Merge pull request #2614 from wireapp/release_2022-08-16_08_27

Release 2022-08-16 - (expected chart version 4.22.0)
wireapp · Aug 16, 2022 · 6ec2a36 · 6ec2a36
2 parents ea40431 + 470e57a
commit 6ec2a36
Show file tree

Hide file tree

Showing 518 changed files with 11,411 additions and 21,182 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,7 +1,7 @@
 on:
  pull_request:
  push:
-   branches: [master]
+   branches: [master, develop]
 
 jobs:
   build-dev-env:
@@ -28,3 +28,34 @@ jobs:
        run: nix-build --no-out-link ./nix -A devEnv
      - name: Install the wire-server-direnv
        run: nix-env -if ./nix -A devEnv
+  build-docs:
+    name: Build docs
+    environment: cachix
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+     - uses: actions/checkout@v2
+       with:
+         submodules: true
+     - uses: cachix/[email protected]
+     - uses: cachix/cachix-action@v10
+       with:
+         name: wire-server
+         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+     - name: Build docs
+       run: nix-build --no-out-link ./nix -A docs
+     - name: Configure AWS credentials
+       if: ${{ github.ref == 'refs/heads/develop' }}
+       uses: aws-actions/configure-aws-credentials@v1
+       with:
+         role-to-assume: arn:aws:iam::093205192929:role/gh-actions-wire-server
+         aws-region: eu-west-1
+     - name: Deploy docs
+       if: ${{ github.ref == 'refs/heads/develop' }}
+       run: |
+         docs=$(nix-build --no-out-link ./nix -A docs)
+         aws s3 sync $docs/html s3://origin-docs.wire.com/
+         aws s3 cp $docs/pdf/wire_federation.pdf s3://origin-docs.wire.com/main.pdf
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,75 @@
+# [2022-08-16] (Chart Release 4.22.0)
+
+## API changes
+
+
+* Drop the deprecated member removal endpoint (#2593)
+
+
+## Features
+
+
+* charts/cannon: Ensure HSTS headers are set for all endpoints (#2574)
+
+* Expired MLS key packages are deleted from the database (#2582)
+
+* Add support for MLS Remove proposals (#2561)
+
+* Human readable names for SAML IdPs (#2565)
+
+* The `preferredLanguage` field from SCIM now maps to the user locale in BRIG and will be set and updated on post SCIM user and on update SCIM user using SAML. (#2605)
+
+* For TLS1.2, by default, remove ECDHE-ECDSA-AES128-GCM-SHA256 and ECDHE-RSA-AES128-GCM-SHA256 ciphers for ingress traffic. (#2528)
+
+
+## Bug fixes and other updates
+
+
+* Allow deleting existing splash screens in `PUT /teams/:tid (see also PR#2474 in Release 4.18.0) (#2588)
+
+* Backoffice: Fix an issue where in some deployments ibis/galeb (Wire Cloud internal services) are unreachable from backoffice if deployed in a different namespace. (#2610)
+
+* Fix an issue for larger client requests on e.g. /list-users and /list-conversations, which were giving 413 errors for some users. Allow client requests of 256k by default (was 64k). (#2579)
+
+
+## Internal changes
+
+
+* Add shellcheck, libstdc++ to nix env; handle emacs auto-save files better (#2609)
+
+* Allow features to be set with HTTP method PATCH. This reflects a prior behavior
+  that is used by Ibis. Additionally, it's more consistent when all setters can be
+  called with PUT and PATCH. As this will fix calls by Ibis, the deployment order
+  doesn't matter. (#2575)
+
+* Brig Polysemization: introduce BlacklistStore and BlacklistPhonePrefixStore effects (#2590)
+
+* Add cabal-fmt development tool (#2601)
+
+* Reformat all cabal files with cabal-fmt (#2603)
+
+* Delete tools: bonanza and makedeb (#2600)
+
+* No more package.yaml / hpack, and stick with cabal files as the single (and only) source of truth (#2596)
+
+* Port Brig SearchAPI and UserRichInfo endpoints to Servant (#2580)
+
+* Added TTL data to stern feature flag GET endpoint. (#2564)
+
+* Prepare removing deprecated non-binding teams (no more used in integration tests) (#2514, #2607)
+
+* Add internal endpoint in Brig to update clients' key package refs in DB upon committing.
+  Brig should be deployed before Galley. (#2604)
+
+* Improved the resilience of provisioning new users via SAML by combining two persistence calls into one, preventing a creation failure from locking a user handle with no corresponding user. (#2526)
+
+
+## Federation changes
+
+
+* Fix TBS field in MLS Message type (#2599)
+
+
 # [2022-07-19] (Chart Release 4.21.0)
 
