Merge branch 'master' of https://github.com/nuxeo/nuxeo-drive into wip-…

…NXDRIVE-2912-Display-drive-notification-for-document-review

.github/workflows/release.yml

@@ -14,6 +14,10 @@ on:
         description: 'Set to "release" for a beta release.'
         required: false
         default: "alpha"
+      signExe:
+        description: 'Set to "true" to generate sign .exe on Windows.'
+        required: false
+        default: "false"
 
 env:
   GITHUB_USERNAME: "nuxeodrive"
@@ -125,6 +129,7 @@ jobs:
           NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }}
           NOTARIZATION_TEAMID: ${{ secrets.NOTARIZATION_TEAMID }}
           SIGNING_ID: "NUXEO CORP"
+          SIGNING_ID_NEW: "Hyland Software, Inc."
           SYSTEM_VERSION_COMPAT: 0
         run: bash tools/osx/deploy_ci_agent.sh --check-upgrade
 
@@ -148,13 +153,6 @@ jobs:
       #
       # Windows
       #
-
-      - name: "[Windows] Setup certificate"
-        if: matrix.os == 'windows-latest'
-        run: |
-          echo "${{ secrets.CERT_APP_WINDOWS }}" > certificate.b64
-          certutil -decode certificate.b64 certificate.pfx
-
       - name: "[Windows] Unlock PowerShell"
         if: matrix.os == 'windows-latest'
         run: powershell Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine
@@ -163,11 +161,60 @@ jobs:
         if: matrix.os == 'windows-latest'
         run: powershell ".\\tools\\windows\\deploy_ci_agent.ps1" -install_release
 
+      - name: Setup Certificate
+        if: matrix.os == 'windows-latest'
+        run: |
+           echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
+           cat  /d/Certificate_pkcs12.p12
+        shell: bash  
+
+      - name: Set variables
+        if: matrix.os == 'windows-latest'
+        id: variables
+        run: |
+          dir
+          echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+          echo "KEYPAIR_NAME=gt-standard-keypair"  >> $GITHUB_OUTPUT
+          echo "CERTIFICATE_NAME=gt-certificate"  >> $GITHUB_OUTPUT
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
+          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> "$GITHUB_ENV"
+          echo "SM_CODE_SIGNING_CERT_SHA1_HASH=${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}" >> "$GITHUB_ENV"
+          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
+          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
+          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
+        shell: bash
+
+      - name: Setup Keylocker KSP on windows 
+        if: matrix.os == 'windows-latest'
+        run: | 
+          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi 
+          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
+          smksp_registrar.exe list 
+          smctl.exe keypair ls 
+          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user 
+        shell: cmd   
+
+      - name: Certificates Sync
+        if: matrix.os == 'windows-latest'      
+        run: |
+           smctl windows certsync --keypair-alias=${{ secrets.SM_KEYPAIR_ALIAS }}
+        shell: cmd
+
+      - name: Health status
+        if: matrix.os == 'windows-latest' 
+        run: |
+           smctl healthcheck
+        shell: cmd
+
+
       - name: "[Windows] Generate the .exe and validate against 2021"
         timeout-minutes: 15
         if: matrix.os == 'windows-latest'
         env:
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
           NXDRIVE_TEST_NUXEO_URL: "https://drive-2021.beta.nuxeocloud.com/nuxeo"
           SIGNING_ID: "Nuxeo"
           SIGNTOOL_PATH: 'C:\Program Files (x86)\Windows Kits\10\bin\10.0.20348.0\x86'
@@ -177,14 +224,22 @@ jobs:
         timeout-minutes: 15
         if: matrix.os == 'windows-latest'
         env:
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           NXDRIVE_TEST_NUXEO_URL: "https://drive-2023.beta.nuxeocloud.com/nuxeo"
           NXDRIVE_TEST_USERNAME: ${{ secrets.NXDRIVE_2023_TEST_USERNAME }}
           NXDRIVE_TEST_PASSWORD: ${{ secrets.NXDRIVE_2023_TEST_PASSWORD }}
           SIGNING_ID: "Nuxeo"
           SIGNTOOL_PATH: 'C:\Program Files (x86)\Windows Kits\10\bin\10.0.20348.0\x86'
         run: powershell ".\\tools\\windows\\deploy_ci_agent.ps1" -check_upgrade
-
+
+      - name: "[Windows] Generate and sign the .exe"
+        timeout-minutes: 15
+        if: matrix.os == 'windows-latest' && github.event.inputs.signExe == 'true'
+        env:
+          KEYCHAIN_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SIGNING_ID_NEW: "Hyland Software, Inc."
+          SIGNTOOL_PATH: 'C:\Program Files (x86)\Windows Kits\10\bin\10.0.20348.0\x86'
+        run: powershell ".\\tools\\windows\\deploy_ci_agent.ps1" -build_installer_and_sign
+
       - name: "Upload artifacts"
         uses: actions/upload-artifact@v4
         with:

