RIPE NCC has merged fe98b5a

* fix(deps): update dependency org.springframework:spring-context to v6.2.15 [82cd0653]
* fix(deps): update dependency commons-io:commons-io to v2.21.0 [43a4570a]
* chore(deps): update dependency org.sonarqube:org.sonarqube.gradle.plugin to v7.2.2.6593 [f546fb27]
* chore(deps): update plugin com.google.cloud.tools.jib to v3.5.2 [e0cf0fee]
* fix(deps): update dependency org.wiremock:wiremock-jetty12 to v3.13.2 [1bda560a]
* fix(deps): update dependency commons-codec:commons-codec to v1.20.0 [37f325ae]
* fix(deps): update dependency io.sentry:sentry-bom to v8.29.0 [9ebaff46]
* chore(deps): update dependency org.eclipse.jgit:org.eclipse.jgit to v7.5.0.202512021534-r [93c5b858]
* renovate: extend recommended config [2559c5cb]
* gitlab: fix deploy check [d5bbe311]
* spring-boot: 3.2.12 -> 3.5.9 [aeb7c7c1]
* gradle: cleanup capabilities for thales HSM implementation [bc4996fc]
* gradle: cleanup build files [454c1ccd]
* gradle: fix property assignment deprecation [4e8710be]
* renovatebot: fix labels and minimum release age [c4422ecc]
* gitlab: generate lockfile for dependency analysis [87c0deb3]
* gitlab: auto-approve dependency update MRs [d1df6ce4]
* Simplify [74cc25e1]
* Same for ta_published_object [3cafbe94]
* Formatting [33297495]
* Do not recalculate SHA256 with every query [435eaedb]
* renovate: fix configuration [4e22ea33]
* renovate: update dependencies on 'next' branch [ae19578e]

Author: RPKI Team at RIPE NCC

.gitignore

@@ -4,6 +4,7 @@ target/
 # Gradle
 .gradle/
 build/
+gradle.lockfile
 
 # direnv
 .direnv

.gitlab-ci.yml

@@ -32,6 +32,13 @@ include:
     file: /templates/security.yml
     inputs:
       stage: security
+      needs: ["lockfile"]
+  - project: swe/gitlab-support
+    file: /templates/approval.yml
+    inputs:
+      stage: .post
+      label: renovatebot
+      access-token: "$APPROVAL_BOT_ACCESS_TOKEN"
 
 variables:
   BUILD_NUMBER: ${CI_COMMIT_REF_SLUG}-${CI_PIPELINE_ID}
@@ -71,6 +78,14 @@ build:
       junit:
         - build/test-results/**/*.xml
 
+lockfile:
+  stage: build
+  script:
+    - gradle dependencies --write-locks
+  artifacts:
+    paths:
+      - "gradle.lockfile"
+
 sonarqube:
   stage: security
   needs: ["build"]

build.gradle

@@ -1,9 +1,9 @@
 plugins {
     id 'rpki-ripe-ncc.build-conventions'
-    id 'org.springframework.boot' version "3.2.12"
+    id 'org.springframework.boot' version "3.5.9"
     id 'distribution'
     id 'jacoco'
-    id "com.google.cloud.tools.jib" version "3.4.5"
+    id "com.google.cloud.tools.jib" version "3.5.2"
     id "com.google.osdetector" version "1.7.3"
 }
 
@@ -12,19 +12,17 @@ apply plugin: 'io.spring.dependency-management'
 
 apply from: "dependencies.gradle"
 
-// Use this style to override dependencies when needed:
-// ext['log4j2.version'] = '2.17.1'
-
 def ENV = System.getenv()
-def hsmImpl = ENV['HSM_IMPL'] ?: 'api-only'
+def useThalesHsm = ENV['HSM_IMPL'] == "thales"
 
 description = 'RPKI RIPE NCC'
 version = ENV['BUILD_NUMBER'] ?: 'DEV'
 
+ext['hibernate.version'] = '6.2.49.Final'
+
 def managedVersions = dependencyManagement.managedVersions
 
 dependencies {
-    //developmentOnly 'org.springframework.boot:spring-boot-devtools'
     implementation 'org.springframework.boot:spring-boot-starter'
     implementation 'org.springframework.boot:spring-boot-starter-actuator'
     implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
@@ -34,17 +32,16 @@ dependencies {
     implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
     implementation 'org.springframework.boot:spring-boot-starter-quartz'
     implementation 'org.springframework.boot:spring-boot-starter-security'
-    // for http client - we do not use reactive patterns in general
     implementation 'org.springframework.boot:spring-boot-starter-webflux'
     if (osdetector.os == "osx") {
         runtimeOnly "io.netty:netty-resolver-dns-native-macos:${managedVersions['io.netty:netty-resolver-dns-native-macos']}:osx-${osdetector.arch}"
     }
-    implementation 'org.flywaydb:flyway-core'
+    implementation 'org.flywaydb:flyway-database-postgresql'
 
     implementation "org.thymeleaf:thymeleaf:3.1.2.RELEASE"
     implementation "org.thymeleaf:thymeleaf-spring6:3.1.3.RELEASE"
 
