Commit Graph

675 Commits

Author SHA1 Message Date
Chris Cochrane
d27aa0e685
Force commons-io version () 2024-10-24 13:27:22 +01:00
rick.parker
967402122c Merge branch 'release/os/4.12' into merge-release/os/4.11-release/os/4.12-2024-08-13-341
# Conflicts:
#	docker/src/docker/DockerfileAL
#	node/src/integration-test/kotlin/net/corda/node/services/identity/NotaryCertificateRotationTest.kt
2024-08-13 17:26:41 +01:00
rick.parker
137c7fb19a Merge branch 'release/os/4.11' into merge-release/os/4.10-release/os/4.11-2024-08-13-301
# Conflicts:
#	tools/checkpoint-agent/build.gradle
2024-08-13 16:38:11 +01:00
r3-build
5fd8875ed2 Merging forward updates from release/os/4.9 to release/os/4.10 - 2024-08-13 2024-08-13 15:08:09 +00:00
r3-build
b301456bac Merging forward updates from release/os/4.8 to release/os/4.9 - 2024-08-13 2024-08-13 13:55:03 +00:00
Adel El-Beik
b9dbf5269a
ENT-12080: Replaced jcenter with public local copy. () 2024-08-13 14:54:10 +01:00
Adel El-Beik
c4d3004020 Revert "ENT-12080: Replaces jcenter with local public backup."
This reverts commit c5815b0381.
2024-08-13 14:15:09 +01:00
Adel El-Beik
c5815b0381 ENT-12080: Replaces jcenter with local public backup. 2024-08-13 14:10:50 +01:00
chriscochrane
e7e4d361f4
Upgraded jackson 2024-07-29 18:08:28 +01:00
chriscochrane
f548c8bdd5
Vulnerability updates 2024-07-17 09:48:54 +01:00
chriscochrane
7cde5523dc
Dependency updates for security issues 2024-07-09 16:13:53 +01:00
Adel El-Beik
71865b3a34 ENT-11008: Upgrade to Gradle 7.6.4. 2024-06-11 16:45:32 +01:00
Adel El-Beik
c8c8a8fa2b ENT-11008: Upgrade gradle to 7.6.2. 2024-06-04 16:41:42 +01:00
Adel El-Beik
7209a4e25c ES-2371: Revert h2 data test change. Will be done in separate branch. 2024-05-23 16:07:45 +01:00
Ronan Browne
4efda6d46b ES-2371: use public mirror 2024-05-13 15:30:01 +01:00
Ronan Browne
835e95c222 ES-2371: Consume H2 DB snapshot version 2024-05-12 18:37:43 +01:00
Chris Cochrane
503d887fd1
Upgrade for security vulns 2024-04-11 14:01:57 +01:00
Adel El-Beik
2db7c9656c
ENT-11728: Force use of LTS version of BC everywhere. ()
* ENT-11728: Force use of LTS version of BC everywhere.

* ENT-11728: Removed extra task left in.

* ENT-11728: Revert to the now released 2.73.6 version of BC.
2024-04-08 13:09:34 +01:00
Adel El-Beik
6c4b8fdf23
ENT-11657: Upgrade artemis. ()
* ENT-11657: Upgraded artemis.

* ENT-11657: Reverted dependencies task leftin.

* ENT-11657: Upgraded log4j and slf4j.
2024-04-03 11:15:00 +01:00
Adel El-Beik
72778b7fb0
ENT-11728: Switched to LTS version of BC. Also removed PQC algos as n… ()
* ENT-11728: Switched to LTS version of BC. Also removed PQC algos as not supported in LTS.
* ENT-11728: Removed the SPHINCS PQC algorithm.
* ENT-11728: Added dependency on bcutil to fix missing class error.
2024-04-03 11:14:19 +01:00
Shams Asari
900809b3d7 ENT-11090: Removed all JDK 8/11 conditional code 2024-03-05 17:10:26 +00:00
Shams Asari
0091807c2f ENT-11101: Fix all crypto issues introduced by Java 17 upgrade
The various crypto tests that were previously ignored have been re-enabled.

The abandoned i2p EdDSA library has been replaced with native support that was added in Java 15.

Java 17 (via the `SunEC` provider) does not support the secp256k1 curve (one of the two ECDSA curves supported in Corda). This would not normally have been an issue as secp256k1 is already taken care of by Bouncy Castle. However, this only works if the `Crypto` API is used or if `”BC”` is explicitly specified as the provider (e.g. `Signature.getInstance(“SHA256withECDSA”, “BC”)`). If no provider is specified, which is what is more common, and actually what the Java docs recommend, then this doesn’t work as the `SunEC` provider is selected. To resolve this, a custom provider was created, installed just in front of `SunEC`, which “augments” `SunEC` by delegating to Bouncy Castle if keys or parameters for secp256k1 are encountered.

`X509Utilities.createCertificate` now calls `X509Certificate.verify()` to verify the created certificate, rather than using the Bouncy Castle API. This is more representative of how certificates will be verified (e.g. during SSL handshake) and weeds out other issues (such as unsupported curve error for secp256k1).

