From 0bcd4cb6764ec1098ede671fdec22517fed34bcd Mon Sep 17 00:00:00 2001 From: Nicolas MOREAU Date: Sat, 8 Aug 2026 18:32:44 +0200 Subject: [PATCH 1/4] feat(sdk): secretspec-jvm Add CI workflow. Add doc. Add examples. Use gradle. Handle MUSL libraries. Update .gitignore. Update scripts. Update conformance. --- .github/workflows/jvm-package.yml | 387 ++++++++++++++++ .github/workflows/pre-release.yml | 8 + .gitignore | 6 + conformance/README.md | 2 + conformance/run.sh | 5 + devenv.nix | 7 + docs/astro.config.ts | 5 + docs/src/content/docs/sdk/jvm.mdx | 82 ++++ docs/src/content/docs/sdk/overview.md | 8 +- scripts/ci-sdks.sh | 3 + scripts/sync-sdk-versions.sh | 11 + secretspec-jvm/README.md | 87 ++++ secretspec-jvm/build.gradle.kts | 90 ++++ secretspec-jvm/examples/as_path/Scopes.java | 14 + .../examples/quick_start/QuickStart.java | 18 + secretspec-jvm/examples/report/Report.java | 14 + secretspec-jvm/examples/scopes/Scopes.java | 10 + .../examples/typed_access/AppSecrets.java | 12 + .../examples/typed_access/Converter.java | 101 +++++ .../examples/typed_access/TypedAccess.java | 12 + secretspec-jvm/gradle.properties | 4 + secretspec-jvm/settings.gradle.kts | 1 + .../org/cachix/secretspec/JsonContracts.java | 412 ++++++++++++++++++ .../secretspec/MissingRequiredException.java | 32 ++ .../java/org/cachix/secretspec/Native.java | 198 +++++++++ .../cachix/secretspec/ResolutionReport.java | 73 ++++ .../java/org/cachix/secretspec/Resolved.java | 134 ++++++ .../org/cachix/secretspec/ResolvedSecret.java | 91 ++++ .../org/cachix/secretspec/SecretReport.java | 95 ++++ .../org/cachix/secretspec/SecretSpec.java | 24 + .../cachix/secretspec/SecretSpecBuilder.java | 163 +++++++ .../secretspec/SecretSpecException.java | 27 ++ .../org/cachix/secretspec/NativeTest.java | 16 + .../org/cachix/secretspec/SecretSpecTest.java | 383 ++++++++++++++++ 34 files changed, 2534 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/jvm-package.yml create mode 100644 docs/src/content/docs/sdk/jvm.mdx create mode 100644 secretspec-jvm/README.md create mode 100644 secretspec-jvm/build.gradle.kts create mode 100644 secretspec-jvm/examples/as_path/Scopes.java create mode 100644 secretspec-jvm/examples/quick_start/QuickStart.java create mode 100644 secretspec-jvm/examples/report/Report.java create mode 100644 secretspec-jvm/examples/scopes/Scopes.java create mode 100644 secretspec-jvm/examples/typed_access/AppSecrets.java create mode 100644 secretspec-jvm/examples/typed_access/Converter.java create mode 100644 secretspec-jvm/examples/typed_access/TypedAccess.java create mode 100644 secretspec-jvm/gradle.properties create mode 100644 secretspec-jvm/settings.gradle.kts create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/JsonContracts.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/MissingRequiredException.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/Native.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/ResolutionReport.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/Resolved.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/ResolvedSecret.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/SecretReport.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpec.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java create mode 100644 secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecException.java create mode 100644 secretspec-jvm/src/test/java/org/cachix/secretspec/NativeTest.java create mode 100644 secretspec-jvm/src/test/java/org/cachix/secretspec/SecretSpecTest.java diff --git a/.github/workflows/jvm-package.yml b/.github/workflows/jvm-package.yml new file mode 100644 index 00000000..cba6eca4 --- /dev/null +++ b/.github/workflows/jvm-package.yml @@ -0,0 +1,387 @@ +name: "Java Virtual Machine SDK" + +# Builds the JVM client and the runtime-specific secretspec-ffi libraries packed +# into org.cachix.secretspec-jvm. Glibc Linux uses a manylinux_2_28 baseline; Alpine +# receives separate musl assets. + +on: + workflow_call: + inputs: + publish: + description: Publish the built package + required: false + type: boolean + default: false + workflow_dispatch: + inputs: + publish: + description: Publish the built package + required: false + type: boolean + default: false + push: + tags: + - v** + pull_request: + paths: + - "secretspec-jvm/**" + - "secretspec-ffi/**" + - ".github/workflows/jvm-package.yml" + - "scripts/install-rustup.sh" + - "scripts/sync-sdk-versions.sh" + +permissions: + contents: read + +jobs: + native: + name: ${{ matrix.rid }} + runs-on: ${{ matrix.runner }} + container: ${{ matrix.container || null }} + strategy: + fail-fast: false + matrix: + include: + - rid: linux-x86-64 + target: x86_64-unknown-linux-gnu + runner: ubuntu-latest + container: quay.io/pypa/manylinux_2_28_x86_64:2026.08.05-1@sha256:e0b40ace8e818e96026eb47714b01998cbca022a6995797d0905474ce3e82ae8 + library: libsecretspec_ffi.so + rustflags: -C strip=symbols + - rid: linux-aarch64 + target: aarch64-unknown-linux-gnu + runner: ubuntu-24.04-arm + container: quay.io/pypa/manylinux_2_28_aarch64:2026.08.05-1@sha256:f766b402889e40f439e7a3ee5788eef1aa3ef399d0110107d27419fa2ba9d905 + library: libsecretspec_ffi.so + rustflags: -C strip=symbols + - rid: darwin-x86-64 + target: x86_64-apple-darwin + runner: macos-15-intel + library: libsecretspec_ffi.dylib + deployment_target: "12.0" + rustflags: -C strip=symbols + - rid: darmin-aarch64 + target: aarch64-apple-darwin + runner: macos-latest + library: libsecretspec_ffi.dylib + deployment_target: "12.0" + rustflags: -C strip=symbols + - rid: win32-x86-64 + target: x86_64-pc-windows-msvc + runner: windows-latest + library: secretspec_ffi.dll + rustflags: -C strip=symbols -C target-feature=+crt-static + - rid: win32-aarch64 + target: aarch64-pc-windows-msvc + runner: windows-11-arm + library: secretspec_ffi.dll + rustflags: -C strip=symbols -C target-feature=+crt-static + + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Sync SDK package versions + shell: bash + run: bash scripts/sync-sdk-versions.sh + + - name: Install verified rustup in manylinux + if: matrix.container + shell: bash + run: | + bash scripts/install-rustup.sh + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" + + - name: Install Rust + run: rustup toolchain install + + - uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: "11" + + - name: Build native resolver + shell: bash + env: + MACOSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target }} + RUSTFLAGS: ${{ matrix.rustflags }} + run: >- + cargo build -p secretspec-ffi --release + --target ${{ matrix.target }} + + - name: Verify glibc portability (glibc <= 2.28, no libdbus) + if: matrix.container + shell: bash + run: >- + bash scripts/check-linux-portability.sh + "target/${{ matrix.target }}/release/${{ matrix.library }}" + + - name: Verify Windows CRT is statically linked + if: runner.os == 'Windows' + shell: bash + run: | + rustup component add llvm-tools-preview + host="$(rustc -vV | sed -n 's/^host: //p')" + llvm_objdump="$(rustc --print sysroot)/lib/rustlib/$host/bin/llvm-objdump" + imports="$("$llvm_objdump" -p \ + "target/${{ matrix.target }}/release/${{ matrix.library }}")" + if grep -Eiq 'DLL Name: (VCRUNTIME|MSVCP)' <<<"$imports"; then + echo "the packaged resolver still depends on the MSVC runtime" >&2 + grep -Ei 'DLL Name: (VCRUNTIME|MSVCP)' <<<"$imports" >&2 + exit 1 + fi + + - name: Run JVM SDK tests against native resolver + shell: bash + env: + SECRETSPEC_FFI_LIB: ${{ github.workspace }}/target/${{ matrix.target }}/release/${{ matrix.library }} + run: >- + cd secretspec-jvm && gradle test + + - name: Stage native Jar asset + shell: bash + run: | + mkdir -p "staged/${{ matrix.rid }}" + cp "target/${{ matrix.target }}/release/${{ matrix.library }}" \ + "staged/${{ matrix.rid }}" + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: jvm-native-${{ matrix.rid }} + path: staged/${{ matrix.rid }} + + musl: + name: ${{ matrix.rid }} + runs-on: ${{ matrix.runner }} + strategy: + fail-fast: false + matrix: + include: + - rid: linux-x86-64-musl + target: x86_64-unknown-linux-musl + runner: ubuntu-latest + image: quay.io/pypa/musllinux_1_2_x86_64:2026.08.05-1@sha256:c7b2187aa4d095a8da73ea4db96acefd46701a13439a9cc4546f5d61a4b5bba1 + - rid: linux-aarch64-musl + target: aarch64-unknown-linux-musl + runner: ubuntu-24.04-arm + image: quay.io/pypa/musllinux_1_2_aarch64:2026.08.05-1@sha256:668c455aeddf5e363bd6fd801f10b369a634a9f01974876cee8c8c518b44ef10 + + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Sync SDK package versions + run: bash scripts/sync-sdk-versions.sh + - name: Build dynamically loadable musl resolver + shell: bash + run: | + docker run --rm \ + --volume "$GITHUB_WORKSPACE:/workspace" \ + --workdir /workspace \ + --env CARGO_TARGET_DIR=/workspace/target \ + --env "RUSTFLAGS=-C target-feature=-crt-static -C strip=symbols" \ + "${{ matrix.image }}" \ + bash -c ' + set -euo pipefail + bash scripts/install-rustup.sh + export PATH="$HOME/.cargo/bin:$PATH" + rustup toolchain install + cargo build -p secretspec-ffi --release \ + --target "${{ matrix.target }}" + ' + test -f \ + "target/${{ matrix.target }}/release/libsecretspec_ffi.so" + - name: Verify musl portability + shell: bash + run: | + library="target/${{ matrix.target }}/release/libsecretspec_ffi.so" + dynamic="$(readelf -d "$library")" + needed="$(grep NEEDED <<<"$dynamic")" + case "${{ matrix.target }}" in + x86_64-unknown-linux-musl) + expected_libc=libc.musl-x86_64.so.1 + ;; + aarch64-unknown-linux-musl) + expected_libc=libc.musl-aarch64.so.1 + ;; + esac + # ARM musl's libgcc_s exports a compatibility symbol version named + # GLIBC_2.0, so inspect the actual dynamic dependencies instead. + if grep -q '\[libc\.so\.6\]' <<<"$needed" || + ! grep -Fq "[$expected_libc]" <<<"$needed"; then + echo "$library does not use the expected musl libc" >&2 + echo "$needed" >&2 + exit 1 + fi + if grep -q dbus <<<"$needed"; then + echo "$library links libdbus dynamically" >&2 + echo "$needed" >&2 + exit 1 + fi + - name: Stage native Jar asset + run: | + mkdir -p "staged/${{ matrix.rid }}/native" + # MUSL and GLIBC libraries must both reside in linux-x86-64 or linux-aarch64 + # Rename the library so they can coexist in the same directory + cp "target/${{ matrix.target }}/release/libsecretspec_ffi.so" \ + "staged/${{ matrix.rid }}/libsecretspec_musl_ffi.so" + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: jvm-native-${{ matrix.rid }} + path: staged/${{ matrix.rid }} + + package: + name: Jar package + needs: [native, musl] + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Sync SDK package versions + run: bash scripts/sync-sdk-versions.sh + - uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: "11" + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: jvm-native-* + path: staged + - name: Place runtime assets + shell: bash + run: | + for artifact in staged/jvm-native-*; do + rid="${artifact##*/jvm-native-}" + # MUSL and GLIBC libraries must both reside in linux-x86-64 or linux-aarch64, remove the suffix + mkdir -p "secretspec-jvm/src/main/resources/com/sun/jna/${rid%-musl}" + cp -R "$artifact/"* "secretspec-jvm/src/main/resources/com/sun/jna/${rid%-musl}/" + done + - name: Pack + run: >- + cd secretspec-jvm && gradle assemble + - name: Verify runtime assets are present + shell: bash + run: | + # The staged directories come from the same matrix that builds the + # native libraries, so this check cannot drift from the matrix. + package="$(find artifacts -name '*.jar' -print -quit)" + shopt -s nullglob + staged=(staged/jvm-native-*) + if [ "${#staged[@]}" -eq 0 ]; then + echo "no staged native artifacts were downloaded" >&2 + exit 1 + fi + for artifact in "${staged[@]}"; do + rid="${artifact##*/jvm-native-}" + if [ "${rid%-musl}" = "${rid}" ] ; then + unzip -l "$package" | grep -q "com/sun/jna/${rid%-musl}/" + else + unzip -l "$package" | grep -q "com/sun/jna/${rid%-musl}/libsecretspec_musl_ffi.so" + fi + done + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: jar-file + path: artifacts/*.jar + + consumer: + name: consume ${{ matrix.rid }} + needs: [package] + runs-on: ${{ matrix.runner }} + strategy: + fail-fast: false + matrix: + include: + - rid: linux-x86-64 + runner: ubuntu-latest + musl: false + - rid: linux-aarch64 + runner: ubuntu-24.04-arm + musl: false + - rid: linux-x86-64-musl + runner: ubuntu-latest + musl: true + - rid: linux-aarch64-musl + runner: ubuntu-24.04-arm + musl: true + - rid: darwin-x86-64 + runner: macos-15-intel + musl: false + - rid: darwin-aarch64 + runner: macos-latest + musl: false + - rid: win32-x86-64 + runner: windows-latest + musl: false + - rid: win32-aarch64 + runner: windows-11-arm + musl: false + + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: jar-file + path: artifacts + - uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: "11" + + - name: Run tests + if: matrix.musl == false && runner.os != 'Windows' + shell: bash + run: | + echo TODO + + - name: Run tests on Windows + if: runner.os == 'Windows' + shell: pwsh + run: | + echo TODO + + - name: Run tests on Alpine + if: matrix.musl + shell: bash + run: | + docker run --rm \ + --volume "$GITHUB_WORKSPACE:/workspace" \ + --volume "$RUNNER_TEMP:/runner" \ + --workdir /runner \ + eclipse-temurin:11-jdk-alpine \ + sh -c ' + echo TODO + ' + + publish: + name: publish to central repository + if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || inputs.publish + needs: [consumer] + runs-on: ubuntu-latest + permissions: + id-token: write # no long-lived key + contents: read + steps: + - uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: "11" + cache: gradle + server-id: central + server-username: MAVEN_CENTRAL_USERNAME + server-password: MAVEN_CENTRAL_PASSWORD + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: jar-file + path: artifacts + - name: Publish package + env: + MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }} + MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} + GPG_SIGNING_KEY: ${{ secrets.GPG_PRIVATE_KEY }} + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + run: >- + cd secretspec-jvm && gradle publishToMavenCentral --no-daemon diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml index 1ec9a3d6..41db985a 100644 --- a/.github/workflows/pre-release.yml +++ b/.github/workflows/pre-release.yml @@ -128,6 +128,14 @@ jobs: contents: write uses: ./.github/workflows/swift-package.yml + jvm: + name: JVM package + needs: authorize + permissions: + contents: read + id-token: write + uses: ./.github/workflows/jvm-package.yml + release-artifacts: name: CLI release artifacts needs: authorize diff --git a/.gitignore b/.gitignore index 441ba8be..35811c2d 100644 --- a/.gitignore +++ b/.gitignore @@ -16,4 +16,10 @@ target /.build/ /secretspec-swift/Artifacts/ +# Java local artifacts and build output +/secretspec-jvm/build/ +/secretspec-jvm/.gradle/ + .idea/ + +.vscode/ diff --git a/conformance/README.md b/conformance/README.md index c409859c..b38eb61a 100644 --- a/conformance/README.md +++ b/conformance/README.md @@ -64,3 +64,5 @@ relative to the repo root: - Swift (0.18+, macOS): `swift test --filter SecretSpecTests.testCrossLanguageConformance` after staging the local XCFramework as described in `secretspec-swift/README.md` +- JVM (0.XX+): + `cd secretspec-jvm && gradle test` \ No newline at end of file diff --git a/conformance/run.sh b/conformance/run.sh index 628886d9..d9ac2775 100755 --- a/conformance/run.sh +++ b/conformance/run.sh @@ -97,6 +97,10 @@ run_swift() { ( "$artifact" "$SECRETSPEC_FFI_LIB" swift test --filter SecretSpecTests.testCrossLanguageConformance ); } +run_jvm() { ( + cd secretspec-jvm + gradle test +); } run "Python" python run_python run "Go" go run_go @@ -111,6 +115,7 @@ else echo "==> SKIP Swift (the XCFramework SDK is macOS-only)" names+=("Swift"); statuses+=("SKIP") fi +run "JVM" jvm run_jvm echo echo "==> Conformance summary" diff --git a/devenv.nix b/devenv.nix index f8a4aeec..d7e62522 100644 --- a/devenv.nix +++ b/devenv.nix @@ -59,6 +59,12 @@ ffi.enable = true; ''; }; + languages.java = { + enable = true; + jdk.package = pkgs.jdk11; + gradle.enable = true; + gradle.package = pkgs.gradle.override { java = pkgs.jdk21; }; + }; packages = [ # coverage testing @@ -103,6 +109,7 @@ CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER = muslcc; MUSL_CC = muslcc; MUSL_STATIC_LDFLAGS = "-L${pkgs.pkgsStatic.libunwind}/lib"; + SECRETSPEC_JVM_TARGET_JDK = "${pkgs.jdk11}"; } ); diff --git a/docs/astro.config.ts b/docs/astro.config.ts index 4a8a3b20..283ef37f 100644 --- a/docs/astro.config.ts +++ b/docs/astro.config.ts @@ -369,6 +369,11 @@ Values can be resolved from: keyring (default), KeePass KDBX (0.17+), dotenv fil slug: "sdk/swift", badge: { text: "0.18+", variant: "note" }, }, + { + label: "JVM", + slug: "sdk/jvm", + badge: { text: "0.XX+", variant: "note" }, + }, ], }, { diff --git a/docs/src/content/docs/sdk/jvm.mdx b/docs/src/content/docs/sdk/jvm.mdx new file mode 100644 index 00000000..9a51824f --- /dev/null +++ b/docs/src/content/docs/sdk/jvm.mdx @@ -0,0 +1,82 @@ +--- +title: JVM SDK +description: Resolve SecretSpec secrets from Java Virtual Machine languages +--- + +import { Code } from 'astro:components'; +import quickStartExample from '../../../../../secretspec-jvm/examples/quick_start/QuickStart.java?raw'; +import scopesExample from '../../../../../secretspec-jvm/examples/scopes/Scopes.java?raw'; +import reportExample from '../../../../../secretspec-jvm/examples/report/Report.java?raw'; +import typedAccessExample from '../../../../../secretspec-jvm/examples/typed_access/TypedAccess.java?raw'; +import asPathExample from '../../../../../secretspec-jvm/examples/as_path/AsPath.java?raw'; + +> **Version compatibility:** Available since SecretSpec 0.XX. + +The JVM SDK (`org.cachix.secretspec-jvm`) is a thin client over the same Rust resolver as +the CLI. Every provider, fallback chain, profile, generator, reference, and +`as_path` secret therefore works without JVM-side resolution logic. + +## Install (0.XX+) + +The package targets JDK 11 and includes native resolvers for glibc and musl +Linux x64/Arm64, macOS x64/Arm64, and Windows x64/Arm64. Windows assets +statically include the C runtime. No separate SecretSpec CLI, native library, +Visual C++ Redistributable, or system `libdbus` installation is needed. + +## Quick start + + + +`get()` returns the inline value, or the readable file path for an `as_path` +secret. A missing required secret throws `MissingRequiredException`; its +`missing` property contains the secret names. Other failures throw +`SecretSpecException`, whose `kind` property is a stable error category. + +## Scopes (0.17+) + +Use `withScope("api")` to resolve only a named `[scopes.api]` subset. The +selected name is available as `Resolved.getScope()` and `ResolutionReport.getScope()`: + + + +## Value-free preflight + +`report()` returns the inventory view exposed by `secretspec check --json`. +It never carries values. Missing required secrets appear with +`getStatus() == "missing_required"` rather than throwing, so incomplete deployments +can still be inspected. + + + +## Typed access + +Generate an idiomatic language model from the manifest schema: + +```bash +secretspec schema | + quicktype -s schema --top-level AppSecrets --lang java -o AppSecrets.java +``` + +Then deserialize the SDK's flat field map: + + + +The schema models successful resolution: required, defaulted, and generated +secrets are non-nullable, and profile-specific schemas include inherited +default-profile fields. + +## Files (`as_path`) + +File-shaped secrets are materialized as mode-0400 temporary files. The returned +path must remain valid after `load()`, so the caller owns its lifetime. +`Resolved` implements `AutoCloseable`; use a `try-with-resources` declaration or call `close()` +to remove these files deterministically: + + + +## Native loading + +The Jar runtime asset is selected automatically. For local SDK development, +`SECRETSPEC_FFI_LIB` can point to a particular `libsecretspec_ffi` build. From +a SecretSpec source checkout, the SDK also searches an ancestor Cargo +`target/debug` or `target/release` directory. diff --git a/docs/src/content/docs/sdk/overview.md b/docs/src/content/docs/sdk/overview.md index 7ffa4295..3671ffb1 100644 --- a/docs/src/content/docs/sdk/overview.md +++ b/docs/src/content/docs/sdk/overview.md @@ -35,6 +35,8 @@ that core rather than a reimplementation: - **PHP** prefers an [ext-php-rs](https://github.com/davidcole1340/ext-php-rs) extension that embeds the resolver (working under FPM with no `ffi.enable`), and falls back to loading the same C ABI at runtime through `ext-ffi`. +- **JVM (0.XX+)** loads the same C ABI with JNA from a runtime-specific + native asset in the Jar package. Because resolution happens in one place, every provider, chain, profile, and generator works the same in every language, and a new provider added to the core @@ -60,7 +62,8 @@ print(resolved.secrets["DATABASE_URL"].get) See each language's page for the idiomatic spelling: [Rust](/sdk/rust), [Python](/sdk/python), [Go](/sdk/go), [Ruby](/sdk/ruby), [Node.js](/sdk/nodejs), [Haskell](/sdk/haskell), [PHP](/sdk/php), -[C# (0.16+)](/sdk/csharp), and [Swift (0.18+)](/sdk/swift). +[C# (0.16+)](/sdk/csharp), [Swift (0.18+)](/sdk/swift) +and [JVM languages (0.XX+)](/sdk/jvm). Every builder also takes a [scope (0.17+)](/concepts/scopes/), resolving only a named subset of the profile and returning the selected name on @@ -108,6 +111,8 @@ no runtime library path to set: - **Node.js** builds the resolver into a napi-rs addon. - **PHP** ships as a normal PHP extension (provisioned like `ext-redis`), with an `ext-ffi` fallback that dlopens the bundled `cdylib`. +- **JVM** ships the `cdylib` as runtime-specific native assets in one + Jar package and loads the matching asset through JNA. Because the resolver is linked or embedded directly, the SDKs do not depend on a separately installed `cdylib` or an `LD_LIBRARY_PATH`/`SECRETSPEC_FFI_LIB` @@ -131,6 +136,7 @@ SecretSpec 0.17. | Swift (0.18+) | — | — | ✓ | ✓ | — | — | | PHP | ✓ | ✓ | — | ✓ | ✓ (0.17+) | — | | Haskell (source) | ✓ | — | — | — | ✓ (0.17+) | — | +| JVM (0.XX+) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | Most Linux packages build against a manylinux_2_28 baseline (glibc 2.28 or newer); the C# package additionally ships musl Linux assets. Hackage diff --git a/scripts/ci-sdks.sh b/scripts/ci-sdks.sh index 09863b92..537ad638 100755 --- a/scripts/ci-sdks.sh +++ b/scripts/ci-sdks.sh @@ -120,6 +120,9 @@ echo "==> C# / .NET" ( cd secretspec-dotnet && dotnet run --project tests/SecretSpec.Tests --configuration Release ) ( cd secretspec-dotnet && find examples -name '*.csproj' -exec dotnet build {} \; ) +echo "==> JVM" +( cd secretspec-jvm && gradle assemble ) + echo "==> PHP" # The PHP SDK has two native backends over the same resolver; exercise both. # The Composer manifest is at the repo root (so Packagist can read it from the diff --git a/scripts/sync-sdk-versions.sh b/scripts/sync-sdk-versions.sh index e4f665c7..eb1d993f 100755 --- a/scripts/sync-sdk-versions.sh +++ b/scripts/sync-sdk-versions.sh @@ -125,6 +125,16 @@ update_file() { END { if (!changed) exit 1 } ' "$file" > "$tmp" ;; + gradle-properties) + awk -v version="$workspace_version" ' + !changed && /^[[:space:]]*secretspec\.version[[:space:]]*=/ { + sub(/secretspec\.version[[:space:]]*=[[:space:]]*[^#]*/, "secretspec.version=" version) + changed = 1 + } + { print } + END { if (!changed) exit 1 } + ' "$file" > "$tmp" + ;; *) echo "unknown manifest kind: $kind" >&2 rm -f "$tmp" @@ -141,6 +151,7 @@ update_file secretspec-hs/secretspec.cabal cabal update_file secretspec-node/package.json package-json update_file secretspec-dotnet/src/SecretSpec/SecretSpec.csproj csproj update_file secretspec-dotnet/tests/SecretSpec.PackageSmoke/SecretSpec.PackageSmoke.csproj csproj +update_file secretspec-jvm/gradle.properties gradle-properties update_file Package.swift swift-package echo "synced SDK package versions to $workspace_version" diff --git a/secretspec-jvm/README.md b/secretspec-jvm/README.md new file mode 100644 index 00000000..f0048f46 --- /dev/null +++ b/secretspec-jvm/README.md @@ -0,0 +1,87 @@ +# SecretSpec for the Java Virtual Machine + +> Supported starting with SecretSpec 0.XX. + +`org.cachix.SecretSpec` is the Java SDK for +[SecretSpec](https://secretspec.dev/), the declarative secrets manager. It is a +thin client over the shared Rust resolver, so every provider, fallback chain, +profile, generator, and `as_path` secret behaves exactly like the CLI and the +other language SDKs. + + +```java +import org.cachix.secretspec.SecretSpec; + +public class MyApplication { + + public static void main() { + var resolved = SecretSpec.builder() + .withProvider("keyring://") + .withProfile("production") + .withReason("boot web app") + .load(); + + var secrets = resolved.getSecrets(): + System.out.println(secrets.get("DATABASE_URL").get()); + resolved.setAsSystemProperties(); + } +} +``` + +A missing required secret throws `MissingRequiredException`, whose `missing` +property contains the names. Other failures throw `SecretSpecException`, with a +stable `kind`. + +## Scopes (0.17+) + +Use `withScope("api")` to resolve only a named `[scopes.api]` subset. Both +`Resolved.getScope()` and `ResolutionReport.getScope()` return the selected scope: + +```java +var resolved = SecretSpec.builder().withScope("api").load(); +``` + +## Value-free reports + +`report()` returns the same inventory/preflight view as +`secretspec check --json`. It never exposes values, and a missing required +secret is an entry with `getStatus() == "missing_required"` rather than an exception. + +```java +var report = SecretSpec.builder() + .withProfile("production") + .withReason("deployment preflight") + .report(); + +for (var secret : report.getSecrets()) + System.out.println("%s: %s".formatted(secret.getName(), secret.getStatus())); +``` + +## Typed access + +Generate a Java type from the manifest, then deserialize `fieldsJson()`: + +```bash +secretspec schema | + quicktype -s schema --top-level AppSecrets --lang java -o AppSecrets.java +``` + +```java +var secrets = io.quicktype.Converter.fromJson(resolved.fieldsJson()); +``` + +## Files and cleanup + +An `as_path` secret is materialized as a mode-0400 temporary file, and `get()` +returns its path. `Resolved` implements `AutoCloseable`; keep the result in a +`try-with-resources` declaration or call `close()` to remove those files when finished. + +## Native resolver + +The JAR file carries the resolver for glibc and musl Linux x64/Arm64, +macOS x64/Arm64, and Windows x64/Arm64. Windows builds include the C runtime, +so users do not need to install the Visual C++ Redistributable. + +During local SDK development, `SECRETSPEC_FFI_LIB` can point to an explicit +`libsecretspec_ffi` build; the SDK also discovers a Cargo `target` directory +when used from a SecretSpec source checkout. diff --git a/secretspec-jvm/build.gradle.kts b/secretspec-jvm/build.gradle.kts new file mode 100644 index 00000000..5d473c0d --- /dev/null +++ b/secretspec-jvm/build.gradle.kts @@ -0,0 +1,90 @@ +plugins { + `java-library` + `maven-publish` + `signing` + id("com.vanniktech.maven.publish") version "0.30.0" +} + +group = "org.cachix" + +version = providers.gradleProperty("secretspec.version").get() + +java { + toolchain { + languageVersion.set(JavaLanguageVersion.of(11)) + } + withSourcesJar() + withJavadocJar() +} + +repositories { + mavenCentral() +} + +dependencies { + val jnaVersion = "5.19.1" + val jacksonVersion = "2.21.5" + val junitVersion = "5.14.4" + val junitPlatformVersion = "1.14.4" + val assertjVersion = "3.27.7" + + implementation("net.java.dev.jna:jna:$jnaVersion") + implementation("com.fasterxml.jackson.core:jackson-databind:$jacksonVersion") + + testImplementation("org.junit.jupiter:junit-jupiter-api:$junitVersion") + testImplementation("org.assertj:assertj-core:$assertjVersion") + + testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:$junitVersion") + testRuntimeOnly("org.junit.platform:junit-platform-launcher:$junitPlatformVersion") +} + +tasks.test { + useJUnitPlatform() +} + +mavenPublishing { + publishToMavenCentral(com.vanniktech.maven.publish.SonatypeHost.CENTRAL_PORTAL) + + signAllPublications() + + coordinates("org.cachix", "secretspec-jvm", version.toString()) + + pom { + name.set("SecretSpec JVM SDK") + description.set("JVM SDK for SecretSpec secret resolution") + url.set("https://secretspec.dev") + + scm { + connection.set("scm:git:https://github.com/cachix/secretspec.git") + developerConnection.set("scm:git:ssh://github.com/cachix/secretspec.git") + url.set("https://github.com/cachix/secretspec") + } + + licenses { + license { + name.set("Apache-2.0") + url.set("https://www.apache.org/licenses/LICENSE-2.0.txt") + } + } + + developers { + developer { + id.set("cachix") + name.set("Cachix Team") + email.set("support@cachix.org") + organization.set("Cachix") + organizationUrl.set("https://www.cachix.org") + } + } + + issueManagement { + system.set("GitHub Issues") + url.set("https://github.com/cachix/secretspec/issues") + } + + ciManagement { + system.set("GitHub Actions") + url.set("https://github.com/cachix/secretspec/actions") + } + } +} diff --git a/secretspec-jvm/examples/as_path/Scopes.java b/secretspec-jvm/examples/as_path/Scopes.java new file mode 100644 index 00000000..2dd78b0e --- /dev/null +++ b/secretspec-jvm/examples/as_path/Scopes.java @@ -0,0 +1,14 @@ + +import org.cachix.secretspec.SecretSpec; + +public class Scopes { + + public static void main() { + try(var resolved = SecretSpec.builder().withReason("TLS boot").load()) { + var secrets = resolved.getSecrets(); + var certificatePath = secrets.get("TLS_CERT").get(); + // Use the certificate before resolved is disposed. + System.out.println(certificatePath); + } + } +} diff --git a/secretspec-jvm/examples/quick_start/QuickStart.java b/secretspec-jvm/examples/quick_start/QuickStart.java new file mode 100644 index 00000000..550c2404 --- /dev/null +++ b/secretspec-jvm/examples/quick_start/QuickStart.java @@ -0,0 +1,18 @@ +import org.cachix.secretspec.SecretSpec; + +public class QuickStart { + + public static void main() { + try(var resolved = SecretSpec.builder() + .withProvider("keyring://") + .withProfile("production") + .withReason("boot web app") + .load() + ) { + System.out.println(resolved.getProvider() + " (" + resolved.getProfile() + ")"); + var secrets = resolved.getSecrets(); + System.out.println(secrets.get("DATABASE_URL").get()); + resolved.setAsSystemProperties(); + } + } +} diff --git a/secretspec-jvm/examples/report/Report.java b/secretspec-jvm/examples/report/Report.java new file mode 100644 index 00000000..91d7bfed --- /dev/null +++ b/secretspec-jvm/examples/report/Report.java @@ -0,0 +1,14 @@ +import org.cachix.secretspec.SecretSpec; + +public class Report { + + public static void main() { + var report = SecretSpec.builder() + .withProfile("production") + .withReason("deployment preflight") + .report(); + + for (var secret : report.getSecrets()) + System.out.println(secret.getName() + ": " + secret.getStatus()); + } +} diff --git a/secretspec-jvm/examples/scopes/Scopes.java b/secretspec-jvm/examples/scopes/Scopes.java new file mode 100644 index 00000000..bfbc92cc --- /dev/null +++ b/secretspec-jvm/examples/scopes/Scopes.java @@ -0,0 +1,10 @@ +import org.cachix.secretspec.SecretSpec; + +public class Scopes { + + public static void main() { + try(var resolved = SecretSpec.builder().withScope("api").load()) { + + } + } +} diff --git a/secretspec-jvm/examples/typed_access/AppSecrets.java b/secretspec-jvm/examples/typed_access/AppSecrets.java new file mode 100644 index 00000000..90d26008 --- /dev/null +++ b/secretspec-jvm/examples/typed_access/AppSecrets.java @@ -0,0 +1,12 @@ +package io.quicktype; + +import com.fasterxml.jackson.annotation.*; + +public class AppSecrets { + private String databaseURL; + + @JsonProperty("DATABASE_URL") + public String getDatabaseURL() { return databaseURL; } + @JsonProperty("DATABASE_URL") + public void setDatabaseURL(String value) { this.databaseURL = value; } +} diff --git a/secretspec-jvm/examples/typed_access/Converter.java b/secretspec-jvm/examples/typed_access/Converter.java new file mode 100644 index 00000000..ca185382 --- /dev/null +++ b/secretspec-jvm/examples/typed_access/Converter.java @@ -0,0 +1,101 @@ +// To use this code, add the following Maven dependency to your project: +// +// +// com.fasterxml.jackson.core : jackson-databind : 2.9.0 +// com.fasterxml.jackson.datatype : jackson-datatype-jsr310 : 2.9.0 +// +// Import this package: +// +// import io.quicktype.Converter; +// +// Then you can deserialize a JSON string with +// +// AppSecrets data = Converter.fromJsonString(jsonString); + +package io.quicktype; + +import java.io.IOException; +import com.fasterxml.jackson.databind.*; +import com.fasterxml.jackson.databind.module.SimpleModule; +import com.fasterxml.jackson.core.JsonParser; +import com.fasterxml.jackson.core.JsonProcessingException; +import java.util.*; +import java.time.LocalDate; +import java.time.OffsetDateTime; +import java.time.OffsetTime; +import java.time.ZoneOffset; +import java.time.ZonedDateTime; +import java.time.format.DateTimeFormatter; +import java.time.format.DateTimeFormatterBuilder; +import java.time.temporal.ChronoField; + +public class Converter { + // Date-time helpers + + private static final DateTimeFormatter DATE_TIME_FORMATTER = new DateTimeFormatterBuilder() + .appendOptional(DateTimeFormatter.ISO_DATE_TIME) + .appendOptional(DateTimeFormatter.ISO_OFFSET_DATE_TIME) + .appendOptional(DateTimeFormatter.ISO_INSTANT) + .appendOptional(DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SX")) + .appendOptional(DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ssX")) + .appendOptional(DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss")) + .toFormatter() + .withZone(ZoneOffset.UTC); + + public static OffsetDateTime parseDateTimeString(String str) { + return ZonedDateTime.from(Converter.DATE_TIME_FORMATTER.parse(str)).toOffsetDateTime(); + } + + private static final DateTimeFormatter TIME_FORMATTER = new DateTimeFormatterBuilder() + .appendOptional(DateTimeFormatter.ISO_TIME) + .appendOptional(DateTimeFormatter.ISO_OFFSET_TIME) + .parseDefaulting(ChronoField.YEAR, 2020) + .parseDefaulting(ChronoField.MONTH_OF_YEAR, 1) + .parseDefaulting(ChronoField.DAY_OF_MONTH, 1) + .toFormatter() + .withZone(ZoneOffset.UTC); + + public static OffsetTime parseTimeString(String str) { + return ZonedDateTime.from(Converter.TIME_FORMATTER.parse(str)).toOffsetDateTime().toOffsetTime(); + } + // Serialize/deserialize helpers + + public static AppSecrets fromJsonString(String json) throws IOException { + return getObjectReader().readValue(json); + } + + public static String toJsonString(AppSecrets obj) throws JsonProcessingException { + return getObjectWriter().writeValueAsString(obj); + } + + private static ObjectReader reader; + private static ObjectWriter writer; + + private static void instantiateMapper() { + ObjectMapper mapper = new ObjectMapper(); + mapper.findAndRegisterModules(); + mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false); + mapper.configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, false); + SimpleModule module = new SimpleModule(); + module.addDeserializer(OffsetDateTime.class, new JsonDeserializer() { + @Override + public OffsetDateTime deserialize(JsonParser jsonParser, DeserializationContext deserializationContext) throws IOException, JsonProcessingException { + String value = jsonParser.getText(); + return Converter.parseDateTimeString(value); + } + }); + mapper.registerModule(module); + reader = mapper.readerFor(AppSecrets.class); + writer = mapper.writerFor(AppSecrets.class); + } + + private static ObjectReader getObjectReader() { + if (reader == null) instantiateMapper(); + return reader; + } + + private static ObjectWriter getObjectWriter() { + if (writer == null) instantiateMapper(); + return writer; + } +} diff --git a/secretspec-jvm/examples/typed_access/TypedAccess.java b/secretspec-jvm/examples/typed_access/TypedAccess.java new file mode 100644 index 00000000..f1dbe69c --- /dev/null +++ b/secretspec-jvm/examples/typed_access/TypedAccess.java @@ -0,0 +1,12 @@ +import org.cachix.secretspec.SecretSpec; +import io.quicktype.Converter; + +public class TypedAccess { + + public static void main() { + try(var resolved = SecretSpec.builder().load()) { + AppSecrets typed = Converter.fromJsonString(resolved.fieldsJson()); + System.out.println(typed.getDatabaseURL()); + } + } +} diff --git a/secretspec-jvm/gradle.properties b/secretspec-jvm/gradle.properties new file mode 100644 index 00000000..6486bba4 --- /dev/null +++ b/secretspec-jvm/gradle.properties @@ -0,0 +1,4 @@ +org.gradle.java.installations.auto-detect=true +org.gradle.java.installations.auto-download=false +org.gradle.java.installations.fromEnv=SECRETSPEC_JVM_TARGET_JDK +secretspec.version=0.0.0-SNAPSHOT diff --git a/secretspec-jvm/settings.gradle.kts b/secretspec-jvm/settings.gradle.kts new file mode 100644 index 00000000..dd4de839 --- /dev/null +++ b/secretspec-jvm/settings.gradle.kts @@ -0,0 +1 @@ +rootProject.name = "secretspec-jvm" diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/JsonContracts.