 ## Release notes

diff --git a/Makefile b/Makefile
@@ -61,7 +61,7 @@ endif
 
 # Usage: make c package=brig test=1
 .PHONY: c
-c:
+c: cabal-fmt
 	cabal build $(WIRE_CABAL_BUILD_OPTIONS) $(package)
 ifeq ($(test), 1)
 	./hack/bin/cabal-run-tests.sh $(package) $(testargs)
@@ -75,6 +75,10 @@ endif
 ci: c
 	./hack/bin/cabal-run-integration.sh $(package)
 
+.PHONY: cabal-fmt
+cabal-fmt:
+	./hack/bin/cabal-fmt.sh $(package)
+
 # Use ghcid to watch a particular package.
 # pass target=package:name to specify which target is watched.
 .PHONY: ghcid
@@ -536,22 +540,3 @@ kind-restart-%: .local/kind-kubeconfig
 #   make helm-template-wire-server
 helm-template-%: clean-charts charts-integration
 	./hack/bin/helm-template.sh $(*)
-
-# make bonanza-deb version=$VERSION
-.PHONY: bonanza-deb
-bonanza-deb:
-	makedeb --name=bonanza \
-            --version=$(version) \
-            --debian-dir=tools/bonanza/deb \
-            --build=0 \
-            --architecture=amd64 \
-            --output-dir=dist
-
-# make makedeb-deb version=$VERSION
-.PHONY: makedeb-deb
-makedeb-deb:
-	$(eval $@_DIR := $(shell mktemp -d -t makedeb.XXXXXXXXXX))
-	cp -R -L tools/makedeb/deb $($@_DIR)
-	sed -i "s/<<VERSION_NUMBER>>/$(version)/g" $($@_DIR)/deb/DEBIAN/control
-	cat $($@_DIR)/deb/DEBIAN/control
-	dpkg-deb -b $($@_DIR)/deb ./dist/makedeb_$(version)+0_amd64.deb
diff --git a/README.md b/README.md
@@ -51,8 +51,6 @@ This repository contains the following source code:
 
 - **tools**
    - **api-simulations**: Run automated smoke and load tests
-   - **makedeb**: Create Debian packages
-   - **bonanza**: Transform and forward log data
    - **db/**: Migration tools (e.g. when new tables are added)
    - **stern/**: Backoffice tool (basic [Swagger](https://swagger.io/) based interface)
 

diff --git a/build/ubuntu/Dockerfile.deps b/build/ubuntu/Dockerfile.deps
@@ -1,3 +1,12 @@
+FROM rust:1.63 as mls-test-cli-builder
+
+# compile mls-test-cli tool
+RUN cd /tmp && \
+    git clone https://github.com/wireapp/mls-test-cli && \
+    cd mls-test-cli && \
+    cargo build --release
+
+
 FROM ubuntu:20.04 as cryptobox-builder
 
 # compile cryptobox-c
@@ -10,11 +19,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     export SODIUM_USE_PKG_CONFIG=1 && \
     cargo build --release
 
-# compile mls-test-cli tool
-RUN cd /tmp && \
-  git clone https://github.com/wireapp/mls-test-cli && \
-  cd mls-test-cli && \
-  cargo build --release
 
 # Minimal dependencies for ubuntu-compiled, dynamically linked wire-server Haskell services
 FROM ubuntu:20.04
@@ -23,7 +27,7 @@ COPY --from=cryptobox-builder /tmp/cryptobox-c/target/release/libcryptobox.so /u
 
 # FUTUREWORK: only copy mls-test-cli executables if we are building an
 # integration test image
-COPY --from=cryptobox-builder /tmp/mls-test-cli/target/release/mls-test-cli /usr/bin
+COPY --from=mls-test-cli-builder /tmp/mls-test-cli/target/release/mls-test-cli /usr/bin
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \

diff --git a/build/ubuntu/Dockerfile.prebuilder b/build/ubuntu/Dockerfile.prebuilder
@@ -70,4 +70,4 @@ ENV PATH=/root/.ghcup/bin:/root/.cabal/bin:${PATH} \
 