`BCCryptoService` has been renamed to `DefaultCryptoService` as it no longer explicitly uses Bouncy Castle but rather uses the installed security providers. This was done to fix a failing test. Further, `BCCryptoService` was already relying on the installed providers in some places.

The hack to get Corda `SecureRandom` working was also resolved. Also, as an added bonus, tests which ignored `SPHINCS256_SHA256` have been reinstated.

Note, there is a slightly inconsistency between how EdDSA and ECDSA keys are handled (and also RSA). For the later, Bouncy Castle is preferred, and methods such as `toSupportedKey*` will convert any JDK class to Bouncy Castle. For EdDSA the preference is the JDK (`SunEC`). However, this is simply a continuation of the previous preference of the i2p library over Bouncy Castle.
2024-03-04 13:29:49 +00:00
Shams Asari
63f8e220c8
ENT-11251: Upgrade to Kotlin language version 1.9 () 2024-01-25 13:51:19 +00:00
Chris Cochrane
07a2d98d0b
Security vulnerabilities 2024-01-12 11:51:12 +00:00
Shams Asari
2e63ca6264
ENT-11065: Remove the need for JVM flags in client code () 2024-01-03 11:22:03 +00:00
Shams Asari
406f7ff292
ENT-11056: Compile the external verifier using Kotlin 1.2 ()
This requires Kotlin 1.2 versions of core and serialization (core-1.2 and serialization-1.2 respectively), which are just "shell" modules and which compile the existing source code with Kotlin 1.2. The 1.2 plugin does not work with the current version of Gradle and so the 1.2 compiler has to be called directly.

Now with two versions of Kotlin in the code base, each module needs to have its version manually specified to ensure a clean separation. Otherwise, the default Kotlin version can override 1.2 when needed.

Some of the code was tidied-up or improved to enable it to be cross-compiled. For post-1.2 APIs being used, they have been copied into core-1.2 with the same method signatures. OpenTelemetryComponent was moved to node-api, along with the dependency, to avoid also having a 1.2 version for the opentelemetry module.
2024-01-02 17:02:20 +00:00
Arshad Mahmood
b7de1dcd23 ENT-11253 Publish sources and javadoc 2023-12-13 16:26:23 +00:00
Shams Asari
11d0054fcc
ENT-11055: Basic external verification ()
* ENT-11055: Basic external verification

Introduction of the external transaction verifier, a separate JVM process for verifying `SignedTransaction`s. The end goal is for this verifier to be built with Kotlin 1.2 so that it creates a compatible verification environment for transactions with 4.11 contracts. For now however the verifier is built against Kotlin 1.8, same as the node.

External verification is enabled when the the system property `net.corda.node.verification.external` is set to `true`. When enabled, all verification requests made via `SignedTransaction.verify` are sent to the external verifier, regardless of the transaction content. It will do the vast bulk of the verification and then send the result back, namely if an exception occurred. If it did, then it's re-thrown in the node.

The external verifier is a stateless process, with no connection to the node's database. All transaction resolution information needed to create the relevant ledger transaction object are made to the node, which waits in a loop servicing these requests until it receives the result. The verifier Jar is embedded in the Corda node Jar, and is extracted and run when needed for the first time. The node opens up a local port for the verifier to communicate with, which is specified to the verifier in the process command line. This all means there is no extra configuration or deployment required to support external verification.

The existing code had some initial attempts and abstractions to support a future external verification feature. However,
they were either incorrect or didn't quite fit. One such example was `TransactionVerifierService`. It incorrectly operated on the `LedgerTransaction` level, which doesn't work since the transaction needs to be first serialised. Instead a new abstraction, `VerificationSupport` has been introduced, which represents all the operations needed to resolve and verify a `SignedTransaction`, essentially replacing `ServicesForResolution` (a lot of the changes are due to this). The external verifier implements this with a simple RPC mechanism, whilst the node needed a new (internal) `ServiceHub` abstraction, `VerifyingServiceHub`. `ServicesForResolution` hasn't been deleted since it's public API, however all classes implementing it must also implement `VerifyingServiceHub`. This is possible to do without breaking compatibility since `ServicesForResolution` is annotated with  `@DoNotImplement`.

Changes to `api-current.txt` were made due to the removal of `TransactionVerifierService`, which was clearly indicated as an internal class, and returning `TransactionBuilder.toLedgerTransactionWithContext` back to an internal method.

