jsii-release 0.2.1007 → 0.2.1009
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +44 -24
- package/bin/publib-npm +10 -3
- package/bin/publib-pypi +61 -14
- package/package.json +1 -1
- package/package.json.bak +1 -1
package/README.md
CHANGED
|
@@ -69,6 +69,7 @@ npx publib-npm [DIR]
|
|
|
69
69
|
| Option | Required | Description |
|
|
70
70
|
| ----------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
71
71
|
| `NPM_TOKEN` | Optional | Registry authentication token (either [npm.js publishing token](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) or a [GitHub personal access token](https://help.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-npm-for-use-with-github-packages#authenticating-to-github-packages)), not used for AWS CodeArtifact |
|
|
72
|
+
| `NPM_TRUSTED_PUBLISHER` | Optional | Use a [Trusted Publisher](https://docs.npmjs.com/trusted-publishers) configuration to publish packages. Requires npm CLI version 11.5.1 or later. When set, `NPM_TOKEN` will be ignored. |
|
|
72
73
|
| `NPM_REGISTRY` | Optional | The registry URL (defaults to "registry.npmjs.org"). Use "npm.pkg.github.com" to publish to GitHub Packages. Use repository endpoint for AWS CodeAtifact, e.g. "my-domain-111122223333.d.codeartifact.us-west-2.amazonaws.com/npm/my_repo/". |
|
|
73
74
|
| `NPM_DIST_TAG` | Optional | Registers the published package with the given [dist-tag](https://docs.npmjs.com/cli/dist-tag) (e.g. `next`, default is `latest`) |
|
|
74
75
|
| `NPM_ACCESS_LEVEL` | Optional | Publishes the package with the given [access level](https://docs.npmjs.com/cli/v8/commands/npm-publish#access) (e.g. `public`, default is `restricted` for scoped packages and `public` for unscoped packages) |
|
|
@@ -107,25 +108,24 @@ npx publib-maven [DIR]
|
|
|
107
108
|
|
|
108
109
|
The server type is selected using the `MAVEN_SERVER_ID` variable.
|
|
109
110
|
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
|
116
|
-
|
|
117
|
-
| (all) | `
|
|
118
|
-
| (all) | `
|
|
119
|
-
| (all) | `
|
|
120
|
-
|
|
|
121
|
-
| `central-ossrh` | `
|
|
122
|
-
|
|
|
123
|
-
|
|
|
124
|
-
| `ossrh` (deprecated) | `
|
|
125
|
-
| `ossrh` (deprecated) | `
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
**How to create a GPG key**
|
|
111
|
+
* `MAVEN_SERVER_ID=ossrh`; this is currently the default but will stop working in July 2025. Publish to the old OSSRH Nexus server.
|
|
112
|
+
* `MAVEN_SERVER_ID=central-ossrh`; publish to the new Central Publishing platform using a service endpoint more-or-less compatible with the old OSSRH Nexus server. This is required to publish to Maven Central starting July 2025.
|
|
113
|
+
* `MAVEN_SERVER_ID=<anything else>`; publish to a custom Nexus server.
|
|
114
|
+
|
|
115
|
+
| Server | Option | Required | Description |
|
|
116
|
+
| -------------------- | --------------------------------------------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
117
|
+
| (all) | `MAVEN_SERVER_ID` | Yes going forward | Either `ossrh` (default but deprecated), `central-ossrh`, or any other string for a custom Nexus server. |
|
|
118
|
+
| (all) | `MAVEN_USERNAME` and `MAVEN_PASSWORD` | Yes | Username and password for maven repository. For Maven Central, you will need to [Create JIRA account](https://issues.sonatype.org/secure/Signup!default.jspa) and then request a [new project](https://issues.sonatype.org/secure/CreateIssue.jspa?issuetype=21&pid=10134). Read the [OSSRH guide](https://central.sonatype.org/pages/ossrh-guide.html) for more details. |
|
|
119
|
+
| (all) | `MAVEN_DRYRUN` | No | Set to "true" for a dry run |
|
|
120
|
+
| (all) | `MAVEN_VERBOSE` | No | Make Maven print debug output if set to `true` |
|
|
121
|
+
| `central-ossrh` | `MAVEN_GPG_PRIVATE_KEY[_FILE]` and `MAVEN_GPG_PRIVATE_KEY_PASSPHRASE` | Yes | GPG private key or file that includes it. This is used to sign your Maven packages. See instructions below |
|
|
122
|
+
| `central-ossrh` | `MAVEN_ENDPOINT` | No | URL of Nexus repository. Defaults to `https://ossrh-staging-api.central.sonatype.com/`. |
|
|
123
|
+
| `<custom>` | `MAVEN_REPOSITORY_URL` | No | Deployment repository when not deploying to Maven Central |
|
|
124
|
+
| `ossrh` (deprecated) | `MAVEN_GPG_PRIVATE_KEY[_FILE]` and `MAVEN_GPG_PRIVATE_KEY_PASSPHRASE` | Yes | GPG private key or file that includes it. This is used to sign your Maven packages. See instructions below |
|
|
125
|
+
| `ossrh` (deprecated) | `MAVEN_STAGING_PROFILE_ID` | Yes | Central Publisher (sonatype) staging profile ID, corresponding to namespace (e.g. `com.sonatype.software`). |
|
|
126
|
+
| `ossrh` (deprecated) | `MAVEN_ENDPOINT` | No | URL of Nexus repository. Defaults to `https://central.sonatype.com`. |
|
|
127
|
+
|
|
128
|
+
### How to create a GPG key
|
|
129
129
|
|
|
130
130
|
Install [GnuPG](https://gnupg.org/).
