diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml deleted file mode 100644 index fa821d3b9..000000000 --- a/.github/FUNDING.yml +++ /dev/null @@ -1,2 +0,0 @@ -github: [cryptomator] -custom: https://cryptomator.org/sponsors/ diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml index 2c28f94d9..2d97ef254 100644 --- a/.github/ISSUE_TEMPLATE/bug.yml +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -1,6 +1,6 @@ name: Bug Report description: Create a report to help us improve -labels: ["type:bug"] +type: "Bug" body: - type: checkboxes id: terms diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml index 52c8c535c..c59ae735f 100644 --- a/.github/ISSUE_TEMPLATE/feature.yml +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -1,6 +1,6 @@ name: Feature Request description: Suggest an idea for this project -labels: ["type:feature-request"] +type: "Feature" body: - type: checkboxes id: terms diff --git a/.github/ISSUE_TEMPLATE/story.md b/.github/ISSUE_TEMPLATE/story.md new file mode 100644 index 000000000..db91f8c49 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/story.md @@ -0,0 +1,23 @@ +--- +name: Story +about: Persona needs for purpose. +title: "[Story]" +labels: '' +assignees: '' + +--- + +### Story +* **Persona**: +* **Need**: +* **Purpose**: + + +### Acceptance Criteria +- [ ] + +### Open Questions + +### Context + +### Implementation diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6fa8c388d..bc0b88069 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -18,14 +18,29 @@ jobs: name: Run Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' cache-dependency-path: frontend/package-lock.json + # / katta start addition + - uses: actions/setup-java@v5 + with: + distribution: 'temurin' + java-version: ${{ env.JAVA_VERSION }} + cache: 'maven' + - name: Generate openapi.json + working-directory: backend + run: > + mvn -B clean compile quarkus:build -P generate-openapi-json + - name: Check openapi.json + working-directory: backend + run: > + cat ../frontend/src/openapi/openapi.json + # \ katta end addition - name: NPM install working-directory: frontend run: npm ci --ignore-scripts @@ -35,48 +50,86 @@ jobs: - name: Deploy frontend working-directory: frontend run: npm run dist - - name: SonarCloud Scan Frontend - uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0 - with: - projectBaseDir: frontend - args: > - -Dsonar.organization=cryptomator - -Dsonar.projectKey=cryptomator_hub_frontend - -Dsonar.typescript.tsconfigPath=tsconfig.json - -Dsonar.sources=src/ - -Dsonar.tests=test/ - -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0 + # / katta start commented out + # - name: SonarCloud Scan Frontend + # uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0 + # with: + # projectBaseDir: frontend + # args: > + # -Dsonar.organization=cryptomator + # -Dsonar.projectKey=cryptomator_hub_frontend + # -Dsonar.typescript.tsconfigPath=tsconfig.json + # -Dsonar.sources=src/ + # -Dsonar.tests=test/ + # -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info + # env: + # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any + # SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + # \ katta start commented out + - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} cache: 'maven' - - name: Cache SonarCloud packages - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 - with: - path: ~/.sonar/cache - key: ${{ runner.os }}-sonar - restore-keys: ${{ runner.os }}-sonar + # / katta start commented out + # - name: Cache SonarCloud packages + # uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + # with: + # path: ~/.sonar/cache + # key: ${{ runner.os }}-sonar + # restore-keys: ${{ runner.os }}-sonar + # \ katta start commented out - name: Build and test backend working-directory: backend run: > ./mvnw -B clean verify - org.sonarsource.scanner.maven:sonar-maven-plugin:sonar - -Dsonar.projectKey=cryptomator_hub_backend - -Dsonar.organization=cryptomator - -Dsonar.host.url=https://sonarcloud.io + # / katta start commented out + # org.sonarsource.scanner.maven:sonar-maven-plugin:sonar + # -Dsonar.projectKey=cryptomator_hub_backend + # -Dsonar.organization=cryptomator + # -Dsonar.host.url=https://sonarcloud.io + # \ katta start commented out --no-transfer-progress env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + # / katta addition + - id: get_tag + name: Get tag + working-directory: backend + run: | + if [[ ! -z "${{ inputs.tag }}" ]]; then + TAG="${{ inputs.tag }}" + elif [[ ${{ github.ref_type }} == 'tag' ]]; then + TAG="${{ github.ref_name }}" + # / katta start modification + elif [[ ${{ github.ref_name }} == ${{ github.event.repository.default_branch }} ]]; then + TAG=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout) + else + TAG="commit-${{ github.sha }}" + fi + # \ katta end modification + echo tag=${TAG} + echo tag=${TAG} >> "$GITHUB_OUTPUT" + - name: Build and push container image (ci) + working-directory: backend + run: ./mvnw -B clean package -DskipTests + env: + QUARKUS_JIB_PLATFORMS: linux/amd64,linux/arm64/v8 + QUARKUS_CONTAINER_IMAGE_TAG: ${{ steps.get_tag.outputs.tag }}-ci + QUARKUS_CONTAINER_IMAGE_BUILD: true + QUARKUS_CONTAINER_IMAGE_PUSH: true + QUARKUS_CONTAINER_IMAGE_REGISTRY: ghcr.io + QUARKUS_CONTAINER_IMAGE_USERNAME: ${{ github.actor }} + QUARKUS_CONTAINER_IMAGE_PASSWORD: ${{ secrets.GITHUB_TOKEN }} + # \ katta addition build-native-image: name: Build and Push ${{ matrix.arch }} Image needs: test - if: startsWith(github.ref, 'refs/tags/') || contains(github.event.head_commit.message, '[build image]') + # / katta start commented out - build every commit + # if: startsWith(github.ref, 'refs/tags/') || contains(github.event.head_commit.message, '[build image]') + # \ katta end commented out strategy: fail-fast: false matrix: @@ -92,15 +145,34 @@ jobs: digest_amd64: ${{ steps.digest.outputs.digest_amd64 }} digest_arm64: ${{ steps.digest.outputs.digest_arm64 }} permissions: - contents: read - packages: write + contents: read # Required for checkout + packages: write # Required for pushing the image to GHCR steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' cache-dependency-path: frontend/package-lock.json + # / katta addition + - id: get_tag + name: get tag + working-directory: backend + run: | + if [[ ! -z "${{ inputs.tag }}" ]]; then + TAG="${{ inputs.tag }}" + elif [[ ${{ github.ref_type }} == 'tag' ]]; then + TAG="${{ github.ref_name }}" + # / katta start modification + elif [[ ${{ github.ref_name }} == ${{ github.event.repository.default_branch }} ]]; then + TAG=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout) + else + TAG="commit-${{ github.sha }}" + fi + # \ katta end modification + echo tag=${TAG} + echo tag=${TAG} >> "$GITHUB_OUTPUT" + # \ katta addition - name: NPM install working-directory: frontend run: npm ci --ignore-scripts @@ -109,30 +181,37 @@ jobs: run: npm run dist - name: Ensure to use tagged version working-directory: backend - run: ./mvnw versions:set --file pom.xml -DnewVersion=${GITHUB_REF##*/} + # / katta modification + #run: ./mvnw versions:set --file pom.xml -DnewVersion=${GITHUB_REF##*/} + run: ./mvnw versions:set --file pom.xml -DnewVersion=${{ steps.get_tag.outputs.tag }} + # \ katta modification - name: Docker metadata id: meta - uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0 + uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 with: - images: ghcr.io/cryptomator/hub + images: ghcr.io/shift7-ch/katta-server + # / katta modification tags: | type=sha,prefix=,format=short + type=raw,value=${{ steps.get_tag.outputs.tag }} + type=raw,value=latest,enable={{is_default_branch}} + # \ katta modification flavor: | suffix=-${{ matrix.arch }} labels: | - org.opencontainers.image.title=Cryptomator Hub - org.opencontainers.image.vendor=Skymatic GmbH + org.opencontainers.image.title=Katta Server + org.opencontainers.image.vendor=Shift 7 GmbH - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Login to GHCR - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and Push Container Image id: push - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 with: context: backend file: backend/src/main/docker/Dockerfile.native @@ -145,42 +224,63 @@ jobs: run: | echo "digest_${{ matrix.arch }}=${{ steps.push.outputs.digest }}" >> "$GITHUB_OUTPUT" + + multi-arch-image: name: Build and Push Multi-Arch Image needs: build-native-image runs-on: ubuntu-latest permissions: - id-token: write - contents: read - attestations: write - packages: write + contents: read # Required for checkout + id-token: write # Required for the attestations step + attestations: write # Required for the attestations step + artifact-metadata: write # Required for the attestations step + packages: write # Required for pushing the image to GHCR steps: - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Determine short Commit SHA id: sha run: echo "short_sha=${LONG_SHA:0:7}" >> "$GITHUB_OUTPUT" env: LONG_SHA: ${{ github.sha }} - name: Login to GHCR - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Create Multi-Arch Manifest for ghcr.io/cryptomator/hub:${{ steps.sha.outputs.short_sha }} + - name: Create Multi-Arch Manifest for ghcr.io/shift7-ch/katta-server:${{ steps.sha.outputs.short_sha }} run: > - docker buildx imagetools create --tag ghcr.io/cryptomator/hub:${{ steps.sha.outputs.short_sha }} - ghcr.io/cryptomator/hub@${{ needs.build-native-image.outputs.digest_amd64 }} - ghcr.io/cryptomator/hub@${{ needs.build-native-image.outputs.digest_arm64 }} + docker buildx imagetools create --tag ghcr.io/shift7-ch/katta-server:${{ steps.sha.outputs.short_sha }} + ghcr.io/shift7-ch/katta-server@${{ needs.build-native-image.outputs.digest_amd64 }} + ghcr.io/shift7-ch/katta-server@${{ needs.build-native-image.outputs.digest_arm64 }} - name: Retrieve Multi-Arch Digest id: inspect run: | - DIGEST=$(docker buildx imagetools inspect ghcr.io/cryptomator/hub:${{ steps.sha.outputs.short_sha }} --format "{{json .Manifest}}" | jq -r .digest) + DIGEST=$(docker buildx imagetools inspect ghcr.io/shift7-ch/katta-server:${{ steps.sha.outputs.short_sha }} --format "{{json .Manifest}}" | jq -r .digest) echo "digest_multiarch=${DIGEST}" >> "$GITHUB_OUTPUT" - name: Generate artifact attestation - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0 + uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 with: - subject-name: ghcr.io/cryptomator/hub + subject-name: ghcr.io/shift7-ch/katta-server subject-digest: ${{ steps.inspect.outputs.digest_multiarch }} push-to-registry: true + +# / katta start addition + keycloak-integrationtests: + name: Run katta Keycloak Integration Tests + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + + - uses: actions/setup-java@v5 + with: + distribution: 'temurin' + java-version: ${{ env.JAVA_VERSION }} + cache: 'maven' + - name: Run Keycloak integration tests + working-directory: keycloak + run: > + mvn -B clean verify +# \ katta end addition \ No newline at end of file diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml new file mode 100644 index 000000000..fed2005a1 --- /dev/null +++ b/.github/workflows/helm-chart.yml @@ -0,0 +1,135 @@ +name: Helm Chart + +on: + push: + paths: + - charts/cryptomator-hub/** + - .github/workflows/helm-chart.yml + workflow_dispatch: + inputs: + version: + description: 'Chart Version' + required: true + appVersion: + description: 'App Version' + required: true + +defaults: + run: + shell: bash + +jobs: + lint: + name: Lint Helm Chart + runs-on: ubuntu-latest + permissions: + contents: read # Required for checkout + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Setup Helm + uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1 + + - name: Lint chart + run: helm lint charts/cryptomator-hub + + publish: + name: Publish Helm Chart + needs: lint + if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/') || contains(github.event.head_commit.message, '[build image]') || contains(github.event.head_commit.message, '[build chart]') + runs-on: ubuntu-latest + permissions: + contents: read # Required for checkout + id-token: write # Required for the attestations step + attestations: write # Required for the attestations step + artifact-metadata: write # Required for the attestations step + packages: write # Required for pushing the chart to GHCR + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Setup Helm + uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1 + + - name: Setup Cosign + uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 + + - name: Compute publish version + id: version + run: | + set -euo pipefail + if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then + echo "publish_version=${{ github.event.inputs.version }}" >> "$GITHUB_OUTPUT" + echo "publish_app_version=${{ github.event.inputs.appVersion }}" >> "$GITHUB_OUTPUT" + exit 0 + fi + + chart_file="charts/cryptomator-hub/Chart.yaml" + base_version=$(awk -F': ' '/^version:/ {print $2}' "$chart_file") + base_app_version=$(awk -F': ' '/^appVersion:/ {print $2}' "$chart_file" | tr -d '"') + + if [[ -z "$base_version" ]]; then + echo "Unable to read chart version from $chart_file" >&2 + exit 1 + fi + + if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then + publish_version="$base_version" + else + short_sha="${GITHUB_SHA::7}" + branch_slug=$(echo "${GITHUB_REF_NAME}" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9.-]+/-/g; s/^-+//; s/-+$//') + publish_version="${base_version}-${branch_slug}.