Skip to content

Commit 2509895

Browse files
ajewellamzajewellamz
authored
Merge branch 'main' into seebees/optimize-below
2 parents e34c518 + 2eb36b3 commit 2509895

File tree

2,068 files changed

+213445
-185575
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,068 files changed

+213445
-185575
lines changed

‎.github/workflows/ci_test_latest_released_mpl_java.yml

+126
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# This workflow is for testing that the latest released version
2+
# of the MPL is compatible with the current DB-ESDK Head
3+
name: Test Latest Released MPL Java with DB-ESDK HEAD
4+
5+
on:
6+
schedule:
7+
- cron: "00 16 * * 1-5"
8+
workflow_dispatch: # allows triggering this manually through the Actions UI
9+
inputs:
10+
run_test_vectors:
11+
description: "Run Test Vectors?"
12+
required: false
13+
default: true
14+
type: boolean
15+
16+
jobs:
17+
getVersion:
18+
# Don't run the cron builds on forks
19+
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
20+
uses: ./.github/workflows/dafny_version.yml
21+
getVerifyVersion:
22+
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
23+
uses: ./.github/workflows/dafny_verify_version.yml
24+
getMplDependencyJavaVersion:
25+
if: github.event_name != 'schedule' || github.repository_owner == 'aws'
26+
uses: ./.github/workflows/mpl_dependency_java_version.yml
27+
testJava:
28+
needs: [getVersion, getMplDependencyJavaVersion]
29+
strategy:
30+
max-parallel: 1
31+
matrix:
32+
java-version: [17]
33+
os: [ubuntu-22.04]
34+
runs-on: ${{ matrix.os }}
35+
permissions:
36+
id-token: write
37+
contents: read
38+
steps:
39+
- name: Configure AWS Credentials
40+
uses: aws-actions/configure-aws-credentials@v4
41+
with:
42+
aws-region: us-west-2
43+
role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2
44+
role-session-name: DDBEC-Dafny-Java-Tests
45+
46+
- uses: actions/checkout@v3
47+
with:
48+
submodules: recursive
49+
50+
- name: Setup Java ${{ matrix.java-version }}
51+
uses: actions/setup-java@v4
52+
with:
53+
distribution: "corretto"
54+
java-version: ${{ matrix.java-version }}
55+
56+
- name: Setup Dafny
57+
uses: dafny-lang/[email protected]
58+
with:
59+
dafny-version: ${{ needs.getVersion.outputs.version }}
60+
61+
- name: Regenerate code using smithy-dafny if necessary
62+
if: ${{ inputs.regenerate-code }}
63+
uses: ./.github/actions/polymorph_codegen
64+
with:
65+
dafny: ${{ env.DAFNY_VERSION }}
66+
library: DynamoDbEncryption
67+
diff-generated-code: false
68+
update-and-regenerate-mpl: true
69+
70+
# The following two steps: "Build and deploy to maven local" and "Run Extensive Tests"
71+
# mimic the tests in ./codebuild/staging/release-staging.yml
72+
- name: Build and deploy to maven local
73+
shell: bash
74+
working-directory: ./DynamoDbEncryption
75+
run: |
76+
# Run transpile by itself. We don't want to locally build the MPL because
77+
# we want to verify that the version pulled down from maven works correctly
78+
make transpile_implementation_java
79+
make transpile_test_java
80+
make mvn_local_deploy
81+
make test_java
82+
83+
- name: Run Extensive Tests
84+
working-directory: ./DynamoDbEncryption
85+
run: |
86+
gradle -p runtimes/java clean
87+
gradle -p runtimes/java test
88+
89+
# This makes sure that we are using the correct MPL version to test the DB-ESDK.
90+
# If this contains a SNAPSHOT version, this will fail because'
91+
# we are NOT building the MPL recursively but pulling from Maven.
92+
- name: Update project.properties to use the correct MPL version (from project.properties in DB-ESDK)
93+
working-directory: ./submodules/MaterialProviders/
94+
run: |
95+
sed "s/mplVersion=.*/mplVersion=${{needs.getMplDependencyJavaVersion.outputs.version}}/g" project.properties > project.properties2; mv project.properties2 project.properties
96+
97+
# The following three steps: "Transpile MPL Test Vectors without recursively building the MPL",
98+
# "Run Test Vectors", and "Test Examples" mimic the tests in ./codebuild/staging/validate-staging.yml
99+
- name: Transpile MPL Test Vectors without recursively building the MPL
100+
working-directory: ./submodules/MaterialProviders/TestVectorsAwsCryptographicMaterialProviders
101+
run: |
102+
# Run transpile by itself. We don't want to locally build the MPL because
103+
# we want to verify that the version pulled down from maven works correctly
104+
make transpile_implementation_java
105+
make transpile_test_java
106+
make mvn_local_deploy
107+
108+
- name: Run Test Vectors
109+
if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && ${{inputs.run_test_vectors}})
110+
working-directory: ./TestVectors
111+
run: |
112+
# Spin up ddb local
113+
docker run --name dynamodb -d -p 8000:8000 amazon/dynamodb-local -jar DynamoDBLocal.jar -port 8000 -inMemory -cors *
114+
# Run transpile by itself so we don't locally build the MPL.
115+
make transpile_implementation_java
116+
make transpile_test_java
117+
gradle -p runtimes/java runTests
118+
119+
- name: Test Examples
120+
working-directory: ./Examples
121+
run: |
122+
# Run Simple Examples
123+
gradle -p runtimes/java/DynamoDbEncryption test
124+
# Run Migration Examples
125+
gradle -p runtimes/java/Migration/PlaintextToAWSDBE test
126+
gradle -p runtimes/java/Migration/DDBECToAWSDBE test

