CASMPET-7068 Upgrade Nexus to 3.68.1

.github/workflows/docker.io.sonatype.nexus3.3.68.1-1.yaml

@@ -0,0 +1,57 @@
+#
+# MIT License
+#
+# (C) Copyright 2024 Hewlett Packard Enterprise Development LP
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included
+# in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+
+---
+name: docker.io/sonatype/nexus3:3.68.1-1
+on:
+  push:
+    paths:
+      - .github/workflows/docker.io.sonatype.nexus3.3.68.1-1.yaml
+      - docker.io/sonatype/nexus3/3.68.1/**
+  workflow_dispatch:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      CONTEXT_PATH: docker.io/sonatype/nexus3/3.68.1-1
+      DOCKER_REPO: artifactory.algol60.net/csm-docker/${{ github.ref == 'refs/heads/main' && 'stable' || 'unstable' }}/docker.io/sonatype/nexus3
+      DOCKER_TAG: 3.68.1-1
+    steps:
+      - name: build-sign-scan
+        uses: Cray-HPE/github-actions/build-sign-scan@build-sign-scan/v2
+        with:
+          context_path: ${{ env.CONTEXT_PATH }}
+          docker_repo: ${{ env.DOCKER_REPO }}
+          docker_tag: ${{ env.DOCKER_TAG }}
+          docker_username: ${{ secrets.ARTIFACTORY_ALGOL60_USERNAME }}
+          docker_password: ${{ secrets.ARTIFACTORY_ALGOL60_TOKEN }}
+          sign: ${{ github.ref == 'refs/heads/main' }}
+          cosign_gcp_workload_identity_provider: ${{ secrets.COSIGN_GCP_WORKLOAD_IDENTITY_PROVIDER_RSA }}
+          cosign_gcp_service_account: ${{ secrets.COSIGN_GCP_SERVICE_ACCOUNT_RSA }}
+          cosign_key: ${{ secrets.COSIGN_KEY_RSA }}
+          snyk_token: ${{ secrets.SNYK_TOKEN }}
+          fail_on_snyk_errors: false

docker.io/sonatype/nexus3/3.68.1-1/Dockerfile

@@ -0,0 +1,55 @@
+#
+# MIT License
+#
+# (C) Copyright 2024 Hewlett Packard Enterprise Development LP
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included
+# in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+
+FROM docker.io/sonatype/nexus3:3.68.1
+
+# Install the Keycloak plugin, see https://github.com/flytreeleft/nexus3-keycloak-plugin
+ARG KEYCLOAK_PLUGIN_VERSION=0.5.0
+COPY ./nexus3-keycloak-plugin-${KEYCLOAK_PLUGIN_VERSION}-bundle.kar /opt/sonatype/nexus/deploy/
+
+USER root
+
+# This Nexus image is based on the RHEL Universal Base Image (UBI).
+# Update any base image packagess now so that we keep our Nexus image
+# current.
+RUN microdnf update -y
+RUN microdnf install jq -y
+
+RUN chown nexus:nexus /opt/sonatype/nexus/deploy/nexus3-keycloak-plugin-${KEYCLOAK_PLUGIN_VERSION}-bundle.kar
+
+# The plugin requires an updated JVM cacerts file and credential
+# which must be referenced from nexus.vmoptions.  The nexus user
+# will need to modify the file so it makes sense that nexus
+# should just own the file.
+RUN chown nexus:nexus /opt/sonatype/nexus/bin/nexus.vmoptions
+RUN microdnf install -y openssl
+
+# Allow nexus to modify the logging properties for debugging purposes.
+RUN chown nexus:nexus /opt/sonatype/nexus/etc/logback/logback.xml
+
+COPY create-trust-store.sh /usr/local/bin/
+
+RUN microdnf clean all
+
+USER nexus

docker.io/sonatype/nexus3/3.68.1-1/create-trust-store.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+#
+# MIT License
+#
+# (C) Copyright 2024 Hewlett Packard Enterprise Development LP
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included
+# in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+if [ $# -lt 2 ]; then
+    echo >&2 "usage: ${0} KEYSTORE CERT..."
+    exit 2
+fi
+
+keystore="$1"
+shift
+
+if [ ! -f "$keystore" ]; then
+    echo >&2 "Initializing trust store from /usr/lib/jvm/jre-1.8.0/lib/security/cacerts"
+    # Start with default JRE trust store
+    cp /usr/lib/jvm/jre-1.8.0/lib/security/cacerts "$keystore"
+    # Make sure it is writable
+    chmod -v u=rw,go=r "$keystore"
+fi
+
+# Add every cert specified on the command line
+while [ $# -gt 0 ]; do
+    cert="$1"
+    echo >&2 "Importing $cert"
+    keytool -importcert -keystore "$keystore" -storepass changeit -noprompt \
+        -file "$cert" -alias "cray-hpe-$(basename $cert)" >&2
+    shift
+done
+
+# List all certs in trust-store
+keytool -list -keystore "$keystore" -storepass changeit -noprompt
+