ci: add trusted dependencies; fix native build

.github/workflows/ci.yml

@@ -111,7 +111,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Build native artifact
         working-directory: api
-        run: ./gradlew --dependency-verification=strict quarkusBuild -Dquarkus.native.enabled=true
+        run: ./gradlew --dependency-verification=strict quarkusBuild -Dquarkus.native.enabled=true -Dquarkus.package.jar.enabled=false
       - name: Verify native executable
         working-directory: api
         run: |

Makefile

@@ -93,6 +93,8 @@ demo-deps:
 # Run the e2e suite (Aussie + demo + Cassandra + Redis in Testcontainers).
 # Requires Docker. Standalone from :check; this is intentionally opt-in because
 # container boot is slow. See docs/platform/e2e-tests.md.
+e2e e2e-soak: demo-deps
+
 e2e:
 	cd api && ./gradlew e2eTest
 

api/gradle/verification-metadata.xml

@@ -178,6 +178,11 @@
             <sha256 value="26ca8ed6f82c9d2ed7cd32298105bb65c0f9d899db61757a09741586fa93a639" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.fasterxml.jackson" name="jackson-base" version="2.15.3">
+         <artifact name="jackson-base-2.15.3.pom">
+            <sha256 value="4290342abf0b0e4567322ffb2d0c36e25b0a87a217bb56b35680a8dd8f8d66e4" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.fasterxml.jackson" name="jackson-base" version="2.20.1">
          <artifact name="jackson-base-2.20.1.pom">
             <sha256 value="0b748ab0cc7f287db5b6018c614cfe67e7e1f4d80941ce2f41d317ccc3b5b5c5" origin="Generated by Gradle"/>
@@ -326,6 +331,11 @@
             <sha256 value="626e1e3c6737e087b5bf4517ae8aebd694350a104876fb474a627787e1c4ab46" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.fasterxml.jackson.datatype" name="jackson-datatypes-collections" version="2.15.3">
+         <artifact name="jackson-datatypes-collections-2.15.3.pom">
+            <sha256 value="e7eea54ed9ff0ec650682a9886274e5a1661bce298bc91c2be37bf9c78c5b66b" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.fasterxml.jackson.module" name="jackson-module-parameter-names" version="2.15.3">
          <artifact name="jackson-module-parameter-names-2.15.3.jar">
             <sha256 value="baf1a3156a23cb407e05374161a07ed8560f78a7ae249955de04a9a2fa2d0f2b" origin="Generated by Gradle"/>
@@ -342,6 +352,11 @@
             <sha256 value="efd5cd26504ef6245fbb327d6dcd8ad8696398807c42c93e40f525ffd00e2107" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.fasterxml.jackson.module" name="jackson-modules-java8" version="2.15.3">
+         <artifact name="jackson-modules-java8-2.15.3.pom">
+            <sha256 value="3efc5c6fea09105da6fe4a8d610cf550e0828982dfd3aafc01bb569d89b6cea0" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.fasterxml.jackson.module" name="jackson-modules-java8" version="2.20.1">
          <artifact name="jackson-modules-java8-2.20.1.pom">
             <sha256 value="011775f2c5758f0191bacedb4e51438fafdcaf3dab2548bfc4b7d795a454360d" origin="Generated by Gradle"/>
@@ -566,6 +581,11 @@
             <sha256 value="f8698ab46ca996ce889c1afc8ca4f25eb8ac6b034dc898d4583742360016cc04" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.google.guava" name="guava-parent" version="32.1.3-jre">
+         <artifact name="guava-parent-32.1.3-jre.pom">
+            <sha256 value="f283c1f04897a9a88a3fa4ff46804e65e82114809a09cd04094bf7de01b1857b" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.google.guava" name="guava-parent" version="33.4.0-android">
          <artifact name="guava-parent-33.4.0-android.pom">
             <sha256 value="7220ede61026596fbc720ee4b93246fa2d14f328058532b59ef053de397c7d83" origin="Generated by Gradle"/>
@@ -5274,6 +5294,14 @@
             <sha256 value="b163c1cfc8fc1fd58b457a00d586c04c46e986d75904e9ca54c03a97d65b496c" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.junit" name="junit-bom" version="5.9.2">
+         <artifact name="junit-bom-5.9.2.module">
+            <sha256 value="ab137ba5a8e32c9b066bf9126a1c76dd5614b724ba5c0b02549772b5e9f4cf1f" origin="Generated by Gradle"/>
+         </artifact>
+         <artifact name="junit-bom-5.9.2.pom">
+            <sha256 value="2ed07d65845131f5336a86476c9a4056b59d0b58b9815ab3679bb0f36f35f705" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.junit" name="junit-bom" version="5.9.3">
          <artifact name="junit-bom-5.9.3.module">
             <sha256 value="b401fd25901e582a524aa5343c4b39e28bc56e24961c1069bf2b4bbfcee46b93" origin="Generated by Gradle"/>