‎.github/workflows/ci_todos.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ jobs:
1717
shell: bash
1818
# TODOs may be committed as long as the same line contains a link to a Github Issue or refers to a CrypTool SIM.
1919
run: |
20-
ALL_TODO_COUNT=$( { grep -r "TODO" . --exclude-dir=./TestVectors/runtimes --exclude-dir=./submodules --exclude-dir=./.git --exclude=./.github/workflows/ci_todos.yml || true; } | wc -l)
21-
GOOD_TODO_COUNT=$( { grep -r "TODO.*\(github.com\/.*issues.*\/[1-9][0-9]*\|CrypTool-[1-9][0-9]*\)" . --exclude-dir=./submodules --exclude-dir=./.git --exclude-dir=./TestVectors/runtimes --exclude=./.github/workflows/ci_todos.yml || true; } | wc -l)
20+
ALL_TODO_COUNT=$( { grep -r "TODO" . --exclude-dir=./releases --exclude-dir=./TestVectors/runtimes --exclude-dir=./submodules --exclude-dir=./.git --exclude=./.github/workflows/ci_todos.yml || true; } | wc -l)
21+
GOOD_TODO_COUNT=$( { grep -r "TODO.*\(github.com\/.*issues.*\/[1-9][0-9]*\|CrypTool-[1-9][0-9]*\)" . --exclude-dir=./releases --exclude-dir=./submodules --exclude-dir=./.git --exclude-dir=./TestVectors/runtimes --exclude=./.github/workflows/ci_todos.yml || true; } | wc -l)
2222
if [ "$ALL_TODO_COUNT" != "$GOOD_TODO_COUNT" ]; then
2323
exit 1;
2424
fi

‎.github/workflows/mpl_dependency_java_version.yml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# This workflow reads the project.properties
2+
# into the environment variables
3+
# and then creates an output variable for `mplDependencyJavaVersion`
4+
name: MPL Dependency Java Version
5+
6+
on:
7+
workflow_call:
8+
outputs:
9+
version:
10+
description: "The MPL Dependency Java version from project.properties"
11+
value: ${{ jobs.getMplDependencyJavaVersion.outputs.version }}
12+
13+
jobs:
14+
getMplDependencyJavaVersion:
15+
runs-on: ubuntu-22.04
16+
outputs:
17+
version: ${{ steps.read_property.outputs.mplDependencyJavaVersion }}
18+
steps:
19+
- uses: actions/checkout@v4
20+
- name: Read version from Properties-file
21+
id: read_property
22+
uses: christian-draeger/[email protected]
23+
with:
24+
path: "./project.properties"
25+
properties: "mplDependencyJavaVersion"