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/JsonContracts.java new file mode 100644 index 00000000..2dd755bf --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/JsonContracts.java @@ -0,0 +1,412 @@ +package org.cachix.secretspec; + +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.core.type.TypeReference; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.fasterxml.jackson.databind.json.JsonMapper; +import java.util.Map; +import java.util.Objects; +import java.util.List; + + +final class JsonContracts { + + static final int RESOLVE_SCHEMA_VERSION = 2; + static final int REPORT_SCHEMA_VERSION = 1; + + private JsonContracts() { + // No instances + } +} + +final class SecretSpecJsonContext { + + public static final ObjectMapper MAPPER = JsonMapper.builder() + .defaultPropertyInclusion(JsonInclude.Value.construct(JsonInclude.Include.NON_NULL, JsonInclude.Include.USE_DEFAULTS)) + .build(); + + public static final TypeReference> RESOLVE_ENVELOPE = + new TypeReference<>() {}; + + public static final TypeReference> REPORT_ENVELOPE = + new TypeReference<>() {}; + + public static final TypeReference> SECRET_FIELDS = + new TypeReference<>() {}; + + private SecretSpecJsonContext() { + // No instances. + } +} + +final class ResolveRequest { + + @JsonProperty("path") + private String path; + + @JsonProperty("provider") + private String provider; + + @JsonProperty("profile") + private String profile; + + @JsonProperty("scope") + private String scope; + + @JsonProperty("reason") + private String reason; + + @JsonProperty("no_values") + private boolean noValues; + + @JsonProperty("mode") + private String mode; + + public ResolveRequest() { + } + + public ResolveRequest(ResolveRequest request) { + this.path = request.path; + this.provider = request.provider; + this.profile = request.profile; + this.scope = request.scope; + this.reason = request.reason; + this.noValues = request.noValues; + this.mode = request.mode; + } + + public String getPath() { + return path; + } + + public void setPath(String path) { + this.path = path; + } + + public String getProvider() { + return provider; + } + + public void setProvider(String provider) { + this.provider = provider; + } + + public String getProfile() { + return profile; + } + + public void setProfile(String profile) { + this.profile = profile; + } + + public String getScope() { + return scope; + } + + public void setScope(String scope) { + this.scope = scope; + } + + public String getReason() { + return reason; + } + + public void setReason(String reason) { + this.reason = reason; + } + + public boolean isNoValues() { + return noValues; + } + + public void setNoValues(boolean noValues) { + this.noValues = noValues; + } + + public String getMode() { + return mode; + } + + public void setMode(String mode) { + this.mode = mode; + } + + @Override + public int hashCode() { + return Objects.hash( + path, + provider, + profile, + scope, + reason, + noValues, + mode + ); + } + + @Override + public boolean equals(Object o) { + if (this == o) + return true; + if (o == null) + return false; + if (getClass() != o.getClass()) + return false; + var other = (ResolveRequest) o; + return Objects.equals(path, other.path) + && Objects.equals(provider, other.provider) + && Objects.equals(profile, other.profile) + && Objects.equals(scope, other.scope) + && Objects.equals(reason, other.reason) + && noValues == other.noValues + && Objects.equals(mode, other.mode); + } +} + +final class Envelope { + + @JsonProperty("ok") + private boolean ok; + + @JsonProperty("response") + private T response; + + @JsonProperty("error") + private ErrorContract error; + + public Envelope() { + } + + public boolean isOk() { + return ok; + } + + public T getResponse() { + return response; + } + + public ErrorContract getError() { + return error; + } + + @Override + public int hashCode() { + return Objects.hash( + ok, + response, + error + ); + } + + @Override + public boolean equals(Object o) { + if (this == o) + return true; + if (o == null) + return false; + if (getClass() != o.getClass()) + return false; + @SuppressWarnings("unchecked") + var other = (Envelope) o; + return Objects.equals(ok, other.ok) + && Objects.equals(response, other.response) + && Objects.equals(error, other.error); + } + +} + +final class ErrorContract { + + @JsonProperty("kind") + private String kind; + + @JsonProperty("message") + private String message; + + public ErrorContract() { + } + + public String getKind() { + return kind; + } + + public String getMessage() { + return message; + } + + @Override + public int hashCode() { + return Objects.hash( + kind, + message + ); + } + + @Override + public boolean equals(Object o) { + if (this == o) + return true; + if (o == null) + return false; + if (getClass() != o.getClass()) + return false; + var other = (ErrorContract) o; + return Objects.equals(kind, other.kind) + && Objects.equals(message, other.message); + } +} + +final class ResolveResponseContract { + + @JsonProperty("schema_version") + private int schemaVersion; + + @JsonProperty("provider") + private String provider; + + @JsonProperty("profile") + private String profile; + + @JsonProperty("scope") + private String scope; + + @JsonProperty("secrets") + private Map secrets; + + @JsonProperty("missing_required") + private List missingRequired; + + @JsonProperty("missing_optional") + private List missingOptional; + + public ResolveResponseContract() { + } + + public int getSchemaVersion() { + return schemaVersion; + } + + public String getProvider() { + return provider; + } + + public String getProfile() { + return profile; + } + + public String getScope() { + return scope; + } + + public Map getSecrets() { + return secrets; + } + + public List getMissingRequired() { + return missingRequired; + } + + public List getMissingOptional() { + return missingOptional; + } + + @Override + public int hashCode() { + return Objects.hash( + schemaVersion, + provider, + profile, + scope, + secrets, + missingRequired, + missingOptional + ); + } + + @Override + public boolean equals(Object o) { + if (this == o) + return true; + if (o == null) + return false; + if (getClass() != o.getClass()) + return false; + var other = (ResolveResponseContract) o; + return Objects.equals(schemaVersion, other.schemaVersion) + && Objects.equals(provider, other.provider) + && Objects.equals(profile, other.profile) + && Objects.equals(scope, other.scope) + && Objects.equals(secrets, other.secrets) + && Objects.equals(missingRequired, other.missingRequired) + && Objects.equals(missingOptional, other.missingOptional); + } +} + +final class ReportResponseContract { + + @JsonProperty("schema_version") + private int schemaVersion; + + @JsonProperty("provider") + private String provider; + + @JsonProperty("profile") + private String profile; + + @JsonProperty("scope") + private String scope; + + @JsonProperty("secrets") + private List secrets; + + public ReportResponseContract() { + } + + public int getSchemaVersion() { + return schemaVersion; + } + + public String getProvider() { + return provider; + } + + public String getProfile() { + return profile; + } + + public String getScope() { + return scope; + } + + public List getSecrets() { + return secrets; + } + + @Override + public int hashCode() { + return Objects.hash( + schemaVersion, + provider, + profile, + scope, + secrets + ); + } + + @Override + public boolean equals(Object o) { + if (this == o) + return true; + if (o == null) + return false; + if (getClass() != o.getClass()) + return false; + var other = (ReportResponseContract) o; + return Objects.equals(schemaVersion, other.schemaVersion) + && Objects.equals(provider, other.provider) + && Objects.equals(profile, other.profile) + && Objects.equals(scope, other.scope) + && Objects.equals(secrets, other.secrets); + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/MissingRequiredException.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/MissingRequiredException.java new file mode 100644 index 00000000..257250e3 --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/MissingRequiredException.java @@ -0,0 +1,32 @@ +package org.cachix.secretspec; + +import static java.util.stream.Collectors.toUnmodifiableList; + +import java.util.List; +import java.util.stream.StreamSupport; + + +/** + * Required secrets that could not be resolved. + */ +public final class MissingRequiredException extends SecretSpecException { + + MissingRequiredException(Iterable missing) { + super("missing_required", buildMessage(missing)); + var missingStream = StreamSupport.stream(missing.spliterator(), false); + this.missing = missingStream.collect(toUnmodifiableList()); + } + + /** + * The unresolved required secret names. + */ + private final List missing; + + public List getMissing() { + return missing; + } + + private static String buildMessage(Iterable missing) { + return "missing required secret(s): " + String.join(", ", missing); + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/Native.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/Native.java new file mode 100644 index 00000000..1956e68e --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/Native.java @@ -0,0 +1,198 @@ +package org.cachix.secretspec; + +import com.sun.jna.Library; +import com.sun.jna.Pointer; + +import java.io.BufferedReader; +import java.io.File; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.Locale; + + +final class Native { + + private static final String LIBRARY_NAME = "secretspec_ffi"; + private static final String MUSL_LIBRARY_NAME = "secretspec_musl_ffi"; + private static final SecretSpecFFI BINDINGS; + + interface SecretSpecFFI extends Library { + Pointer secretspec_resolve(String requestJson); + void secretspec_free(Pointer pointer); + Pointer secretspec_abi_version(); + } + + static { + try { + String libPath = findLibraryPath(); + if (libPath != null) { + BINDINGS = com.sun.jna.Native.load(libPath, SecretSpecFFI.class); + } else if (shouldUseMusl()) { + /* + * JNA does not distinguish between musl and glibc. + * To ship two binaries targeting the same linux-arch in the Jar we must rename one of them. + * We rename the musl library. + */ + BINDINGS = com.sun.jna.Native.load(MUSL_LIBRARY_NAME, SecretSpecFFI.class); + } else { + BINDINGS = com.sun.jna.Native.load(LIBRARY_NAME, SecretSpecFFI.class); + } + } catch (UnsatisfiedLinkError error) { + throw new SecretSpecException("load", error.getMessage(), error); + } + } + + private Native() { + // No instances. + } + + static String resolve(String requestJson) { + Pointer responsePtr = Pointer.NULL; + try { + responsePtr = BINDINGS.secretspec_resolve(requestJson); + if (responsePtr == Pointer.NULL) { + throw new SecretSpecException("ffi", "secretspec_resolve returned null"); + } + + String result = responsePtr.getString(0, "UTF-8"); + if (result == null) { + throw new SecretSpecException("ffi", "secretspec_resolve returned invalid UTF-8"); + } + return result; + } catch (UnsatisfiedLinkError error) { + throw new SecretSpecException("load", error.getMessage(), error); + } finally { + if (responsePtr != Pointer.NULL) { + BINDINGS.secretspec_free(responsePtr); + } + } + } + + static String abiVersion() { + try { + Pointer pointer = BINDINGS.secretspec_abi_version(); + if (pointer == Pointer.NULL) { + throw new SecretSpecException("ffi", "secretspec_abi_version returned null"); + } + String version = pointer.getString(0, "UTF-8"); + if (version == null) { + throw new SecretSpecException("ffi", "secretspec_abi_version returned null"); + } + return version; + } catch (UnsatisfiedLinkError error) { + throw new SecretSpecException("load", error.getMessage(), error); + } + } + + private static String findLibraryPath() { + String explicitPath = System.getenv("SECRETSPEC_FFI_LIB"); + if (explicitPath != null && !explicitPath.trim().isEmpty()) { + return explicitPath; + } + + String os = System.getProperty("os.name").toLowerCase(); + String fileName; + if (os.contains("win")) { + fileName = "secretspec_ffi.dll"; + } else if (os.contains("mac")) { + fileName = "libsecretspec_ffi.dylib"; + } else { + fileName = "libsecretspec_ffi.so"; + } + + String[] starts = new String[]{ + System.getProperty("user.dir"), + Native.class.getProtectionDomain().getCodeSource() != null && + Native.class.getProtectionDomain().getCodeSource().getLocation() != null + ? new File(Native.class.getProtectionDomain().getCodeSource().getLocation().getPath()).getParent() + : null + }; + + for (String start : starts) { + if (start == null) continue; + + File directory = new File(start); + while (directory != null) { + String newest = null; + long newestTime = Long.MIN_VALUE; + + for (String profile : new String[]{"release", "debug"}) { + File candidate = new File(directory, "target" + File.separator + profile + File.separator + fileName); + if (candidate.exists() && candidate.lastModified() >= newestTime) { + newest = candidate.getAbsolutePath(); + newestTime = candidate.lastModified(); + } + } + + if (newest != null) { + return newest; + } + + directory = directory.getParentFile(); + } + } + + return null; + } + + private static boolean shouldUseMusl() { + String os = System.getProperty("os.name").toLowerCase(Locale.ROOT); + if (!os.contains("linux")) { + return false; + } + + // Try running ldd + try { + ProcessBuilder pb = new ProcessBuilder("ldd", "--version"); + Process process = pb.start(); + + InputStream[] inputStreams = { + process.getInputStream(), + process.getErrorStream(), + }; + for (var inputStream : inputStreams) { + try ( + var reader = new BufferedReader(new InputStreamReader(inputStream)); + var lines = reader.lines(); + ) { + var found = lines + .map(line -> line.toLowerCase(Locale.ROOT)) + .anyMatch(line -> line.contains("musl")); + if (found) { + return true; + } + } + } + } catch (IOException ignored) { + } + + // Try finding musl-specific files + Path[] searchDirectories = { + Path.of("/lib"), + Path.of("/usr/lib"), + Path.of("/lib64"), + Path.of("/usr/lib64") + }; + for (Path candidate : searchDirectories) { + if (Files.exists(candidate) && Files.isDirectory(candidate)) { + try (var directoryContents = Files.list(candidate)) { + boolean found = directoryContents + .map(Path::getFileName) + .map(Path::toString) + .anyMatch( + name -> name.startsWith("ld-musl-") + && name.endsWith(".so.1") + ); + if (found) { + return true; + } + } catch (IOException ignored) { + } + } + } + return false; + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/ResolutionReport.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/ResolutionReport.java new file mode 100644 index 00000000..2d0c6363 --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/ResolutionReport.java @@ -0,0 +1,73 @@ +package org.cachix.secretspec; + +import java.util.Collection; +import java.util.List; +import java.util.Objects; + + +/** + * A value-free inventory/preflight snapshot. + */ +public final class ResolutionReport { + + ResolutionReport( + String provider, + String profile, + String scope, + Collection secrets + ) { + this.provider = provider; + this.profile = profile; + this.scope = scope; + this.secrets = List.copyOf(secrets); + } + + private final String provider; + private final String profile; + /** + * Selected manifest scope, or null for a full-profile report (0.17+). + */ + private final String scope; + private final List secrets; + + public String getProvider() { + return provider; + } + + public String getProfile() { + return profile; + } + + public String getScope() { + return scope; + } + + public List getSecrets() { + return secrets; + } + + @Override + public int hashCode() { + return Objects.hash( + provider, + profile, + scope, + secrets + ); + } + + @Override + public boolean equals(Object o) { + if (this == o) + return true; + if (o == null) + return false; + if (getClass() != o.getClass()) + return false; + var other = (ResolutionReport) o; + return Objects.equals(provider, other.provider) + && Objects.equals(profile, other.profile) + && Objects.equals(scope, other.scope) + && Objects.equals(secrets, other.secrets); + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/Resolved.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/Resolved.java new file mode 100644 index 00000000..c01c1a81 --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/Resolved.java @@ -0,0 +1,134 @@ +package org.cachix.secretspec; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.ObjectMapper; + +import java.util.List; +import java.util.Map; +import java.util.Optional; +import java.io.IOException; +import java.io.UncheckedIOException; +import java.nio.file.Files; +import java.nio.file.Paths; +import java.util.Collection; +import java.util.HashMap; + +import static java.util.Collections.unmodifiableMap; + + +/** + * A successful, value-carrying resolution. + */ +public final class Resolved implements AutoCloseable { + + private static final ObjectMapper MAPPER = new ObjectMapper(); + + private boolean disposed; + + Resolved( + String provider, + String profile, + String scope, + Map secrets, + Collection missingOptional + ) { + this.provider = provider; + this.profile = profile; + this.scope = scope; + this.secrets = Map.copyOf(secrets); + this.missingOptional = List.copyOf(missingOptional); + } + + private final String provider; + private final String profile; + /** + * Selected manifest scope, or null for a full-profile resolve (0.17+). + */ + private final String scope; + private final Map secrets; + private final List missingOptional; + + public String getProvider() { + return provider; + } + + public String getProfile() { + return profile; + } + + public String getScope() { + return scope; + } + + public Map getSecrets() { + return secrets; + } + + public List getMissingOptional() { + return missingOptional; + } + + /** + * Exports every present secret into the system properties. + */ + public void setAsSystemProperties() { + for (var entry : secrets.entrySet()) { + var name = entry.getKey(); + var secret = entry.getValue(); + var value = secret.get(); + if (value != null) + System.setProperty(name, value); + } + } + + /** + * Returns a flat secret-name-to-value map suitable for a generated typed + * deserializer. File-shaped secrets map to their paths; stripped values map to null. + */ + public Map fields() { + var fields = new HashMap(); + for (var key: secrets.keySet()) { + var secret = Optional.ofNullable(secrets.get(key)); + fields.put(key, secret.map(ResolvedSecret::get).orElse(null)); + } + return unmodifiableMap(fields); + } + + /** + * Serializes {@link #fields()} for a generated deserializer. + */ + public String fieldsJson() { + try { + return MAPPER.writeValueAsString(fields()); + } catch (JsonProcessingException e) { + throw new RuntimeException("Failed to serialize fields to JSON", e); + } + } + + /** + * Removes temporary files backing {@code as_path} secrets. + */ + public void close() { + if (disposed) + return; + + disposed = true; + UncheckedIOException firstError = null; + for (var secret : secrets.values()) { + if (!secret.isAsPath() || secret.getPath() == null) + continue; + + try { + var path = Paths.get(secret.getPath()); + Files.delete(path); + } + catch (IOException e) { + if (firstError == null) + firstError = new UncheckedIOException(e); + } + } + + if (firstError != null) + throw firstError; + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/ResolvedSecret.