Skip to content

Commit abd359d

Browse files
ajewellamzajewellamz
authored
Merge branch 'main' into dependabot/github_actions/dot-github/workflows/aws-actions/configure-aws-credentials-4
2 parents dc60f79 + c817b5b commit abd359d

File tree

9 files changed

+119
-10
lines changed

9 files changed

+119
-10
lines changed

‎CHANGELOG.md

+19
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,24 @@
11
# Changelog
22

3+
## [3.6.0](https://github.com/aws/aws-database-encryption-sdk-dynamodb/compare/v3.5.0...v3.6.0) (2024-07-23)
4+
5+
### Features
6+
7+
- allow indirect attribute names with MultiKeyStore ([#1208](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1208)) ([4ab97bc](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/4ab97bcc43d0b906e45c487920bc7ef5ba66e505))
8+
9+
### Maintenance
10+
11+
- bump dafny verification version to 4.7 ([#1181](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1181)) ([e7801ec](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/e7801ec42b1bb212af68f9dc0c8037eed9876b5c))
12+
- **CI/CD:** use latest conventional-changelog-conventionalcommits ([#1195](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1195)) ([510227e](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/510227eabb958ff4a17d55fc2eac83f964d6a945))
13+
- Fix nightly build (aside from verification) ([#1029](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1029)) ([862420e](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/862420ef12ef1e764327671d839be451a7579bda))
14+
- **GHA:** add action for testing against MPL HEAD ([#1187](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1187)) ([b2f70ca](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/b2f70ca6733ac522f622014ae6c93bd1a1c15d28))
15+
- **GHA:** fix daily ci ([#1194](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1194)) ([a1427e0](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/a1427e0f7febc10cddd2eccb08385afb2b964367))
16+
- **MPL:** Bump MPL to 1.5.1 ([#1201](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1201)) ([808a5b4](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/808a5b4ad1143ffb8c0bb223fde1e3770c7abe62))
17+
- Sonatype Migration to User Tokens ([#1216](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1216)) ([a3b4ef9](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/a3b4ef9aac11f4a1e1048d938d554c669befc0a6))
18+
- Try to update existing issues ([31c6b98](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/31c6b9806920d500861154eccca07bd8a5ac4454))
19+
- Try to update existing issues ([4471295](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/4471295aa2b7f10e88c3742a41c947d9ad9f4cd2))
20+
- update project.properties to be SNAPSHOT ([#1087](https://github.com/aws/aws-database-encryption-sdk-dynamodb/issues/1087)) ([6f2825e](https://github.com/aws/aws-database-encryption-sdk-dynamodb/commit/6f2825e198c84a5b20d50e49188b5d9004a1b71a))
21+
322
## [3.5.0](https://github.com/aws/aws-database-encryption-sdk-dynamodb/compare/v3.4.0...v3.5.0) (2024-05-30)
423

524
### Features

‎DynamoDbEncryption/dafny/DynamoDbEncryption/src/FilterExpr.dfy

+1-1
Original file line numberDiff line numberDiff line change
@@ -1533,7 +1533,7 @@ module DynamoDBFilterExpr {
15331533
else
15341534
var name := if names.Some? && attr.value.s in names.value then names.value[attr.value.s] else attr.value.s;
15351535
var keyIdField := bv.keySource.keyLoc.keyName;
1536-
if keyIdField == attr.value.s then
1536+
if keyIdField == name then
15371537
Some(value)
15381538
else
15391539
KeyIdFromPart(bv, keyIdField, attr.value.s, value)

‎DynamoDbEncryption/dafny/DynamoDbEncryption/test/BeaconTestFixtures.dfy

+37-3
Original file line numberDiff line numberDiff line change
@@ -130,9 +130,9 @@ module BeaconTestFixtures {
130130
var keyStoreConfig := KTypes.KeyStoreConfig(
131131
id := None,
132132
kmsConfiguration := kmsConfig,
133-
logicalKeyStoreName := "foo",
133+
logicalKeyStoreName := "KeyStoreDdbTable",
134134
grantTokens := None,
135-
ddbTableName := "foo",
135+
ddbTableName := "KeyStoreDdbTable",
136136
ddbClient := Some(ddbClient),
137137
kmsClient := Some(kmsClient)
138138
);
@@ -177,6 +177,24 @@ module BeaconTestFixtures {
177177
);
178178
}
179179