-    implementation platform('io.sentry:sentry-bom:8.26.0')
+    implementation platform('io.sentry:sentry-bom:8.29.0')
     implementation 'io.sentry:sentry-spring-boot-starter'
     implementation 'io.sentry:sentry-logback'
 
@@ -58,8 +55,8 @@ dependencies {
 
     implementation 'com.google.code.gson:gson:2.13.2'
     implementation 'com.jamesmurty.utils:java-xmlbuilder:1.3'
-    implementation 'commons-codec:commons-codec:1.19.0'
-    implementation 'commons-io:commons-io:2.20.0'
+    implementation 'commons-codec:commons-codec:1.20.0'
+    implementation 'commons-io:commons-io:2.21.0'
     implementation 'ch.qos.logback.contrib:logback-json-classic:0.1.5'
     implementation 'ch.qos.logback.contrib:logback-jackson:0.1.5'
     implementation 'net.logstash.logback:logstash-logback-encoder:8.1'
@@ -72,20 +69,20 @@ dependencies {
         exclude group: 'org.hamcrest', module: 'hamcrest-core'
     }
 
-    testImplementation "org.wiremock:wiremock-jetty12:3.9.2"
+    testImplementation "org.wiremock:wiremock-jetty12:3.13.2"
     testImplementation 'net.jqwik:jqwik:1.9.3'
     testImplementation("net.ripe.rpki:rpki-commons:$rpki_commons_version:tests") {
         exclude group: "net.sf.saxon", module: "Saxon-HE"
     }
     testImplementation 'org.assertj:assertj-core'
 
-
     implementation (project(':hsm')) {
-        capabilities {
-            requireCapability('net.ripe.rpki.hsm:' + hsmImpl)
+        if (useThalesHsm) {
+            capabilities {
+                requireCapability('net.ripe.rpki.hsm:thales')
+            }
         }
     }
-
 }
 
 sourceSets {
@@ -103,6 +100,10 @@ configurations {
     integrationRuntimeOnly.extendsFrom testRuntimeOnly
 }
 
+dependencyLocking {
+    lockAllConfigurations()
+}
+
 tasks.withType(Tar) {
     compression = Compression.GZIP
 }
@@ -121,7 +122,6 @@ task integrationTest(type: Test) {
      mustRunAfter test
 }
 
-// run integration tests as part of `check`
 tasks.named('check') {
     dependsOn tasks.named('integrationTest')
 }

buildSrc/build.gradle

@@ -4,15 +4,13 @@ plugins {
 
 repositories {
     maven {
-      url "https://plugins.gradle.org/m2/"
+      url = "https://plugins.gradle.org/m2/"
     }
 }
 
 dependencies {
     implementation 'io.freefair.lombok:io.freefair.lombok.gradle.plugin:9.0.0'
-    implementation('com.gorylenko.gradle-git-properties:com.gorylenko.gradle-git-properties.gradle.plugin:2.5.3') {
-        exclude group: 'org.eclipse.jgit', module: 'org.eclipse.jgit'
-    }
-    implementation 'org.eclipse.jgit:org.eclipse.jgit:7.4.0.202509020913-r'
-    implementation 'org.sonarqube:org.sonarqube.gradle.plugin:7.0.1.6134'
+    implementation 'com.gorylenko.gradle-git-properties:com.gorylenko.gradle-git-properties.gradle.plugin:2.5.3'
+    implementation 'org.eclipse.jgit:org.eclipse.jgit:7.5.0.202512021534-r'
+    implementation 'org.sonarqube:org.sonarqube.gradle.plugin:7.2.2.6593'
 }

buildSrc/src/main/groovy/rpki-ripe-ncc.build-conventions.gradle

@@ -35,10 +35,6 @@ repositories {
     maven {
         url = uri('https://maven.nexus.ripe.net/repository/maven-third-party')
     }
-    // Use when testing new third party dependencies
-    // maven {
-    //     url = uri('https://maven.nexus.ripe.net/repository/maven-third-party-snapshots')
-    // }
 }
 
