Skip to content

Commit 9297e1b

Browse files
imabhichowimabhichow
authored
feat!: Integrate ESDK-Java with AWS Cryptographic Material Providers Library (MPL) for Keyring and CMM Support. (#1864)
feat!: Integrate ESDK-Java with AWS Cryptographic Material Providers Library (MPL) for Keyring and CMM Support. New Features: The AWS ESDK for Java now incorporates the AWS Cryptographic Material Providers Library (MPL), enabling the use of Keyrings and Cryptographic Materials Managers (CMMs). BREAKING CHANGE: This feature update includes a breaking change that requires AWS SDK v2 Java as a hard dependency.
1 parent 1870a08 commit 9297e1b

File tree

97 files changed

+7765
-876
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

97 files changed

+7765
-876
lines changed

‎.github/workflows/ci.yml

+31
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,37 @@ jobs:
5858
env-vars-for-codebuild: JAVA_ENV_VERSION
5959
env:
6060
JAVA_ENV_VERSION: ${{ matrix.platform.distribution }}${{ matrix.version }}
61+
generateTestVectors:
62+
name: Generate Vectors
63+
runs-on: ubuntu-latest
64+
strategy:
65+
max-parallel: 1
66+
fail-fast: true
67+
matrix:
68+
platform:
69+
- distribution: openjdk
70+
image: "aws/codebuild/standard:3.0"
71+
- distribution: corretto
72+
image: "aws/codebuild/amazonlinux2-x86_64-standard:3.0" # Corretto only runs on AL2
73+
version: [ 8, 11 ]
74+
steps:
75+
- name: Configure AWS Credentials
76+
uses: aws-actions/configure-aws-credentials@v2
77+
with:
78+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
79+
aws-region: us-west-2
80+
role-duration-seconds: 3600
81+
- name: Generate Test Vectors
82+
uses: aws-actions/aws-codebuild-run-build@v1
83+
timeout-minutes: 60
84+
with:
85+
project-name: AWS-ESDK-Java-CI
86+
buildspec-override: codebuild/ci/vectors-generator.yml
87+
compute-type-override: BUILD_GENERAL1_LARGE
88+
image-override: ${{ matrix.platform.image }}
89+
env-vars-for-codebuild: JAVA_ENV_VERSION
90+
env:
91+
JAVA_ENV_VERSION: ${{ matrix.platform.distribution }}${{ matrix.version }}
6192
releaseCI:
6293
name: Release CI
6394
runs-on: ubuntu-latest

‎.gitmodules

+3
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,6 @@
44
[submodule "aws-encryption-sdk-specification"]
55
path = aws-encryption-sdk-specification
66
url = https://github.com/awslabs/aws-encryption-sdk-specification.git
7+
[submodule "submodules/MaterialProviders"]
8+
path = submodules/MaterialProviders
9+
url = https://github.com/aws/aws-cryptographic-material-providers-library-java.git

‎aws-encryption-sdk-specification

Submodule aws-encryption-sdk-specification updated 93 files

‎codebuild/ci/release-ci.yml

+21
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,34 @@ phases:
1717
install:
1818
runtime-versions:
1919
java: openjdk11
20+
commands:
21+
- git submodule update --init submodules/MaterialProviders
22+
# Get Dafny
23+
- curl https://github.com/dafny-lang/dafny/releases/download/v4.2.0/dafny-4.2.0-x64-ubuntu-20.04.zip -L -o dafny.zip
24+
- unzip -qq dafny.zip && rm dafny.zip
25+
- export PATH="$PWD/dafny:$PATH"
26+
# Get Gradle 7.6
27+
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
28+
- unzip -qq gradle.zip && rm gradle.zip
29+
- export PATH="$PWD/gradle-7.6/bin:$PATH"
2030
pre_build:
2131
commands:
2232
- export SETTINGS_FILE=$(pwd)/codebuild/release/settings.xml
2333
- export CODEARTIFACT_TOKEN=$(aws codeartifact get-authorization-token --domain $DOMAIN --domain-owner $ACCOUNT --query authorizationToken --output text --region ${REGION})
2434
- export CODEARTIFACT_REPO_URL=https://${DOMAIN}-${ACCOUNT}.d.codeartifact.${REGION}.amazonaws.com/maven/${REPOSITORY}
2535
- aws secretsmanager get-secret-value --region us-west-2 --secret-id Maven-GPG-Keys-CI --query SecretBinary --output text | base64 -d > ~/mvn_gpg.tgz
2636
- tar -xvf ~/mvn_gpg.tgz -C ~
37+
38+
# Build and deploy to maven local
39+
- cd submodules/MaterialProviders
40+
- git checkout $BRANCH
41+
- cd TestVectorsAwsCryptographicMaterialProviders/
42+
# This works because `node` is installed by default on GHA runners
43+
- CORES=$(node -e 'console.log(os.cpus().length)')
44+
- make build_java CORES=$CORES
45+
- ./runtimes/java/gradlew -p runtimes/java publishMavenLocalPublicationToMavenLocal
46+
- cd $CODEBUILD_SRC_DIR
47+
2748
build:
2849
commands:
2950
- VERSION_HASH="$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)-$CODEBUILD_RESOLVED_SOURCE_VERSION-$GITHUB_EVENT_NAME"