180+
method GetLotsaBeaconsMulti() returns (output : BeaconVersion)
181+
ensures output.keyStore.ValidState()
182+
ensures fresh(output.keyStore.Modifies)
183+
ensures output.version == 1
184+
{
185+
var store := GetKeyStore();
186+
return BeaconVersion (
187+
version := 1,
188+
keyStore := store,
189+
keySource := multi(MultiKeyStore(keyFieldName := "TheKeyField", cacheTTL := 42)),
190+
standardBeacons := [std2, std4, std6, NameTitleBeacon, NameB, TitleB],
191+
compoundBeacons := Some([NameTitle, YearName, Mixed, JustSigned]),
192+
virtualFields := Some([NameTitleField]),
193+
encryptedParts := None,
194+
signedParts := None
195+
);
196+
}
197+
180198
const EmptyTableConfig := DynamoDbTableEncryptionConfig (
181199
logicalTableName := "Foo",
182200
partitionKeyName := "foo",
@@ -200,7 +218,8 @@ module BeaconTestFixtures {
200218
"Title" := SE.ENCRYPT_AND_SIGN,
201219
"TooBad" := SE.ENCRYPT_AND_SIGN,
202220
"Year" := SE.SIGN_ONLY,
203-
"Date" := SE.SIGN_ONLY
221+
"Date" := SE.SIGN_ONLY,
222+
"TheKeyField" := SE.SIGN_ONLY
204223
]
205224
)
206225

@@ -223,6 +242,21 @@ module BeaconTestFixtures {
223242
return SI.KeySource(client, version.keyStore, SI.LiteralLoc(keys), cache, 0);
224243
}
225244

245+
method GetMultiSource(keyName : string, version : BeaconVersion) returns (output : SI.KeySource)
246+
requires version.keyStore.ValidState()
247+
ensures output.ValidState()
248+
ensures version.keyStore == output.store
249+
ensures fresh(output.client.Modifies)
250+
{
251+
var client :- expect Primitives.AtomicPrimitives();
252+
var mpl :- expect MaterialProviders.MaterialProviders();
253+
var input := MPT.CreateCryptographicMaterialsCacheInput(
254+
cache := MPT.Default(Default := MPT.DefaultCache(entryCapacity := 3))
255+
);
256+
var cache :- expect mpl.CreateCryptographicMaterialsCache(input);
257+
return SI.KeySource(client, version.keyStore, SI.MultiLoc(keyName, false), cache, 0);
258+
}
259+
226260
const SimpleItem : DDB.AttributeMap := map[
227261
"std2" := Std2String,
228262
"std4" := Std4String,

‎DynamoDbEncryption/dafny/DynamoDbEncryption/test/DDBSupport.dfy

+56
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,60 @@ module TestDDBSupport {
3232
expect newItem == SimpleItem + expectedNew;
3333
}
3434

