6 Commits

Include renames

Author	SHA1	Message	Date
3 people	3131956eb0	Harden workflow checkout credential hygiene + permissions (#6545) ... * Harden workflow checkout credential hygiene + permissions Address zizmor static-analysis findings: - artipacked: add `persist-credentials: false` to actions/checkout steps in codeql.yml (2), test-binary-installation.yml (2), clang-format-check.yml, freebsd.yml, h5py.yml, openbsd.yml, signed-plugins.yml, and update-progress.yml. None of these jobs push to git, so dropping the persisted checkout credential is safe. - excessive-permissions: restrict call-workflows.yml top-level permissions to `contents: read`, and grant `packages: write` / `pull-requests: write` only on the two jobs that call the maven-staging reusable workflow (which declares those needs). No behavioral change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Removed extra blank lines. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Larry Knox <lrknox@hdfgroup.org>	2026-08-04 16:41:53 -04:00
dependabot[bot]	4fd1bd4545	build(deps): bump the github-actions group with 17 updates (#6588) ... | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.3.4` | `4.4.1` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.4.0` | `5.6.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.3` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.37.3` | | [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell) | `3abb875e3aa9713e40eed5aea082672a42f7f95c` | `3c04c03694eb927ff908b8b5abfe9c58b239b0ae` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.1` | `6.2.3` | | [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.5.0` | `1.5.2` | | [julia-actions/julia-runtest](https://github.com/julia-actions/julia-runtest) | `1.11.5` | `1.12.0` | | [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) | `2.8.0` | `2.9.0` | | [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `1.4.4` | `1.4.5` | | [mpi4py/setup-mpi](https://github.com/mpi4py/setup-mpi) | `1.4.3` | `1.4.4` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |	2026-08-04 10:23:32 -05:00
3 people	9d5d995bec	build(deps): bump the github-actions group with 21 updates (#6500) ... * build(deps): bump the github-actions group with 21 updates Bumps the github-actions group with 21 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.0` | | [DamianReeves/write-file-action](https://github.com/damianreeves/write-file-action) | `1d019960841941be46b139298996df6f139cc7a4` | `d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.3.3` | `4.3.4` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.4.0` | | [fortran-lang/setup-fortran](https://github.com/fortran-lang/setup-fortran) | `1.9.0` | `1.9.2` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` | | [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell) | `3b7da264292a727fcdc4acdc9eaf9a5abb92ba10` | `3abb875e3aa9713e40eed5aea082672a42f7f95c` | | [cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action) | `4ef15ca7fd18a18f1000989fcfd968e06d146ce8` | `a3d72946b163026bbd0fa9a88379ccbda4bd86bb` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.0` | `6.2.1` | | [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.4.6` | `1.5.0` | | [julia-actions/julia-runtest](https://github.com/julia-actions/julia-runtest) | `1.11.4` | `1.11.5` | | [msys2/setup-msys2](https://github.com/msys2/setup-msys2) | `2.31.1` | `2.32.0` | | [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `1.4.3` | `1.4.4` | | [mpi4py/setup-mpi](https://github.com/mpi4py/setup-mpi) | `1.4.2` | `1.4.3` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.0` | `3.0.1` | | [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` | | [actions/cache/save](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | Updates `actions/checkout` from 4.2.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v4.2.2...v7) Updates `DamianReeves/write-file-action` from 1d019960841941be46b139298996df6f139cc7a4 to d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7 - [Release notes](https://github.com/damianreeves/write-file-action/releases) - [Commits](https://github.com/damianreeves/write-file-action/compare/1d019960841941be46b139298996df6f139cc7a4...d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7) Updates `actions/cache` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `lukka/get-cmake` from 4.3.3 to 4.3.4 - [Release notes](https://github.com/lukka/get-cmake/releases) - [Changelog](https://github.com/lukka/get-cmake/blob/main/RELEASE_PROCESS.md) - [Commits](https://github.com/lukka/get-cmake/compare/591817e96fcad43505fb4eae36172462abb3a42e...f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9) Updates `actions/setup-java` from 5.2.0 to 5.4.