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/ResolvedSecret.java new file mode 100644 index 00000000..a94dd23c --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/ResolvedSecret.java @@ -0,0 +1,91 @@ +package org.cachix.secretspec; + +import java.util.Objects; + +import com.fasterxml.jackson.annotation.JsonProperty; + + +/** + * One resolved secret and its provenance. + */ +public final class ResolvedSecret { + + /** + * The inline value, or null for an as_path secret. + */ + @JsonProperty("value") + private String value; + + /** + * The materialized file path, or null for an inline secret. + */ + @JsonProperty("path") + private String path; + + @JsonProperty("as_path") + private boolean asPath; + + @JsonProperty("source") + private String source = ""; + + @JsonProperty("source_provider") + private String sourceProvider; + + /** Returns the usable string: the file path for an {@code as_path} secret, + * otherwise its inline value. A value-less resolution returns null. + */ + public String get() { + return asPath ? path : value; + } + + public ResolvedSecret() { + } + + public String getValue() { + return value; + } + + public String getPath() { + return path; + } + + public boolean isAsPath() { + return asPath; + } + + public String getSource() { + return source; + } + + public String getSourceProvider() { + return sourceProvider; + } + + + @Override + public int hashCode() { + return Objects.hash( + value, + path, + asPath, + source, + sourceProvider + ); + } + + @Override + public boolean equals(Object o) { + if (this == o) + return true; + if (o == null) + return false; + if (getClass() != o.getClass()) + return false; + var other = (ResolvedSecret) o; + return Objects.equals(value, other.value) + && Objects.equals(path, other.path) + && asPath == other.asPath + && Objects.equals(source, other.source) + && Objects.equals(sourceProvider, other.sourceProvider); + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretReport.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretReport.java new file mode 100644 index 00000000..5dfb81a9 --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretReport.java @@ -0,0 +1,95 @@ +package org.cachix.secretspec; + +import java.util.Objects; + +import com.fasterxml.jackson.annotation.JsonProperty; + + +/** + * The value-free resolution outcome for one declared secret. + */ +public final class SecretReport { + + @JsonProperty("name") + private String name = ""; + + @JsonProperty("status") + private String status = ""; + + @JsonProperty("required") + private boolean required; + + @JsonProperty("source_provider") + private String sourceProvider; + + @JsonProperty("default_applied") + private boolean defaultApplied; + + @JsonProperty("generated") + private boolean generated; + + @JsonProperty("as_path") + private boolean asPath; + + public SecretReport() { + } + + public String getName() { + return name; + } + + public String getStatus() { + return status; + } + + public boolean isRequired() { + return required; + } + + public String getSourceProvider() { + return sourceProvider; + } + + public boolean isDefaultApplied() { + return defaultApplied; + } + + public boolean isGenerated() { + return generated; + } + + public boolean isAsPath() { + return asPath; + } + + @Override + public int hashCode() { + return Objects.hash( + name, + status, + required, + sourceProvider, + defaultApplied, + generated, + asPath + ); + } + + @Override + public boolean equals(Object o) { + if (this == o) + return true; + if (o == null) + return false; + if (getClass() != o.getClass()) + return false; + var other = (SecretReport) o; + return Objects.equals(name, other.name) + && Objects.equals(status, other.status) + && required == other.required + && Objects.equals(sourceProvider, other.sourceProvider) + && defaultApplied == other.defaultApplied + && generated == other.generated + && asPath == other.asPath; + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpec.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpec.java new file mode 100644 index 00000000..3c1d05df --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpec.java @@ -0,0 +1,24 @@ +package org.cachix.secretspec; + + +/** + * Entry point for the SecretSpec JVM SDK. + */ +public class SecretSpec { + + /** + * Starts a fluent resolution builder. + */ + public static SecretSpecBuilder builder() { + return new SecretSpecBuilder(); + } + + /** + * The ABI version reported by the loaded native resolver. + */ + public static String abiVersion() { return Native.abiVersion(); }; + + private SecretSpec() { + // No instances. + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java new file mode 100644 index 00000000..a0619823 --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java @@ -0,0 +1,163 @@ +package org.cachix.secretspec; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.core.type.TypeReference; +import com.fasterxml.jackson.databind.ObjectMapper; + +/** + * Configures a SecretSpec resolution. + */ +public final class SecretSpecBuilder { + + private static final ObjectMapper MAPPER = SecretSpecJsonContext.MAPPER; + + private final ResolveRequest request = new ResolveRequest(); + + public SecretSpecBuilder withPath(String path) { + this.request.setPath(path); + return this; + } + + public SecretSpecBuilder withProvider(String provider) { + this.request.setProvider(provider); + return this; + } + + public SecretSpecBuilder withProfile(String profile) { + this.request.setProfile(profile); + return this; + } + + /** + * Limits resolution to a named manifest scope (SecretSpec 0.17+). + */ + public SecretSpecBuilder withScope(String scope) { + this.request.setScope(scope); + return this; + } + + public SecretSpecBuilder withReason(String reason) { + this.request.setReason(reason); + return this; + } + + public SecretSpecBuilder withNoValues(boolean noValues) { + this.request.setNoValues(noValues); + return this; + } + + public SecretSpecBuilder withNoValues() { + return withNoValues(true); + } + + /** + * Resolves the configured secrets. + * + * @return a {@link Resolved} instance with the secrets loaded + * @throws MissingRequiredException if a required secret was missing + * @throws SecretSpecException if resolution otherwise failed + */ + public Resolved load() { + ResolveResponseContract response = call( + this.request, + "resolve", + SecretSpecJsonContext.RESOLVE_ENVELOPE + ); + + ensureSchemaVersion(response.getSchemaVersion(), JsonContracts.RESOLVE_SCHEMA_VERSION, "resolve"); + + if (response.getMissingRequired() != null && !response.getMissingRequired().isEmpty()) { + throw new MissingRequiredException(response.getMissingRequired()); + } + + return new Resolved( + response.getProvider(), + response.getProfile(), + response.getScope(), + response.getSecrets(), + response.getMissingOptional() + ); + } + + /** + * Resolves a value-free inventory/preflight report. Missing required + * secrets appear in the report rather than throwing. + * + * @return a {@link ResolutionReport} instance + */ + public ResolutionReport report() { + ResolveRequest reportRequest = new ResolveRequest(request); + reportRequest.setMode("report"); + + var response = call( + reportRequest, + "report", + SecretSpecJsonContext.REPORT_ENVELOPE + ); + + ensureSchemaVersion(response.getSchemaVersion(), JsonContracts.REPORT_SCHEMA_VERSION, "report"); + + return new ResolutionReport( + response.getProvider(), + response.getProfile(), + response.getScope(), + response.getSecrets() + ); + } + + private static T call( + ResolveRequest request, + String kind, + TypeReference> typeReference) { + + String payload; + try { + payload = MAPPER.writeValueAsString(request); + } catch (JsonProcessingException e) { + throw new SecretSpecException("serialize", "Failed to serialize request: " + e.getMessage(), e); + } + + String raw = Native.resolve(payload); + + Envelope envelope; + try { + envelope = MAPPER.readValue(raw, typeReference); + } catch (JsonProcessingException error) { + throw new SecretSpecException("parse", error.getMessage(), error); + } + + if (envelope == null) { + throw new SecretSpecException("parse", "native resolver returned an empty response"); + } + + if (!envelope.isOk()) { + String errorKind = (envelope.getError() != null && envelope.getError().getKind() != null) + ? envelope.getError().getKind() + : "unknown"; + String errorMessage = (envelope.getError() != null && envelope.getError().getMessage() != null) + ? envelope.getError().getMessage() + : "native resolver returned an unspecified error"; + + throw new SecretSpecException(errorKind, errorMessage); + } + + if (envelope.getResponse() == null) { + throw new SecretSpecException( + "ffi", + String.format("secretspec_resolve reported ok with no %s response", kind) + ); + } + + return envelope.getResponse(); + } + + private static void ensureSchemaVersion(int actual, int expected, String kind) { + if (actual != expected) { + throw new SecretSpecException( + "version", + String.format("unsupported %s schema version %d (expected %d); " + + "the secretspec-ffi library and this SDK are out of sync", kind, actual, expected) + ); + } + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecException.java b/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecException.java new file mode 100644 index 00000000..5ba59ae6 --- /dev/null +++ b/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecException.java @@ -0,0 +1,27 @@ +package org.cachix.secretspec; + + +/** + * A manifest, provider, policy, native-loading, or wire-format failure. + */ +public class SecretSpecException extends RuntimeException { + + public SecretSpecException(String kind, String message) { + super(message + " (kind: " + kind + ")"); + this.kind = kind; + } + + public SecretSpecException(String kind, String message, Throwable cause) { + super(message + " (kind: " + kind + ")", cause); + this.kind = kind; + } + + /** + * A stable machine-readable error category. + */ + private final String kind; + + public String getKind() { + return kind; + } +} diff --git a/secretspec-jvm/src/test/java/org/cachix/secretspec/NativeTest.java b/secretspec-jvm/src/test/java/org/cachix/secretspec/NativeTest.java new file mode 100644 index 00000000..67e2b5c2 --- /dev/null +++ b/secretspec-jvm/src/test/java/org/cachix/secretspec/NativeTest.java @@ -0,0 +1,16 @@ +package org.cachix.secretspec; + +import org.junit.jupiter.api.Test; +import static org.junit.jupiter.api.Assertions.*; + + +class NativeTest { + + @Test + void abi_version_should_be_defined() { + String version = Native.abiVersion(); + + assertNotNull(version); + assertFalse(version.isBlank()); + } +} diff --git a/secretspec-jvm/src/test/java/org/cachix/secretspec/SecretSpecTest.java b/secretspec-jvm/src/test/java/org/cachix/secretspec/SecretSpecTest.java new file mode 100644 index 00000000..c4fdf0f2 --- /dev/null +++ b/secretspec-jvm/src/test/java/org/cachix/secretspec/SecretSpecTest.java @@ -0,0 +1,383 @@ +package org.cachix.secretspec; +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.fasterxml.jackson.databind.node.ArrayNode; +import com.fasterxml.jackson.databind.node.ObjectNode; + +import java.io.File; +import java.io.IOException; +import java.io.UncheckedIOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.Comparator; +import java.util.List; +import java.util.Map; +import java.util.Objects; +import java.util.UUID; +import java.util.stream.Collectors; +import java.util.stream.Stream; + +import org.junit.jupiter.api.Test; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.catchThrowableOfType; + + +class SecretSpecTest { + + private static final ObjectMapper MAPPER = new ObjectMapper(); + + private static final String MANIFEST = + "[project]\n" + + "name = \"java-test\"\n" + + "revision = \"1.0\"\n" + + "\n" + + "[profiles.default]\n" + + "DATABASE_URL = { description = \"DB\", required = true }\n" + + "DEV_SESSION_SECRET = { description = \"Development-only session secret\", required = false, default = \"development-only-secret\" }\n" + + "SENTRY_DSN = { description = \"sentry\", required = false }\n" + + "\n" + + "[scopes.database]\n" + + "secrets = [\"DATABASE_URL\"]\n"; + + @Test + void testAbiVersion() { + assertThat(SecretSpec.abiVersion()) + .withFailMessage("ABI version was empty") + .isNotBlank(); + } + + @Test + void testLoad() { + try (Project project = Project.create(MANIFEST, "DATABASE_URL=postgres://db\n"); + Resolved resolved = project.builder().load()) { + + assertThat(resolved.getProfile()).isEqualTo("default"); + assertThat(resolved.getSecrets().get("DATABASE_URL").get()).isEqualTo("postgres://db"); + assertThat(resolved.getSecrets().get("DATABASE_URL").getSource()).isEqualTo("provider"); + assertThat(resolved.getSecrets().get("DATABASE_URL").getSourceProvider()).withFailMessage("provider provenance missing").isNotNull(); + assertThat(resolved.getSecrets().get("DEV_SESSION_SECRET").get()).isEqualTo("development-only-secret"); + assertThat(resolved.getSecrets().get("DEV_SESSION_SECRET").getSource()).isEqualTo("default"); + assertThat(resolved.getMissingOptional()).isEqualTo(List.of("SENTRY_DSN")); + assertThat(resolved.getSecrets()).withFailMessage("missing optional secret was returned").doesNotContainKey("SENTRY_DSN"); + + JsonNode fields = readJson(resolved.fieldsJson()); + assertThat(fields.get("DATABASE_URL").asText()).isEqualTo("postgres://db"); + } + } + + @Test + void testScope() { + try (Project project = Project.create( + MANIFEST, + "DATABASE_URL=postgres://db\nSENTRY_DSN=https://sentry\n")) { + + SecretSpecBuilder builder = project.builder().withScope("database"); + + try (Resolved resolved = builder.load()) { + assertThat(resolved.getScope()).isEqualTo("database"); + assertThat(resolved.getSecrets().keySet()).containsExactly("DATABASE_URL"); + } + + ResolutionReport report = builder.report(); + assertThat(report.getScope()).isEqualTo("database"); + List reportNames = report.getSecrets().stream() + .map(SecretReport::getName) + .collect(Collectors.toList()); + assertThat(reportNames).containsExactly("DATABASE_URL"); + } + } + + @Test + void testMissingRequired() { + try (Project project = Project.create(MANIFEST, "")) { + MissingRequiredException error = catchThrowableOfType(MissingRequiredException.class, () -> project.builder().load()); + assertThat(error.getMissing()).containsExactly("DATABASE_URL"); + assertThat(error.getKind()).isEqualTo("missing_required"); + } + } + + @Test + void testInvalidManifest() { + Path invalidPath = Path.of(System.getProperty("java.io.tmpdir"), UUID.randomUUID().toString(), "secretspec.toml"); + SecretSpecException error = catchThrowableOfType(SecretSpecException.class, () -> + SecretSpec.builder() + .withPath(invalidPath.toString()) + .withReason("Java test") + .load() + ); + + assertThat(error.getClass()).withFailMessage("transport failure became missing-required") + .isNotEqualTo(MissingRequiredException.class); + assertThat(error.getKind()).withFailMessage("error kind was empty") + .isNotNull() + .isNotBlank(); + } + + @Test + void testAsPathCleanup() { + String manifest = + "[project]\n" + + "name = \"java-test\"\n" + + "revision = \"1.0\"\n" + + "\n" + + "[profiles.default]\n" + + "TLS_CERT = { description = \"cert\", required = true, as_path = true }\n"; + + String path; + try (Project project = Project.create(manifest, "TLS_CERT=----cert----\n")) { + try (Resolved resolved = project.builder().load()) { + ResolvedSecret cert = resolved.getSecrets().get("TLS_CERT"); + assertThat(cert.isAsPath()).withFailMessage("TLS_CERT was not marked as_path").isTrue(); + assertThat(cert.getValue()).withFailMessage("as_path secret exposed an inline value").isNull(); + + path = cert.get(); + assertThat(path).withFailMessage("as_path secret had no path").isNotNull(); + assertThat(readString(Path.of(path))).isEqualTo("----cert----"); + } + assertThat(Path.of(path)).withFailMessage("Dispose/close did not remove the secret temp file") + .doesNotExist(); + } + } + + @Test + void testReport() { + try (Project project = Project.create(MANIFEST, "")) { + ResolutionReport report = project.builder().report(); + + assertThat(report.getProfile()).isEqualTo("default"); + + SecretReport database = report.getSecrets().stream() + .filter(s -> "DATABASE_URL".equals(s.getName())) + .findFirst() + .orElseThrow(() -> new AssertionError("DATABASE_URL not found")); + assertThat(database.getStatus()).isEqualTo("missing_required"); + assertThat(database.isRequired()).withFailMessage("DATABASE_URL was not reported as required").isTrue(); + + SecretReport sessionSecret = report.getSecrets().stream() + .filter(s -> "DEV_SESSION_SECRET".equals(s.getName())) + .findFirst() + .orElseThrow(() -> new AssertionError("DEV_SESSION_SECRET not found")); + assertThat(sessionSecret.isDefaultApplied()).withFailMessage("DEV_SESSION_SECRET default was not reported").isTrue(); + } + } + + @Test + void testSetAsSystemProperties() { + var previous = System.getProperty("DATABASE_URL"); + try (Project project = Project.create(MANIFEST, "DATABASE_URL=postgres://environment\n")) { + try (Resolved resolved = project.builder().load()) { + resolved.setAsSystemProperties(); + assertThat(System.getProperty("DATABASE_URL")) + .isNotEqualTo(previous) + .isEqualTo("postgres://environment"); + } + finally { + if (previous != null) { + System.setProperty("DATABASE_URL", previous); + } + } + } + } + + @Test void testConformance() throws IOException { + Path root = findRepositoryRoot(); + Path fixtures = root.resolve("conformance").resolve("fixtures"); + + List directories; + try (Stream stream = Files.list(fixtures)) { + directories = stream.filter(Files::isDirectory) + .sorted(Comparator.comparing(Path::getFileName)) + .collect(Collectors.toList()); + } + + assertThat(directories.size()) + .withFailMessage("Error: No conformance tests found!") + .isGreaterThan(0); + + for (Path directory : directories) { + String manifest = directory.resolve("secretspec.toml").toString(); + String provider = "dotenv://" + directory.resolve(".env"); + + SecretSpecBuilder fixture = SecretSpec.builder() + .withPath(manifest) + .withProvider(provider) + .withReason("conformance"); + + try (Resolved resolved = fixture.load()) { + assertJsonEqual( + readString(directory.resolve("expected.json")), + MAPPER.writeValueAsString(canonicalResolved(resolved)) + ); + } + + try (Resolved noValues = fixture.withNoValues(true).load()) { + + System.out.println(noValues); + + assertJsonEqual( + readString(directory.resolve("expected_no_values.json")), + noValues.fieldsJson() + ); + } + + ResolutionReport report = fixture.report(); + assertJsonEqual( + readString(directory.resolve("expected_report.json")), + MAPPER.writeValueAsString(canonicalReport(report)) + ); + } + } + + private static ObjectNode canonicalResolved(Resolved resolved) { + ObjectNode secrets = MAPPER.createObjectNode(); + + for (Map.Entry entry : resolved.getSecrets().entrySet()) { + String name = entry.getKey(); + ResolvedSecret secret = entry.getValue(); + + String value = secret.isAsPath() + ? readString(Path.of(Objects.requireNonNull(secret.get(), name + " had no path"))) + : secret.getValue(); + + ObjectNode secretNode = MAPPER.createObjectNode(); + secretNode.put("value", value); + secretNode.put("source", secret.getSource()); + secretNode.put("as_path", secret.isAsPath()); + + secrets.set(name, secretNode); + } + + ObjectNode root = MAPPER.createObjectNode(); + root.put("profile", resolved.getProfile()); + root.set("secrets", secrets); + root.set("missing_required", MAPPER.createArrayNode()); + + ArrayNode missingOptional = MAPPER.createArrayNode(); + for (String item : resolved.getMissingOptional()) { + missingOptional.add(item); + } + root.set("missing_optional", missingOptional); + + return root; + } + + private static ObjectNode canonicalReport(ResolutionReport report) { + ObjectNode secrets = MAPPER.createObjectNode(); + + for (SecretReport secret : report.getSecrets()) { + ObjectNode node = MAPPER.createObjectNode(); + node.put("status", secret.getStatus()); + node.put("required", secret.isRequired()); + node.put("as_path", secret.isAsPath()); + node.put("generated", secret.isGenerated()); + node.put("default_applied", secret.isDefaultApplied()); + node.put("source_provider", secret.getSourceProvider() != null); + + secrets.set(secret.getName(), node); + } + + ObjectNode root = MAPPER.createObjectNode(); + root.put("profile", report.getProfile()); + root.set("secrets", secrets); + + return root; + } + + private static Path findRepositoryRoot() { + Path current = Path.of(System.getProperty("user.dir")).toAbsolutePath(); + while (current != null) { + if (Files.exists(current.resolve("Cargo.toml")) && Files.exists(current.resolve("conformance"))) { + return current; + } + current = current.getParent(); + } + throw new IllegalStateException("could not find the SecretSpec repository root"); + } + + private static void assertJsonEqual(String expected, String actual) { + JsonNode expectedNode = readJson(expected); + JsonNode actualNode = readJson(actual); + assertThat(actualNode) + .withFailMessage(String.format("JSON mismatch%nactual: %s%nexpected: %s", actual, expected)) + .isEqualTo(expectedNode); + } + + // Java 11 IO Compatibility + private static String readString(Path path) { + try { + return new String(Files.readAllBytes(path), StandardCharsets.UTF_8); + } + catch (IOException e) { + throw new UncheckedIOException(e); + } + } + + // Java 11 IO Compatibility + private static void writeString(Path path, String content) { + try { + Files.write(path, content.getBytes(StandardCharsets.UTF_8)); + } + catch (IOException e) { + throw new UncheckedIOException(e); + } + } + + private static JsonNode readJson(String text) { + try { + return MAPPER.readTree(text); + } + catch (IOException e) { + throw new UncheckedIOException(e); + } + } + + private static final class Project implements AutoCloseable { + private final Path root; + final String manifestPath; + final String provider; + + private Project(Path root) { + this.root = root; + this.manifestPath = root.resolve("secretspec.toml").toString(); + this.provider = "dotenv://" + root.resolve(".env"); + } + + SecretSpecBuilder builder() { + return SecretSpec.builder() + .withPath(manifestPath) + .withProvider(provider) + .withReason("Java test"); + } + + static Project create(String manifest, String dotenv) { + try { + Path tempDir = Files.createTempDirectory("secretspec-jvm-"); + Project project = new Project(tempDir); + writeString(Path.of(project.manifestPath), manifest); + writeString(tempDir.resolve(".env"), dotenv); + return project; + } + catch (IOException e) { + throw new UncheckedIOException(e); + } + } + + @Override + public void close() { + deleteDirectory(root.toFile()); + } + + private static void deleteDirectory(File dir) { + File[] files = dir.listFiles(); + if (files != null) { + for (File f : files) { + if (f.isDirectory()) deleteDirectory(f); + else f.delete(); + } + } + dir.delete(); + } + } +} From e0e637af737e384bf7d5eb45ad469bbc14e75339 Mon Sep 17 00:00:00 2001 From: Nicolas MOREAU Date: Fri, 14 Aug 2026 16:54:04 +0200 Subject: [PATCH 2/4] feat(sdk): secretspec-jvm Use gradle wrapper. Use gradle modules. Add a consumer test. Synchronize SDK version to a SNAPSHOT version. Use a naive publication mechanism in GitHub Actions. --- .gitattributes | 1 + .github/workflows/jvm-package.yml | 138 ++++++++-- .gitignore | 4 + conformance/README.md | 2 +- conformance/run.sh | 2 +- devenv.nix | 7 +- scripts/ci-sdks.sh | 2 +- scripts/sync-sdk-versions.sh | 2 +- secretspec-jvm/build.gradle.kts | 94 +------ secretspec-jvm/consumer/build.gradle.kts | 47 ++++ .../org/cachix/demo/SecretSpecFfiTest.java | 17 ++ secretspec-jvm/gradle.properties | 2 +- .../gradle/wrapper/gradle-wrapper.jar | Bin 0 -> 43764 bytes .../gradle/wrapper/gradle-wrapper.properties | 7 + secretspec-jvm/gradlew | 251 ++++++++++++++++++ secretspec-jvm/gradlew.bat | 94 +++++++ secretspec-jvm/library/build.gradle.kts | 47 ++++ .../org/cachix/secretspec/JsonContracts.java | 0 .../secretspec/MissingRequiredException.java | 0 .../java/org/cachix/secretspec/Native.java | 0 .../cachix/secretspec/ResolutionReport.java | 0 .../java/org/cachix/secretspec/Resolved.java | 0 .../org/cachix/secretspec/ResolvedSecret.java | 0 .../org/cachix/secretspec/SecretReport.java | 0 .../org/cachix/secretspec/SecretSpec.java | 0 .../cachix/secretspec/SecretSpecBuilder.java | 0 .../secretspec/SecretSpecException.java | 0 .../org/cachix/secretspec/NativeTest.java | 0 .../org/cachix/secretspec/SecretSpecTest.java | 0 secretspec-jvm/settings.gradle.kts | 3 + 30 files changed, 594 insertions(+), 126 deletions(-) create mode 100644 secretspec-jvm/consumer/build.gradle.kts create mode 100644 secretspec-jvm/consumer/src/test/java/org/cachix/demo/SecretSpecFfiTest.java create mode 100644 secretspec-jvm/gradle/wrapper/gradle-wrapper.jar create mode 100644 secretspec-jvm/gradle/wrapper/gradle-wrapper.properties create mode 100755 secretspec-jvm/gradlew create mode 100644 secretspec-jvm/gradlew.bat create mode 100644 secretspec-jvm/library/build.gradle.kts rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/JsonContracts.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/MissingRequiredException.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/Native.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/ResolutionReport.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/Resolved.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/ResolvedSecret.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/SecretReport.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/SecretSpec.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java (100%) rename secretspec-jvm/{ => library}/src/main/java/org/cachix/secretspec/SecretSpecException.java (100%) rename secretspec-jvm/{ => library}/src/test/java/org/cachix/secretspec/NativeTest.java (100%) rename secretspec-jvm/{ => library}/src/test/java/org/cachix/secretspec/SecretSpecTest.java (100%) diff --git a/.gitattributes b/.gitattributes index e9fba4c1..4fd5932b 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1 +1,2 @@ secretspec/src/provider/sops/test_fixtures/** text eol=lf +*.bat text eol=crlf \ No newline at end of file diff --git a/.github/workflows/jvm-package.yml b/.github/workflows/jvm-package.yml index cba6eca4..c02f7067 100644 --- a/.github/workflows/jvm-package.yml +++ b/.github/workflows/jvm-package.yml @@ -99,6 +99,12 @@ jobs: with: distribution: temurin java-version: "11" + set-default: false + - uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: "21" + set-default: true - name: Build native resolver shell: bash @@ -136,7 +142,7 @@ jobs: env: SECRETSPEC_FFI_LIB: ${{ github.workspace }}/target/${{ matrix.target }}/release/${{ matrix.library }} run: >- - cd secretspec-jvm && gradle test + cd secretspec-jvm && ./gradlew test --no-daemon - name: Stage native Jar asset shell: bash @@ -220,7 +226,7 @@ jobs: fi - name: Stage native Jar asset run: | - mkdir -p "staged/${{ matrix.rid }}/native" + mkdir -p "staged/${{ matrix.rid }}" # MUSL and GLIBC libraries must both reside in linux-x86-64 or linux-aarch64 # Rename the library so they can coexist in the same directory cp "target/${{ matrix.target }}/release/libsecretspec_ffi.so" \ @@ -244,6 +250,12 @@ jobs: with: distribution: temurin java-version: "11" + set-default: false + - uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: "21" + set-default: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: jvm-native-* @@ -254,18 +266,20 @@ jobs: for artifact in staged/jvm-native-*; do rid="${artifact##*/jvm-native-}" # MUSL and GLIBC libraries must both reside in linux-x86-64 or linux-aarch64, remove the suffix - mkdir -p "secretspec-jvm/src/main/resources/com/sun/jna/${rid%-musl}" - cp -R "$artifact/"* "secretspec-jvm/src/main/resources/com/sun/jna/${rid%-musl}/" + mkdir -p "secretspec-jvm/library/src/main/resources/com/sun/jna/${rid%-musl}" + cp -R "$artifact/"* "secretspec-jvm/library/src/main/resources/com/sun/jna/${rid%-musl}/" done - name: Pack - run: >- - cd secretspec-jvm && gradle assemble + run: | + cd secretspec-jvm && ./gradlew build --no-daemon + mkdir -p artifacts/ + cp library/build/libs/*.jar artifacts/ - name: Verify runtime assets are present shell: bash run: | # The staged directories come from the same matrix that builds the # native libraries, so this check cannot drift from the matrix. - package="$(find artifacts -name '*.jar' -print -quit)" + package="$(find artifacts -name '*.jar' -not -name '*-sources.jar' -not -name '*-javadoc.jar' -print -quit)" shopt -s nullglob staged=(staged/jvm-native-*) if [ "${#staged[@]}" -eq 0 ]; then @@ -329,19 +343,25 @@ jobs: - uses: actions/setup-java@v5 with: distribution: temurin - java-version: "11" + java-version: "21" + set-default: true - name: Run tests if: matrix.musl == false && runner.os != 'Windows' shell: bash run: | - echo TODO + package="$(find artifacts -name '*.jar' -not -name '*-sources.jar' -not -name '*-javadoc.jar' -print -quit)" + unset SECRETSPEC_FFI_LIB + cd secretspec-jvm && ./gradlew :consumer:test -PsecretspecJar=$package --no-daemon - name: Run tests on Windows if: runner.os == 'Windows' shell: pwsh run: | - echo TODO + $package = (Get-ChildItem -Path "artifacts" -Filter "*.jar" | Where-Object { $_.Name -notlike "*-sources.jar" -and $_.Name -notlike "*-javadoc.jar" } | Select-Object -First 1).FullName + Set-Location "secretspec-jvm" + Remove-Item Env:SECRETSPEC_FFI_LIB + .\gradlew.bat :consumer:test -PsecretspecJar="$package" --no-daemon - name: Run tests on Alpine if: matrix.musl @@ -349,11 +369,12 @@ jobs: run: | docker run --rm \ --volume "$GITHUB_WORKSPACE:/workspace" \ - --volume "$RUNNER_TEMP:/runner" \ - --workdir /runner \ - eclipse-temurin:11-jdk-alpine \ + --workdir /workspace \ + eclipse-temurin:21-jdk-alpine \ sh -c ' - echo TODO + package="$(find /workspace/artifacts -name '*.jar' -not -name '*-sources.jar' -not -name '*-javadoc.jar' -print -quit)" + unset SECRETSPEC_FFI_LIB + cd secretspec-jvm && ./gradlew :consumer:test -PsecretspecJar=$package --no-daemon ' publish: @@ -365,23 +386,84 @@ jobs: id-token: write # no long-lived key contents: read steps: - - uses: actions/setup-java@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - distribution: temurin - java-version: "11" - cache: gradle - server-id: central - server-username: MAVEN_CENTRAL_USERNAME - server-password: MAVEN_CENTRAL_PASSWORD + persist-credentials: false - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: jar-file path: artifacts - - name: Publish package + - name: Setup GPG Key + shell: bash env: - MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }} - MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} - GPG_SIGNING_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - run: >- - cd secretspec-jvm && gradle publishToMavenCentral --no-daemon + MAVEN_CENTRAL_SIGNING_KEY: ${{ secrets.MAVEN_CENTRAL_SIGNING_KEY }} + run: | + mkdir -p -m 700 ~/.gnupg + echo "$MAVEN_CENTRAL_SIGNING_KEY" | gpg --batch --import + # Ultimately trust the imported key + KEY_ID=$(gpg --with-colons --list-secret-keys | grep '^sec' | cut -d':' -f5) + echo "${KEY_ID}:6:" | gpg --import-ownertrust + - name: Prepare Maven Bundle Structure + shell: bash + env: + GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_SIGNING_PASSPHRASE }} + run: | + VERSION=$(grep 'secretspec.version' secretspec-jvm/gradle.properties | cut -d'=' -f2 | tr -d '[:space:]') + VERSION="${VERSION%-SNAPSHOT}" + BUNDLE_DIR="bundle-dir/org/cachix/secretspec-jvm/$VERSION" + mkdir -p "$BUNDLE_DIR" + cp artifacts/*.jar "$BUNDLE_DIR/" + cat < "$BUNDLE_DIR/secretspec-jvm-$VERSION.pom" + + 4.0.0 + org.cachix + secretspec-jvm + $VERSION + SecretSpec JVM SDK + JVM SDK for SecretSpec secret resolution + https://secretspec.dev + + + Apache License, Version 2.0 + https://www.apache.org/licenses/LICENSE-2.0.txt + + + + + cachix-oss + Cachix Team & Open-Source contributors + + + + https://github.com/cachix/secretspec + scm:git:github.com/cachix/secretspec.git + + + GitHub + https://github.com/cachix/secretspec/issues + + + GitHub Actions + https://github.com/cachix/secretspec/actions + + + EOF + cd bundle-dir + find . -type f \( -name "*.jar" -o -name "*.pom" \) -print0 | while IFS= read -r -d '' file; do + gpg --batch --yes --pinentry-mode loopback --passphrase-fd 3 -ab "$file" 3<<< "$GPG_PASSPHRASE" + done + zip -r ../maven-central-bundle.zip . + cd .. + + - name: Upload to Maven Central via API + env: + MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_TOKEN_USERNAME }} + MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_PASSWORD }} + run: | + ENCODED_AUTH=$(echo -n "$MAVEN_CENTRAL_USERNAME:$MAVEN_CENTRAL_PASSWORD" | base64 -w 0) + curl --request POST \ + --header "Authorization: Bearer $ENCODED_AUTH" \ + --form "bundle=@maven-central-bundle.zip" \ + "https://central.sonatype.com/api/v1/publisher/upload?publishingType=AUTOMATIC" \ No newline at end of file diff --git a/.gitignore b/.gitignore index 35811c2d..ee2ff5c6 100644 --- a/.gitignore +++ b/.gitignore @@ -18,6 +18,10 @@ target # Java local artifacts and build output /secretspec-jvm/build/ +/secretspec-jvm/library/bin/ +/secretspec-jvm/library/build/ +/secretspec-jvm/consumer/bin/ +/secretspec-jvm/consumer/build/ /secretspec-jvm/.gradle/ .idea/ diff --git a/conformance/README.md b/conformance/README.md index b38eb61a..c1367e03 100644 --- a/conformance/README.md +++ b/conformance/README.md @@ -65,4 +65,4 @@ relative to the repo root: `swift test --filter SecretSpecTests.testCrossLanguageConformance` after staging the local XCFramework as described in `secretspec-swift/README.md` - JVM (0.XX+): - `cd secretspec-jvm && gradle test` \ No newline at end of file + `cd secretspec-jvm && ./gradlew test` \ No newline at end of file diff --git a/conformance/run.sh b/conformance/run.sh index d9ac2775..1c71251a 100755 --- a/conformance/run.sh +++ b/conformance/run.sh @@ -99,7 +99,7 @@ run_swift() { ( ); } run_jvm() { ( cd secretspec-jvm - gradle test + ./gradlew test ); } run "Python" python run_python diff --git a/devenv.nix b/devenv.nix index d7e62522..cc0a2f8b 100644 --- a/devenv.nix +++ b/devenv.nix @@ -61,9 +61,7 @@ }; languages.java = { enable = true; - jdk.package = pkgs.jdk11; - gradle.enable = true; - gradle.package = pkgs.gradle.override { java = pkgs.jdk21; }; + jdk.package = pkgs.jdk21; }; packages = [ @@ -89,6 +87,9 @@ pkgs.pkg-config # Installs the secretspec-ffi archive with its header and pkg-config file pkgs.cargo-c + # Need JDK 11 as a compilation target, JDK 21 to run gradle + pkgs.jdk11 + pkgs.jdk21 ]; # Fully-static musl build of the Go SDK (-tags static + -extldflags -static). diff --git a/scripts/ci-sdks.sh b/scripts/ci-sdks.sh index 537ad638..caa67710 100755 --- a/scripts/ci-sdks.sh +++ b/scripts/ci-sdks.sh @@ -121,7 +121,7 @@ echo "==> C# / .NET" ( cd secretspec-dotnet && find examples -name '*.csproj' -exec dotnet build {} \; ) echo "==> JVM" -( cd secretspec-jvm && gradle assemble ) +( cd secretspec-jvm && ./gradlew build ) echo "==> PHP" # The PHP SDK has two native backends over the same resolver; exercise both. diff --git a/scripts/sync-sdk-versions.sh b/scripts/sync-sdk-versions.sh index eb1d993f..8ef347dd 100755 --- a/scripts/sync-sdk-versions.sh +++ b/scripts/sync-sdk-versions.sh @@ -128,7 +128,7 @@ update_file() { gradle-properties) awk -v version="$workspace_version" ' !changed && /^[[:space:]]*secretspec\.version[[:space:]]*=/ { - sub(/secretspec\.version[[:space:]]*=[[:space:]]*[^#]*/, "secretspec.version=" version) + sub(/secretspec\.version[[:space:]]*=[[:space:]]*[^#]*/, "secretspec.version=" version "-SNAPSHOT") changed = 1 } { print } diff --git a/secretspec-jvm/build.gradle.kts b/secretspec-jvm/build.gradle.kts index 5d473c0d..d4a2c9e0 100644 --- a/secretspec-jvm/build.gradle.kts +++ b/secretspec-jvm/build.gradle.kts @@ -1,90 +1,4 @@ -plugins { - `java-library` - `maven-publish` - `signing` - id("com.vanniktech.maven.publish") version "0.30.0" -} - -group = "org.cachix" - -version = providers.gradleProperty("secretspec.version").get() - -java { - toolchain { - languageVersion.set(JavaLanguageVersion.of(11)) - } - withSourcesJar() - withJavadocJar() -} - -repositories { - mavenCentral() -} - -dependencies { - val jnaVersion = "5.19.1" - val jacksonVersion = "2.21.5" - val junitVersion = "5.14.4" - val junitPlatformVersion = "1.14.4" - val assertjVersion = "3.27.7" - - implementation("net.java.dev.jna:jna:$jnaVersion") - implementation("com.fasterxml.jackson.core:jackson-databind:$jacksonVersion") - - testImplementation("org.junit.jupiter:junit-jupiter-api:$junitVersion") - testImplementation("org.assertj:assertj-core:$assertjVersion") - - testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:$junitVersion") - testRuntimeOnly("org.junit.platform:junit-platform-launcher:$junitPlatformVersion") -} - -tasks.test { - useJUnitPlatform() -} - -mavenPublishing { - publishToMavenCentral(com.vanniktech.maven.publish.SonatypeHost.CENTRAL_PORTAL) - - signAllPublications() - - coordinates("org.cachix", "secretspec-jvm", version.toString()) - - pom { - name.set("SecretSpec JVM SDK") - description.set("JVM SDK for SecretSpec secret resolution") - url.set("https://secretspec.dev") - - scm { - connection.set("scm:git:https://github.com/cachix/secretspec.git") - developerConnection.set("scm:git:ssh://github.com/cachix/secretspec.git") - url.set("https://github.com/cachix/secretspec") - } - - licenses { - license { - name.set("Apache-2.0") - url.set("https://www.apache.org/licenses/LICENSE-2.0.txt") - } - } - - developers { - developer { - id.set("cachix") - name.set("Cachix Team") - email.set("support@cachix.org") - organization.set("Cachix") - organizationUrl.set("https://www.cachix.org") - } - } - - issueManagement { - system.set("GitHub Issues") - url.set("https://github.com/cachix/secretspec/issues") - } - - ciManagement { - system.set("GitHub Actions") - url.set("https://github.com/cachix/secretspec/actions") - } - } -} +tasks.wrapper { + gradleVersion = "8.14.4" + distributionType = Wrapper.DistributionType.BIN +} \ No newline at end of file diff --git a/secretspec-jvm/consumer/build.gradle.kts b/secretspec-jvm/consumer/build.gradle.kts new file mode 100644 index 00000000..88545efa --- /dev/null +++ b/secretspec-jvm/consumer/build.gradle.kts @@ -0,0 +1,47 @@ +plugins { + `java` +} + +group = "org.cachix" + +version = providers.gradleProperty("secretspec.version").get() + +val secretspecJar = providers.gradleProperty("secretspec.jar") + +repositories { + mavenCentral() +} + +dependencies { + val jnaVersion = "5.19.1" + val junitVersion = "5.14.4" + val junitPlatformVersion = "1.14.4" + val assertjVersion = "3.27.7" + + testCompileOnly(project(":library")) + if (secretspecJar.isPresent) { + val multiPlatformJarFile = rootProject.file(secretspecJar.get()) + testRuntimeOnly(files(multiPlatformJarFile)) + } + + testImplementation("net.java.dev.jna:jna:$jnaVersion") + testImplementation("org.junit.jupiter:junit-jupiter-api:$junitVersion") + testImplementation("org.assertj:assertj-core:$assertjVersion") + + testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:$junitVersion") + testRuntimeOnly("org.junit.platform:junit-platform-launcher:$junitPlatformVersion") +} + +tasks.test { + onlyIf("Only runs if the multi-platform JAR is present") { + secretspecJar.isPresent + } + useJUnitPlatform() + testLogging { + events("passed", "skipped", "failed") + } +} + +tasks.jar { + enabled = false +} \ No newline at end of file diff --git a/secretspec-jvm/consumer/src/test/java/org/cachix/demo/SecretSpecFfiTest.java b/secretspec-jvm/consumer/src/test/java/org/cachix/demo/SecretSpecFfiTest.java new file mode 100644 index 00000000..d77a357c --- /dev/null +++ b/secretspec-jvm/consumer/src/test/java/org/cachix/demo/SecretSpecFfiTest.java @@ -0,0 +1,17 @@ +package org.cachix.demo; + +import org.junit.jupiter.api.Test; +import static org.assertj.core.api.Assertions.assertThat; + +import org.cachix.secretspec.SecretSpec; + + +class SecretSpecFfiTest { + + @Test + void testJnaBinding() { + assertThat(SecretSpec.abiVersion()) + .withFailMessage("Cannot get ABI version from JNA library. ") + .isNotNull(); + } +} \ No newline at end of file diff --git a/secretspec-jvm/gradle.properties b/secretspec-jvm/gradle.properties index 6486bba4..98224550 100644 --- a/secretspec-jvm/gradle.properties +++ b/secretspec-jvm/gradle.properties @@ -1,4 +1,4 @@ org.gradle.java.installations.auto-detect=true org.gradle.java.installations.auto-download=false org.gradle.java.installations.fromEnv=SECRETSPEC_JVM_TARGET_JDK -secretspec.version=0.0.0-SNAPSHOT +secretspec.version=0.18.0-SNAPSHOT diff --git a/secretspec-jvm/gradle/wrapper/gradle-wrapper.jar b/secretspec-jvm/gradle/wrapper/gradle-wrapper.jar new file mode 100644 index 0000000000000000000000000000000000000000..1b33c55baabb587c669f562ae36f953de2481846 GIT binary patch literal 43764 zcma&OWmKeVvL#I6?i3D%6z=Zs?ofE*?rw#G$eqJB ziT4y8-Y@s9rkH0Tz>ll(^xkcTl)CY?rS&9VNd66Yc)g^6)JcWaY(5$5gt z8gr3SBXUTN;~cBgz&})qX%#!Fxom2Yau_`&8)+6aSN7YY+pS410rRUU*>J}qL0TnJ zRxt*7QeUqTh8j)Q&iavh<}L+$Jqz))<`IfKussVk%%Ah-Ti?Eo0hQH!rK%K=#EAw0 zwq@@~XNUXRnv8$;zv<6rCRJ6fPD^hfrh;0K?n z=p!u^3xOgWZ%f3+?+>H)9+w^$Tn1e;?UpVMJb!!;f)`6f&4|8mr+g)^@x>_rvnL0< zvD0Hu_N>$(Li7|Jgu0mRh&MV+<}`~Wi*+avM01E)Jtg=)-vViQKax!GeDc!xv$^mL z{#OVBA$U{(Zr8~Xm|cP@odkHC*1R8z6hcLY#N@3E-A8XEvpt066+3t9L_6Zg6j@9Q zj$$%~yO-OS6PUVrM2s)(T4#6=JpI_@Uz+!6=GdyVU?`!F=d;8#ZB@(5g7$A0(`eqY z8_i@3w$0*es5mrSjhW*qzrl!_LQWs4?VfLmo1Sd@Ztt53+etwzAT^8ow_*7Jp`Y|l z*UgSEwvxq+FYO!O*aLf-PinZYne7Ib6ny3u>MjQz=((r3NTEeU4=-i0LBq3H-VJH< z^>1RE3_JwrclUn9vb7HcGUaFRA0QHcnE;6)hnkp%lY1UII#WPAv?-;c?YH}LWB8Nl z{sx-@Z;QxWh9fX8SxLZk8;kMFlGD3Jc^QZVL4nO)1I$zQwvwM&_!kW+LMf&lApv#< zur|EyC|U@5OQuph$TC_ZU`{!vJp`13e9alaR0Dbn5ikLFH7>eIz4QbV|C=%7)F=qo z_>M&5N)d)7G(A%c>}UCrW!Ql_6_A{?R7&CL`;!KOb3 z8Z=$YkV-IF;c7zs{3-WDEFJzuakFbd*4LWd<_kBE8~BFcv}js_2OowRNzWCtCQ6&k z{&~Me92$m*@e0ANcWKuz)?YjB*VoSTx??-3Cc0l2U!X^;Bv@m87eKHukAljrD54R+ zE;@_w4NPe1>3`i5Qy*3^E9x#VB6?}v=~qIprrrd5|DFkg;v5ixo0IsBmik8=Y;zv2 z%Bcf%NE$a44bk^`i4VwDLTbX=q@j9;JWT9JncQ!+Y%2&HHk@1~*L8-{ZpY?(-a9J-1~<1ltr9i~D9`P{XTIFWA6IG8c4;6bFw*lzU-{+?b&%OcIoCiw00n>A1ra zFPE$y@>ebbZlf(sN_iWBzQKDV zmmaLX#zK!@ZdvCANfwV}9@2O&w)!5gSgQzHdk2Q`jG6KD7S+1R5&F)j6QTD^=hq&7 zHUW+r^da^%V(h(wonR(j?BOiC!;y=%nJvz?*aW&5E87qq;2z`EI(f zBJNNSMFF9U{sR-af5{IY&AtoGcoG)Iq-S^v{7+t0>7N(KRoPj;+2N5;9o_nxIGjJ@ z7bYQK)bX)vEhy~VL%N6g^NE@D5VtV+Q8U2%{ji_=6+i^G%xeskEhH>Sqr194PJ$fB zu1y^){?9Vkg(FY2h)3ZHrw0Z<@;(gd_dtF#6y_;Iwi{yX$?asr?0N0_B*CifEi7<6 zq`?OdQjCYbhVcg+7MSgIM|pJRu~`g?g3x?Tl+V}#$It`iD1j+!x+!;wS0+2e>#g?Z z*EA^k7W{jO1r^K~cD#5pamp+o@8&yw6;%b|uiT?{Wa=4+9<}aXWUuL#ZwN1a;lQod zW{pxWCYGXdEq9qAmvAB904}?97=re$>!I%wxPV#|f#@A*Y=qa%zHlDv^yWbR03%V0 zprLP+b(#fBqxI%FiF*-n8HtH6$8f(P6!H3V^ysgd8de-N(@|K!A< z^qP}jp(RaM9kQ(^K(U8O84?D)aU(g?1S8iWwe)gqpHCaFlJxb*ilr{KTnu4_@5{K- z)n=CCeCrPHO0WHz)dDtkbZfUfVBd?53}K>C5*-wC4hpDN8cGk3lu-ypq+EYpb_2H; z%vP4@&+c2p;thaTs$dc^1CDGlPG@A;yGR5@$UEqk6p58qpw#7lc<+W(WR;(vr(D>W z#(K$vE#uBkT=*q&uaZwzz=P5mjiee6>!lV?c}QIX%ZdkO1dHg>Fa#xcGT6~}1*2m9 zkc7l3ItD6Ie~o_aFjI$Ri=C!8uF4!Ky7iG9QTrxVbsQroi|r)SAon#*B*{}TB-?=@ z8~jJs;_R2iDd!$+n$%X6FO&PYS{YhDAS+U2o4su9x~1+U3z7YN5o0qUK&|g^klZ6X zj_vrM5SUTnz5`*}Hyts9ADwLu#x_L=nv$Z0`HqN`Zo=V>OQI)fh01n~*a%01%cx%0 z4LTFVjmW+ipVQv5rYcn3;d2o4qunWUY!p+?s~X~(ost@WR@r@EuDOSs8*MT4fiP>! zkfo^!PWJJ1MHgKS2D_hc?Bs?isSDO61>ebl$U*9*QY(b=i&rp3@3GV@z>KzcZOxip z^dzA~44;R~cnhWz7s$$v?_8y-k!DZys}Q?4IkSyR!)C0j$(Gm|t#e3|QAOFaV2}36 z?dPNY;@I=FaCwylc_;~kXlZsk$_eLkNb~TIl8QQ`mmH&$*zwwR8zHU*sId)rxHu*K z;yZWa8UmCwju%aSNLwD5fBl^b0Ux1%q8YR*uG`53Mi<`5uA^Dc6Ync)J3N7;zQ*75)hf%a@{$H+%S?SGT)ks60)?6j$ zspl|4Ad6@%-r1t*$tT(en!gIXTUDcsj?28ZEzz)dH)SV3bZ+pjMaW0oc~rOPZP@g! zb9E+ndeVO_Ib9c_>{)`01^`ZS198 z)(t=+{Azi11$eu%aU7jbwuQrO`vLOixuh~%4z@mKr_Oc;F%Uq01fA)^W&y+g16e?rkLhTxV!EqC%2}sx_1u7IBq|}Be&7WI z4I<;1-9tJsI&pQIhj>FPkQV9{(m!wYYV@i5h?A0#BN2wqlEwNDIq06|^2oYVa7<~h zI_OLan0Do*4R5P=a3H9`s5*>xU}_PSztg`+2mv)|3nIy=5#Z$%+@tZnr> zLcTI!Mxa`PY7%{;KW~!=;*t)R_sl<^b>eNO@w#fEt(tPMg_jpJpW$q_DoUlkY|uo> z0-1{ouA#;t%spf*7VjkK&$QrvwUERKt^Sdo)5@?qAP)>}Y!h4(JQ!7{wIdkA+|)bv z&8hBwoX4v|+fie}iTslaBX^i*TjwO}f{V)8*!dMmRPi%XAWc8<_IqK1jUsApk)+~R zNFTCD-h>M5Y{qTQ&0#j@I@tmXGj%rzhTW5%Bkh&sSc=$Fv;M@1y!zvYG5P2(2|(&W zlcbR1{--rJ&s!rB{G-sX5^PaM@3EqWVz_y9cwLR9xMig&9gq(voeI)W&{d6j1jh&< zARXi&APWE1FQWh7eoZjuP z;vdgX>zep^{{2%hem;e*gDJhK1Hj12nBLIJoL<=0+8SVEBx7!4Ea+hBY;A1gBwvY<)tj~T=H`^?3>zeWWm|LAwo*S4Z%bDVUe z6r)CH1H!(>OH#MXFJ2V(U(qxD{4Px2`8qfFLG+=a;B^~Te_Z!r3RO%Oc#ZAHKQxV5 zRYXxZ9T2A%NVJIu5Pu7!Mj>t%YDO$T@M=RR(~mi%sv(YXVl`yMLD;+WZ{vG9(@P#e zMo}ZiK^7^h6TV%cG+;jhJ0s>h&VERs=tuZz^Tlu~%d{ZHtq6hX$V9h)Bw|jVCMudd zwZ5l7In8NT)qEPGF$VSKg&fb0%R2RnUnqa){)V(X(s0U zkCdVZe6wy{+_WhZh3qLp245Y2RR$@g-!9PjJ&4~0cFSHMUn=>dapv)hy}|y91ZWTV zCh=z*!S3_?`$&-eZ6xIXUq8RGl9oK0BJw*TdU6A`LJqX9eS3X@F)g$jLkBWFscPhR zpCv8#KeAc^y>>Y$k^=r|K(DTC}T$0#jQBOwB#@`P6~*IuW_8JxCG}J4va{ zsZzt}tt+cv7=l&CEuVtjD6G2~_Meh%p4RGuY?hSt?(sreO_F}8r7Kp$qQdvCdZnDQ zxzc*qchE*E2=WK)^oRNa>Ttj`fpvF-JZ5tu5>X1xw)J@1!IqWjq)ESBG?J|ez`-Tc zi5a}GZx|w-h%5lNDE_3ho0hEXMoaofo#Z;$8|2;EDF&*L+e$u}K=u?pb;dv$SXeQM zD-~7P0i_`Wk$#YP$=hw3UVU+=^@Kuy$>6?~gIXx636jh{PHly_a2xNYe1l60`|y!7 z(u%;ILuW0DDJ)2%y`Zc~hOALnj1~txJtcdD#o4BCT68+8gZe`=^te6H_egxY#nZH&P*)hgYaoJ^qtmpeea`35Fw)cy!w@c#v6E29co8&D9CTCl%^GV|X;SpneSXzV~LXyRn-@K0Df z{tK-nDWA!q38M1~`xUIt_(MO^R(yNY#9@es9RQbY@Ia*xHhD&=k^T+ zJi@j2I|WcgW=PuAc>hs`(&CvgjL2a9Rx zCbZyUpi8NWUOi@S%t+Su4|r&UoU|ze9SVe7p@f1GBkrjkkq)T}X%Qo1g!SQ{O{P?m z-OfGyyWta+UCXH+-+(D^%kw#A1-U;?9129at7MeCCzC{DNgO zeSqsV>W^NIfTO~4({c}KUiuoH8A*J!Cb0*sp*w-Bg@YfBIPZFH!M}C=S=S7PLLcIG zs7K77g~W)~^|+mx9onzMm0qh(f~OsDTzVmRtz=aZTllgR zGUn~_5hw_k&rll<4G=G+`^Xlnw;jNYDJz@bE?|r866F2hA9v0-8=JO3g}IHB#b`hy zA42a0>{0L7CcabSD+F7?pGbS1KMvT{@1_@k!_+Ki|5~EMGt7T%u=79F)8xEiL5!EJ zzuxQ`NBliCoJMJdwu|);zRCD<5Sf?Y>U$trQ-;xj6!s5&w=9E7)%pZ+1Nh&8nCCwM zv5>Ket%I?cxr3vVva`YeR?dGxbG@pi{H#8@kFEf0Jq6~K4>kt26*bxv=P&jyE#e$| zDJB_~imk^-z|o!2njF2hL*|7sHCnzluhJjwLQGDmC)Y9 zr9ZN`s)uCd^XDvn)VirMgW~qfn1~SaN^7vcX#K1G`==UGaDVVx$0BQnubhX|{e z^i0}>k-;BP#Szk{cFjO{2x~LjK{^Upqd&<+03_iMLp0$!6_$@TbX>8U-f*-w-ew1?`CtD_0y_Lo|PfKi52p?`5$Jzx0E8`M0 zNIb?#!K$mM4X%`Ry_yhG5k@*+n4||2!~*+&pYLh~{`~o(W|o64^NrjP?-1Lgu?iK^ zTX6u3?#$?R?N!{599vg>G8RGHw)Hx&=|g4599y}mXNpM{EPKKXB&+m?==R3GsIq?G zL5fH={=zawB(sMlDBJ+{dgb)Vx3pu>L=mDV0{r1Qs{0Pn%TpopH{m(By4;{FBvi{I z$}x!Iw~MJOL~&)p93SDIfP3x%ROjg}X{Sme#hiJ&Yk&a;iR}V|n%PriZBY8SX2*;6 z4hdb^&h;Xz%)BDACY5AUsV!($lib4>11UmcgXKWpzRL8r2Srl*9Y(1uBQsY&hO&uv znDNff0tpHlLISam?o(lOp#CmFdH<6HmA0{UwfU#Y{8M+7od8b8|B|7ZYR9f<#+V|ZSaCQvI$~es~g(Pv{2&m_rKSB2QQ zMvT}$?Ll>V+!9Xh5^iy3?UG;dF-zh~RL#++roOCsW^cZ&({6q|?Jt6`?S8=16Y{oH zp50I7r1AC1(#{b`Aq5cw>ypNggHKM9vBx!W$eYIzD!4KbLsZGr2o8>g<@inmS3*>J zx8oG((8f!ei|M@JZB`p7+n<Q}?>h249<`7xJ?u}_n;Gq(&km#1ULN87CeTO~FY zS_Ty}0TgQhV zOh3T7{{x&LSYGQfKR1PDIkP!WnfC1$l+fs@Di+d4O=eVKeF~2fq#1<8hEvpwuqcaH z4A8u~r^gnY3u6}zj*RHjk{AHhrrDqaj?|6GaVJbV%o-nATw}ASFr!f`Oz|u_QPkR# z0mDudY1dZRlk@TyQ?%Eti=$_WNFtLpSx9=S^be{wXINp%MU?a`F66LNU<c;0&ngifmP9i;bj6&hdGMW^Kf8e6ZDXbQD&$QAAMo;OQ)G zW(qlHh;}!ZP)JKEjm$VZjTs@hk&4{?@+NADuYrr!R^cJzU{kGc1yB?;7mIyAWwhbeA_l_lw-iDVi7wcFurf5 z#Uw)A@a9fOf{D}AWE%<`s1L_AwpZ?F!Vac$LYkp<#A!!`XKaDC{A%)~K#5z6>Hv@V zBEqF(D5?@6r3Pwj$^krpPDCjB+UOszqUS;b2n>&iAFcw<*im2(b3|5u6SK!n9Sg4I z0KLcwA6{Mq?p%t>aW0W!PQ>iUeYvNjdKYqII!CE7SsS&Rj)eIw-K4jtI?II+0IdGq z2WT|L3RL?;GtGgt1LWfI4Ka`9dbZXc$TMJ~8#Juv@K^1RJN@yzdLS8$AJ(>g!U9`# zx}qr7JWlU+&m)VG*Se;rGisutS%!6yybi%B`bv|9rjS(xOUIvbNz5qtvC$_JYY+c& za*3*2$RUH8p%pSq>48xR)4qsp!Q7BEiJ*`^>^6INRbC@>+2q9?x(h0bpc>GaNFi$K zPH$6!#(~{8@0QZk=)QnM#I=bDx5vTvjm$f4K}%*s+((H2>tUTf==$wqyoI`oxI7>C z&>5fe)Yg)SmT)eA(|j@JYR1M%KixxC-Eceknf-;N=jJTwKvk#@|J^&5H0c+%KxHUI z6dQbwwVx3p?X<_VRVb2fStH?HH zFR@Mp=qX%#L3XL)+$PXKV|o|#DpHAoqvj6uQKe@M-mnhCSou7Dj4YuO6^*V`m)1lf z;)@e%1!Qg$10w8uEmz{ENb$^%u}B;J7sDd zump}onoD#!l=agcBR)iG!3AF0-63%@`K9G(CzKrm$VJ{v7^O9Ps7Zej|3m= zVXlR&yW6=Y%mD30G@|tf=yC7-#L!16Q=dq&@beWgaIL40k0n% z)QHrp2Jck#evLMM1RGt3WvQ936ZC9vEje0nFMfvmOHVI+&okB_K|l-;|4vW;qk>n~ z+|kk8#`K?x`q>`(f6A${wfw9Cx(^)~tX7<#TpxR#zYG2P+FY~mG{tnEkv~d6oUQA+ z&hNTL=~Y@rF`v-RZlts$nb$3(OL1&@Y11hhL9+zUb6)SP!;CD)^GUtUpCHBE`j1te zAGud@miCVFLk$fjsrcpjsadP__yj9iEZUW{Ll7PPi<$R;m1o!&Xdl~R_v0;oDX2z^!&8}zNGA}iYG|k zmehMd1%?R)u6R#<)B)1oe9TgYH5-CqUT8N7K-A-dm3hbm_W21p%8)H{O)xUlBVb+iUR}-v5dFaCyfSd zC6Bd7=N4A@+Bna=!-l|*_(nWGDpoyU>nH=}IOrLfS+-d40&(Wo*dDB9nQiA2Tse$R z;uq{`X7LLzP)%Y9aHa4YQ%H?htkWd3Owv&UYbr5NUDAH^<l@Z0Cx%`N+B*i!!1u>D8%;Qt1$ zE5O0{-`9gdDxZ!`0m}ywH!;c{oBfL-(BH<&SQ~smbcobU!j49O^f4&IIYh~f+hK*M zZwTp%{ZSAhMFj1qFaOA+3)p^gnXH^=)`NTYgTu!CLpEV2NF=~-`(}7p^Eof=@VUbd z_9U|8qF7Rueg&$qpSSkN%%%DpbV?8E8ivu@ensI0toJ7Eas^jyFReQ1JeY9plb^{m z&eQO)qPLZQ6O;FTr*aJq=$cMN)QlQO@G&%z?BKUs1&I^`lq>=QLODwa`(mFGC`0H< zOlc*|N?B5&!U6BuJvkL?s1&nsi$*5cCv7^j_*l&$-sBmRS85UIrE--7eD8Gr3^+o? zqG-Yl4S&E;>H>k^a0GdUI(|n1`ws@)1%sq2XBdK`mqrNq_b4N{#VpouCXLzNvjoFv zo9wMQ6l0+FT+?%N(ka*;%m~(?338bu32v26!{r)|w8J`EL|t$}TA4q_FJRX5 zCPa{hc_I(7TGE#@rO-(!$1H3N-C0{R$J=yPCXCtGk{4>=*B56JdXU9cQVwB`6~cQZ zf^qK21x_d>X%dT!!)CJQ3mlHA@ z{Prkgfs6=Tz%63$6Zr8CO0Ak3A)Cv#@BVKr&aiKG7RYxY$Yx>Bj#3gJk*~Ps-jc1l z;4nltQwwT4@Z)}Pb!3xM?+EW0qEKA)sqzw~!C6wd^{03-9aGf3Jmt=}w-*!yXupLf z;)>-7uvWN4Unn8b4kfIza-X=x*e4n5pU`HtgpFFd))s$C@#d>aUl3helLom+RYb&g zI7A9GXLRZPl}iQS*d$Azxg-VgcUr*lpLnbPKUV{QI|bsG{8bLG<%CF( zMoS4pRDtLVYOWG^@ox^h8xL~afW_9DcE#^1eEC1SVSb1BfDi^@g?#f6e%v~Aw>@w- zIY0k+2lGWNV|aA*e#`U3=+oBDmGeInfcL)>*!w|*;mWiKNG6wP6AW4-4imN!W)!hE zA02~S1*@Q`fD*+qX@f3!2yJX&6FsEfPditB%TWo3=HA;T3o2IrjS@9SSxv%{{7&4_ zdS#r4OU41~GYMiib#z#O;zohNbhJknrPPZS6sN$%HB=jUnlCO_w5Gw5EeE@KV>soy z2EZ?Y|4RQDDjt5y!WBlZ(8M)|HP<0YyG|D%RqD+K#e7-##o3IZxS^wQ5{Kbzb6h(i z#(wZ|^ei>8`%ta*!2tJzwMv+IFHLF`zTU8E^Mu!R*45_=ccqI};Zbyxw@U%a#2}%f zF>q?SrUa_a4H9l+uW8JHh2Oob>NyUwG=QH~-^ZebU*R@67DcXdz2{HVB4#@edz?B< z5!rQH3O0>A&ylROO%G^fimV*LX7>!%re{_Sm6N>S{+GW1LCnGImHRoF@csnFzn@P0 zM=jld0z%oz;j=>c7mMwzq$B^2mae7NiG}%>(wtmsDXkWk{?BeMpTrIt3Mizq?vRsf zi_WjNp+61uV(%gEU-Vf0;>~vcDhe(dzWdaf#4mH3o^v{0EWhj?E?$5v02sV@xL0l4 zX0_IMFtQ44PfWBbPYN#}qxa%=J%dlR{O!KyZvk^g5s?sTNycWYPJ^FK(nl3k?z-5t z39#hKrdO7V(@!TU)LAPY&ngnZ1MzLEeEiZznn7e-jLCy8LO zu^7_#z*%I-BjS#Pg-;zKWWqX-+Ly$T!4`vTe5ZOV0j?TJVA*2?*=82^GVlZIuH%9s zXiV&(T(QGHHah=s&7e|6y?g+XxZGmK55`wGV>@1U)Th&=JTgJq>4mI&Av2C z)w+kRoj_dA!;SfTfkgMPO>7Dw6&1*Hi1q?54Yng`JO&q->^CX21^PrU^JU#CJ_qhV zSG>afB%>2fx<~g8p=P8Yzxqc}s@>>{g7}F!;lCXvF#RV)^fyYb_)iKVCz1xEq=fJ| z0a7DMCK*FuP=NM*5h;*D`R4y$6cpW-E&-i{v`x=Jbk_xSn@2T3q!3HoAOB`@5Vg6) z{PW|@9o!e;v1jZ2{=Uw6S6o{g82x6g=k!)cFSC*oemHaVjg?VpEmtUuD2_J^A~$4* z3O7HsbA6wxw{TP5Kk)(Vm?gKo+_}11vbo{Tp_5x79P~#F)ahQXT)tSH5;;14?s)On zel1J>1x>+7;g1Iz2FRpnYz;sD0wG9Q!vuzE9yKi3@4a9Nh1!GGN?hA)!mZEnnHh&i zf?#ZEN2sFbf~kV;>K3UNj1&vFhc^sxgj8FCL4v>EOYL?2uuT`0eDH}R zmtUJMxVrV5H{L53hu3#qaWLUa#5zY?f5ozIn|PkMWNP%n zWB5!B0LZB0kLw$k39=!akkE9Q>F4j+q434jB4VmslQ;$ zKiO#FZ`p|dKS716jpcvR{QJkSNfDVhr2%~eHrW;fU45>>snr*S8Vik-5eN5k*c2Mp zyxvX&_cFbB6lODXznHHT|rsURe2!swomtrqc~w5 zymTM8!w`1{04CBprR!_F{5LB+2_SOuZN{b*!J~1ZiPpP-M;);!ce!rOPDLtgR@Ie1 zPreuqm4!H)hYePcW1WZ0Fyaqe%l}F~Orr)~+;mkS&pOhP5Ebb`cnUt!X_QhP4_4p( z8YKQCDKGIy>?WIFm3-}Br2-N`T&FOi?t)$hjphB9wOhBXU#Hb+zm&We_-O)s(wc`2 z8?VsvU;J>Ju7n}uUb3s1yPx_F*|FlAi=Ge=-kN?1;`~6szP%$3B0|8Sqp%ebM)F8v zADFrbeT0cgE>M0DMV@_Ze*GHM>q}wWMzt|GYC%}r{OXRG3Ij&<+nx9;4jE${Fj_r* z`{z1AW_6Myd)i6e0E-h&m{{CvzH=Xg!&(bLYgRMO_YVd8JU7W+7MuGWNE=4@OvP9+ zxi^vqS@5%+#gf*Z@RVyU9N1sO-(rY$24LGsg1>w>s6ST^@)|D9>cT50maXLUD{Fzf zt~tp{OSTEKg3ZSQyQQ5r51){%=?xlZ54*t1;Ow)zLe3i?8tD8YyY^k%M)e`V*r+vL zPqUf&m)U+zxps+NprxMHF{QSxv}>lE{JZETNk1&F+R~bp{_T$dbXL2UGnB|hgh*p4h$clt#6;NO~>zuyY@C-MD@)JCc5XrYOt`wW7! z_ti2hhZBMJNbn0O-uTxl_b6Hm313^fG@e;RrhIUK9@# z+DHGv_Ow$%S8D%RB}`doJjJy*aOa5mGHVHz0e0>>O_%+^56?IkA5eN+L1BVCp4~m=1eeL zb;#G!#^5G%6Mw}r1KnaKsLvJB%HZL)!3OxT{k$Yo-XrJ?|7{s4!H+S2o?N|^Z z)+?IE9H7h~Vxn5hTis^3wHYuOU84+bWd)cUKuHapq=&}WV#OxHpLab`NpwHm8LmOo zjri+!k;7j_?FP##CpM+pOVx*0wExEex z@`#)K<-ZrGyArK;a%Km`^+We|eT+#MygHOT6lXBmz`8|lyZOwL1+b+?Z$0OhMEp3R z&J=iRERpv~TC=p2-BYLC*?4 zxvPs9V@g=JT0>zky5Poj=fW_M!c)Xxz1<=&_ZcL=LMZJqlnO1P^xwGGW*Z+yTBvbV z-IFe6;(k1@$1;tS>{%pXZ_7w+i?N4A2=TXnGf=YhePg8bH8M|Lk-->+w8Y+FjZ;L=wSGwxfA`gqSn)f(XNuSm>6Y z@|#e-)I(PQ^G@N`%|_DZSb4_pkaEF0!-nqY+t#pyA>{9^*I-zw4SYA1_z2Bs$XGUZbGA;VeMo%CezHK0lO={L%G)dI-+8w?r9iexdoB{?l zbJ}C?huIhWXBVs7oo{!$lOTlvCLZ_KN1N+XJGuG$rh<^eUQIqcI7^pmqhBSaOKNRq zrx~w^?9C?*&rNwP_SPYmo;J-#!G|{`$JZK7DxsM3N^8iR4vvn>E4MU&Oe1DKJvLc~ zCT>KLZ1;t@My zRj_2hI^61T&LIz)S!+AQIV23n1>ng+LUvzv;xu!4;wpqb#EZz;F)BLUzT;8UA1x*6vJ zicB!3Mj03s*kGV{g`fpC?V^s(=JG-k1EMHbkdP4P*1^8p_TqO|;!Zr%GuP$8KLxuf z=pv*H;kzd;P|2`JmBt~h6|GxdU~@weK5O=X&5~w$HpfO}@l-T7@vTCxVOwCkoPQv8 z@aV_)I5HQtfs7^X=C03zYmH4m0S!V@JINm6#(JmZRHBD?T!m^DdiZJrhKpBcur2u1 zf9e4%k$$vcFopK5!CC`;ww(CKL~}mlxK_Pv!cOsFgVkNIghA2Au@)t6;Y3*2gK=5d z?|@1a)-(sQ%uFOmJ7v2iG&l&m^u&^6DJM#XzCrF%r>{2XKyxLD2rgWBD;i(!e4InDQBDg==^z;AzT2z~OmV0!?Z z0S9pX$+E;w3WN;v&NYT=+G8hf=6w0E1$0AOr61}eOvE8W1jX%>&Mjo7&!ulawgzLH zbcb+IF(s^3aj12WSi#pzIpijJJzkP?JzRawnxmNDSUR#7!29vHULCE<3Aa#be}ie~d|!V+ z%l~s9Odo$G&fH!t!+`rUT0T9DulF!Yq&BfQWFZV1L9D($r4H(}Gnf6k3^wa7g5|Ws zj7%d`!3(0bb55yhC6@Q{?H|2os{_F%o=;-h{@Yyyn*V7?{s%Grvpe!H^kl6tF4Zf5 z{Jv1~yZ*iIWL_9C*8pBMQArfJJ0d9Df6Kl#wa}7Xa#Ef_5B7=X}DzbQXVPfCwTO@9+@;A^Ti6il_C>g?A-GFwA0#U;t4;wOm-4oS})h z5&on>NAu67O?YCQr%7XIzY%LS4bha9*e*4bU4{lGCUmO2UQ2U)QOqClLo61Kx~3dI zmV3*(P6F_Tr-oP%x!0kTnnT?Ep5j;_IQ^pTRp=e8dmJtI4YgWd0}+b2=ATkOhgpXe z;jmw+FBLE}UIs4!&HflFr4)vMFOJ19W4f2^W(=2)F%TAL)+=F>IE$=e=@j-*bFLSg z)wf|uFQu+!=N-UzSef62u0-C8Zc7 zo6@F)c+nZA{H|+~7i$DCU0pL{0Ye|fKLuV^w!0Y^tT$isu%i1Iw&N|tX3kwFKJN(M zXS`k9js66o$r)x?TWL}Kxl`wUDUpwFx(w4Yk%49;$sgVvT~n8AgfG~HUcDt1TRo^s zdla@6heJB@JV z!vK;BUMznhzGK6PVtj0)GB=zTv6)Q9Yt@l#fv7>wKovLobMV-+(8)NJmyF8R zcB|_K7=FJGGn^X@JdFaat0uhKjp3>k#^&xE_}6NYNG?kgTp>2Iu?ElUjt4~E-?`Du z?mDCS9wbuS%fU?5BU@Ijx>1HG*N?gIP+<~xE4u=>H`8o((cS5M6@_OK%jSjFHirQK zN9@~NXFx*jS{<|bgSpC|SAnA@I)+GB=2W|JJChLI_mx+-J(mSJ!b)uUom6nH0#2^(L@JBlV#t zLl?j54s`Y3vE^c_3^Hl0TGu*tw_n?@HyO@ZrENxA+^!)OvUX28gDSF*xFtQzM$A+O zCG=n#6~r|3zt=8%GuG} z<#VCZ%2?3Q(Ad#Y7GMJ~{U3>E{5e@z6+rgZLX{Cxk^p-7dip^d29;2N1_mm4QkASo z-L`GWWPCq$uCo;X_BmGIpJFBlhl<8~EG{vOD1o|X$aB9KPhWO_cKiU*$HWEgtf=fn zsO%9bp~D2c@?*K9jVN@_vhR03>M_8h!_~%aN!Cnr?s-!;U3SVfmhRwk11A^8Ns`@KeE}+ zN$H}a1U6E;*j5&~Og!xHdfK5M<~xka)x-0N)K_&e7AjMz`toDzasH+^1bZlC!n()crk9kg@$(Y{wdKvbuUd04N^8}t1iOgsKF zGa%%XWx@WoVaNC1!