‎.github/workflows/mpl_head_version.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
# This workflow reads the project.properties
1+
# This workflow reads the project.properties in the MPL submodule
22
# into the environment variables
3-
# and then creates an output variable for `dafnyVerifyVersion `
3+
# and then creates an output variable for `mplVersion`
44
name: MPL HEAD Version
55

66
on:
@@ -13,7 +13,7 @@ on:
1313
type: string
1414
outputs:
1515
version:
16-
description: "The dafny version for verify"
16+
description: "The MPL version"
1717
value: ${{ jobs.getMplHeadVersion.outputs.version }}
1818

1919
jobs:

‎CHANGELOG.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Changelog
22

3-
## [3.8.0](https://github.com/aws/aws-database-encryption-sdk-dynamodb/compare/v3.7.0...v3.8.0) (2025-01-27)
3+
## [3.8.0](https://github.com/aws/aws-database-encryption-sdk-dynamodb/compare/v3.7.0...v3.8.0) (2025-02-05)
44

55
This release is available in the following languages:
66

@@ -9,6 +9,7 @@ This release is available in the following languages:
99
### Features
1010

1111
- **SharedCache:** Shared Cache for Searchable Encryption ([#1476](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1476)) ([46076f8](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/46076f86aec77f7df204c1e06a8ecb2400f01b6f))
12+
- bump to dafny 4.9.0 and mpl 1.9.0 ([#1627](https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1627))
1213

1314
### Fixes
1415

@@ -21,6 +22,12 @@ This release is available in the following languages:
2122

2223
### Maintenance
2324

25+
- make const policy an extern ([#1587](https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1587)) ([be3b96e](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/be3b96e7d6c441aee3b87862a2989309560413ba))
26+
- mpl: Bump to 1.9.0 ([#1621](https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1621)) ([04a8eb2](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/04a8eb2ec84e57b795562618331e9c7e6f0de0c4))
27+
- release Rust 1.0.0 ([#1612](https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1612)) ([3392200](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/3392200e2c844710a2d1b6d9c9942c8b9769f71e))
28+
- remove unsafe from interceptor ([#1620](https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1620)) ([f6ef3f4](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/f6ef3f4b05010aa06f5a0f7f0d48ca05db4f71f1))
29+
- TestVectors: Reuse single KeyVectors client across TestVectors ([#1577](https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1577)) ([dabcaf1](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/dabcaf12c198bd3dda78996a42ae5a5682f2b88a))
30+
- update for async support ([#1560](https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1560)) ([700f939](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/700f939e9e5c5e8ed7f7880ea74213231ab6e6ed))
2431
- add dependabot for rust ([#1481](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1481)) ([67f3d2e](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/67f3d2e567b513a53d208f60ec6991a0b6c825d0))
2532
- Add ECDH examples ([#1461](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1461)) ([cc937b4](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/cc937b41190c17e1087acbdcd524becc1a97e214))
2633
- add Rust release directory ([#1479](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1479)) ([97dde01](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/97dde01a3b6d9a33a8b60dcb6e63debc5329d691))

‎DynamoDbEncryption/dafny/DynamoDbEncryption/src/ConfigToInfo.dfy

+1-1
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ module SearchConfigToInfo {
176176
var cache;
177177
if cacheType.Shared? {
178178
cache := cacheType.Shared;
179-
reveal ValidSharedCache(config);
179+
reveal ValidSharedCache();
180180
} else {
181181
//= specification/searchable-encryption/search-config.md#key-store-cache
182182
//# For a Beacon Key Source a [CMC](../../submodules/MaterialProviders/aws-encryption-sdk-specification/framework/cryptographic-materials-cache.md)