 ARG CABAL_VERSION=3.6.2.0
 RUN ghcup install cabal ${CABAL_VERSION} && \
-    cabal install cabal-plan
+    cabal install cabal-plan -fexe
diff --git a/cabal.project b/cabal.project
@@ -41,7 +41,6 @@ packages:
   , services/proxy/
   , services/spar/
   , tools/api-simulations/
-  , tools/bonanza/
   , tools/db/assets/
   , tools/db/auto-whitelist/
   , tools/db/migrate-sso-feature-flag/
@@ -50,7 +49,6 @@ packages:
   , tools/db/find-undead/
   , tools/db/move-team/
   , tools/db/repair-handles/
-  , tools/makedeb/
   , tools/rex/
   , tools/stern/
 
@@ -176,8 +174,6 @@ package bilge
     ghc-options: -Werror
 package billing-team-member-backfill
     ghc-options: -Werror
-package bonanza
-    ghc-options: -Werror
 package brig
     ghc-options: -Werror
 package brig-types
@@ -212,8 +208,6 @@ package hscim
     ghc-options: -Werror
 package imports
     ghc-options: -Werror
-package makedeb
-    ghc-options: -Werror
 package metrics-core
     ghc-options: -Werror
 package metrics-wai

diff --git a/cabal.project.freeze b/cabal.project.freeze
@@ -1153,8 +1153,6 @@ constraints: any.AC-Angle ==1.0,
              any.hourglass ==0.2.12,
              any.hourglass-orphans ==0.1.0.0,
              any.hp2pretty ==0.10,
-             any.hpack ==0.34.5,
-             any.hpack-dhall ==0.5.3,
              any.hpc-codecov ==0.3.0.0,
              any.hpc-lcov ==1.0.1,
              any.hprotoc ==2.4.17,

diff --git a/cassandra-schema.cql b/cassandra-schema.cql
@@ -1718,6 +1718,7 @@ CREATE TABLE spar_test.idp (
     idp uuid PRIMARY KEY,
     api_version int,
     extra_public_keys list<blob>,
+    handle text,
     issuer text,
     old_issuers list<text>,
     public_key blob,

diff --git a/charts/backoffice/templates/configmap.yaml b/charts/backoffice/templates/configmap.yaml
@@ -23,10 +23,10 @@ data:
     # Both ibis and galeb should be made optional for
     # installations where these services are not available
     galeb:
-      host: galeb
+      host: {{ .Values.config.galebHost }}
       port: 8080
     ibis:
-      host: ibis
+      host: {{ .Values.config.ibisHost }}
       port: 8080
   nginx.conf: |
     worker_processes 1;
@@ -127,8 +127,14 @@ data:
         ssl_session_timeout 5m;
         ssl_prefer_server_ciphers on;
         ssl_protocols TLSv1.2 TLSv1.3;
-        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
-
+        # NOTE: These are some sane defaults (compliant to TR-02102-2), you may want to overrride them on your own installation
+        # For TR-02102-2 see https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-2.html
+        # As a Wire employee, for Wire-internal discussions and context see
+        # * https://wearezeta.atlassian.net/browse/FS-33
+        # * https://wearezeta.atlassian.net/browse/FS-444
+        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384'; # for TLS 1.2
+        # FUTUREWORK: upgrade nginx used for the backoffice to support ssl_conf_command (i.e. build a new backoffice-frontend), then uncomment below
+        # ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384; # for TLS 1.3
         server {
           listen {{ .Values.service.internalPort }};
 

diff --git a/charts/backoffice/values.yaml b/charts/backoffice/values.yaml
@@ -20,4 +20,6 @@ resources:
     cpu: 500m
 config:
   logLevel: Info
-baseUrl: http://localhost:8080
+  galebHost: galeb.integrations
+  ibisHost: ibis.integrations
+baseUrl: http://localhost:8080
diff --git a/charts/cannon/templates/conf/_nginx.conf.tpl b/charts/cannon/templates/conf/_nginx.conf.tpl
@@ -196,7 +196,8 @@ http {
     ssl_certificate_key /etc/wire/nginz/tls/tls.key;
 
     ssl_protocols {{ .Values.nginx_conf.tls.protocols }};
-    ssl_ciphers {{ .Values.nginx_conf.tls.ciphers }};
+    ssl_ciphers {{ .Values.nginx_conf.tls.ciphers_tls12 }}; # this only sets TLS 1.2 ciphers (and has no effect if TLS 1.2 is not enabled)
+    ssl_conf_command Ciphersuites {{ .Values.nginx_conf.tls.ciphers_tls13 }}; # needed to override TLS 1.3 ciphers.
 