docs/changes.md

@@ -20,7 +20,7 @@
 - [5.3.1](changes/5.3.1.md) ([diff](https://github.com/nuxeo/nuxeo-drive/compare/release-5.3.0...release-5.3.1))
 - [5.3.2](changes/5.3.2.md) ([diff](https://github.com/nuxeo/nuxeo-drive/compare/release-5.3.1...release-5.3.2))
 - [5.4.0](changes/5.4.0.md) ([diff](https://github.com/nuxeo/nuxeo-drive/compare/release-5.3.2...release-5.4.0))
-- [5.5.0](changes/5.5.0.md) ([diff](https://github.com/nuxeo/nuxeo-drive/compare/release-5.4.0...master))
+- [5.4.1](changes/5.4.1.md) ([diff](https://github.com/nuxeo/nuxeo-drive/compare/release-5.4.0...master))
 
 ## 4.x
 

docs/changes/5.5.0.md → docs/changes/5.4.1.md

@@ -1,21 +1,13 @@
-# 5.5.0
+# 5.4.1
 
-Release date: `2024-xx-xx`
+Release date: `2024-06-18`
 
 ## Core
 
 - [NXDRIVE-2882](https://jira.nuxeo.com/browse/NXDRIVE-2882): fix_db should create dump.sql in same dir as db
 - [NXDRIVE-2912](https://jira.nuxeo.com/browse/NXDRIVE-2912): Display Drive notification for document review
 - [NXDRIVE-2901](https://jira.nuxeo.com/browse/NXDRIVE-2901): Authorization Error for OAuth
-- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2):
 
-### Direct Edit
-
-- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2):
-
-### Direct Transfer
-
-- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2):
 
 ### Task Management
 
@@ -30,16 +22,11 @@ Release date: `2024-xx-xx`
 ## Packaging / Build
 
 - [NXDRIVE-2896](https://jira.nuxeo.com/browse/NXDRIVE-2896): Fix release build for upload/download artifact
+- [NXDRIVE-2923](https://jira.nuxeo.com/browse/NXDRIVE-2923): Download nuxeo package from nexus sonatatype
 - [NXDRIVE-2926] (https://jira.nuxeo.com/browse/NXDRIVE-2926): Update github Action Runner to use mac-latest
 - [NXDRIVE-2932] (https://jira.nuxeo.com/browse/NXDRIVE-2932): Fix Microsoft Visual Studio issue
-
-## Tests
-
-- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2):
-
-## Docs
-
-- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2):
+- [NXDRIVE-2938] (https://jira.nuxeo.com/browse/NXDRIVE-2938): Update token for codecov
+- [NXDRIVE-2941] (https://jira.nuxeo.com/browse/NXDRIVE-2941): Update the release process to sign Windows exe to limit signature usage
 
 ## Minor Changes
 
@@ -117,5 +104,5 @@ Release date: `2024-xx-xx`
 
 ## Technical Changes
 
-- Replaced `distutils.version` with `packaging.version`
 - Check Drive version in Windows `ndrive.exe --version > version.txt` and then run `type version.txt`
+- Replaced `distutils.version` with `packaging.version`

nxdrive/__init__.py

@@ -27,7 +27,7 @@
 """
 
 __author__ = "Nuxeo"
-__version__ = "5.5.0"
+__version__ = "5.4.1"
 __copyright__ = """
     Copyright © 2024 Hyland Software, Inc. and its affiliates. All rights reserved.
     All Hyland product names are registered or unregistered trademarks of Hyland Software, Inc. or its affiliates

tools/deps/requirements.txt

@@ -208,9 +208,10 @@ jmespath==1.0.1 \
 jwt==1.3.1 \
     --hash=sha256:61c9170f92e736b530655e75374681d4fcca9cfa8763ab42be57353b2b203494
     # via nuxeo
-nuxeo[oauth2,s3]==6.1.1 \
-    --hash=sha256:31fc973c55d7fc7567860e589c6c59c386d2e3563cb8f7709276551a76902daa \
-    --hash=sha256:d7e30368fa2ca02e3981cdadee27c9f8011fddb091b5af879735543900009767
+-i https://packages.nuxeo.com/repository/pypi-nuxeopublic/simple
+nuxeo==6.1.2 \
+    --hash=sha256:41f4272419df615629735184ceb129c1c1886c3110f9e3cb0461f6043e95e6ab \
+    --hash=sha256:549c974fe83004aab462771b86a4ab7c3bf3b5c0f899af08008523999fc7726e
     # via -r requirements.txt
 packaging==24.0 \
     --hash=sha256:2ddfb553fdf02fb784c234c7ba6ccc288296ceabec964ad2eae3777778130bc5 \