‎DynamoDbEncryption/dafny/DynamoDbItemEncryptor/src/InternalLegacyOverride.dfy

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ module {:extern "software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencry
1313
static method {:extern} Build(encryptorConfig: Types.DynamoDbItemEncryptorConfig)
1414
returns (output: Result<Option<InternalLegacyOverride>, Types.Error>)
1515

16-
const policy: DDBE.LegacyPolicy
16+
const {:extern} policy: DDBE.LegacyPolicy
1717

1818
method {:extern} EncryptItem(input: Types.EncryptItemInput)
1919
returns (output: Result<Types.EncryptItemOutput, Types.Error>)

‎DynamoDbEncryption/runtimes/net/Extern/InternalLegacyConfig.cs

+12-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,18 @@ namespace software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.in
88

99
public partial class InternalLegacyOverride
1010
{
11-
11+
public software.amazon.cryptography.dbencryptionsdk.dynamodb.internaldafny.types._ILegacyPolicy _policy
12+
{
13+
get => software.amazon.cryptography.dbencryptionsdk.dynamodb.internaldafny.types.LegacyPolicy.create_FORBID__LEGACY__ENCRYPT__FORBID__LEGACY__DECRYPT();
14+
set { }
15+
}
16+
public software.amazon.cryptography.dbencryptionsdk.dynamodb.internaldafny.types._ILegacyPolicy policy
17+
{
18+
get
19+
{
20+
return this._policy;
21+
}
22+
}
1223
public static Wrappers_Compile._IResult<
1324
Wrappers_Compile._IOption<InternalLegacyOverride>,
1425
_IError

‎DynamoDbEncryption/runtimes/rust/Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "aws-db-esdk"
3-
version = "0.2.0"
3+
version = "1.0.0"
44
edition = "2021"
55
rust-version = "1.81.0"
66
keywords = ["cryptography", "security", "dynamodb", "encryption", "client-side"]

‎DynamoDbEncryption/runtimes/rust/src/intercept.rs

-3
Original file line numberDiff line numberDiff line change
@@ -91,9 +91,6 @@ impl DbEsdkInterceptor {
9191
}
9292
}
9393

94-
unsafe impl Sync for DbEsdkInterceptor {}
95-
unsafe impl Send for DbEsdkInterceptor {}
96-
9794
#[derive(Debug)]
9895
struct OriginalRequest(Input);
9996

‎DynamoDbEncryption/runtimes/rust/src/software_externs.rs

+3
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ pub mod software {
5858
}
5959

6060
impl InternalLegacyOverride {
61+
pub fn policy(&self) -> Rc<LegacyPolicy> {
62+
self.r#__i_policy.clone()
63+
}
6164
pub fn Build(
6265
config: &Rc<crate::software::amazon::cryptography::dbencryptionsdk::dynamodb::itemencryptor::internaldafny::types::DynamoDbItemEncryptorConfig>,
6366
) -> Rc<

‎SUPPORT_POLICY.rst

+17
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,21 @@ This table describes the current support status of each major version of the AWS
3030
-
3131
-
3232

33+
Version Support Matrix for Rust
34+
===============================
35+
This table describes the current support status of each major version of the AWS Encryption SDK for Rust. It also shows the next status each major version will transition to, and the date at which that transition will happen.
36+
37+
.. list-table::
38+
:widths: 30 50 50 50
39+
:header-rows: 1
40+
41+
* - Major version
42+
- Current status
43+
- Next status
44+
- Next status date
45+
* - 1.x
46+
- Generally Available
47+
-
48+
-
49+
3350
.. _AWS SDKs and Tools Maintenance Policy: https://docs.aws.amazon.com/sdkref/latest/guide/maint-policy.html#version-life-cycle

‎TestVectors/dafny/DDBEncryption/src/DecryptManifest.dfy

+26-9
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,17 @@ module {:options "-functionSyntax:4"} DecryptManifest {
2020
import opened JSONHelpers
2121
import JsonConfig
2222
import ENC = AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorTypes
23+
import KeyVectors
2324