     # Disable session resumption. See comments in SQPIT-226 for more context and
     # discussion.
@@ -206,6 +207,8 @@ http {
     zauth_keystore {{ .Values.nginx_conf.zauth_keystore }};
     zauth_acl      {{ .Values.nginx_conf.zauth_acl }};
 
+    add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains; preload' always;
+
     location /status {
         zauth off;
         access_log off;
@@ -338,7 +341,7 @@ http {
 
         more_set_headers 'Access-Control-Expose-Headers: Request-Id, Location';
         more_set_headers 'Request-Id: $request_id';
-        more_set_headers 'Strict-Transport-Security: max-age=31536000; preload';
+        more_set_headers 'Strict-Transport-Security: max-age=31536000; includeSubdomains; preload';
     }
 
           {{- end -}}

diff --git a/charts/cannon/values.yaml b/charts/cannon/values.yaml
@@ -46,7 +46,8 @@ nginx_conf:
     # As a Wire employee, for Wire-internal discussions and context see
     # * https://wearezeta.atlassian.net/browse/FS-33
     # * https://wearezeta.atlassian.net/browse/FS-444
-    ciphers: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
+    ciphers_tls12: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
+    ciphers_tls13: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"
 
   # The origins from which we allow CORS requests. These are combined with
   # 'external_env_domain' to form a full url

diff --git a/charts/nginx-ingress-controller/values.yaml b/charts/nginx-ingress-controller/values.yaml
@@ -8,7 +8,9 @@ nginx-ingress:
       # As a Wire employee, for Wire-internal discussions and context see
       # * https://wearezeta.atlassian.net/browse/FS-33
       # * https://wearezeta.atlassian.net/browse/FS-444
-      ssl-ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
+      #
+      # Note/FUTUREWORK: this current ingress-controller does not yet support TLS 1.3 (and its ciphers). An upgrade/different helm chart will be provided in the future.
+      ssl-ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
       http2-max-field-size: 16k
       http2-max-header-size: 32k
       proxy-buffer-size: 16k

diff --git a/charts/nginz/templates/conf/_nginx.conf.tpl b/charts/nginz/templates/conf/_nginx.conf.tpl
@@ -283,7 +283,7 @@ http {
             {{- if (hasKey $location "body_buffer_size") }}
         client_body_buffer_size {{ $location.body_buffer_size -}};
             {{- end }}
-        client_max_body_size {{ $location.max_body_size | default "64k" }};
+        client_max_body_size {{ $location.max_body_size | default $.Values.nginx_conf.default_client_max_body_size }};
 
             {{ if ($location.use_websockets) }}
         proxy_set_header   Upgrade        $http_upgrade;

diff --git a/charts/nginz/values.yaml b/charts/nginz/values.yaml
@@ -56,6 +56,7 @@ nginx_conf:
   - /search/top
   - /search/common
 
+  default_client_max_body_size: "256k"
   rate_limit_reqs_per_user: "10r/s"
   rate_limit_reqs_per_addr: "5r/m"
 
@@ -492,7 +493,6 @@ nginx_conf:
       - all
     spar:
     - path: /identity-providers
-      max_body_size: 256k
       envs:
       - all
     - path: /i/sso

diff --git a/docs/.dockerignore b/docs/.dockerignore
diff --git a/docs/.envrc b/docs/.envrc
@@ -1,10 +1,8 @@
-env="$(nix-build $PWD/nix/default.nix -A env)"
+source_up
 
-PATH_add "${env}/bin"
+docs_env="$(nix-build $PWD/../nix/default.nix -A docsEnv)"
 
-# source .profile from `$env`.
-# This is only used to set things interpolated by nix. All static things should live inside here.
-[[ -f "${env}/.profile" ]] && source_env "${env}/.profile"
+PATH_add "${docs_env}/bin"
 
 # allow local .envrc overrides
 [[ -f .envrc.local ]] && source_env .envrc.local