api/src/main/java/aussie/core/service/auth/ApiKeyService.java

@@ -37,7 +37,7 @@ public class ApiKeyService implements ApiKeyManagement {
     public static final String API_KEY_PREFIX = "aussie_v1_";
     private static final int KEY_LENGTH_BYTES = 32;
     private static final int KEY_ID_LENGTH = 8;
-    private static final SecureRandom SECURE_RANDOM = new SecureRandom();
+    private final SecureRandom secureRandom = new SecureRandom();
 
     private final ApiKeyRepository repository;
     private final ApiKeyConfig config;
@@ -175,7 +175,7 @@ public Uni<ApiKeyCreateResult> createWithKey(
      */
     private String generateSecureKey() {
         byte[] bytes = new byte[KEY_LENGTH_BYTES];
-        SECURE_RANDOM.nextBytes(bytes);
+        secureRandom.nextBytes(bytes);
         return API_KEY_PREFIX + Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
     }
 
@@ -209,7 +209,7 @@ public static boolean isLegacyKey(String credential) {
      */
     private String generateKeyId() {
         byte[] bytes = new byte[KEY_ID_LENGTH / 2];
-        SECURE_RANDOM.nextBytes(bytes);
+        secureRandom.nextBytes(bytes);
         return HexFormat.of().formatHex(bytes);
     }
 

api/src/main/java/aussie/core/service/auth/PkceService.java

@@ -37,7 +37,7 @@ public class PkceService {
     private static final Pattern CODE_CHALLENGE_PATTERN = Pattern.compile("[A-Za-z0-9_-]{43}");
     private static final Pattern CODE_VERIFIER_PATTERN = Pattern.compile("[A-Za-z0-9._~-]{43,128}");
     private static final Pattern STATE_PATTERN = Pattern.compile("[A-Za-z0-9_-]{43}");
-    private static final SecureRandom SECURE_RANDOM = new SecureRandom();
+    private final SecureRandom secureRandom = new SecureRandom();
 
     private final PkceChallengeRepository repository;
     private final PkceConfig config;
@@ -95,7 +95,7 @@ public boolean isValidState(String state) {
      */
     public String generateCodeVerifier() {
         byte[] randomBytes = new byte[VERIFIER_LENGTH];
-        SECURE_RANDOM.nextBytes(randomBytes);
+        secureRandom.nextBytes(randomBytes);
         return Base64.getUrlEncoder().withoutPadding().encodeToString(randomBytes);
     }
 
@@ -174,7 +174,7 @@ public Uni<Optional<OidcAuthorizationTransaction>> consumeTransaction(String sta
      */
     public String generateState() {
         final var bytes = new byte[STATE_LENGTH];
-        SECURE_RANDOM.nextBytes(bytes);
+        secureRandom.nextBytes(bytes);
         return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
     }
 

api/src/main/java/aussie/core/service/session/SessionIdGenerator.java

@@ -16,7 +16,7 @@
 public class SessionIdGenerator {
 
     private static final int SESSION_ID_BYTES = 32; // 256 bits
-    private static final SecureRandom SECURE_RANDOM = new SecureRandom();
+    private final SecureRandom secureRandom = new SecureRandom();
     private static final Base64.Encoder ENCODER = Base64.getUrlEncoder().withoutPadding();
 
     /**
@@ -26,7 +26,7 @@ public class SessionIdGenerator {
      */
     public String generate() {
         byte[] bytes = new byte[SESSION_ID_BYTES];
-        SECURE_RANDOM.nextBytes(bytes);
+        secureRandom.nextBytes(bytes);
         return ENCODER.encodeToString(bytes);
     }
 }