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/be666c2fcd27ec809703dec50e508c2fdc7f6654...1bcf9fb12cf4aa7d266a90ae39939e61372fe520) Updates `fortran-lang/setup-fortran` from 1.9.0 to 1.9.2 - [Release notes](https://github.com/fortran-lang/setup-fortran/releases) - [Commits](https://github.com/fortran-lang/setup-fortran/compare/2a1b9c55897d827a9dfeb114408f3615e53b2b72...195bac823dc6e05bb7c706311ad4540ffc34d5b9) Updates `github/codeql-action/init` from 4.36.1 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e) Updates `github/codeql-action/analyze` from 4.36.1 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e) Updates `github/codeql-action/upload-sarif` from 4.36.1 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](https://github.com/github/codeql-action/compare/v4.36.1...v4.36.2) Updates `codespell-project/actions-codespell` from 3b7da264292a727fcdc4acdc9eaf9a5abb92ba10 to 3abb875e3aa9713e40eed5aea082672a42f7f95c - [Release notes](https://github.com/codespell-project/actions-codespell/releases) - [Commits](https://github.com/codespell-project/actions-codespell/compare/3b7da264292a727fcdc4acdc9eaf9a5abb92ba10...3abb875e3aa9713e40eed5aea082672a42f7f95c) Updates `cygwin/cygwin-install-action` from 4ef15ca7fd18a18f1000989fcfd968e06d146ce8 to a3d72946b163026bbd0fa9a88379ccbda4bd86bb - [Release notes](https://github.com/cygwin/cygwin-install-action/releases) - [Commits](https://github.com/cygwin/cygwin-install-action/compare/4ef15ca7fd18a18f1000989fcfd968e06d146ce8...a3d72946b163026bbd0fa9a88379ccbda4bd86bb) Updates `aws-actions/configure-aws-credentials` from 6.2.0 to 6.2.1 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/e7f100cf4c008499ea8adda475de1042d6975c7b...254c19bd240aabef8777f48595e9d2d7b972184b) Updates `vmactions/freebsd-vm` from 1.4.6 to 1.5.0 - [Release notes](https://github.com/vmactions/freebsd-vm/releases) - [Commits](https://github.com/vmactions/freebsd-vm/compare/a6de9343ef5747433d9c25784c90e84998b9d69a...5a72679103d223925653750faa878a143340fbd0) Updates `julia-actions/julia-runtest` from 1.11.4 to 1.11.5 - [Release notes](https://github.com/julia-actions/julia-runtest/releases) - [Commits](https://github.com/julia-actions/julia-runtest/compare/d60b785c6f2bdf4ebfb18b2b6f7d93b7dfb0efe3...fc07e51ec99db23b29943e95406b5762501e2897) Updates `msys2/setup-msys2` from 2.31.1 to 2.32.0 - [Release notes](https://github.com/msys2/setup-msys2/releases) - [Changelog](https://github.com/msys2/setup-msys2/blob/main/CHANGELOG.md) - [Commits](https://github.com/msys2/setup-msys2/compare/e9898307ac31d1a803454791be09ab9973336e1c...66cd2cce69caa17b53920067426061ca1de3a884) Updates `vmactions/openbsd-vm` from 1.4.3 to 1.4.4 - [Release notes](https://github.com/vmactions/openbsd-vm/releases) - [Commits](https://github.com/vmactions/openbsd-vm/compare/fcf799d7ce9c305ad89eabef1fb2fa5c1c42d0ee...18edb32f4e48dae5865d7b8b3a9587bc01218a20) Updates `mpi4py/setup-mpi` from 1.4.2 to 1.4.3 - [Release notes](https://github.com/mpi4py/setup-mpi/releases) - [Commits](https://github.com/mpi4py/setup-mpi/compare/dbbb80b116bea57fc1788daf7dbbf7ab3df3a0f1...f200dce75b64188be849b46657dcf86c721937b2) Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3) Updates `actions/setup-python` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1) Updates `actions/cache/save` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: DamianReeves/write-file-action dependency-version: d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7 dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: lukka/get-cmake dependency-version: 4.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: fortran-lang/setup-fortran dependency-version: 1.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: codespell-project/actions-codespell dependency-version: 3abb875e3aa9713e40eed5aea082672a42f7f95c dependency-type: direct:production dependency-group: github-actions - dependency-name: cygwin/cygwin-install-action dependency-version: a3d72946b163026bbd0fa9a88379ccbda4bd86bb dependency-type: direct:production dependency-group: github-actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: vmactions/freebsd-vm dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: julia-actions/julia-runtest dependency-version: 1.11.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: msys2/setup-msys2 dependency-version: 2.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: vmactions/openbsd-vm dependency-version: 1.