Skip to content

Commit 65db21b

Browse files
josecorellajosecorella
committed
chore: add .NET release steps
1 parent 15adbab commit 65db21b

14 files changed

+285
-10
lines changed

‎.github/workflows/ci_test_vector_net.yml

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
dotnet-version: [ '6.0.x' ]
1515
os: [
1616
# Run on ubuntu image that comes pre-configured with docker
17-
ubuntu-latest
17+
ubuntu-latest, windows-latest, macos-latest
1818
]
1919
runs-on: ${{ matrix.os }}
2020
permissions:
@@ -55,10 +55,18 @@ jobs:
5555
# This works because `node` is installed by default on GHA runners
5656
make transpile_net
5757
58-
- name: Test TestVectors
58+
- name: Test TestVectors on .NET 6.0
5959
working-directory: ./TestVectors/runtimes/net
6060
run: |
6161
cp ../java/decrypt_java.json ../java/decrypt_dotnet.json .
6262
dotnet run
6363
cp ../java/*.json .
64-
dotnet run
64+
dotnet run --framework net6.0
65+
66+
- name: Test TestVectors on .NET 48
67+
if: matrix.os == 'windows-latest'
68+
working-directory: ./TestVectors/runtimes/net
69+
run: |
70+
cp ../java/*.json .
71+
dotnet run --framework net48
72+

‎DynamoDbEncryption/codebuild/release-prod.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
dotnet: 6.0
7+
python: 3.x
8+
commands:
9+
- cd ..
10+
# Get Dafny
11+
## TODO FIX ME
12+
#- export `cat ./aws-database-encryption-sdk-dynamodb/project.properties`
13+
- curl https://github.com/dafny-lang/dafny/releases/download/v$dafnyVersion/dafny-$dafnyVersion-x64-ubuntu-20.04.zip -L -o dafny.zip
14+
- unzip -qq dafny.zip && rm dafny.zip
15+
- export PATH="$PWD/dafny:$PATH"
16+
# Switch back to the main directory
17+
- cd aws-database-encryption-sdk-dynamodb
18+
pre_build:
19+
commands:
20+
# UNIQUE_ID should be passed in as an environment variable. It is used to tie
21+
# the different parts of the asynchronous signing process together
22+
- echo "Using unique id for flow $UNIQUE_ID"
23+
# Build unsigned source
24+
- cd DynamoDbEncryption
25+
- make transpile_net
26+
- dotnet build runtimes/net /p:Configuration=Release -nowarn:CS0162,CS0168
27+
# This step assumes signing has already happened and we just need to retrieve
28+
# the signed artifacts
29+
- export ASSEMBLY_NAME="AWS.Cryptography.DbEncryptionSDK.DynamoDb.dll"
30+
- export BASE=../codebuild/net
31+
- python $BASE/retrieve_signed_assembly.py --target net6.0 --unique-id $UNIQUE_ID
32+
- python $BASE/retrieve_signed_assembly.py --target net48 --unique-id $UNIQUE_ID
33+
build:
34+
commands:
35+
- mkdir build
36+
- export VERSION=`grep '<Version>' runtimes/net/DynamoDbEncryption.csproj | sed 's/.*<Version>\(.*\)<\/Version>/\1/'`
37+
- dotnet pack runtimes/net/DynamoDbEncryption.csproj --no-build /p:Configuration=Release --output build
38+
- export API_ACCESS_KEY=$(python $BASE/retrieve_api_access_key.py)
39+
- dotnet nuget push build/AWS.Cryptography.DbEncryptionSDK.DynamoDb.$VERSION.nupkg --api-key "$API_ACCESS_KEY" --source https://api.nuget.org/v3/index.json

