.35.0") licenseHeaderFile("$rootDir/config/webPKILicenseHeader") target("src/*/java/dev/sigstore/json/canonicalizer/*.java") } diff --git a/sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java b/sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java index 32775c836..53d448e35 100644 --- a/sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java @@ -31,10 +31,13 @@ import java.util.function.Function; import java.util.stream.Stream; import org.junit.jupiter.api.Assertions; +import org.junit.jupiter.api.condition.DisabledForJreRange; +import org.junit.jupiter.api.condition.JRE; import org.junit.jupiter.api.extension.ExtendWith; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.MethodSource; +@DisabledForJreRange(max = JRE.JAVA_16) public class FulcioClientTest { static Stream>> clients() { diff --git a/sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientNonceTest.java b/sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientNonceTest.java index 5252fd1fc..4209bc8aa 100644 --- a/sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientNonceTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientNonceTest.java @@ -18,34 +18,25 @@ import com.gargoylesoftware.htmlunit.WebClient; import com.google.common.io.Resources; import dev.sigstore.trustroot.Service; -import java.io.IOException; import java.nio.charset.StandardCharsets; import java.util.Map; import no.nav.security.mock.oauth2.MockOAuth2Server; import no.nav.security.mock.oauth2.OAuth2Config; -import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.condition.DisabledForJreRange; +import org.junit.jupiter.api.condition.JRE; +@DisabledForJreRange(max = JRE.JAVA_16) public class WebOidcClientNonceTest { - private MockOAuth2Server server; - - @AfterEach - void teardown() throws IOException { - if (server != null) { - server.shutdown(); - } - } - @Test void testNonceVerificationSuccess() throws Exception { String config = Resources.toString( Resources.getResource("dev/sigstore/oidc/server/config.json"), StandardCharsets.UTF_8); - server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config)); + var server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config)); server.start(); - try (var webClient = new WebClient()) { var oidcClient = WebOidcClient.builder() @@ -55,6 +46,8 @@ void testNonceVerificationSuccess() throws Exception { var token = oidcClient.getIDToken(Map.of()); Assertions.assertNotNull(token.getIdToken()); + } finally { + server.shutdown(); } } @@ -64,9 +57,8 @@ void testNonceVerificationFailure_MismatchedNonce() throws Exception { Resources.toString( Resources.getResource("dev/sigstore/oidc/server/config-bad-nonce.json"), StandardCharsets.UTF_8); - server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config)); + var server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config)); server.start(); - try (var webClient = new WebClient()) { var oidcClient = WebOidcClient.builder() @@ -81,6 +73,8 @@ void testNonceVerificationFailure_MismatchedNonce() throws Exception { oidcClient.getIDToken(Map.of()); }); Assertions.assertTrue(exception.getMessage().contains("nonce in id token does not match")); + } finally { + server.shutdown(); } } } diff --git a/sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientTest.java b/sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientTest.java index 5b9a53b95..05a4f35fe 100644 --- a/sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientTest.java @@ -23,9 +23,12 @@ import java.util.Map; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.condition.DisabledForJreRange; +import org.junit.jupiter.api.condition.JRE; import org.junit.jupiter.api.extension.RegisterExtension; import org.slf4j.event.Level; +@DisabledForJreRange(max = JRE.JAVA_16) public class WebOidcClientTest { @RegisterExtension diff --git a/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json b/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json index d8ff2a693..800e671a2 100644 --- a/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json +++ b/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json @@ -11,8 +11,8 @@ "tokenExpiry": 120, "requestMappings": [ { - "requestParam": "scope", - "match": "openid email", + "requestParam": "client_id", + "match": "sigstore", "claims": { "audience": "sigstore", "email": "test.person@test.com", diff --git a/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json b/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json index 1c9b1832c..8644d8feb 100644 --- a/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json +++ b/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json @@ -11,8 +11,8 @@ "tokenExpiry": 120, "requestMappings": [ { - "requestParam": "scope", - "match": "openid email", + "requestParam": "client_id", + "match": "sigstore", "claims": { "audience": "sigstore", "email": "test.person@test.com",