 java {

hsm/build.gradle

@@ -13,32 +13,20 @@ sourceSets {
 }
 
 java {
-    registerFeature("apiOnly") {
-        usingSourceSet(sourceSets.main)
-        capability('net.ripe.rpki.hsm', 'api-only', '1.0')
-    }
-
     registerFeature("thales") {
         usingSourceSet(sourceSets.thales)
         capability('net.ripe.rpki.hsm', 'thales', '1.0')
     }
 }
 
 dependencies {
-    thalesApi (project(':hsm')) {
-        capabilities {
-            requireCapability('net.ripe.rpki.hsm:api-only')
-        }
-    }
+    thalesApi (project(':hsm'))
     thalesImplementation("net.ripe.rpki:rpki-commons:$rpki_commons_version")
 
-    // 2024-4-26: Final DBProvider 1.6 provided by Entrust
     thalesImplementation 'com.thales.esecurity.asg.ripe.db-jceprovider:DBProvider:1.6'
-    // **When using JDK 11** make sure the matching version of nCipherKM is on classpath because DBProvider depends on it.
     thalesImplementation 'com.ncipher.nfast:nCipherKM:13.6.12'
 
-    thalesImplementation 'org.springframework:spring-context:6.1.15'
-    // used in spring-context, but not exported.
+    thalesImplementation 'org.springframework:spring-context:6.2.15'
     thalesImplementation 'javax.annotation:javax.annotation-api:1.3.2'
-    thalesImplementation "org.springframework.boot:spring-boot-autoconfigure:2.7.18"
+    thalesImplementation "org.springframework.boot:spring-boot-autoconfigure:3.5.9"
 }

renovate.json

@@ -1,22 +1,21 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "enabled": true,
-  "autoApprove": true,
   "extends": [
-    "config:base",
+    "config:recommended",
     "group:recommended"
   ],
+  "baseBranchPatterns": ["next"],
   "schedule": "after 8am and before 1pm every weekday",
   "dependencyDashboard": true,
   "osvVulnerabilityAlerts": true,
+  "minimumReleaseAge": "3 days",
+  "labels": ["renovatebot:dependencies"],
   "vulnerabilityAlerts": {
-    "labels": ["security"],
+    "labels": ["renovatebot:security"],
     "automerge": true
   },
   "packageRules": [
-    {
-      "minimumReleaseAge": "3 days"
-    },
     {
       "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
       "automerge": true

scripts/gitlab-deploy-check

@@ -190,6 +190,7 @@ const main = async (ctx) => {
         status: "success",
     })();
     const timeline = [...deployments].sort(Calendar.compare((x) => x.finished_at))
+          .filter((x) => x.deployable != null)
           .filter((x) => !Calendar.isAfter(x.deployable.created_at, mergeRequest.merged_at))
           .reduce((acc, x) => acc.find(({id}) => id === x.id) != null ? acc : [...acc, x], []);
 

src/main/java/net/ripe/rpki/config/actuator/ActiveNodeEndpoint.java

@@ -5,18 +5,18 @@
 import lombok.Value;
 import net.ripe.rpki.server.api.services.system.ActiveNodeService;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.actuate.endpoint.web.annotation.RestControllerEndpoint;
+import org.springframework.boot.actuate.endpoint.annotation.Endpoint;
+import org.springframework.boot.actuate.endpoint.annotation.ReadOperation;
 import org.springframework.stereotype.Component;
-import org.springframework.web.bind.annotation.GetMapping;
 
 @AllArgsConstructor
 @Component
-@RestControllerEndpoint(id="active-node")
+@Endpoint(id="active-node")
 public class ActiveNodeEndpoint {
     @Autowired
     private ActiveNodeService activeNodeService;
 
-    @GetMapping()
+    @ReadOperation()
     public ActiveNodeStatus activeNodeStatus() {
         return ActiveNodeStatus.builder()
                 .activeNodeName(activeNodeService.getActiveNodeName())

src/main/java/net/ripe/rpki/domain/ManagedCertificateAuthority.java

@@ -61,7 +61,7 @@ public static EventSubscription subscribe(final CertificateAuthorityEventVisitor
         return EVENTS.subscribe(event -> event.accept(listener, recording));
     }
 
-    @OneToMany(orphanRemoval = true, cascade = CascadeType.ALL )
+    @OneToMany(orphanRemoval = true, cascade = CascadeType.ALL)
     @JoinColumn(name = "ca_id", nullable = false)
     private final Set<KeyPairEntity> keyPairs = new HashSet<>();