|&{5ZbkopFre-Lu(LCE5HWZBoE#W@er9W<>R=^oYxBvypN#x3 zq#LC8&q)GFP=5^-bpHj?LW=)-g+3_)Ylps!3^YQ{9~O9&K)xgy zMkCWaApU-MI~e^cV{Je75Qr7eF%&_H)BvfyKL=gIA>;OSq(y z052BFz3E(Prg~09>|_Z@!qj}@;8yxnw+#Ej0?Rk<y}4ghbD569B{9hSFr*^ygZ zr6j7P#gtZh6tMk6?4V$*Jgz+#&ug;yOr>=qdI#9U&^am2qoh4Jy}H2%a|#Fs{E(5r z%!ijh;VuGA6)W)cJZx+;9Bp1LMUzN~x_8lQ#D3+sL{be-Jyeo@@dv7XguJ&S5vrH` z>QxOMWn7N-T!D@1(@4>ZlL^y5>m#0!HKovs12GRav4z!>p(1~xok8+_{| z#Ae4{9#NLh#Vj2&JuIn5$d6t@__`o}umFo(n0QxUtd2GKCyE+erwXY?`cm*h&^9*8 zJ+8x6fRZI-e$CRygofIQN^dWysCxgkyr{(_oBwwSRxZora1(%(aC!5BTtj^+YuevI zx?)H#(xlALUp6QJ!=l9N__$cxBZ5p&7;qD3PsXRFVd<({Kh+mShFWJNpy`N@ab7?9 zv5=klvCJ4bx|-pvOO2-+G)6O?$&)ncA#Urze2rlBfp#htudhx-NeRnJ@u%^_bfw4o z4|{b8SkPV3b>Wera1W(+N@p9H>dc6{cnkh-sgr?e%(YkWvK+0YXVwk0=d`)}*47*B z5JGkEdVix!w7-<%r0JF~`ZMMPe;f0EQHuYHxya`puazyph*ZSb1mJAt^k4549BfS; zK7~T&lRb=W{s&t`DJ$B}s-eH1&&-wEOH1KWsKn0a(ZI+G!v&W4A*cl>qAvUv6pbUR z#(f#EKV8~hk&8oayBz4vaswc(?qw1vn`yC zZQDl2PCB-&Uu@g9ZQHhO+v(W0bNig{-k0;;`+wM@#@J)8r?qOYs#&vUna8ILxN7S{ zp1s41KnR8miQJtJtOr|+qk}wrLt+N*z#5o`TmD1)E&QD(Vh&pjZJ_J*0!8dy_ z>^=@v=J)C`x&gjqAYu`}t^S=DFCtc0MkBU2zf|69?xW`Ck~(6zLD)gSE{7n~6w8j_ zoH&~$ED2k5-yRa0!r8fMRy z;QjBYUaUnpd}mf%iVFPR%Dg9!d>g`01m~>2s))`W|5!kc+_&Y>wD@@C9%>-lE`WB0 zOIf%FVD^cj#2hCkFgi-fgzIfOi+ya)MZK@IZhHT5FVEaSbv-oDDs0W)pA0&^nM0TW zmgJmd7b1R7b0a`UwWJYZXp4AJPteYLH>@M|xZFKwm!t3D3&q~av?i)WvAKHE{RqpD{{%OhYkK?47}+}` zrR2(Iv9bhVa;cDzJ%6ntcSbx7v7J@Y4x&+eWSKZ*eR7_=CVIUSB$^lfYe@g+p|LD{ zPSpQmxx@b$%d!05|H}WzBT4_cq?@~dvy<7s&QWtieJ9)hd4)$SZz}#H2UTi$CkFWW|I)v_-NjuH!VypONC=1`A=rm_jfzQ8Fu~1r8i{q-+S_j$ z#u^t&Xnfi5tZtl@^!fUJhx@~Cg0*vXMK}D{>|$#T*+mj(J_@c{jXBF|rm4-8%Z2o! z2z0o(4%8KljCm^>6HDK!{jI7p+RAPcty_~GZ~R_+=+UzZ0qzOwD=;YeZt*?3%UGdr z`c|BPE;yUbnyARUl&XWSNJ<+uRt%!xPF&K;(l$^JcA_CMH6)FZt{>6ah$|(9$2fc~ z=CD00uHM{qv;{Zk9FR0~u|3|Eiqv9?z2#^GqylT5>6JNZwKqKBzzQpKU2_pmtD;CT zi%Ktau!Y2Tldfu&b0UgmF(SSBID)15*r08eoUe#bT_K-G4VecJL2Pa=6D1K6({zj6 za(2Z{r!FY5W^y{qZ}08+h9f>EKd&PN90f}Sc0ejf%kB4+f#T8Q1=Pj=~#pi$U zp#5rMR%W25>k?<$;$x72pkLibu1N|jX4cWjD3q^Pk3js!uK6h7!dlvw24crL|MZs_ zb%Y%?Fyp0bY0HkG^XyS76Ts*|Giw{31LR~+WU5NejqfPr73Rp!xQ1mLgq@mdWncLy z%8}|nzS4P&`^;zAR-&nm5f;D-%yNQPwq4N7&yULM8bkttkD)hVU>h>t47`{8?n2&4 zjEfL}UEagLUYwdx0sB2QXGeRmL?sZ%J!XM`$@ODc2!y|2#7hys=b$LrGbvvjx`Iqi z&RDDm3YBrlKhl`O@%%&rhLWZ*ABFz2nHu7k~3@e4)kO3%$=?GEFUcCF=6-1n!x^vmu+Ai*amgXH+Rknl6U>#9w;A} zn2xanZSDu`4%%x}+~FG{Wbi1jo@wqBc5(5Xl~d0KW(^Iu(U3>WB@-(&vn_PJt9{1`e9Iic@+{VPc`vP776L*viP{wYB2Iff8hB%E3|o zGMOu)tJX!`qJ}ZPzq7>=`*9TmETN7xwU;^AmFZ-ckZjV5B2T09pYliaqGFY|X#E-8 z20b>y?(r-Fn5*WZ-GsK}4WM>@TTqsxvSYWL6>18q8Q`~JO1{vLND2wg@58OaU!EvT z1|o+f1mVXz2EKAbL!Q=QWQKDZpV|jznuJ}@-)1&cdo z^&~b4Mx{*1gurlH;Vhk5g_cM&6LOHS2 zRkLfO#HabR1JD4Vc2t828dCUG#DL}f5QDSBg?o)IYYi@_xVwR2w_ntlpAW0NWk$F1 z$If?*lP&Ka1oWfl!)1c3fl`g*lMW3JOn#)R1+tfwrs`aiFUgz3;XIJ>{QFxLCkK30 zNS-)#DON3yb!7LBHQJ$)4y%TN82DC2-9tOIqzhZ27@WY^<6}vXCWcR5iN{LN8{0u9 zNXayqD=G|e?O^*ms*4P?G%o@J1tN9_76e}E#66mr89%W_&w4n66~R;X_vWD(oArwj z4CpY`)_mH2FvDuxgT+akffhX0b_slJJ*?Jn3O3~moqu2Fs1oL*>7m=oVek2bnprnW zixkaIFU%+3XhNA@@9hyhFwqsH2bM|`P?G>i<-gy>NflhrN{$9?LZ1ynSE_Mj0rADF zhOz4FnK}wpLmQuV zgO4_Oz9GBu_NN>cPLA=`SP^$gxAnj;WjJnBi%Q1zg`*^cG;Q)#3Gv@c^j6L{arv>- zAW%8WrSAVY1sj$=umcAf#ZgC8UGZGoamK}hR7j6}i8#np8ruUlvgQ$j+AQglFsQQq zOjyHf22pxh9+h#n$21&$h?2uq0>C9P?P=Juw0|;oE~c$H{#RGfa>| zj)Iv&uOnaf@foiBJ}_;zyPHcZt1U~nOcNB{)og8Btv+;f@PIT*xz$x!G?u0Di$lo7 zOugtQ$Wx|C($fyJTZE1JvR~i7LP{ zbdIwqYghQAJi9p}V&$=*2Azev$6K@pyblphgpv8^9bN!?V}{BkC!o#bl&AP!3DAjM zmWFsvn2fKWCfjcAQmE+=c3Y7j@#7|{;;0f~PIodmq*;W9Fiak|gil6$w3%b_Pr6K_ zJEG@&!J%DgBZJDCMn^7mk`JV0&l07Bt`1ymM|;a)MOWz*bh2#d{i?SDe9IcHs7 zjCrnyQ*Y5GzIt}>`bD91o#~5H?4_nckAgotN{2%!?wsSl|LVmJht$uhGa+HiH>;av z8c?mcMYM7;mvWr6noUR{)gE!=i7cZUY7e;HXa221KkRoc2UB>s$Y(k%NzTSEr>W(u z<(4mcc)4rB_&bPzX*1?*ra%VF}P1nwiP5cykJ&W{!OTlz&Td0pOkVp+wc z@k=-Hg=()hNg=Q!Ub%`BONH{ z_=ZFgetj@)NvppAK2>8r!KAgi>#%*7;O-o9MOOfQjV-n@BX6;Xw;I`%HBkk20v`qoVd0)}L6_49y1IhR z_OS}+eto}OPVRn*?UHC{eGyFU7JkPz!+gX4P>?h3QOwGS63fv4D1*no^6PveUeE5% zlehjv_3_^j^C({a2&RSoVlOn71D8WwMu9@Nb@=E_>1R*ve3`#TF(NA0?d9IR_tm=P zOP-x;gS*vtyE1Cm zG0L?2nRUFj#aLr-R1fX*$sXhad)~xdA*=hF3zPZhha<2O$Ps+F07w*3#MTe?)T8|A!P!v+a|ot{|^$q(TX`35O{WI0RbU zCj?hgOv=Z)xV?F`@HKI11IKtT^ocP78cqHU!YS@cHI@{fPD?YXL)?sD~9thOAv4JM|K8OlQhPXgnevF=F7GKD2#sZW*d za}ma31wLm81IZxX(W#A9mBvLZr|PoLnP>S4BhpK8{YV_}C|p<)4#yO{#ISbco92^3 zv&kCE(q9Wi;9%7>>PQ!zSkM%qqqLZW7O`VXvcj;WcJ`2~v?ZTYB@$Q&^CTfvy?1r^ z;Cdi+PTtmQwHX_7Kz?r#1>D zS5lWU(Mw_$B&`ZPmqxpIvK<~fbXq?x20k1~9az-Q!uR78mCgRj*eQ>zh3c$W}>^+w^dIr-u{@s30J=)1zF8?Wn|H`GS<=>Om|DjzC{}Jt?{!fSJe*@$H zg>wFnlT)k#T?LslW zu$^7Uy~$SQ21cE?3Ijl+bLfuH^U5P^$@~*UY#|_`uvAIe(+wD2eF}z_y!pvomuVO; zS^9fbdv)pcm-B@CW|Upm<7s|0+$@@<&*>$a{aW+oJ%f+VMO<#wa)7n|JL5egEgoBv zl$BY(NQjE0#*nv=!kMnp&{2Le#30b)Ql2e!VkPLK*+{jv77H7)xG7&=aPHL7LK9ER z5lfHxBI5O{-3S?GU4X6$yVk>lFn;ApnwZybdC-GAvaznGW-lScIls-P?Km2mF>%B2 zkcrXTk+__hj-3f48U%|jX9*|Ps41U_cd>2QW81Lz9}%`mTDIhE)jYI$q$ma7Y-`>% z8=u+Oftgcj%~TU}3nP8&h7k+}$D-CCgS~wtWvM|UU77r^pUw3YCV80Ou*+bH0!mf0 zxzUq4ed6y>oYFz7+l18PGGzhB^pqSt)si=9M>~0(Bx9*5r~W7sa#w+_1TSj3Jn9mW zMuG9BxN=}4645Cpa#SVKjFst;9UUY@O<|wpnZk$kE+to^4!?0@?Cwr3(>!NjYbu?x z1!U-?0_O?k!NdM^-rIQ8p)%?M+2xkhltt*|l=%z2WFJhme7*2xD~@zk#`dQR$6Lmd zb3LOD4fdt$Cq>?1<%&Y^wTWX=eHQ49Xl_lFUA(YQYHGHhd}@!VpYHHm=(1-O=yfK#kKe|2Xc*9}?BDFN zD7FJM-AjVi)T~OG)hpSWqH>vlb41V#^G2B_EvYlWhDB{Z;Q9-0)ja(O+By`31=biA zG&Fs#5!%_mHi|E4Nm$;vVQ!*>=_F;ZC=1DTPB#CICS5fL2T3XmzyHu?bI;m7D4@#; ztr~;dGYwb?m^VebuULtS4lkC_7>KCS)F@)0OdxZIFZp@FM_pHnJes8YOvwB|++#G( z&dm*OP^cz95Wi15vh`Q+yB>R{8zqEhz5of>Po$9LNE{xS<)lg2*roP*sQ}3r3t<}; zPbDl{lk{pox~2(XY5=qg0z!W-x^PJ`VVtz$git7?)!h>`91&&hESZy1KCJ2nS^yMH z!=Q$eTyRi68rKxdDsdt+%J_&lapa{ds^HV9Ngp^YDvtq&-Xp}60B_w@Ma>_1TTC;^ zpbe!#gH}#fFLkNo#|`jcn?5LeUYto%==XBk6Ik0kc4$6Z+L3x^4=M6OI1=z5u#M%0 z0E`kevJEpJjvvN>+g`?gtnbo$@p4VumliZV3Z%CfXXB&wPS^5C+7of2tyVkMwNWBiTE2 z8CdPu3i{*vR-I(NY5syRR}I1TJOV@DJy-Xmvxn^IInF>Tx2e)eE9jVSz69$6T`M9-&om!T+I znia!ZWJRB28o_srWlAxtz4VVft8)cYloIoVF=pL zugnk@vFLXQ_^7;%hn9x;Vq?lzg7%CQR^c#S)Oc-8d=q_!2ZVH764V z!wDKSgP}BrVV6SfCLZnYe-7f;igDs9t+K*rbMAKsp9L$Kh<6Z;e7;xxced zn=FGY<}CUz31a2G}$Q(`_r~75PzM4l_({Hg&b@d8&jC}B?2<+ed`f#qMEWi z`gm!STV9E4sLaQX+sp5Nu9*;9g12naf5?=P9p@H@f}dxYprH+3ju)uDFt^V{G0APn zS;16Dk{*fm6&BCg#2vo?7cbkkI4R`S9SSEJ=#KBk3rl69SxnCnS#{*$!^T9UUmO#&XXKjHKBqLdt^3yVvu8yn|{ zZ#%1CP)8t-PAz(+_g?xyq;C2<9<5Yy<~C74Iw(y>uUL$+$mp(DRcCWbCKiGCZw@?_ zdomfp+C5xt;j5L@VfhF*xvZdXwA5pcdsG>G<8II-|1dhAgzS&KArcb0BD4ZZ#WfiEY{hkCq5%z9@f|!EwTm;UEjKJsUo696V>h zy##eXYX}GUu%t{Gql8vVZKkNhQeQ4C%n|RmxL4ee5$cgwlU+?V7a?(jI#&3wid+Kz5+x^G!bb#$q>QpR#BZ}Xo5UW^ zD&I`;?(a}Oys7-`I^|AkN?{XLZNa{@27Dv^s4pGowuyhHuXc zuctKG2x0{WCvg_sGN^n9myJ}&FXyGmUQnW7fR$=bj$AHR88-q$D!*8MNB{YvTTEyS zn22f@WMdvg5~o_2wkjItJN@?mDZ9UUlat2zCh(zVE=dGi$rjXF7&}*sxac^%HFD`Y zTM5D3u5x**{bW!68DL1A!s&$2XG@ytB~dX-?BF9U@XZABO`a|LM1X3HWCllgl0+uL z04S*PX$%|^WAq%jkzp~%9HyYIF{Ym?k)j3nMwPZ=hlCg9!G+t>tf0o|J2%t1 ztC+`((dUplgm3`+0JN~}&FRRJ3?l*>Y&TfjS>!ShS`*MwO{WIbAZR#<%M|4c4^dY8 z{Rh;-!qhY=dz5JthbWoovLY~jNaw>%tS4gHVlt5epV8ekXm#==Po$)}mh^u*cE>q7*kvX&gq)(AHoItMYH6^s6f(deNw%}1=7O~bTHSj1rm2|Cq+3M z93djjdomWCTCYu!3Slx2bZVy#CWDozNedIHbqa|otsUl+ut?>a;}OqPfQA05Yim_2 zs@^BjPoFHOYNc6VbNaR5QZfSMh2S*`BGwcHMM(1@w{-4jVqE8Eu0Bi%d!E*^Rj?cR z7qgxkINXZR)K^=fh{pc0DCKtrydVbVILI>@Y0!Jm>x-xM!gu%dehm?cC6ok_msDVA*J#{75%4IZt}X|tIVPReZS#aCvuHkZxc zHVMtUhT(wp09+w9j9eRqz~LtuSNi2rQx_QgQ(}jBt7NqyT&ma61ldD(s9x%@q~PQl zp6N*?=N$BtvjQ_xIT{+vhb1>{pM0Arde0!X-y))A4znDrVx8yrP3B1(7bKPE5jR@5 zwpzwT4cu~_qUG#zYMZ_!2Tkl9zP>M%cy>9Y(@&VoB84#%>amTAH{(hL4cDYt!^{8L z645F>BWO6QaFJ-{C-i|-d%j7#&7)$X7pv#%9J6da#9FB5KyDhkA+~)G0^87!^}AP>XaCSScr;kL;Z%RSPD2CgoJ;gpYT5&6NUK$86$T?jRH=w8nI9Z534O?5fk{kd z`(-t$8W|#$3>xoMfXvV^-A(Q~$8SKDE^!T;J+rQXP71XZ(kCCbP%bAQ1|%$%Ov9_a zyC`QP3uPvFoBqr_+$HenHklqyIr>PU_Fk5$2C+0eYy^~7U&(!B&&P2%7#mBUhM!z> z_B$Ko?{Pf6?)gpYs~N*y%-3!1>o-4;@1Zz9VQHh)j5U1aL-Hyu@1d?X;jtDBNk*vMXPn@ z+u@wxHN*{uHR!*g*4Xo&w;5A+=Pf9w#PeZ^x@UD?iQ&${K2c}UQgLRik-rKM#Y5rdDphdcNTF~cCX&9ViRP}`>L)QA4zNXeG)KXFzSDa6 zd^St;inY6J_i=5mcGTx4_^Ys`M3l%Q==f>{8S1LEHn{y(kbxn5g1ezt4CELqy)~TV6{;VW>O9?5^ ztcoxHRa0jQY7>wwHWcxA-BCwzsP>63Kt&3fy*n#Cha687CQurXaRQnf5wc9o8v7Rw zNwGr2fac;Wr-Ldehn7tF^(-gPJwPt@VR1f;AmKgxN&YPL;j=0^xKM{!wuU|^mh3NE zy35quf}MeL!PU;|{OW_x$TBothLylT-J>_x6p}B_jW1L>k)ps6n%7Rh z96mPkJIM0QFNYUM2H}YF5bs%@Chs6#pEnloQhEl?J-)es!(SoJpEPoMTdgA14-#mC zghayD-DJWtUu`TD8?4mR)w5E`^EHbsz2EjH5aQLYRcF{l7_Q5?CEEvzDo(zjh|BKg z3aJl_n#j&eFHsUw4~lxqnr!6NL*se)6H=A+T1e3xUJGQrd}oSPwSy5+$tt{2t5J5@(lFxl43amsARG74iyNC}uuS zd2$=(r6RdamdGx^eatX@F2D8?U23tDpR+Os?0Gq2&^dF+$9wiWf?=mDWfjo4LfRwL zI#SRV9iSz>XCSgEj!cW&9H-njJopYiYuq|2w<5R2!nZ27DyvU4UDrHpoNQZiGPkp@ z1$h4H46Zn~eqdj$pWrv;*t!rTYTfZ1_bdkZmVVIRC21YeU$iS-*XMNK`#p8Z_DJx| zk3Jssf^XP7v0X?MWFO{rACltn$^~q(M9rMYoVxG$15N;nP)A98k^m3CJx8>6}NrUd@wp-E#$Q0uUDQT5GoiK_R{ z<{`g;8s>UFLpbga#DAf%qbfi`WN1J@6IA~R!YBT}qp%V-j!ybkR{uY0X|x)gmzE0J z&)=eHPjBxJvrZSOmt|)hC+kIMI;qgOnuL3mbNR0g^<%|>9x7>{}>a2qYSZAGPt4it?8 zNcLc!Gy0>$jaU?}ZWxK78hbhzE+etM`67*-*x4DN>1_&{@5t7_c*n(qz>&K{Y?10s zXsw2&nQev#SUSd|D8w7ZD2>E<%g^; zV{yE_O}gq?Q|zL|jdqB^zcx7vo(^})QW?QKacx$yR zhG|XH|8$vDZNIfuxr-sYFR{^csEI*IM#_gd;9*C+SysUFejP0{{z7@P?1+&_o6=7V|EJLQun^XEMS)w(=@eMi5&bbH*a0f;iC~2J74V2DZIlLUHD&>mlug5+v z6xBN~8-ovZylyH&gG#ptYsNlT?-tzOh%V#Y33zlsJ{AIju`CjIgf$@gr8}JugRq^c zAVQ3;&uGaVlVw}SUSWnTkH_6DISN&k2QLMBe9YU=sA+WiX@z)FoSYX`^k@B!j;ZeC zf&**P?HQG6Rk98hZ*ozn6iS-dG}V>jQhb3?4NJB*2F?6N7Nd;EOOo;xR7acylLaLy z9)^lykX39d@8@I~iEVar4jmjjLWhR0d=EB@%I;FZM$rykBNN~jf>#WbH4U{MqhhF6 zU??@fSO~4EbU4MaeQ_UXQcFyO*Rae|VAPLYMJEU`Q_Q_%s2*>$#S^)&7er+&`9L=1 z4q4ao07Z2Vsa%(nP!kJ590YmvrWg+YrgXYs_lv&B5EcoD`%uL79WyYA$0>>qi6ov7 z%`ia~J^_l{p39EY zv>>b}Qs8vxsu&WcXEt8B#FD%L%ZpcVtY!rqVTHe;$p9rbb5O{^rFMB>auLn-^;s+-&P1#h~mf~YLg$8M9 zZ4#87;e-Y6x6QO<{McUzhy(%*6| z)`D~A(TJ$>+0H+mct(jfgL4x%^oC^T#u(bL)`E2tBI#V1kSikAWmOOYrO~#-cc_8! zCe|@1&mN2{*ceeiBldHCdrURk4>V}79_*TVP3aCyV*5n@jiNbOm+~EQ_}1#->_tI@ zqXv+jj2#8xJtW508rzFrYcJxoek@iW6SR@1%a%Bux&;>25%`j3UI`0DaUr7l79`B1 zqqUARhW1^h6=)6?;@v>xrZNM;t}{yY3P@|L}ey@gG( z9r{}WoYN(9TW&dE2dEJIXkyHA4&pU6ki=rx&l2{DLGbVmg4%3Dlfvn!GB>EVaY_%3+Df{fBiqJV>~Xf8A0aqUjgpa} zoF8YXO&^_x*Ej}nw-$-F@(ddB>%RWoPUj?p8U{t0=n>gAI83y<9Ce@Q#3&(soJ{64 z37@Vij1}5fmzAuIUnXX`EYe;!H-yTVTmhAy;y8VZeB#vD{vw9~P#DiFiKQ|kWwGFZ z=jK;JX*A;Jr{#x?n8XUOLS;C%f|zj-7vXtlf_DtP7bpurBeX%Hjwr z4lI-2TdFpzkjgiv!8Vfv`=SP+s=^i3+N~1ELNWUbH|ytVu>EyPN_3(4TM^QE1swRo zoV7Y_g)a>28+hZG0e7g%@2^s>pzR4^fzR-El}ARTmtu!zjZLuX%>#OoU3}|rFjJg} zQ2TmaygxJ#sbHVyiA5KE+yH0LREWr%^C*yR|@gM$nK2P zo}M}PV0v))uJh&33N>#aU376@ZH79u(Yw`EQ2hM3SJs9f99+cO6_pNW$j$L-CtAfe zYfM)ccwD!P%LiBk!eCD?fHCGvgMQ%Q2oT_gmf?OY=A>&PaZQOq4eT=lwbaf}33LCH zFD|)lu{K7$8n9gX#w4~URjZxWm@wlH%oL#G|I~Fb-v^0L0TWu+`B+ZG!yII)w05DU z>GO?n(TN+B=>HdxVDSlIH76pta$_LhbBg;eZ`M7OGcqt||qi zogS72W1IN%=)5JCyOHWoFP7pOFK0L*OAh=i%&VW&4^LF@R;+K)t^S!96?}^+5QBIs zjJNTCh)?)4k^H^g1&jc>gysM`y^8Rm3qsvkr$9AeWwYpa$b22=yAd1t<*{ zaowSEFP+{y?Ob}8&cwfqoy4Pb9IA~VnM3u!trIK$&&0Op#Ql4j>(EW?UNUv#*iH1$ z^j>+W{afcd`{e&`-A{g}{JnIzYib)!T56IT@YEs{4|`sMpW3c8@UCoIJv`XsAw!XC z34|Il$LpW}CIHFC5e*)}00I5{%OL*WZRGzC0?_}-9{#ue?-ug^ zLE|uv-~6xnSs_2_&CN9{9vyc!Xgtn36_g^wI0C4s0s^;8+p?|mm;Odt3`2ZjwtK;l zfd6j)*Fr#53>C6Y8(N5?$H0ma;BCF3HCjUs7rpb2Kf*x3Xcj#O8mvs#&33i+McX zQpBxD8!O{5Y8D&0*QjD=Yhl9%M0)&_vk}bmN_Ud^BPN;H=U^bn&(csl-pkA+GyY0Z zKV7sU_4n;}uR78ouo8O%g*V;79KY?3d>k6%gpcmQsKk&@Vkw9yna_3asGt`0Hmj59 z%0yiF*`jXhByBI9QsD=+>big5{)BGe&+U2gAARGe3ID)xrid~QN_{I>k}@tzL!Md_ z&=7>TWciblF@EMC3t4-WX{?!m!G6$M$1S?NzF*2KHMP3Go4=#ZHkeIv{eEd;s-yD# z_jU^Ba06TZqvV|Yd;Z_sN%$X=!T+&?#p+OQIHS%!LO`Hx0q_Y0MyGYFNoM{W;&@0@ zLM^!X4KhdtsET5G<0+|q0oqVXMW~-7LW9Bg}=E$YtNh1#1D^6Mz(V9?2g~I1( zoz9Cz=8Hw98zVLwC2AQvp@pBeKyidn6Xu0-1SY1((^Hu*-!HxFUPs)yJ+i`^BC>PC zjwd0mygOVK#d2pRC9LxqGc6;Ui>f{YW9Bvb>33bp^NcnZoH~w9(lM5@JiIlfa-6|k ziy31UoMN%fvQfhi8^T+=yrP{QEyb-jK~>$A4SZT-N56NYEbpvO&yUme&pWKs3^94D zH{oXnUTb3T@H+RgzML*lejx`WAyw*?K7B-I(VJx($2!NXYm%3`=F~TbLv3H<{>D?A zJo-FDYdSA-(Y%;4KUP2SpHKAIcv9-ld(UEJE7=TKp|Gryn;72?0LHqAN^fk6%8PCW z{g_-t)G5uCIf0I`*F0ZNl)Z>))MaLMpXgqWgj-y;R+@A+AzDjsTqw2Mo9ULKA3c70 z!7SOkMtZb+MStH>9MnvNV0G;pwSW9HgP+`tg}e{ij0H6Zt5zJ7iw`hEnvye!XbA@!~#%vIkzowCOvq5I5@$3wtc*w2R$7!$*?}vg4;eDyJ_1=ixJuEp3pUS27W?qq(P^8$_lU!mRChT}ctvZz4p!X^ zOSp|JOAi~f?UkwH#9k{0smZ7-#=lK6X3OFEMl7%)WIcHb=#ZN$L=aD`#DZKOG4p4r zwlQ~XDZ`R-RbF&hZZhu3(67kggsM-F4Y_tI^PH8PMJRcs7NS9ogF+?bZB*fcpJ z=LTM4W=N9yepVvTj&Hu~0?*vR1HgtEvf8w%Q;U0^`2@e8{SwgX5d(cQ|1(!|i$km! zvY03MK}j`sff;*-%mN~ST>xU$6Bu?*Hm%l@0dk;j@%>}jsgDcQ)Hn*UfuThz9(ww_ zasV`rSrp_^bp-0sx>i35FzJwA!d6cZ5#5#nr@GcPEjNnFHIrtUYm1^Z$;{d&{hQV9 z6EfFHaIS}46p^5I-D_EcwwzUUuO}mqRh&T7r9sfw`)G^Q%oHxEs~+XoM?8e*{-&!7 z7$m$lg9t9KP9282eke608^Q2E%H-xm|oJ8=*SyEo} z@&;TQ3K)jgspgKHyGiKVMCz>xmC=H5Fy3!=TP)-R3|&1S-B)!6q50wfLHKM@7Bq6E z44CY%G;GY>tC`~yh!qv~YdXw! zSkquvYNs6k1r7>Eza?Vkkxo6XRS$W7EzL&A`o>=$HXgBp{L(i^$}t`NcnAxzbH8Ht z2!;`bhKIh`f1hIFcI5bHI=ueKdzmB9)!z$s-BT4ItyY|NaA_+o=jO%MU5as9 zc2)aLP>N%u>wlaXTK!p)r?+~)L+0eCGb5{8WIk7K52$nufnQ+m8YF+GQc&{^(zh-$ z#wyWV*Zh@d!b(WwXqvfhQX)^aoHTBkc;4ossV3&Ut*k>AI|m+{#kh4B!`3*<)EJVj zwrxK>99v^k4&Y&`Awm>|exo}NvewV%E+@vOc>5>%H#BK9uaE2$vje zWYM5fKuOTtn96B_2~~!xJPIcXF>E_;yO8AwpJ4)V`Hht#wbO3Ung~@c%%=FX4)q+9 z99#>VC2!4l`~0WHs9FI$Nz+abUq# zz`Of97})Su=^rGp2S$)7N3rQCj#0%2YO<R&p>$<#lgXcUj=4H_{oAYiT3 z44*xDn-$wEzRw7#@6aD)EGO$0{!C5Z^7#yl1o;k0PhN=aVUQu~eTQ^Xy{z8Ow6tk83 z4{5xe%(hx)%nD&|e*6sTWH`4W&U!Jae#U4TnICheJmsw{l|CH?UA{a6?2GNgpZLyzU2UlFu1ZVwlALmh_DOs03J^Cjh1im`E3?9&zvNmg(MuMw&0^Lu$(#CJ*q6DjlKsY-RMJ^8yIY|{SQZ*9~CH|u9L z`R78^r=EbbR*_>5?-)I+$6i}G)%mN(`!X72KaV(MNUP7Nv3MS9S|Pe!%N2AeOt5zG zVJ;jI4HZ$W->Ai_4X+`9c(~m=@ek*m`ZQbv3ryI-AD#AH=`x$~WeW~M{Js57(K7(v ze5`};LG|%C_tmd>bkufMWmAo&B+DT9ZV~h(4jg0>^aeAqL`PEUzJJtI8W1M!bQWpv zvN(d}E1@nlYa!L!!A*RN!(Q3F%J?5PvQ0udu?q-T)j3JKV~NL>KRb~w-lWc685uS6 z=S#aR&B8Sc8>cGJ!!--?kwsJTUUm`Jk?7`H z7PrO~xgBrSW2_tTlCq1LH8*!o?pj?qxy8}(=r_;G18POrFh#;buWR0qU24+XUaVZ0 z?(sXcr@-YqvkCmHr{U2oPogHL{r#3r49TeR<{SJX1pcUqyWPrkYz^X8#QW~?F)R5i z>p^!i<;qM8Nf{-fd6!_&V*e_9qP6q(s<--&1Ttj01j0w>bXY7y1W*%Auu&p|XSOH=)V7Bd4fUKh&T1)@cvqhuD-d=?w}O zjI%i(f|thk0Go*!d7D%0^ztBfE*V=(ZIN84f5HU}T9?ulmEYzT5usi=DeuI*d|;M~ zp_=Cx^!4k#=m_qSPBr5EK~E?3J{dWWPH&oCcNepYVqL?nh4D5ynfWip$m*YlZ8r^Z zuFEUL-nW!3qjRCLIWPT0x)FDL7>Yt7@8dA?R2kF@WE>ysMY+)lTsgNM#3VbXVGL}F z1O(>q>2a+_`6r5Xv$NZAnp=Kgnr3)cL(^=8ypEeOf3q8(HGe@7Tt59;yFl||w|mnO zHDxg2G3z8=(6wjj9kbcEY@Z0iOd7Gq5GiPS5% z*sF1J<#daxDV2Z8H>wxOF<;yKzMeTaSOp_|XkS9Sfn6Mpe9UBi1cSTieGG5$O;ZLIIJ60Y>SN4vC?=yE_CWlo(EEE$e4j?z&^FM%kNmRtlbEL^dPPgvs9sbK5fGw*r@ z+!EU@u$T8!nZh?Fdf_qk$VuHk^yVw`h`_#KoS*N%epIIOfQUy_&V}VWDGp3tplMbf z5Se1sJUC$7N0F1-9jdV2mmGK{-}fu|Nv;12jDy0<-kf^AmkDnu6j~TPWOgy1MT68|D z=4=50jVbUKdKaQgD`eWGr3I&^<6uhkjz$YwItY8%Yp9{z4-{6g{73<_b*@XJ4Nm3-3z z?BW3{aY_ccRjb@W1)i5nLg|7BnWS!B`_Uo9CWaE`Ij327QH?i)9A}4Ug4wmxVVa^b z-4+m%-wwOl7cKH7+=x&nrCrbEC)Q$fpg&V83#uEH;C=GNMz`ps@^RxK%T*8%OPnC` z{WO~J%nxYJ`x|N%?&i7?;{_8t^jM&=50HlaOQj8fS}_`moH$c;vI<|cruPFnpT8yU zS%rPOCUSd5Zdb(zwk`hqwTQn)*&n)uYsP*F_(~xEWq}C= zv30kFmZFwJZ@ELVX3?$dXQh|icO7UrL*_5G=I^xXjImz`ZPp>?g#tf(ej~KaIU0algsG!IS09;>?MvqGg#c{i+}qY|{P8W~O%#>|gFd z<1dr$-oxyRGN17yZo1OwLnzwYs0|;IS_nymNB0IlSzPQ%-r`?T=;_XQ^~&#}b|AB} zkNbN5uB?-sUB-T5QLlg%Uk3)uHB;>VIzGe9_J9 zaeISkQm!v(9d(0ML^b9fR^sfHFlH?7Mvddt37OuR{|O0{uv)(&-6<87W4 zyO>s!=cPgP3O&7xxU5DlIPw_o3O>6o6Qb?JWs3qw#p3sBc3g$?Dx zi(6D+DYgV;GrUis-CL%Qe{nvZnwaVXmbhH(|GFh|Q)k=1uvA$I@1DXI7bKlQ@8D6P zS?(*?><>)G49q0wr;NajpxP4W2G)kHl6^=Z>hrNEI4Mwd_$O6$1dXF;Q#hE(-eeW6 zz03GJF%Wl?HO=_ztv5*zRlcU~{+{k%#N59mgm~eK>P!QZ6E?#Cu^2)+K8m@ySvZ*5 z|HDT}BkF@3!l(0%75G=1u2hETXEj!^1Z$!)!lyGXlWD!_vqGE$Z)#cUVBqlORW>0^ zDjyVTxwKHKG|0}j-`;!R-p>}qQfBl(?($7pP<+Y8QE#M8SCDq~k<+>Q^Zf@cT_WdX3~BSe z+|KK|7OL5Hm5(NFP~j>Ct3*$wi0n0!xl=(C61`q&cec@mFlH(sy%+RH<=s)8aAPN`SfJdkAQjdv82G5iRdv8 zh{9wHUZaniSEpslXl^_ODh}mypC?b*9FzLjb~H@3DFSe;D(A-K3t3eOTB(m~I6C;(-lKAvit(70k`%@+O*Ztdz;}|_TS~B?Tpmi=QKC^m_ z2YpEaT3iiz*;T~ap1yiA)a`dKMwu`^UhIUeltNQ1Yjo=q@bI@&3zH?rVUg=IxLy-ni zyxDu%-Fr{H6owTjZU2O5>nDb=q&Jz_TjeSq%!2m40x&U6w~GQ({quPL73IsJS;f`$ zsuhioqCBj(gJ>2hoo)Gou7(WP*pX)f=Y=!=k!&1K?EYY%jJ~X&DnK{^saPQK<1BJ z_A`_{%ZozcB(3w$z^To^6d|XuT@=X~wtW!+{4ID@N{AB~J6AL5vuY>JwvWCNFKsKh zd}@>q@_WV#QZ&UJ0#?X(pXR!oyXOEG3rqzHbCzGLONDb042i$})fM@XF)uSP(DHUc z^&{|$*xe{cs?Gp8=B%RY3L7#$ve$?TWh>MZdxF1zH1v}1z+$Ov#G7?%D)bBCyDe*% zSeKSpETC2V1){II>@UwJi>4uBN+iAx+82E~gb|Cr&8E^i&)A!uv-g?jzH99wU}8+# z$nh>yvb;TwZmS@7LrvuCu_d0-WxFNI&C7%sWuTL%YU!l|I1{|->=dlOeHOCtUO#zkS3ESO8LHV4hTdQL5EdV zuWD33fFPH}HPrW^s$Qn1Xgp&AT6<-He{{4%eIu3rN=iK|9mURdKXfB&Q?qGok%!cs ze53UP{Z!TO-Y@q2;;k2avA3`lm4OoN4@S*k=UA)7H;qZ`d8`XaYFCv?Ba+uGW@r5v z&&{nf(24WSBOhc7!qF^@0cz;XcUynNaj6w2349;s!K{KVqs5yS{ z7VubS`2OzT^5#1~6Tt^RTvt9-J|D2F>y~>2;jeF>g`hx5l%B3H=aLExQihuYngzlnBTYOTHJQMzl>kwqN5JYs)Ej zblA@ntkUS~xi+}y6|(81helS}Q~&VB37qyV|S3Y=><^1wh%msQM?fz z<58MX(=|PSUKCF#)dbhR%D&xgCD?$aR0qen+wpp6 zst}vX18!Be96TD??j1HsHTUx(a&@F?=gT`Q$oJFFyrh^;zgz!(NlAHGn0cJy@us=w zNhC#l5G;H}+>49Nsh12=ZPO2r*2OBQe5kpb&1?*PIBFitK8}FUfb~S-#hKfF0o#&d z#3aPkB$9scYku&kA6{0xHnBV#&Wei5J>5T-XX-gUXEPo+9b7WL=*XESc(3BshL`aj zXp}QIp*40}oWJt*l043e8_5;H5PI5c)U&IEw5dF(4zjX0y_lk9 zAp@!mK>WUqHo)-jop=DoK>&no>kAD=^qIE7qis&_*4~ z6q^EF$D@R~3_xseCG>Ikb6Gfofb$g|75PPyyZN&tiRxqovo_k zO|HA|sgy#B<32gyU9x^&)H$1jvw@qp+1b(eGAb)O%O!&pyX@^nQd^9BQ4{(F8<}|A zhF&)xusQhtoXOOhic=8#Xtt5&slLia3c*a?dIeczyTbC#>FTfiLST57nc3@Y#v_Eg#VUv zT8cKH#f3=1PNj!Oroz_MAR*pow%Y0*6YCYmUy^7`^r|j23Q~^*TW#cU7CHf0eAD_0 zEWEVddxFgQ7=!nEBQ|ibaScslvhuUk^*%b#QUNrEB{3PG@uTxNwW}Bs4$nS9wc(~O zG7Iq>aMsYkcr!9#A;HNsJrwTDYkK8ikdj{M;N$sN6BqJ<8~z>T20{J8Z2rRUuH7~3 z=tgS`AgxbBOMg87UT4Lwge`*Y=01Dvk>)^{Iu+n6fuVX4%}>?3czOGR$0 zpp*wp>bsFFSV`V;r_m+TZns$ZprIi`OUMhe^cLE$2O+pP3nP!YB$ry}2THx2QJs3< za1;>d-AggCarrQ>&Z!d@;mW+!q6eXhb&`GbzUDSxpl8AJ#Cm#tuc)_xh(2NV=5XMs zrf_ozRYO$NkC=pKFX5OH8v1>0i9Z$ec`~Mf+_jQ68spn(CJwclDhEEkH2Qw;${J$clv__nUjn5jA0wCLEnu1j;v!0vB>Ri6m9`;R{JMS%^)4FC zU0Z44+u$I$w=Bj|iu4DT5h~sS`C*zbmX?@-crY}E+hy>}2~C0Nn(EKk@5^qO4@l@! z6O0lr%tzGC`D^)8xU3FnMZVm0kX1sBWhaQyzVoXFWwr%Ny?=2M{5s#5i7fTu3gEkG zc{(Pr$v=;`Y#&`y*J}#M9ux>0?xu!`$9cUKm#Bdd_&S#LPTS?ZPV6zN6>W6JTS~-LfjL{mB=b(KMk3 z2HjBSlJeyUVqDd=Mt!=hpYsvby2GL&3~zm;0{^nZJq+4vb?5HH4wufvr}IX42sHeK zm@x?HN$8TsTavXs)tLDFJtY9b)y~Tl@7z4^I8oUQq4JckH@~CVQ;FoK(+e0XAM>1O z(ei}h?)JQp>)d=6ng-BZF1Z5hsAKW@mXq+hU?r8I(*%`tnIIOXw7V6ZK(T9RFJJe@ zZS!aC+p)Gf2Ujc=a6hx4!A1Th%YH!Lb^xpI!Eu` zmJO{9rw){B1Ql18d%F%da+Tbu1()?o(zT7StYqK6_w`e+fjXq5L^y(0 z09QA6H4oFj59c2wR~{~>jUoDzDdKz}5#onYPJRwa`SUO)Pd4)?(ENBaFVLJr6Kvz= zhTtXqbx09C1z~~iZt;g^9_2nCZ{};-b4dQJbv8HsWHXPVg^@(*!@xycp#R?a|L!+` zY5w))JWV`Gls(=}shH0#r*;~>_+-P5Qc978+QUd>J%`fyn{*TsiG-dWMiJXNgwBaT zJ=wgYFt+1ACW)XwtNx)Q9tA2LPoB&DkL16P)ERWQlY4%Y`-5aM9mZ{eKPUgI!~J3Z zkMd5A_p&v?V-o-6TUa8BndiX?ooviev(DKw=*bBVOW|=zps9=Yl|-R5@yJe*BPzN}a0mUsLn{4LfjB_oxpv(mwq# zSY*%E{iB)sNvWfzg-B!R!