phax/phoss-smp phoss-smp-parent-pom-8.6.2

v8.6.2

on GitHub

• Added the new REST APIs GET /migration/outbound and GET /migration/inbound to list the participant migrations of this SMP.
  The optional URL parameter state (inprogress, cancelled or migrated) filters the result, so GET /migration/outbound?state=inprogress returns what the Migrate to another SMP page shows as "In progress".
  The response contains the migration ID, state, participant ID, initiation date/time and migration key.
  See the [[REST API]] page for details.
• Added support for ECDSA (EC) keys in the SMP keystore.
  The XMLDSig signature method used to sign the Service Metadata responses now follows the key algorithm - ecdsa-sha256 for EC keys and rsa-sha256 for RSA keys - for all three REST types.
  Previously it was hard coded to RSA-SHA256, so an SMP with an EC key failed to sign every Service Metadata response.
  Other key algorithms are rejected with an explicit error message.
• Fixed the SML registration check on the Tasks and Problems page, which always reported "The registration of this SMP at the SML could not be determined".
  The SML rejected the Read request with a BadRequestFault (code 106), because the mandatory PublisherEndpoint was missing in it.
  The fix is in peppol-sml-client 13.2.1, which sends a PublisherEndpoint with dummy addresses - the SML ignores them for the Read operation.
  See #583
• Security: the Docker images now block the 16 compromised eMudhra intermediate CA certificates.
  The private keys of 8 eMudhra intermediate CAs were compromised, and each of them is also cross-signed by Sectigo's AAA Certificate Services, which is still trusted by the JDK.
  The Java runtime does not check revocation by default, so outbound HTTPS connections relying on the JDK trust store could accept forged certificates.
  All Dockerfiles now append the SHA-256 hashes of all 16 certificates to the JDK blocked.certs file.
  The step is skipped if the base image already contains the entries.
  Existing deployments must pull the new image, or add the hashes to the blocked.certs file of their own JDK.

Full Changelog: phoss-smp-parent-pom-8.6.1...phoss-smp-parent-pom-8.6.2