‎codebuild/ci/vectors-ci.yml

+29
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,35 @@ phases:
44
install:
55
runtime-versions:
66
java: $JAVA_ENV_VERSION
7+
commands:
8+
- git submodule update --init submodules/MaterialProviders
9+
# Get Dafny
10+
- curl https://github.com/dafny-lang/dafny/releases/download/v4.2.0/dafny-4.2.0-x64-ubuntu-20.04.zip -L -o dafny.zip
11+
- unzip -qq dafny.zip && rm dafny.zip
12+
- export PATH="$PWD/dafny:$PATH"
13+
# Get Gradle 7.6
14+
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
15+
- unzip -qq gradle.zip && rm gradle.zip
16+
- export PATH="$PWD/gradle-7.6/bin:$PATH"
17+
pre_build:
18+
commands:
19+
# Assume Role to access non-prod resources
20+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Java-Role-us-west-2" --role-session-name "CB-TestVectorResources")
21+
- export TMP_ROLE
22+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
23+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
24+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
25+
- aws sts get-caller-identity
26+
27+
# Build and deploy TestVectors to maven local
28+
- cd submodules/MaterialProviders
29+
- git checkout $BRANCH
30+
- cd TestVectorsAwsCryptographicMaterialProviders/
31+
# This works because `node` is installed by default on GHA runners
32+
- CORES=$(node -e 'console.log(os.cpus().length)')
33+
- make build_java CORES=$CORES
34+
- ./runtimes/java/gradlew -p runtimes/java publishMavenLocalPublicationToMavenLocal
35+
- cd $CODEBUILD_SRC_DIR
736
build:
837
commands:
938
- mvn install -T 8 -Dgpg.skip=true -ntp "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.3.0.zip"

‎codebuild/ci/vectors-generator.yml

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
java: $JAVA_ENV_VERSION
7+
commands:
8+
- n 16
9+
# Install the Javascript ESDK run test vectors
10+
- npm install -g @aws-crypto/integration-node
11+
12+
- git submodule update --init submodules/MaterialProviders
13+
# Get Dafny
14+
- curl https://github.com/dafny-lang/dafny/releases/download/v4.2.0/dafny-4.2.0-x64-ubuntu-20.04.zip -L -o dafny.zip
15+
- unzip -qq dafny.zip && rm dafny.zip
16+
- export PATH="$PWD/dafny:$PATH"
17+
# Get Gradle 7.6
18+
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
19+
- unzip -qq gradle.zip && rm gradle.zip
20+
- export PATH="$PWD/gradle-7.6/bin:$PATH"
21+
pre_build:
22+
commands:
23+
# Assume Role to access non-prod resources
24+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Java-Role-us-west-2" --role-session-name "CB-TestVectorResources")
25+
- export TMP_ROLE
26+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
27+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
28+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
29+
- aws sts get-caller-identity
30+
31+
# Build and deploy to maven local
32+
- cd submodules/MaterialProviders
33+
- git checkout $BRANCH
34+
- cd TestVectorsAwsCryptographicMaterialProviders/
35+
# This works because `node` is installed by default on GHA runners
36+
- CORES=$(node -e 'console.log(os.cpus().length)')
37+
- make build_java CORES=$CORES
38+
- ./runtimes/java/gradlew -p runtimes/java publishMavenLocalPublicationToMavenLocal
39+
- cd $CODEBUILD_SRC_DIR
40+
build:
41+
commands:
42+
- export VECTORS_ZIP="$CODEBUILD_SRC_DIR/generated_vectors.zip"
43+
# Generate test vectors by encrypting with Keyrings
44+
# Ignore Testing coverage requirement by skipping jacoco
45+
- mvn -B -ntp install -Dgpg.skip=true -Djacoco.skip=true "-Dtest=TestVectorGenerator" "-DzipFilePath=$VECTORS_ZIP" "-DkeysManifest=$CODEBUILD_SRC_DIR/src/test/resources/keys.json"
46+
# Decrypt generated vectors with Javascript ESDK
47+
- integration-node decrypt -v $VECTORS_ZIP
48+
49+
- rm $VECTORS_ZIP
50+
# Generate test vectors by encrypting with MasterKeys
51+
- mvn -B -ntp install -Dgpg.skip=true -Djacoco.skip=true -Dmasterkey=true "-Dtest=TestVectorGenerator" "-DzipFilePath=$VECTORS_ZIP" "-DkeysManifest=$CODEBUILD_SRC_DIR/src/test/resources/keys.json"
52+
# Decrypt generated vectors with Javascript ESDK
53+
- integration-node decrypt -v $VECTORS_ZIP