* Address review comments

* One bulk load states method

* Merge fix
2023-12-07 11:29:27 +00:00
Shams Asari
4cf5fe55dd
ENT-11099: Update Java compile source & target to 17 ()
And removed unused `jdkClassifier` in build files.
2023-12-06 09:46:29 +00:00
Connel McGovern
2adb502405
Merge branch 'release/os/4.11' into merge-release/os/4.10-release/os/4.11-2023-11-20-9 2023-11-21 09:16:06 +00:00
r3-build
5e9fdb7b2b Merging forward updates from release/os/4.9 to release/os/4.10 - 2023-11-20 2023-11-20 14:29:12 +00:00
Ronan Browne
18d98760b1
Merge branch 'release/os/4.9' into merge-release/os/4.8-release/os/4.9-2023-11-19-6 2023-11-19 19:56:09 +00:00
Adel El-Beik
548242e3cd
Merge branch 'release/os/4.8' into merge-release/os/4.7-release/os/4.8-2023-11-17-6 2023-11-18 18:10:07 +00:00
Connel McGovern
5b846406c8
ES-1331: Enable Gradle Enterprise build scans & remote caching ()
* ES-1131: Enable Gradle Enterprise build scans & remote caching
2023-11-17 17:41:45 +00:00
Arshad Mahmood
6dd33fb8f7 Upgrade to gradle 7.6, kotlin 1.8 and jdk 17
Major changes due to JDK 17:
1. JDK17 JCE Provider now has built-in support for eddsas, corda uses
   the bouncycastle (i2p) implementation. This PR removes the conflicting
   algorithms from the built-in JCE provider.

2. JavaScript scripting has been removed from the JDK, the corda log4j config was using
   scripting to conditionally output additional diagnostic info if the MDC
   was populated. This PR has removed the scripting.

3. The artifactory plug-ins used are now deprecated, this PR has removed them
   and uses the same code as Corda 5 for publishing to artifactory.

4. Javadoc generation has been modified to use the latest dokka plug-ins.

5. Gradle 7.6 has implemented an incredibly annoying change where transitive
   dependencies are not put on the compile classpath, so that they have to be
   explicitly added as dependencies to projects.

6. Mockito has been updated, which sadly meant that quite a few source files
   have to changes to use the new (org.mockito.kotlin) package name. This makes
   this PR appear much larger than it is.

7. A number of tests have been marked as ignored to get a green, broadly they fall
   into 3 classes.

   The first is related to crypto keypair tests, it appears some logic
   in the JDK prefers to use the SunJCE implementation and we prefer to use
   bouncycastle. I believe this issue can be fixed with better test setup.

   The second group is related to our use of a method called "uncheckedCast(..)",
   the purpose of this method was to get rid of the annoying unchecked cast compiler
   warning that would otherwise exist. It looks like the Kotlin 1.9 compiler type
   inference differs and at runtime sometimes the type it infers is "Void" which causes
   an exception at runtime. The simplest solution is to use an explicit cast instead of
   unchecked cast, Corda 5 have removed unchecked cast from their codebase.

   The third class are a number of ActiveMQ tests which appear to have a memory leak somewhere.
2023-11-06 10:24:17 +00:00
Jose Coll
5c32d3dec4
ENT-11073 Checkpoint agent: update java assist version. () 2023-11-02 17:46:29 +00:00
Chris Cochrane
6735e4bf36
ENT-10806 - Bumped jetty version () 2023-09-27 11:43:14 +01:00
Ronan Browne
91d2ae9364 ES-1140: Merging forward updates from 4.10 to 4.11 (2023-08-24) 2023-08-24 19:50:24 +01:00
Ronan Browne
2691ecd5fa ENT-10606: Merging forward updates from 4.9 to 4.10 (2023-08-24) 2023-08-24 16:48:04 +01:00
Ronan Browne
a104923cd6
ENT-10606: fix shell artifact resolution () 2023-08-24 16:44:35 +01:00
Shams Asari
e0e4f51ba2
ENT-10285: Remove experimental DJVM support () 2023-08-09 08:44:32 +01:00
Connel McGovern
52f2e8e2e6 ES-853: Correcting forward merge 2023-07-14 18:23:17 +01:00
Connel McGovern
b01f85fb11 Merge branch 'release/os/4.9' into connelm/merge-4.9-4.10-2023-07-14
# Conflicts:
#	build.gradle
2023-07-14 18:19:55 +01:00
Ronan Browne
befae353ac ES-853: Merging forward updates from 4.8 to 4.9 (2023-07-13) 2023-07-13 15:25:55 +01:00
Ronan Browne
6bcc843f19 ES-853: Merging forward updates from 4.7 to 4.8 (2023-07-13) 2023-07-13 07:07:17 +01:00
Ronan Browne
010a9a6c08 ES-853: Merging forward updates from 4.6 to 4.7 (2023-07-12) 2023-07-12 20:02:32 +01:00
Ronan Browne
b410cd2a5d
ES-853: update Artifactory refrences to new public location ()
* ES-853: update artifactory references to new public location
2023-07-12 17:36:57 +01:00
Chris Cochrane
e100bee4f1
ENT-10076,ENT-10080 - Security Vulnerabilities ()
* Updated dependencies

* Address compiler checks
2023-06-28 13:20:58 +01:00
Chris Cochrane
d02f6ff68c
ENT-10048,ENT-10050 - Security vulnerabilities ()
* Updated netty and tcnative
2023-06-27 13:29:28 +01:00
Chris Cochrane
89b2deebe3
Upgraded tcnative, for nett (previous commit) 2023-06-15 16:56:42 +01:00