‎DynamoDbEncryption/codebuild/release-staging.yml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
dotnet: 6.0
7+
python: 3.x
8+
commands:
9+
- cd ..
10+
# Get Dafny
11+
## TODO FIX ME
12+
#- export `cat ./aws-database-encryption-sdk-dynamodb/project.properties`
13+
- curl https://github.com/dafny-lang/dafny/releases/download/v$dafnyVersion/dafny-$dafnyVersion-x64-ubuntu-20.04.zip -L -o dafny.zip
14+
- unzip -qq dafny.zip && rm dafny.zip
15+
- export PATH="$PWD/dafny:$PATH"
16+
# Switch back to the main directory
17+
- cd aws-database-encryption-sdk-dynamodb
18+
pre_build:
19+
commands:
20+
# UNIQUE_ID should be passed in as an environment variable. It is used to tie
21+
# the different parts of the asynchronous signing process together
22+
- echo "Using unique id for flow $UNIQUE_ID"
23+
# Build unsigned source
24+
- cd DynamoDbEncryption
25+
- make transpile_net
26+
- dotnet build runtimes/net /p:Configuration=Release -nowarn:CS0162,CS0168
27+
# This step assumes signing has already happened and we just need to retrieve
28+
# the signed artifacts
29+
- export ASSEMBLY_NAME="AWS.Cryptography.DbEncryptionSDK.DynamoDb.dll"
30+
- export BASE=../codebuild/net
31+
- python $BASE/retrieve_signed_assembly.py --target net6.0 --unique-id $UNIQUE_ID
32+
- python $BASE/retrieve_signed_assembly.py --target net48 --unique-id $UNIQUE_ID
33+
build:
34+
commands:
35+
- mkdir build
36+
- >-
37+
aws codeartifact login \
38+
--tool dotnet \
39+
--repository dbesdk-net-staging \
40+
--domain crypto-tools-internal \
41+
--domain-owner 587316601012 \
42+
--region us-east-1
43+
# Set a unique version for releasing to staging, because this may fail and we don't
44+
# want to collide with previous runs
45+
- export VERSION=`grep '<Version>' runtimes/net/DynamoDbEncryption.csproj | sed 's/.*<Version>\(.*\)<\/Version>/\1/'`
46+
- dotnet pack runtimes/net/DynamoDbEncryption.csproj --no-build /p:Configuration=Release --output build
47+
- dotnet nuget push build/AWS.Cryptography.DbEncryptionSDK.DynamoDb.$VERSION.nupkg --source crypto-tools-internal/dbesdk-net-staging
48+
# Now validate we can run the tests
49+
- sed -i.backup "/\<ProjectReference Include=\"..\/DynamoDbEncryption.csproj\" \/>/d" runtimes/net/tests/Test-DynamoDbEncryption.csproj
50+
- dotnet add runtimes/net/tests/Test-DynamoDbEncryption.csproj package AWS.Cryptography.DbEncryptionSDK.DynamoDb --version $VERSION
51+
52+
# run tests
53+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2" --role-session-name "CB-TestVectorResources")
54+
- export TMP_ROLE
55+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
56+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
57+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
58+
- aws sts get-caller-identity
59+
- make test_net FRAMEWORK=net6.0
60+
61+
# run test vectors
62+
- cd ../TestVectors
63+
- sed -i.backup "/\<ProjectReference Include=\"..\/..\/..\/DynamoDbEncryption\/runtimes\/net\/DynamoDbEncryption.csproj\" \/>/d" runtimes/net/DbEsdkTestVectors.csproj
64+
- dotnet add runtimes/net/DbEsdkTestVectors.csproj package AWS.Cryptography.DbEncryptionSDK.DynamoDb --version $VERSION
65+
- make transpile_net
66+
- cd runtimes/net
67+
- cp ../java/decrypt_java.json ../java/decrypt_dotnet.json .
68+
- dotnet run --framework net6.0

‎DynamoDbEncryption/codebuild/release.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
version: 0.2
2+
3+
batch:
4+
fast-fail: true
5+
build-graph:
6+
- identifier: sign
7+
buildspec: DynamoDbEncryption/codebuild/sign.yml
8+
env:
9+
type: LINUX_CONTAINER
10+
image: aws/codebuild/standard:6.0
11+
- identifier: verify
12+
buildspec: DynamoDbEncryption/codebuild/verify.yml
13+
env:
14+
type: WINDOWS_SERVER_2019_CONTAINER
15+
image: aws/codebuild/windows-base:2019-2.0
16+
depend-on:
17+
- sign
18+
- identifier: release_staging
19+
buildspec: DynamoDbEncryption/codebuild/release-staging.yml
20+
env:
21+
type: LINUX_CONTAINER
22+
image: aws/codebuild/standard:6.0
23+
depend-on:
24+
- verify
25+
- identifier: release_prod
26+
buildspec: DynamoDbEncryption/codebuild/release-prod.yml
27+
env:
28+
type: LINUX_CONTAINER
29+
image: aws/codebuild/standard:6.0
30+
depend-on:
31+
- verify
32+
- release_staging
33+
- identifier: test_prod
34+
buildspec: DynamoDbEncryption/codebuild/test-prod.yml
35+
env:
36+
type: LINUX_CONTAINER
37+
image: aws/codebuild/standard:6.0
38+
depend-on:
39+
- release_prod