‎codebuild/release/release-prod.yml

+19
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,31 @@ phases:
1616
install:
1717
runtime-versions:
1818
java: corretto11
19+
commands:
20+
- git submodule update --init submodules/MaterialProviders
21+
# Get Dafny
22+
- curl https://github.com/dafny-lang/dafny/releases/download/v4.2.0/dafny-4.2.0-x64-ubuntu-20.04.zip -L -o dafny.zip
23+
- unzip -qq dafny.zip && rm dafny.zip
24+
- export PATH="$PWD/dafny:$PATH"
25+
# Get Gradle 7.6
26+
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
27+
- unzip -qq gradle.zip && rm gradle.zip
28+
- export PATH="$PWD/gradle-7.6/bin:$PATH"
1929
pre_build:
2030
commands:
2131
- git checkout $BRANCH
2232
- export SETTINGS_FILE=$(pwd)/codebuild/release/settings.xml
2333
- aws secretsmanager get-secret-value --region us-west-2 --secret-id Maven-GPG-Keys-Release --query SecretBinary --output text | base64 -d > ~/mvn_gpg.tgz
2434
- tar -xvf ~/mvn_gpg.tgz -C ~
35+
# Build and deploy TestVectorsAwsCryptographicMaterialProviders to maven local
36+
- cd submodules/MaterialProviders
37+
- git checkout $BRANCH
38+
- cd TestVectorsAwsCryptographicMaterialProviders/
39+
# This works because `node` is installed by default on GHA runners
40+
- CORES=$(node -e 'console.log(os.cpus().length)')
41+
- make build_java CORES=$CORES
42+
- ./runtimes/java/gradlew -p runtimes/java publishMavenLocalPublicationToMavenLocal
43+
- cd $CODEBUILD_SRC_DIR
2544
build:
2645
commands:
2746
- |

‎codebuild/release/release-staging.yml

+19
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,32 @@ phases:
1818
install:
1919
runtime-versions:
2020
java: corretto11
21+
commands:
22+
- git submodule update --init submodules/MaterialProviders
23+
# Get Dafny
24+
- curl https://github.com/dafny-lang/dafny/releases/download/v4.2.0/dafny-4.2.0-x64-ubuntu-20.04.zip -L -o dafny.zip
25+
- unzip -qq dafny.zip && rm dafny.zip
26+
- export PATH="$PWD/dafny:$PATH"
27+
# Get Gradle 7.6
28+
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
29+
- unzip -qq gradle.zip && rm gradle.zip
30+
- export PATH="$PWD/gradle-7.6/bin:$PATH"
2131
pre_build:
2232
commands:
2333
- export SETTINGS_FILE=$(pwd)/codebuild/release/settings.xml
2434
- export CODEARTIFACT_TOKEN=$(aws codeartifact get-authorization-token --domain $DOMAIN --domain-owner $ACCOUNT --query authorizationToken --output text --region ${REGION})
2535
- export CODEARTIFACT_REPO_URL=https://${DOMAIN}-${ACCOUNT}.d.codeartifact.${REGION}.amazonaws.com/maven/${REPOSITORY}
2636
- aws secretsmanager get-secret-value --region us-west-2 --secret-id Maven-GPG-Keys-Release --query SecretBinary --output text | base64 -d > ~/mvn_gpg.tgz
2737
- tar -xvf ~/mvn_gpg.tgz -C ~
38+
# Build and deploy TestVectorsAwsCryptographicMaterialProviders to maven local
39+
- cd submodules/MaterialProviders
40+
- git checkout $BRANCH
41+
- cd TestVectorsAwsCryptographicMaterialProviders/
42+
# This works because `node` is installed by default on GHA runners
43+
- CORES=$(node -e 'console.log(os.cpus().length)')
44+
- make build_java CORES=$CORES
45+
- ./runtimes/java/gradlew -p runtimes/java publishMavenLocalPublicationToMavenLocal
46+
- cd $CODEBUILD_SRC_DIR
2847
build:
2948
commands:
3049
- VERSION_HASH="$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)-$CODEBUILD_RESOLVED_SOURCE_VERSION"

‎compliance_exceptions/aws-kms-mrk-aware-multi-keyrings.java

-104
This file was deleted.

0 commit comments

Comments
 (0)