${short_sha}" + fi + + echo "publish_version=${publish_version}" >> "$GITHUB_OUTPUT" + echo "publish_app_version=${base_app_version}" >> "$GITHUB_OUTPUT" + + - name: Package chart + run: | + mkdir -p dist + helm package charts/cryptomator-hub \ + --destination dist \ + --version "${{ steps.version.outputs.publish_version }}" \ + --app-version "${{ steps.version.outputs.publish_app_version }}" + + - name: Login to GHCR + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: "Helm Registry: Login to GHCR" + run: echo "$GITHUB_TOKEN" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Push chart to GHCR + id: push + run: | + set -euo pipefail + push_output=$(helm push "dist/cryptomator-hub-${{ steps.version.outputs.publish_version }}.tgz" "oci://ghcr.io/cryptomator/charts" 2>&1) + echo "$push_output" + + digest=$(printf '%s\n' "$push_output" | grep -Eo 'sha256:[0-9a-fA-F]{64}' | tail -n1 || true) + if [[ -z "$digest" ]]; then + echo "Failed to extract chart digest from helm push output" >&2 + echo "Raw helm push output:" >&2 + echo "$push_output" >&2 + exit 1 + fi + + echo "chart_digest=$digest" >> "$GITHUB_OUTPUT" + + - name: Sign chart with cosign (keyless) + run: | + set -euo pipefail + cosign sign --yes "ghcr.io/cryptomator/charts/cryptomator-hub@${{ steps.push.outputs.chart_digest }}" + + - name: Generate artifact attestation + uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 + with: + subject-name: "ghcr.io/cryptomator/charts/cryptomator-hub" + subject-digest: ${{ steps.push.outputs.chart_digest }} + push-to-registry: true diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index 666a5b2fc..5f6476cbd 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -9,6 +9,9 @@ on: env: NODE_VERSION: 22 + # / cipherduck start addition + JAVA_VERSION: 22 + # \ cipherduck end addition defaults: run: @@ -19,45 +22,65 @@ jobs: name: Build Custom Keycloak Image runs-on: ubuntu-latest permissions: - id-token: write - contents: read - attestations: write - packages: write + contents: read # Required for checkout + id-token: write # Required for the attestations step + attestations: write # Required for the attestations step + artifact-metadata: write # Required for the attestations step + packages: write # Required for pushing the image to GHCR steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' - cache-dependency-path: keycloak/themes/cryptomator/common/resources/package-lock.json + # / cipherduck start modification + cache-dependency-path: keycloak/themes/katta/common/resources/package-lock.json + # \ cipherduck end modification - name: Install Dependencies - working-directory: keycloak/themes/cryptomator/common/resources + # / cipherduck start modification + working-directory: keycloak/themes/katta/common/resources + # \ cipherduck end modification run: npm install - name: Build Theme - working-directory: keycloak/themes/cryptomator/common/resources + # / cipherduck start modification + working-directory: keycloak/themes/katta/common/resources + # \ cipherduck end modification run: npm run build + # / katta start addition + - uses: actions/setup-java@v5 + with: + distribution: 'temurin' + java-version: ${{ env.JAVA_VERSION }} + cache: 'maven' + - name: Generate and test token exchange spi + working-directory: keycloak + run: > + mvn -B clean verify + # \ katta end addition - name: Set up QEMU - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Login to GHCR - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and Push Container Image id: push - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 with: context: keycloak platforms: linux/amd64,linux/arm64 push: true + # / katta start modification tags: | - ghcr.io/cryptomator/keycloak:${{ github.event.inputs.tag }} + ghcr.io/shift7-ch/keycloak:${{ github.event.inputs.tag }} + # \ katta end modification - name: Generate artifact attestation - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0 + uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 with: - subject-name: ghcr.io/cryptomator/keycloak + subject-name: ghcr.io/shift7-ch/keycloak subject-digest: ${{ steps.push.outputs.digest }} - push-to-registry: true \ No newline at end of file + push-to-registry: true diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml index 458dcc3ed..c9a043631 100644 --- a/.github/workflows/tag.yml +++ b/.github/workflows/tag.yml @@ -18,16 +18,18 @@ jobs: tag: name: Tags an existing image runs-on: ubuntu-latest + permissions: + packages: write # Required for pushing the image to GHCR steps: - name: Pull image defined by digest - run: docker pull ghcr.io/cryptomator/hub@${{ github.event.inputs.digest}} + run: docker pull ghcr.io/shift7-ch/katta-server@${{ github.event.inputs.digest}} - name: Tag image in github registry - run: docker tag ghcr.io/cryptomator/hub@${{ github.event.inputs.digest}} ghcr.io/cryptomator/hub:${{ github.event.inputs.tag }} + run: docker tag ghcr.io/shift7-ch/katta-server@${{ github.event.inputs.digest}} ghcr.io/shift7-ch/katta-server:${{ github.event.inputs.tag }} - name: Login to GitHub Container Registry - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Push tagged image - run: docker push ghcr.io/cryptomator/hub:${{ github.event.inputs.tag }} \ No newline at end of file + run: docker push ghcr.io/shift7-ch/katta-server:${{ github.event.inputs.tag }} \ No newline at end of file diff --git a/.gitignore b/.gitignore new file mode 100644 index 000000000..62c893550 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.idea/ \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index c0f0e550b..72bdef404 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,9 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased](https://github.com/cryptomator/hub/compare/1.4.6...HEAD) +### Added + +- User and group management (#376) +- Emergency Access: Allow a council to restore access to a orphaned vault (#390) +- Show pictures of the groups in the Vaults member list (#375) +- Allow admins to archive and unarchive any vault (#283, #430) +- Disable users to exclude them from license seat count (#427, #428) +- Display a banner to indicate that legacy devices are still in use, since these will be removed in the next major release (#420) + ### Changed -- Updated Keycloak to 26.4.5 +- Updated Keycloak to 26.5.6 +- Update Quarkus to 3.27.3 LTS +- Improved browser locale detection (#371) +- Improved efficiency of keycloak-to-hub data sync (#377) +- Improved efficiency of group-based access permission checks (#372) +- Migrated aes-siv and base encoding libraries to [`@noble/ciphers`](https://github.com/paulmillr/noble-ciphers) and [`@scure/base`](https://github.com/paulmillr/scure-base/) (#373) + +### Security + +- CVE-2025-64756, CVE-2025-64118: removed `glob` and `tar` dependencies +- CVE-2025-64718, CVE-2025-62522: updated `js-yaml` and `vite` + +### Fixed +- Hide Archive/Reactivate Vault actions for admins without ownership rights (#379) +- Creating user with sole role `create-vault` was unable to login due to missing role `user` ## [1.4.6](https://github.com/cryptomator/hub/compare/1.4.5...1.4.6) diff --git a/README.md b/README.md index 58efdc6dd..135cda44c 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,20 @@ -[![CI Build](https://github.com/cryptomator/hub/actions/workflows/build.yml/badge.svg)](https://github.com/cryptomator/hub/actions/workflows/build.yml) +[![CI Build](https://github.com/shift7-ch/katta-server/actions/workflows/build.yml/badge.svg)](https://github.com/shift7-ch/katta-server/actions/workflows/build.yml) -# Cryptomator Hub +# Katta: the secure and easy way to work in teams -Hub consists of these components: +Katta bring zero-config storage management and zero-knowledge key management for teams and organizations. + +It easily integrates into your existing identity management incl. OpenID Connect, SAML, and LDAP. +As usual, your favorite cloud service remains your free choice [^1]. + +[^1]: Currently, we support AWS S3 and MinIO S3. + +Katta consists of Katta Server and Katta Client: + +* Katta Client is based on [Mountain Duck](https://mountainduck.io/), +* Katta Server is based on [Cryptomator Hub](https://github.com/cryptomator/hub/). + +Katta Server consists of these components: ## Web Frontend @@ -14,4 +26,11 @@ During development, run Quarkus from the `backend` dir as explained in [its READ ## Custom Keycloak Image -We add a custom theme to the base keycloak image, as explained in [its README file](keycloak/README.md).: \ No newline at end of file +We add custom theme to the base keycloak image, as explained +in [its README file](keycloak/README.md). We use [token-exchange-standard:v2](https://www.keycloak.org/securing-apps/token-exchange) as per [RFC 8693](https://www.rfc-editor.org/rfc/rfc8693.html). + +# Setup + +See [Katta Documentation → Setup Katta Server](https://github.com/shift7-ch/katta-docs/blob/main/SETUP_KATTA_SERVER.md). + + diff --git a/backend/.gitignore b/backend/.gitignore index 35e9ee6fe..da1e16343 100644 --- a/backend/.gitignore +++ b/backend/.gitignore @@ -45,4 +45,4 @@ nb-configuration.xml *.rej # Local environment -.env +.env \ No newline at end of file diff --git a/backend/.idea/codeStyles/Project.xml b/backend/.idea/codeStyles/Project.xml index 909896660..412c01932 100644 --- a/backend/.idea/codeStyles/Project.xml +++ b/backend/.idea/codeStyles/Project.xml @@ -1,18 +1,43 @@ +