diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 9f0752bfb..8ae423d67 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -20,7 +20,7 @@ jobs: strategy: matrix: # sigstore-java still supports Java 11, however, we test it with conformance-tests only - java-version: [17, 21] + java-version: [17, 21, 25] fail-fast: false concurrency: diff --git a/build-logic/basics/src/main/kotlin/ToolchainProperties.kt b/build-logic/basics/src/main/kotlin/ToolchainProperties.kt index d4725d10a..1275b9b80 100644 --- a/build-logic/basics/src/main/kotlin/ToolchainProperties.kt +++ b/build-logic/basics/src/main/kotlin/ToolchainProperties.kt @@ -17,9 +17,16 @@ val BuildParametersExtension.buildJdkVersion: Int get() = buildJdk?.version ?: JavaVersion.current().majorVersion.toInt() val BuildParametersExtension.testJdk: ToolchainProperties? - get() = jdkTestVersion.orNull?.takeIf { it != 0 } - ?.let { ToolchainProperties(it, jdkTestVendor.orNull, jdkTestImplementation.orNull) } - ?: buildJdk + get() { + val requestedVersion = jdkTestVersion.orNull?.takeIf { it != 0 } + val finalVersion = requestedVersion ?: buildJdkVersion + if (finalVersion < 17) { + throw IllegalArgumentException("Unit tests require at least Java 17. Resolved: $finalVersion") + } + return requestedVersion?.let { ToolchainProperties(it, jdkTestVendor.orNull, jdkTestImplementation.orNull) } + ?: buildJdk + } val BuildParametersExtension.testJdkVersion: Int - get() = jdkTestVersion.orNull ?: buildJdkVersion + get() = testJdk?.version ?: buildJdkVersion + diff --git a/build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts b/build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts index 657775ebf..6dd79786d 100644 --- a/build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts +++ b/build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts @@ -25,7 +25,7 @@ tasks.configureEach { spotless { java { - googleJavaFormat("1.24.0") + googleJavaFormat("1.35.0") licenseHeaderFile("$rootDir/config/licenseHeader") // Note if submodule needs to add more exclusions, it should list ALL of them since // Spotless does not have "addTargetExclude" method @@ -43,7 +43,11 @@ tasks.withType().configureEach { compilerArgs.add("-Werror") } - release.set(buildParameters.targetJavaVersion) + if (name.endsWith("TestJava")) { + release.set(17) + } else { + release.set(buildParameters.targetJavaVersion) + } } } diff --git a/build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts b/build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts index 7bc5ad0d1..014ac5fb1 100644 --- a/build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts +++ b/build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts @@ -26,7 +26,7 @@ autostyle { tasks.withType().configureEach { compilerOptions { - val targetJdkRelease = buildParameters.targetJavaVersion.toString() + val targetJdkRelease = if (name.endsWith("TestKotlin")) "17" else buildParameters.targetJavaVersion.toString() freeCompilerArgs.add("-Xjdk-release=$targetJdkRelease") jvmTarget = JvmTarget.fromTarget(targetJdkRelease) } diff --git a/build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts b/build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts index d12777a87..c769fe8cd 100644 --- a/build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts +++ b/build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts @@ -22,4 +22,7 @@ tasks.withType().configureEach { if (project.hasProperty("skipStaging")) { systemProperty("sigstore-java.test.skipStaging", project.findProperty("skipStaging")!!) } + if (buildParameters.testJdkVersion >= 23) { + jvmArgs("--sun-misc-unsafe-memory-access=deny") + } } diff --git a/fuzzing/oss_fuzz_build.sh b/fuzzing/oss_fuzz_build.sh index b5e8d41cc..700b55f4e 100755 --- a/fuzzing/oss_fuzz_build.sh +++ b/fuzzing/oss_fuzz_build.sh @@ -3,7 +3,8 @@ # TODO: this should be a gradle plugin # build the fuzzing classes and extract dependencies into $OUT -./gradlew :fuzzing:copyToFuzzOut -x test -PfuzzOut="$OUT" +# Exclude spotlessCheck because GJF 1.35.0+ requires JDK 21+ to run, which would crash the build in CIFuzz (currently running on JDK 17). +./gradlew :fuzzing:copyToFuzzOut -x test -x spotlessCheck -PfuzzOut="$OUT" ALL_JARS="" for jarfile in $(find $OUT -name *.jar) do diff --git a/sigstore-java/build.gradle.kts b/sigstore-java/build.gradle.kts index b54461ee1..d7f8d8bf1 100644 --- a/sigstore-java/build.gradle.kts +++ b/sigstore-java/build.gradle.kts @@ -50,7 +50,7 @@ dependencies { testImplementation("org.mockito:mockito-core") testImplementation("org.mockito:mockito-junit-jupiter") - testImplementation("no.nav.security:mock-oauth2-server:0.5.10") + testImplementation("no.nav.security:mock-oauth2-server:5.0.2") testImplementation("com.squareup.okhttp3:mockwebserver:5.4.0") testImplementation("net.sourceforge.htmlunit:htmlunit:2.70.0") @@ -91,12 +91,12 @@ spotless { ) } format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) { - googleJavaFormat("1.24.0") + googleJavaFormat("1.35.0") licenseHeaderFile("$rootDir/config/conscryptLicenseHeader") target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java") } format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) { - googleJavaFormat("1.24.0") + googleJavaFormat("1.35.0") licenseHeaderFile("$rootDir/config/webPKILicenseHeader") target("src/*/java/dev/sigstore/json/canonicalizer/*.java") } diff --git a/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json b/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json index d8ff2a693..800e671a2 100644 --- a/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json +++ b/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json @@ -11,8 +11,8 @@ "tokenExpiry": 120, "requestMappings": [ { - "requestParam": "scope", - "match": "openid email", + "requestParam": "client_id", + "match": "sigstore", "claims": { "audience": "sigstore", "email": "test.person@test.com", diff --git a/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json b/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json index 1c9b1832c..8644d8feb 100644 --- a/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json +++ b/sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json @@ -11,8 +11,8 @@ "tokenExpiry": 120, "requestMappings": [ { - "requestParam": "scope", - "match": "openid email", + "requestParam": "client_id", + "match": "sigstore", "claims": { "audience": "sigstore", "email": "test.person@test.com", diff --git a/sigstore-testkit/build.gradle.kts b/sigstore-testkit/build.gradle.kts index 1b95370f5..080bbe0c9 100644 --- a/sigstore-testkit/build.gradle.kts +++ b/sigstore-testkit/build.gradle.kts @@ -1,3 +1,6 @@ +import org.jetbrains.kotlin.gradle.dsl.JvmTarget +import org.jetbrains.kotlin.gradle.tasks.KotlinJvmCompile + plugins { id("build-logic.kotlin") id("build-logic.repositories") @@ -18,3 +21,14 @@ dependencies { api("org.assertj:assertj-core:3.27.7") api(gradleTestKit()) } + +tasks.withType().configureEach { + options.release.set(17) +} + +tasks.withType().configureEach { + compilerOptions { + freeCompilerArgs.add("-Xjdk-release=17") + jvmTarget = JvmTarget.JVM_17 + } +}