‎DynamoDbEncryption/codebuild/sign.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
dotnet: 6.0
7+
python: 3.x
8+
commands:
9+
- cd ..
10+
# Get Dafny
11+
## TODO FIX ME
12+
#- export `cat ./aws-database-encryption-sdk-dynamodb/project.properties`
13+
- curl https://github.com/dafny-lang/dafny/releases/download/v$dafnyVersion/dafny-$dafnyVersion-x64-ubuntu-20.04.zip -L -o dafny.zip
14+
- unzip -qq dafny.zip && rm dafny.zip
15+
- export PATH="$PWD/dafny:$PATH"
16+
# Switch back to the main directory
17+
- cd aws-database-encryption-sdk-dynamodb
18+
pre_build:
19+
commands:
20+
# UNIQUE_ID should be passed in as an environment variable. It is used to tie
21+
# the different parts of the asynchronous signing process together
22+
- echo "Using unique id for flow $UNIQUE_ID"
23+
build:
24+
commands:
25+
## Build Library from Source
26+
- cd DynamoDbEncryption
27+
- make transpile_net
28+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2" --role-session-name "CB-TestVectorResources")
29+
- export TMP_ROLE
30+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
31+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
32+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
33+
- aws sts get-caller-identity
34+
- make test_net FRAMEWORK=net6.0
35+
36+
## Unset temp creds so that we get dropped back into the aws codebuild service role
37+
- unset AWS_ACCESS_KEY_ID; unset AWS_SECRET_ACCESS_KEY; unset AWS_SESSION_TOKEN;
38+
39+
- dotnet build runtimes/net /p:Configuration=Release -nowarn:CS0162,CS0168
40+
- export ASSEMBLY_NAME="AWS.Cryptography.DbEncryptionSDK.DynamoDb.dll"
41+
- export BASE=../codebuild/net
42+
- python $BASE/upload_assembly.py --target net6.0 --unique-id $UNIQUE_ID
43+
- python $BASE/upload_assembly.py --target net48 --unique-id $UNIQUE_ID
44+
## Retrieve the signed assembly. We're not going to use it, but this
45+
## ensures that the signing process is complete
46+
- python $BASE/retrieve_signed_assembly.py --target net6.0 --unique-id $UNIQUE_ID
47+
- python $BASE/retrieve_signed_assembly.py --target net48 --unique-id $UNIQUE_ID

‎DynamoDbEncryption/codebuild/test-prod.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
dotnet: 6.0
7+
python: 3.x
8+
commands:
9+
- cd ..
10+
# Get Dafny
11+
## TODO FIX ME
12+
#- export `cat ./aws-database-encryption-sdk-dynamodb/project.properties`
13+
- curl https://github.com/dafny-lang/dafny/releases/download/v$dafnyVersion/dafny-$dafnyVersion-x64-ubuntu-20.04.zip -L -o dafny.zip
14+
- unzip -qq dafny.zip && rm dafny.zip
15+
- export PATH="$PWD/dafny:$PATH"
16+
# Switch back to the main directory
17+
- cd aws-database-encryption-sdk-dynamodb
18+
pre_build:
19+
commands:
20+
- cd DynamoDbEncryption
21+
- make transpile_net
22+
build:
23+
commands:
24+
- export VERSION=`grep '<Version>' runtimes/net/DynamoDbEncryption.csproj | sed 's/.*<Version>\(.*\)<\/Version>/\1/'`
25+
- sed -i.backup "/\<ProjectReference Include=\"..\/DynamoDbEncryption.csproj\" \/>/d" runtimes/net/tests/Test-DynamoDbEncryption.csproj
26+
- dotnet add runtimes/net/tests/Test-DynamoDbEncryption.csproj package AWS.Cryptography.DbEncryptionSDK.DynamoDb --version $VERSION
27+
28+
# run tests
29+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2" --role-session-name "CB-TestVectorResources")
30+
- export TMP_ROLE
31+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
32+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
33+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
34+
- aws sts get-caller-identity
35+
- make test_net FRAMEWORK=net6.0
36+
37+
# run test vectors
38+
- cd ../TestVectors
39+
- sed -i.backup "/\<ProjectReference Include=\"..\/..\/..\/DynamoDbEncryption\/runtimes\/net\/DynamoDbEncryption.csproj\" \/>/d" runtimes/net/DbEsdkTestVectors.csproj
40+
- dotnet add runtimes/net/DbEsdkTestVectors.csproj package AWS.Cryptography.DbEncryptionSDK.DynamoDb --version $VERSION
41+
- make transpile_net
42+
- cd runtimes/net
43+
- cp ../java/decrypt_java.json ../java/decrypt_dotnet.json .
44+
- dotnet run --framework net6.0