24-
method OnePositiveTest(name : string, config : JSON, encrypted : JSON, plaintext : JSON) returns (output : Result<bool, string>)
25+
method OnePositiveTest(name : string, config : JSON, encrypted : JSON, plaintext : JSON, keys : KeyVectors.KeyVectorsClient)
26+
returns (output : Result<bool, string>)
27+
requires keys.ValidState()
28+
modifies keys.Modifies
29+
ensures keys.ValidState()
2530
{
2631
var enc :- JsonConfig.GetRecord(encrypted);
2732
var plain :- JsonConfig.GetRecord(plaintext);
28-
var encryptor :- JsonConfig.GetItemEncryptor(name, config);
33+
var encryptor :- JsonConfig.GetItemEncryptor(name, config, keys);
2934
var decrypted :- expect encryptor.DecryptItem(
3035
ENC.DecryptItemInput(
3136
encryptedItem:=enc.item
@@ -36,10 +41,14 @@ module {:options "-functionSyntax:4"} DecryptManifest {
3641
return Success(true);
3742
}
3843

39-
method OneNegativeTest(name : string, config : JSON, encrypted : JSON) returns (output : Result<bool, string>)
44+
method OneNegativeTest(name : string, config : JSON, encrypted : JSON, keys: KeyVectors.KeyVectorsClient)
45+
returns (output : Result<bool, string>)
46+
requires keys.ValidState()
47+
modifies keys.Modifies
48+
ensures keys.ValidState()
4049
{
4150
var enc :- JsonConfig.GetRecord(encrypted);
42-
var encryptor :- JsonConfig.GetItemEncryptor(name, config);
51+
var encryptor :- JsonConfig.GetItemEncryptor(name, config, keys);
4352
var decrypted := encryptor.DecryptItem(
4453
ENC.DecryptItemInput(
4554
encryptedItem:=enc.item
@@ -51,7 +60,11 @@ module {:options "-functionSyntax:4"} DecryptManifest {
5160
return Success(true);
5261
}
5362

54-
method OneTest(name : string, value : JSON) returns (output : Result<bool, string>)
63+
method OneTest(name : string, value : JSON, keys: KeyVectors.KeyVectorsClient)
64+
returns (output : Result<bool, string>)
65+
requires keys.ValidState()
66+
modifies keys.Modifies
67+
ensures keys.ValidState()
5568
{
5669
:- Need(value.Object?, "Test must be an object");
5770

@@ -89,15 +102,19 @@ module {:options "-functionSyntax:4"} DecryptManifest {
89102

90103
if types.value == "positive-decrypt" {
91104
:- Need(plaintext.Some?, "positive-decrypt Test requires a 'plaintext' member.");
92-
output := OnePositiveTest(name, config.value, encrypted.value, plaintext.value);
105+
output := OnePositiveTest(name, config.value, encrypted.value, plaintext.value, keys);
93106
} else if types.value == "negative-decrypt" {
94-
output := OneNegativeTest(name, config.value, encrypted.value);
107+
output := OneNegativeTest(name, config.value, encrypted.value, keys);
95108
} else {
96109
return Failure("Invalid encrypt type : '" + types.value + "'.");
97110
}
98111
}
99112

100-
method Decrypt(inFile : string) returns (output : Result<bool, string>)
113+
method Decrypt(inFile : string, keyVectors: KeyVectors.KeyVectorsClient)
114+
returns (output : Result<bool, string>)
115+
requires keyVectors.ValidState()
116+
modifies keyVectors.Modifies
117+
ensures keyVectors.ValidState()
101118
{
102119
var timeStamp :- expect Time.GetCurrentTimeStamp();
103120
print timeStamp + " Decrypt : ", inFile, "\n";
@@ -154,7 +171,7 @@ module {:options "-functionSyntax:4"} DecryptManifest {
154171
for i := 0 to |tests.value| {
155172
var obj := tests.value[i];
156173
:- Need(obj.1.Object?, "Value of test '" + obj.0 + "' must be an Object.");
157-
var _ :- OneTest(obj.0, obj.1);
174+
var _ :- OneTest(obj.0, obj.1, keyVectors);
158175
}
159176

160177
timeStamp :- expect Time.GetCurrentTimeStamp();

0 commit comments

Comments
 (0)