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: mpi4py/setup-mpi dependency-version: 1.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/cache/save dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> * ci(zizmor): hash-pin actions/checkout in signed-plugins.yml Dependabot bumped this reference from the bare tag @v6 to @v7.0.0, leaving it unpinned. zizmor's blanket policy requires a hash pin, which failed the code-scanning check with an error. Pin to the same v7.0.0 commit used across the other workflows. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: H. Joe Lee <hyoklee@hdfgroup.org> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-02 13:51:49 -05:00
dependabot[bot]	71b4aba68d	Bump the github-actions group with 12 updates (#6429) ... | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `6` | | [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.3.2` | `4.3.3` | | [softwareforgood/check-artifact-v4-existence](https://github.com/softwareforgood/check-artifact-v4-existence) | `0.4.1` | `0.4.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.3` | `4.36.1` | | [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell) | `cf810cf4cbd6cdefe6ef86e55b64d524a16654a7` | `3b7da264292a727fcdc4acdc9eaf9a5abb92ba10` | | [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) | `1.2.0` | `2.0.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.1.0` | `6.2.0` | | [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.4.5` | `1.4.6` | | [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia) | `3.0.1` | `3.0.2` | | [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `23b3fb94fbb4729a51b1c937f609483e759c8f28` | `fcf799d7ce9c305ad89eabef1fb2fa5c1c42d0ee` | | [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages) | `4.0.0` | `4.1.0` | | [adriangl/check-new-commits-action](https://github.com/adriangl/check-new-commits-action) | `1.0.7` | `2.0.1` |	2026-06-03 12:41:20 -05:00
Scot Breitenfeld	b33b9bff3f	ci: skip signed-plugins workflow for doc-only changes (#6398)	2026-05-06 17:05:45 -05:00
3 people	86bdc78365	✨[Feature] Digital Signature Verification for HDF5 Plugins (#6198) ... feat: add optional digital signature verification for HDF5 filter plugins Introduce an opt-in plugin signing and verification system that allows HDF5 deployments to require cryptographically signed filter plugins before loading them. Disabled by default (HDF5_REQUIRE_SIGNED_PLUGINS=OFF). New tool: h5sign - Signs plugin shared libraries by appending an RSA signature and a 14-byte footer (algo_id | sig_len | 8-byte magic | format_ver) to the binary without modifying the original content. - Supports SHA-512 (default), SHA-256, SHA-384, and their PSS variants (-a/--algorithm flag). - Detects already-signed plugins; --force strips the old signature and re-signs. - Security hardened: keeps the file descriptor open through hashing and appending (no TOCTOU window), enforces a 2048-bit minimum RSA key size, rolls back partial writes on failure, and rejects paths that are not regular files. Verification (H5PLsig.c) - At plugin load time, reads the footer, validates the magic and format version, then checks the RSA signature against all public keys found in the KeyStore directory. - File is hashed once; per-key verification operates on the pre-computed digest (no redundant I/O for multi-key keystores). - Plugins whose signature hash appears in revoked_signatures.txt are rejected regardless of key validity. - Runtime debug output via HDF5_DEBUG=pl. KeyStore management - Trusted public keys are PEM files in a directory specified by HDF5_PLUGIN_KEYSTORE_DIR (build time) or HDF5_PLUGIN_KEYSTORE (env var). - HDF5_LOCK_PLUGIN_KEYSTORE cmake option disables the env-var override for security-hardened deployments. Test infrastructure - h5signverifytest: positive, negative, tamper, re-sign, and revocation test cases. - CTest fixture-based dependency graph (FIXTURES_SETUP/FIXTURES_REQUIRED) replaces fragile DEPENDS chains so tests remain correct under -R filtering. - Dedicated signed-plugins.yml CI workflow; full test suite scoped to H5SIGN and H5PLUGIN-signature tests to avoid unrelated flaky failures. - Cross-platform: Linux, macOS, and Windows (MSVC-compatible, BIO-based OpenSSL I/O, HDsleep/HDsetenv portability wrappers). Documentation: docs/PLUGIN_SIGNATURE_README.md covers usage, footer format, revocation file format, FAQ, and troubleshooting. Co-authored-by: Glenn Song <gsong@hdfgroup.org> Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>	2026-05-06 09:35:19 -05:00