‎DynamoDbEncryption/codebuild/verify.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
FILE_NAME: "AWS.Cryptography.DbEncryptionSDK.DynamoDb.dll"
6+
ASSEMBLY_NAME: "AWS.Cryptography.DbEncryptionSDK.DynamoDb.dll"
7+
8+
phases:
9+
install:
10+
runtime-versions:
11+
dotnet: 6.0
12+
python: 3.x
13+
build:
14+
commands:
15+
- mkdir net48
16+
- python codebuild/net/retrieve_signed_assembly.py --target net48 --unique-id $Env:UNIQUE_ID --output net48
17+
- $sig = Get-AuthenticodeSignature -FilePath net48/$Env:FILE_NAME
18+
- $sig | Format-List -Property *
19+
# Check signature on net6.0 dll
20+
- mkdir net6.0
21+
- python codebuild/net/retrieve_signed_assembly.py --target net6.0 --unique-id $Env:UNIQUE_ID --output net6.0
22+
- $sig = Get-AuthenticodeSignature -FilePath net6.0/$Env:FILE_NAME
23+
- $sig | Format-List -Property *

‎DynamoDbEncryption/runtimes/java/build.gradle.kts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ publishing {
138138
pom {
139139
name.set("AWS Database Encryption SDK for DynamoDB")
140140
description.set("AWS Database Encryption SDK for DynamoDB in Java")
141-
url.set("https://github.com/aws/aws-database-encryption-sdk-dynamodb-java")
141+
url.set("https://github.com/aws/aws-database-encryption-sdk-dynamodb")
142142
licenses {
143143
license {
144144
name.set("Apache License 2.0")
@@ -155,7 +155,7 @@ publishing {
155155
}
156156
}
157157
scm {
158-
url.set("https://github.com/aws/aws-database-encryption-sdk-dynamodb-java.git")
158+
url.set("https://github.com/aws/aws-database-encryption-sdk-dynamodb.git")
159159
}
160160
}
161161
}

‎DynamoDbEncryption/runtimes/net/AssemblyInfo.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
using System.Reflection;
2+
3+
[assembly: AssemblyTitle("AWS.Cryptography.DbEncryptionSDK.DynamoDb")]
4+
5+
// This should be kept in sync with the version number in MPL.csproj
6+
[assembly: AssemblyVersion("3.2.0")]
7+

‎codebuild/net/signing_lib.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ def assume_artifact_access_role():
6262
creds = sts.assume_role(
6363
RoleArn=ARTIFACT_ACCESS_ROLE_ARN,
6464
RoleSessionName="CodeBuildRelease",
65-
ExternalId="MPLNetCodeSigning",
65+
ExternalId="DbEsdkNetCodeSigning",
6666
)
6767

6868
return creds

‎codebuild/release/release-prod.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ phases:
2626
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
2727
- unzip -qq gradle.zip && rm gradle.zip
2828
- export PATH="$PWD/gradle-7.6/bin:$PATH"
29-
- cd aws-database-encryption-sdk-dynamodb-java/
29+
- cd aws-database-encryption-sdk-dynamodb/
3030
pre_build:
3131
commands:
3232
- aws secretsmanager get-secret-value --region us-west-2 --secret-id Maven-GPG-Keys-Release --query SecretBinary --output text | base64 -d > ~/mvn_gpg.tgz

‎codebuild/release/validate-release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ phases:
2121
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
2222
- unzip -qq gradle.zip && rm gradle.zip
2323
- export PATH="$PWD/gradle-7.6/bin:$PATH"
24-
- cd aws-database-encryption-sdk-dynamodb-java/
24+
- cd aws-database-encryption-sdk-dynamodb/
2525
pre_build:
2626
commands:
2727
# Get CI Creds to be able to call DBESDK TestVectors

‎codebuild/staging/release-staging.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ phases:
2828
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
2929
- unzip -qq gradle.zip && rm gradle.zip
3030
- export PATH="$PWD/gradle-7.6/bin:$PATH"
31-
- cd aws-database-encryption-sdk-dynamodb-java/
31+
- cd aws-database-encryption-sdk-dynamodb/
3232
pre_build:
3333
commands:
3434
- export CODEARTIFACT_TOKEN=$(aws codeartifact get-authorization-token --domain crypto-tools-internal --domain-owner 587316601012 --region us-east-1 --query authorizationToken --output text)

‎codebuild/staging/validate-staging.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ phases:
2525
- curl https://services.gradle.org/distributions/gradle-7.6-all.zip -L -o gradle.zip
2626
- unzip -qq gradle.zip && rm gradle.zip
2727
- export PATH="$PWD/gradle-7.6/bin:$PATH"
28-
- cd aws-database-encryption-sdk-dynamodb-java/
28+
- cd aws-database-encryption-sdk-dynamodb/
2929
pre_build:
3030
commands:
3131
# Get published CA DBESDK jar

0 commit comments

Comments
 (0)