|+x(Q|b@>{-~cFvdDHA{F2sFGA5QGiIWy#3?P2JIpPKg6ncI^)dvqe`_|N=8 '} + case $link in #( + /*) app_path=$link ;; #( + *) app_path=$APP_HOME$link ;; + esac +done + +# This is normally unused +# shellcheck disable=SC2034 +APP_BASE_NAME=${0##*/} +# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036) +APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit + +# Use the maximum available, or set MAX_FD != -1 to use that value. +MAX_FD=maximum + +warn () { + echo "$*" +} >&2 + +die () { + echo + echo "$*" + echo + exit 1 +} >&2 + +# OS specific support (must be 'true' or 'false'). +cygwin=false +msys=false +darwin=false +nonstop=false +case "$( uname )" in #( + CYGWIN* ) cygwin=true ;; #( + Darwin* ) darwin=true ;; #( + MSYS* | MINGW* ) msys=true ;; #( + NONSTOP* ) nonstop=true ;; +esac + +CLASSPATH="\\\"\\\"" + + +# Determine the Java command to use to start the JVM. +if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD=$JAVA_HOME/jre/sh/java + else + JAVACMD=$JAVA_HOME/bin/java + fi + if [ ! -x "$JAVACMD" ] ; then + die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +else + JAVACMD=java + if ! command -v java >/dev/null 2>&1 + then + die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +fi + +# Increase the maximum file descriptors if we can. +if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then + case $MAX_FD in #( + max*) + # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked. + # shellcheck disable=SC2039,SC3045 + MAX_FD=$( ulimit -H -n ) || + warn "Could not query maximum file descriptor limit" + esac + case $MAX_FD in #( + '' | soft) :;; #( + *) + # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked. + # shellcheck disable=SC2039,SC3045 + ulimit -n "$MAX_FD" || + warn "Could not set maximum file descriptor limit to $MAX_FD" + esac +fi + +# Collect all arguments for the java command, stacking in reverse order: +# * args from the command line +# * the main class name +# * -classpath +# * -D...appname settings +# * --module-path (only if needed) +# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. + +# For Cygwin or MSYS, switch paths to Windows format before running java +if "$cygwin" || "$msys" ; then + APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) + CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) + + JAVACMD=$( cygpath --unix "$JAVACMD" ) + + # Now convert the arguments - kludge to limit ourselves to /bin/sh + for arg do + if + case $arg in #( + -*) false ;; # don't mess with options #( + /?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath + [ -e "$t" ] ;; #( + *) false ;; + esac + then + arg=$( cygpath --path --ignore --mixed "$arg" ) + fi + # Roll the args list around exactly as many times as the number of + # args, so each arg winds up back in the position where it started, but + # possibly modified. + # + # NB: a `for` loop captures its iteration list before it begins, so + # changing the positional parameters here affects neither the number of + # iterations, nor the values presented in `arg`. + shift # remove old arg + set -- "$@" "$arg" # push replacement arg + done +fi + + +# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' + +# Collect all arguments for the java command: +# * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments, +# and any embedded shellness will be escaped. +# * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be +# treated as '${Hostname}' itself on the command line. + +set -- \ + "-Dorg.gradle.appname=$APP_BASE_NAME" \ + -classpath "$CLASSPATH" \ + -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \ + "$@" + +# Stop when "xargs" is not available. +if ! command -v xargs >/dev/null 2>&1 +then + die "xargs is not available" +fi + +# Use "xargs" to parse quoted args. +# +# With -n1 it outputs one arg per line, with the quotes and backslashes removed. +# +# In Bash we could simply go: +# +# readarray ARGS < <( xargs -n1 <<<"$var" ) && +# set -- "${ARGS[@]}" "$@" +# +# but POSIX shell has neither arrays nor command substitution, so instead we +# post-process each arg (as a line of input to sed) to backslash-escape any +# character that might be a shell metacharacter, then use eval to reverse +# that process (while maintaining the separation between arguments), and wrap +# the whole thing up as a single "set" statement. +# +# This will of course break if any of these variables contains a newline or +# an unmatched quote. +# + +eval "set -- $( + printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | + xargs -n1 | + sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | + tr '\n' ' ' + )" '"$@"' + +exec "$JAVACMD" "$@" diff --git a/secretspec-jvm/gradlew.bat b/secretspec-jvm/gradlew.bat new file mode 100644 index 00000000..db3a6ac2 --- /dev/null +++ b/secretspec-jvm/gradlew.bat @@ -0,0 +1,94 @@ +@rem +@rem Copyright 2015 the original author or authors. +@rem +@rem Licensed under the Apache License, Version 2.0 (the "License"); +@rem you may not use this file except in compliance with the License. +@rem You may obtain a copy of the License at +@rem +@rem https://www.apache.org/licenses/LICENSE-2.0 +@rem +@rem Unless required by applicable law or agreed to in writing, software +@rem distributed under the License is distributed on an "AS IS" BASIS, +@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +@rem See the License for the specific language governing permissions and +@rem limitations under the License. +@rem +@rem SPDX-License-Identifier: Apache-2.0 +@rem + +@if "%DEBUG%"=="" @echo off +@rem ########################################################################## +@rem +@rem Gradle startup script for Windows +@rem +@rem ########################################################################## + +@rem Set local scope for the variables with windows NT shell +if "%OS%"=="Windows_NT" setlocal + +set DIRNAME=%~dp0 +if "%DIRNAME%"=="" set DIRNAME=. +@rem This is normally unused +set APP_BASE_NAME=%~n0 +set APP_HOME=%DIRNAME% + +@rem Resolve any "." and ".." in APP_HOME to make it shorter. +for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi + +@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" + +@rem Find java.exe +if defined JAVA_HOME goto findJavaFromJavaHome + +set JAVA_EXE=java.exe +%JAVA_EXE% -version >NUL 2>&1 +if %ERRORLEVEL% equ 0 goto execute + +echo. 1>&2 +echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2 +echo. 1>&2 +echo Please set the JAVA_HOME variable in your environment to match the 1>&2 +echo location of your Java installation. 1>&2 + +goto fail + +:findJavaFromJavaHome +set JAVA_HOME=%JAVA_HOME:"=% +set JAVA_EXE=%JAVA_HOME%/bin/java.exe + +if exist "%JAVA_EXE%" goto execute + +echo. 1>&2 +echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2 +echo. 1>&2 +echo Please set the JAVA_HOME variable in your environment to match the 1>&2 +echo location of your Java installation. 1>&2 + +goto fail + +:execute +@rem Setup the command line + +set CLASSPATH= + + +@rem Execute Gradle +"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* + +:end +@rem End local scope for the variables with windows NT shell +if %ERRORLEVEL% equ 0 goto mainEnd + +:fail +rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of +rem the _cmd.exe /c_ return code! +set EXIT_CODE=%ERRORLEVEL% +if %EXIT_CODE% equ 0 set EXIT_CODE=1 +if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE% +exit /b %EXIT_CODE% + +:mainEnd +if "%OS%"=="Windows_NT" endlocal + +:omega diff --git a/secretspec-jvm/library/build.gradle.kts b/secretspec-jvm/library/build.gradle.kts new file mode 100644 index 00000000..89a3a51c --- /dev/null +++ b/secretspec-jvm/library/build.gradle.kts @@ -0,0 +1,47 @@ +plugins { + `java-library` +} + +group = "org.cachix" + +version = providers.gradleProperty("secretspec.version").get() + +base { + archivesName.set("secretspec-jvm") +} + +java { + toolchain { + languageVersion.set(JavaLanguageVersion.of(11)) + } + withSourcesJar() + withJavadocJar() +} + +repositories { + mavenCentral() +} + +dependencies { + val jnaVersion = "5.19.1" + val jacksonVersion = "2.21.5" + val junitVersion = "5.14.4" + val junitPlatformVersion = "1.14.4" + val assertjVersion = "3.27.7" + + implementation("net.java.dev.jna:jna:$jnaVersion") + implementation("com.fasterxml.jackson.core:jackson-databind:$jacksonVersion") + + testImplementation("org.junit.jupiter:junit-jupiter-api:$junitVersion") + testImplementation("org.assertj:assertj-core:$assertjVersion") + + testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:$junitVersion") + testRuntimeOnly("org.junit.platform:junit-platform-launcher:$junitPlatformVersion") +} + +tasks.test { + useJUnitPlatform() + testLogging { + events("passed", "skipped", "failed") + } +} diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/JsonContracts.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/JsonContracts.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/JsonContracts.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/JsonContracts.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/MissingRequiredException.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/MissingRequiredException.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/MissingRequiredException.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/MissingRequiredException.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/Native.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/Native.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/Native.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/Native.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/ResolutionReport.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/ResolutionReport.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/ResolutionReport.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/ResolutionReport.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/Resolved.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/Resolved.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/Resolved.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/Resolved.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/ResolvedSecret.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/ResolvedSecret.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/ResolvedSecret.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/ResolvedSecret.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretReport.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/SecretReport.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/SecretReport.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/SecretReport.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpec.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/SecretSpec.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpec.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/SecretSpec.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/SecretSpecBuilder.java diff --git a/secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecException.java b/secretspec-jvm/library/src/main/java/org/cachix/secretspec/SecretSpecException.java similarity index 100% rename from secretspec-jvm/src/main/java/org/cachix/secretspec/SecretSpecException.java rename to secretspec-jvm/library/src/main/java/org/cachix/secretspec/SecretSpecException.java diff --git a/secretspec-jvm/src/test/java/org/cachix/secretspec/NativeTest.java b/secretspec-jvm/library/src/test/java/org/cachix/secretspec/NativeTest.java similarity index 100% rename from secretspec-jvm/src/test/java/org/cachix/secretspec/NativeTest.java rename to secretspec-jvm/library/src/test/java/org/cachix/secretspec/NativeTest.java diff --git a/secretspec-jvm/src/test/java/org/cachix/secretspec/SecretSpecTest.java b/secretspec-jvm/library/src/test/java/org/cachix/secretspec/SecretSpecTest.java similarity index 100% rename from secretspec-jvm/src/test/java/org/cachix/secretspec/SecretSpecTest.java rename to secretspec-jvm/library/src/test/java/org/cachix/secretspec/SecretSpecTest.java diff --git a/secretspec-jvm/settings.gradle.kts b/secretspec-jvm/settings.gradle.kts index dd4de839..0b51b77b 100644 --- a/secretspec-jvm/settings.gradle.kts +++ b/secretspec-jvm/settings.gradle.kts @@ -1 +1,4 @@ rootProject.name = "secretspec-jvm" + +include("library") +include("consumer") \ No newline at end of file From 4eecf43c594b72d74902ecde32a844ee244e8899 Mon Sep 17 00:00:00 2001 From: Nicolas MOREAU Date: Sat, 15 Aug 2026 13:32:19 +0200 Subject: [PATCH 3/4] feat(sdk): secretspec-jvm Rename SNAPSHOT artifacts during publication. --- .github/workflows/jvm-package.yml | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/.github/workflows/jvm-package.yml b/.github/workflows/jvm-package.yml index c02f7067..e8e6715d 100644 --- a/.github/workflows/jvm-package.yml +++ b/.github/workflows/jvm-package.yml @@ -408,19 +408,21 @@ jobs: env: GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_SIGNING_PASSPHRASE }} run: | - VERSION=$(grep 'secretspec.version' secretspec-jvm/gradle.properties | cut -d'=' -f2 | tr -d '[:space:]') - VERSION="${VERSION%-SNAPSHOT}" - BUNDLE_DIR="bundle-dir/org/cachix/secretspec-jvm/$VERSION" - mkdir -p "$BUNDLE_DIR" - cp artifacts/*.jar "$BUNDLE_DIR/" - cat < "$BUNDLE_DIR/secretspec-jvm-$VERSION.pom" + SNAPSHOT_VERSION=$(grep 'secretspec.version' secretspec-jvm/gradle.properties | cut -d'=' -f2 | tr -d '[:space:]') + VERSION="${SNAPSHOT_VERSION%-SNAPSHOT}" + BUNDLE_DIR="bundle-dir/org/cachix/secretspec-jvm/${VERSION}" + mkdir -p "${BUNDLE_DIR}" + cp artifacts/secretspec-jvm-${SNAPSHOT_VERSION}.jar "${BUNDLE_DIR}/secretspec-jvm-${VERSION}.jar" + cp artifacts/secretspec-jvm-${SNAPSHOT_VERSION}-javadoc.jar "${BUNDLE_DIR}/secretspec-jvm-${VERSION}-javadoc.jar" + cp artifacts/secretspec-jvm-${SNAPSHOT_VERSION}-sources.jar "${BUNDLE_DIR}/secretspec-jvm-${VERSION}-sources.jar" + cat < "${BUNDLE_DIR}/secretspec-jvm-${VERSION}.pom" 4.0.0 org.cachix secretspec-jvm - $VERSION + ${VERSION} SecretSpec JVM SDK JVM SDK for SecretSpec secret resolution https://secretspec.dev @@ -452,7 +454,7 @@ jobs: EOF cd bundle-dir find . -type f \( -name "*.jar" -o -name "*.pom" \) -print0 | while IFS= read -r -d '' file; do - gpg --batch --yes --pinentry-mode loopback --passphrase-fd 3 -ab "$file" 3<<< "$GPG_PASSPHRASE" + gpg --batch --yes --pinentry-mode loopback --passphrase-fd 3 -ab "$file" 3<<< "${GPG_PASSPHRASE}" done zip -r ../maven-central-bundle.zip . cd .. @@ -462,8 +464,8 @@ jobs: MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_TOKEN_USERNAME }} MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_PASSWORD }} run: | - ENCODED_AUTH=$(echo -n "$MAVEN_CENTRAL_USERNAME:$MAVEN_CENTRAL_PASSWORD" | base64 -w 0) + ENCODED_AUTH=$(echo -n "${MAVEN_CENTRAL_USERNAME}:${MAVEN_CENTRAL_PASSWORD}" | base64 -w 0) curl --request POST \ - --header "Authorization: Bearer $ENCODED_AUTH" \ + --header "Authorization: Bearer ${ENCODED_AUTH}" \ --form "bundle=@maven-central-bundle.zip" \ "https://central.sonatype.com/api/v1/publisher/upload?publishingType=AUTOMATIC" \ No newline at end of file From 90eb8a0326aca92332c6cea4b56e7c13d3de9f21 Mon Sep 17 00:00:00 2001 From: Nicolas MOREAU Date: Sat, 15 Aug 2026 21:54:01 +0200 Subject: [PATCH 4/4] feat(sdk): secretspec-jvm Fix GitHub Actions workflow errors & mistakes. Temurin JDK 11 is not available on win32-aarch64: use Microsoft JDK. --- .github/workflows/jvm-package.yml | 12 +++++++++--- .../examples/as_path/{Scopes.java => AsPath.java} | 2 +- secretspec-jvm/gradle.properties | 2 +- 3 files changed, 11 insertions(+), 5 deletions(-) rename secretspec-jvm/examples/as_path/{Scopes.java => AsPath.java} (94%) diff --git a/.github/workflows/jvm-package.yml b/.github/workflows/jvm-package.yml index e8e6715d..c42d3a83 100644 --- a/.github/workflows/jvm-package.yml +++ b/.github/workflows/jvm-package.yml @@ -35,7 +35,7 @@ permissions: jobs: native: - name: ${{ matrix.rid }} + name: "building ${{ matrix.rid }} native library" runs-on: ${{ matrix.runner }} container: ${{ matrix.container || null }} strategy: @@ -48,34 +48,40 @@ jobs: container: quay.io/pypa/manylinux_2_28_x86_64:2026.08.05-1@sha256:e0b40ace8e818e96026eb47714b01998cbca022a6995797d0905474ce3e82ae8 library: libsecretspec_ffi.so rustflags: -C strip=symbols + jdk11_distribution: temurin - rid: linux-aarch64 target: aarch64-unknown-linux-gnu runner: ubuntu-24.04-arm container: quay.io/pypa/manylinux_2_28_aarch64:2026.08.05-1@sha256:f766b402889e40f439e7a3ee5788eef1aa3ef399d0110107d27419fa2ba9d905 library: libsecretspec_ffi.so rustflags: -C strip=symbols + jdk11_distribution: temurin - rid: darwin-x86-64 target: x86_64-apple-darwin runner: macos-15-intel library: libsecretspec_ffi.dylib deployment_target: "12.0" rustflags: -C strip=symbols - - rid: darmin-aarch64 + jdk11_distribution: temurin + - rid: darwin-aarch64 target: aarch64-apple-darwin runner: macos-latest library: libsecretspec_ffi.dylib deployment_target: "12.0" rustflags: -C strip=symbols + jdk11_distribution: temurin - rid: win32-x86-64 target: x86_64-pc-windows-msvc runner: windows-latest library: secretspec_ffi.dll rustflags: -C strip=symbols -C target-feature=+crt-static + jdk11_distribution: temurin - rid: win32-aarch64 target: aarch64-pc-windows-msvc runner: windows-11-arm library: secretspec_ffi.dll rustflags: -C strip=symbols -C target-feature=+crt-static + jdk11_distribution: microsoft # temurin does not provide win32-aarch64 builds steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -97,7 +103,7 @@ jobs: - uses: actions/setup-java@v5 with: - distribution: temurin + distribution: ${{ matrix.jdk11_distribution }} java-version: "11" set-default: false - uses: actions/setup-java@v5 diff --git a/secretspec-jvm/examples/as_path/Scopes.java b/secretspec-jvm/examples/as_path/AsPath.java similarity index 94% rename from secretspec-jvm/examples/as_path/Scopes.java rename to secretspec-jvm/examples/as_path/AsPath.java index 2dd78b0e..8e24ca4d 100644 --- a/secretspec-jvm/examples/as_path/Scopes.java +++ b/secretspec-jvm/examples/as_path/AsPath.java @@ -1,7 +1,7 @@ import org.cachix.secretspec.SecretSpec; -public class Scopes { +public class AsPath { public static void main() { try(var resolved = SecretSpec.builder().withReason("TLS boot").load()) { diff --git a/secretspec-jvm/gradle.properties b/secretspec-jvm/gradle.properties index 98224550..345aa236 100644 --- a/secretspec-jvm/gradle.properties +++ b/secretspec-jvm/gradle.properties @@ -1,4 +1,4 @@ org.gradle.java.installations.auto-detect=true org.gradle.java.installations.auto-download=false -org.gradle.java.installations.fromEnv=SECRETSPEC_JVM_TARGET_JDK +org.gradle.java.installations.fromEnv=SECRETSPEC_JVM_TARGET_JDK,JAVA_HOME_11_X64,JAVA_HOME_11_ARM64 secretspec.version=0.18.0-SNAPSHOT