35+
// DynamoDB String :: cast string to DDB.AttributeValue.S
36+
function method DS(x : string) : DDB.AttributeValue
37+
{
38+
DDB.AttributeValue.S(x)
39+
}
40+
41+
method {:test} TestMulti() {
42+
var version := GetLotsaBeaconsMulti();
43+
var src := GetMultiSource("TheKeyField", version);
44+
var bv :- expect ConvertVersionWithSource(FullTableConfig, version, src);
45+
var search := SI.SearchInfo([bv], 0);
46+
var expressionAttributeValues : map<string, AttributeValue> := map[
47+
":value" := DS("0ad21413-51aa-42e1-9c3d-6a4b1edf7e10")
48+
];
49+
var queryInput := DDB.QueryInput (
50+
TableName := "SomeTable",
51+
ExpressionAttributeValues := Some(expressionAttributeValues),
52+
KeyConditionExpression := Some("TheKeyField = :value")
53+
);
54+
var result :- expect QueryInputForBeacons(Some(search), FullTableConfig.attributeActionsOnEncrypt, queryInput);
55+
56+
// Verify Success with branch key id plus beacon
57+
expressionAttributeValues := map[
58+
":value" := DS("0ad21413-51aa-42e1-9c3d-6a4b1edf7e10"),
59+
":other" := DS("junk")
60+
];
61+
queryInput := DDB.QueryInput (
62+
TableName := "foo",
63+
ExpressionAttributeValues := Some(expressionAttributeValues),
64+
KeyConditionExpression := Some("TheKeyField = :value AND std2 = :other")
65+
);
66+
result :- expect QueryInputForBeacons(Some(search), FullTableConfig.attributeActionsOnEncrypt, queryInput);
67+
68+
// Verify Failure with beacon but no branch key id
69+
queryInput := DDB.QueryInput (
70+
TableName := "foo",
71+
ExpressionAttributeValues := Some(expressionAttributeValues),
72+
KeyConditionExpression := Some("std2 = :other")
73+
);
74+
var result2 := QueryInputForBeacons(Some(search), FullTableConfig.attributeActionsOnEncrypt, queryInput);
75+
expect result2 == Failure(AwsCryptographyDbEncryptionSdkDynamoDbTypes.Error.DynamoDbEncryptionException(
76+
message := "Need KeyId because of beacon std2 but no KeyId found in query"));
77+
78+
// Verify Success, even when field names are indirect via ExpressionAttributeNames
79+
var expressionAttributeNames := map[
80+
"#beacon" := "std2",
81+
"#keyfield" := "TheKeyField"
82+
];
83+
queryInput := DDB.QueryInput (
84+
TableName := "foo",
85+
ExpressionAttributeNames := Some(expressionAttributeNames),
86+
ExpressionAttributeValues := Some(expressionAttributeValues),
87+
KeyConditionExpression := Some("#keyfield = :value AND #beacon = :other")
88+
);
89+
result :- expect QueryInputForBeacons(Some(search), FullTableConfig.attributeActionsOnEncrypt, queryInput);
90+
}
3591
}

‎DynamoDbEncryption/runtimes/net/AssemblyInfo.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@
33
[assembly: AssemblyTitle("AWS.Cryptography.DbEncryptionSDK.DynamoDb")]
44

55
// This should be kept in sync with the version number in MPL.csproj
6-
[assembly: AssemblyVersion("3.5.0")]
6+
[assembly: AssemblyVersion("3.6.0")]
77

‎DynamoDbEncryption/runtimes/net/DynamoDbEncryption.csproj

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
66
<IsPackable>true</IsPackable>
77

8-
<Version>3.5.0</Version>
8+
<Version>3.6.0</Version>
99

1010
<AssemblyName>AWS.Cryptography.DbEncryptionSDK.DynamoDb</AssemblyName>
1111
<PackageId>AWS.Cryptography.DbEncryptionSDK.DynamoDb</PackageId>

‎cfn/CB-Staging.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,7 @@ Resources:
238238
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Maven-GPG-Keys-CI-Credentials-eBrSNB",
239239
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Maven-GPG-Keys-Release-haLIjZ",
240240
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Maven-GPG-Keys-Release-Credentials-WgJanS",
241-
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Sonatype-Team-Account-0tWvZm",
241+
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Sonatype-User-Token-zK61bM",
242242
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Github/aws-crypto-tools-ci-bot-AGUB3U"
243243
],
244244
"Action": "secretsmanager:GetSecretValue"

‎codebuild/release/release-prod.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ env:
99
secrets-manager:
1010
GPG_KEY: Maven-GPG-Keys-Release-Credentials:Keyname
1111
GPG_PASS: Maven-GPG-Keys-Release-Credentials:Passphrase
12-
SONA_USERNAME: Sonatype-Team-Account:Username
13-
SONA_PASSWORD: Sonatype-Team-Account:Password
12+
SONA_USERNAME: Sonatype-User-Token:username
13+
SONA_PASSWORD: Sonatype-User-Token:password
1414

1515
phases:
1616
install:

‎project.properties

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
projectJavaVersion=3.5.0-SNAPSHOT
1+
projectJavaVersion=3.6.0-SNAPSHOT
22
mplDependencyJavaVersion=1.5.1
33
dafnyVersion=4.2.0
44
dafnyVerifyVersion=4.7.0

0 commit comments

Comments
 (0)