From 3184f86d56cf46d5f42d8db5cedc863315bbac26 Mon Sep 17 00:00:00 2001 From: Matt Wistrand Date: Sat, 29 Aug 2026 11:08:02 -0500 Subject: [PATCH] ci: add trusted dependencies; fix native build --- .github/workflows/ci.yml | 2 +- Makefile | 2 ++ api/gradle/verification-metadata.xml | 28 +++++++++++++++++++ .../core/service/auth/ApiKeyService.java | 6 ++-- .../aussie/core/service/auth/PkceService.java | 6 ++-- .../service/session/SessionIdGenerator.java | 4 +-- 6 files changed, 39 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2f2fbf9b..51a66fdc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -111,7 +111,7 @@ jobs: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Build native artifact working-directory: api - run: ./gradlew --dependency-verification=strict quarkusBuild -Dquarkus.native.enabled=true + run: ./gradlew --dependency-verification=strict quarkusBuild -Dquarkus.native.enabled=true -Dquarkus.package.jar.enabled=false - name: Verify native executable working-directory: api run: | diff --git a/Makefile b/Makefile index 04579367..8ef89e53 100644 --- a/Makefile +++ b/Makefile @@ -93,6 +93,8 @@ demo-deps: # Run the e2e suite (Aussie + demo + Cassandra + Redis in Testcontainers). # Requires Docker. Standalone from :check; this is intentionally opt-in because # container boot is slow. See docs/platform/e2e-tests.md. +e2e e2e-soak: demo-deps + e2e: cd api && ./gradlew e2eTest diff --git a/api/gradle/verification-metadata.xml b/api/gradle/verification-metadata.xml index 2f41a447..daf4afb5 100644 --- a/api/gradle/verification-metadata.xml +++ b/api/gradle/verification-metadata.xml @@ -178,6 +178,11 @@ + + + + + @@ -326,6 +331,11 @@ + + + + + @@ -342,6 +352,11 @@ + + + + + @@ -566,6 +581,11 @@ + + + + + @@ -5274,6 +5294,14 @@ + + + + + + + + diff --git a/api/src/main/java/aussie/core/service/auth/ApiKeyService.java b/api/src/main/java/aussie/core/service/auth/ApiKeyService.java index 1cd9f441..ea4e7a12 100644 --- a/api/src/main/java/aussie/core/service/auth/ApiKeyService.java +++ b/api/src/main/java/aussie/core/service/auth/ApiKeyService.java @@ -37,7 +37,7 @@ public class ApiKeyService implements ApiKeyManagement { public static final String API_KEY_PREFIX = "aussie_v1_"; private static final int KEY_LENGTH_BYTES = 32; private static final int KEY_ID_LENGTH = 8; - private static final SecureRandom SECURE_RANDOM = new SecureRandom(); + private final SecureRandom secureRandom = new SecureRandom(); private final ApiKeyRepository repository; private final ApiKeyConfig config; @@ -175,7 +175,7 @@ public Uni createWithKey( */ private String generateSecureKey() { byte[] bytes = new byte[KEY_LENGTH_BYTES]; - SECURE_RANDOM.nextBytes(bytes); + secureRandom.nextBytes(bytes); return API_KEY_PREFIX + Base64.getUrlEncoder().withoutPadding().encodeToString(bytes); } @@ -209,7 +209,7 @@ public static boolean isLegacyKey(String credential) { */ private String generateKeyId() { byte[] bytes = new byte[KEY_ID_LENGTH / 2]; - SECURE_RANDOM.nextBytes(bytes); + secureRandom.nextBytes(bytes); return HexFormat.of().formatHex(bytes); } diff --git a/api/src/main/java/aussie/core/service/auth/PkceService.java b/api/src/main/java/aussie/core/service/auth/PkceService.java index 1157349c..a4f235d7 100644 --- a/api/src/main/java/aussie/core/service/auth/PkceService.java +++ b/api/src/main/java/aussie/core/service/auth/PkceService.java @@ -37,7 +37,7 @@ public class PkceService { private static final Pattern CODE_CHALLENGE_PATTERN = Pattern.compile("[A-Za-z0-9_-]{43}"); private static final Pattern CODE_VERIFIER_PATTERN = Pattern.compile("[A-Za-z0-9._~-]{43,128}"); private static final Pattern STATE_PATTERN = Pattern.compile("[A-Za-z0-9_-]{43}"); - private static final SecureRandom SECURE_RANDOM = new SecureRandom(); + private final SecureRandom secureRandom = new SecureRandom(); private final PkceChallengeRepository repository; private final PkceConfig config; @@ -95,7 +95,7 @@ public boolean isValidState(String state) { */ public String generateCodeVerifier() { byte[] randomBytes = new byte[VERIFIER_LENGTH]; - SECURE_RANDOM.nextBytes(randomBytes); + secureRandom.nextBytes(randomBytes); return Base64.getUrlEncoder().withoutPadding().encodeToString(randomBytes); } @@ -174,7 +174,7 @@ public Uni> consumeTransaction(String sta */ public String generateState() { final var bytes = new byte[STATE_LENGTH]; - SECURE_RANDOM.nextBytes(bytes); + secureRandom.nextBytes(bytes); return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes); } diff --git a/api/src/main/java/aussie/core/service/session/SessionIdGenerator.java b/api/src/main/java/aussie/core/service/session/SessionIdGenerator.java index 12ed5a02..76f54d19 100644 --- a/api/src/main/java/aussie/core/service/session/SessionIdGenerator.java +++ b/api/src/main/java/aussie/core/service/session/SessionIdGenerator.java @@ -16,7 +16,7 @@ public class SessionIdGenerator { private static final int SESSION_ID_BYTES = 32; // 256 bits - private static final SecureRandom SECURE_RANDOM = new SecureRandom(); + private final SecureRandom secureRandom = new SecureRandom(); private static final Base64.Encoder ENCODER = Base64.getUrlEncoder().withoutPadding(); /** @@ -26,7 +26,7 @@ public class SessionIdGenerator { */ public String generate() { byte[] bytes = new byte[SESSION_ID_BYTES]; - SECURE_RANDOM.nextBytes(bytes); + secureRandom.nextBytes(bytes); return ENCODER.encodeToString(bytes); } }