You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-commits@axis.apache.org by ro...@apache.org on 2026/06/10 00:32:56 UTC
(axis-axis2-java-rampart) branch master updated (da0ff646 -> 8a43eb53)
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-rampart.git
from da0ff646 RAMPART-337: retire expired tokens from SimpleTokenStore to bound memory
new cb60b2eb CI: skip snapshot Deploy step when Nexus credentials are absent
new 9b92fcd4 Add .claude to .gitignore
new 8a43eb53 RAMPART-337: also retire expired tokens on SimpleTokenStore.update()
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/ci.yml | 12 ++++++++---
.gitignore | 1 +
.../org/apache/rahas/SimpleTokenStoreTest.java | 24 ++++++++++++++++++++++
.../java/org/apache/rahas/SimpleTokenStore.java | 7 +++++--
4 files changed, 39 insertions(+), 5 deletions(-)
(axis-axis2-java-rampart) 02/03: Add .claude to .gitignore
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-rampart.git
commit 9b92fcd4ae1fce71aad8581d3f500c311450d0a7
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Tue Jun 9 14:18:23 2026 -1000
Add .claude to .gitignore
Keeps local Claude Code session/lock files out of the repository.
Co-Authored-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
.gitignore | 1 +
1 file changed, 1 insertion(+)
diff --git a/.gitignore b/.gitignore
index 4d7b35bc..086e850e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
.classpath
.settings
target
+.claude
(axis-axis2-java-rampart) 03/03: RAMPART-337: also retire expired tokens on SimpleTokenStore.update()
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-rampart.git
commit 8a43eb533f01f54c1f8743d0dc596449eee340a1
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Tue Jun 9 14:25:12 2026 -1000
RAMPART-337: also retire expired tokens on SimpleTokenStore.update()
Follow-up to the Gemini review of the RAMPART-337 fix: perform the expired-token
cleanup on update() as well as add(), so the store is bounded on every write path
(e.g. update/renew-heavy workloads), not only when new tokens are added.
Adds SimpleTokenStoreTest.testUpdateRetiresExpiredTokens. Verified with a full
clean -Papache-release verify (all modules, all tests including the 9 policy
samples) on JDK 25.
Co-Authored-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
.../org/apache/rahas/SimpleTokenStoreTest.java | 24 ++++++++++++++++++++++
.../java/org/apache/rahas/SimpleTokenStore.java | 7 +++++--
2 files changed, 29 insertions(+), 2 deletions(-)
diff --git a/modules/rampart-tests/src/test/java/org/apache/rahas/SimpleTokenStoreTest.java b/modules/rampart-tests/src/test/java/org/apache/rahas/SimpleTokenStoreTest.java
index d479396b..0721c4f5 100644
--- a/modules/rampart-tests/src/test/java/org/apache/rahas/SimpleTokenStoreTest.java
+++ b/modules/rampart-tests/src/test/java/org/apache/rahas/SimpleTokenStoreTest.java
@@ -173,6 +173,30 @@ public class SimpleTokenStoreTest extends TestCase {
}
}
+ public void testUpdateRetiresExpiredTokens() {
+ // RAMPART-337: cleanup must also happen on update(), not just add().
+ SimpleTokenStore store = new SimpleTokenStore();
+ // Large grace so the tokens survive the add() calls below.
+ store.setExpiredTokenGracePeriodMillis(10 * 60 * 1000L);
+ try {
+ store.add(getTestToken("expired-1", new Date(System.currentTimeMillis() - 1000)));
+ Token toUpdate = getTestToken("valid-1", new Date(System.currentTimeMillis() + 60000));
+ store.add(toUpdate);
+ assertEquals("Both tokens should be present before update", 2, store.getTokenIdentifiers().length);
+
+ // Make expired tokens eligible for removal, then update the valid token.
+ store.setExpiredTokenGracePeriodMillis(0);
+ toUpdate.setState(Token.RENEWED);
+ store.update(toUpdate);
+
+ String[] ids = store.getTokenIdentifiers();
+ assertEquals("update() should have retired the expired token", 1, ids.length);
+ assertEquals("Only the updated token should remain", "valid-1", ids[0]);
+ } catch (TrustException e) {
+ fail(e.getMessage());
+ }
+ }
+
private Token getTestToken(String tokenId)
throws TrustException {
return getTestToken(tokenId, new Date());
diff --git a/modules/rampart-trust/src/main/java/org/apache/rahas/SimpleTokenStore.java b/modules/rampart-trust/src/main/java/org/apache/rahas/SimpleTokenStore.java
index e7e0e2b9..ab4ca915 100644
--- a/modules/rampart-trust/src/main/java/org/apache/rahas/SimpleTokenStore.java
+++ b/modules/rampart-trust/src/main/java/org/apache/rahas/SimpleTokenStore.java
@@ -129,9 +129,12 @@ public class SimpleTokenStore implements TokenStorage, Serializable {
if (token != null && token.getId() != null && token.getId().trim().length() != 0) {
- writeLock.lock();
-
+ writeLock.lock();
+
try {
+ // Retire long-expired tokens on update as well as add, so the
+ // store is bounded even under update/renew-heavy workloads (RAMPART-337).
+ removeExpiredTokens();
if (!this.tokens.keySet().contains(token.getId())) {
throw new TrustException("noTokenToUpdate", new String[]{token.getId()});
}
(axis-axis2-java-rampart) 01/03: CI: skip snapshot Deploy step when Nexus credentials are absent
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-rampart.git
commit cb60b2ebe86633d508852b934f8f236a1fa7b693
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Tue Jun 9 14:17:23 2026 -1000
CI: skip snapshot Deploy step when Nexus credentials are absent
The Deploy job pushes a SNAPSHOT to repository.apache.org using the
NEXUS_USER/NEXUS_PW secrets. When those secrets are not provisioned the upload
fails with 401 Unauthorized, turning the whole workflow red even though the
build itself succeeded.
Expose the credentials as job-level env and guard the Deploy step with
`if: env.NEXUS_USER != ''` so it is skipped cleanly when no credentials are
configured. Snapshot deploys resume automatically once the secrets are set.
Co-Authored-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
.github/workflows/ci.yml | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 338a5c97..91c932e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -79,6 +79,11 @@ jobs:
if: github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'apache/axis-axis2-java-rampart'
name: Deploy
runs-on: ubuntu-24.04
+ # Credentials are exposed as job-level env so the Deploy step can both use
+ # them and skip cleanly (see its `if`) when they are not configured.
+ env:
+ NEXUS_USER: ${{ secrets.NEXUS_USER }}
+ NEXUS_PW: ${{ secrets.NEXUS_PW }}
needs:
- build
- site
@@ -101,10 +106,11 @@ jobs:
server-id: apache.snapshots.https
server-username: NEXUS_USER
server-password: NEXUS_PW
+ # Skip cleanly when Nexus credentials are not configured, so a missing-secret
+ # environment does not turn the whole workflow red. Snapshot deploys resume
+ # automatically once NEXUS_USER/NEXUS_PW are provisioned in the repo secrets.
- name: Deploy
+ if: ${{ env.NEXUS_USER != '' }}
run: mvn -B -e -Papache-release -Dgpg.skip=true -Dmaven.test.skip=true -Dmaven.compiler.release=${{ env.BASE_JAVA_VERSION }} deploy
- env:
- NEXUS_USER: ${{ secrets.NEXUS_USER }}
- NEXUS_PW: ${{ secrets.NEXUS_PW }}
- name: Remove Snapshots
run: find ~/.m2/repository -name '*-SNAPSHOT' -a -type d -print0 | xargs -0 rm -rf