|
|
131
131
|
|
|
@@ -214,11 +214,31 @@ npx publib-pypi [DIR]
|
|
|
214
214
|
|
|
215
215
|
**Options (environment variables):**
|
|
216
216
|
|
|
217
|
-
| Option
|
|
218
|
-
|
|
|
219
|
-
| `TWINE_USERNAME`
|
|
220
|
-
| `TWINE_PASSWORD`
|
|
221
|
-
| `
|
|
217
|
+
| Option | Required | Description |
|
|
218
|
+
| --------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
219
|
+
| `TWINE_USERNAME` | Optional | PyPI username ([register](https://pypi.org/account/register/)). Not required when using Trusted Publishers. |
|
|
220
|
+
| `TWINE_PASSWORD` | Optional | PyPI password or API token. Not required when using Trusted Publishers. |
|
|
221
|
+
| `TWINE_REPOSITORY` | Optional | The repository to upload the package to. Defaults to `pypi`, set `testpypi` to publish to the testing index. |
|
|
222
|
+
| `TWINE_REPOSITORY_URL` | Optional | A custom repository URL, overrides `TWINE_REPOSITORY`. |
|
|
223
|
+
| `PYPI_TRUSTED_PUBLISHER` | Optional | Set to any value to use PyPI [Trusted Publisher](https://docs.pypi.org/trusted-publishers/) authentication (OIDC). Requires a supported ambient identity (i.e. CI/CD environment). |
|
|
224
|
+
| `PYPI_DISABLE_ATTESTATIONS` | Optional | Set to any value to disable [PyPI attestations](https://docs.pypi.org/attestations/producing-attestations/) (enabled by default with Trusted Publishers). |
|
|
225
|
+
|
|
226
|
+
### Trusted Publishers and Attestations
|
|
227
|
+
|
|
228
|
+
PyPI [Trusted Publishers](https://docs.pypi.org/trusted-publishers/) allows publishing without API tokens by using OpenID Connect (OIDC) authentication between a trusted third-party service and PyPI.
|
|
229
|
+
Typically these are CI/CD providers like GitHub Actions or Gitlab CI/CD.
|
|
230
|
+
PyPI attestations provide cryptographic proof of package provenance and integrity and are **enabled by default when using Trusted Publishers**. Attestations are only available when using Trusted Publisher authentication.
|
|
231
|
+
|
|
232
|
+
**Trusted Publisher Setup:**
|
|
233
|
+
|
|
234
|
+
1. Configure your PyPI project to use a [Trusted Publisher](https://docs.pypi.org/trusted-publishers/adding-a-publisher/)
|
|
235
|
+
2. Set `PYPI_TRUSTED_PUBLISHER=1` in your workflow environment
|
|
236
|
+
3. No `TWINE_USERNAME` or `TWINE_PASSWORD` needed
|
|
237
|
+
|
|
238
|
+
**Requirements:**
|
|
239
|
+
|
|
240
|
+
* **GitHub Actions**: Your workflow must have `id-token: write` permission.
|
|
241
|
+
* **Gitlab CI/CD**: The keyword `id_tokens` is used to request an OIDC token from GitLab with name `PYPI_ID_TOKEN` and audience `pypi`.
|
|
222
242
|
|
|
223
243
|
## Golang
|
|
224
244
|
|
package/bin/publib-npm
CHANGED
|
@@ -10,6 +10,7 @@ set -eu
|
|
|
10
10
|
# DIR: directory where npm tarballs are found (default is `dist/js`).
|
|
11
11
|
#
|
|
12
12
|
# NPM_TOKEN (optional): registry authentication token (either from npmjs or a GitHub personal access token), not used for AWS CodeArtifact
|
|
13
|
+
# NPM_TRUSTED_PUBLISHER (optional): use a Trusted Publisher configuration instead of tokens, any value
|
|
13
14
|
# NPM_REGISTRY (optional): the registry URL (defaults to "registry.npmjs.org")
|
|
14
15
|
# AWS_ACCESS_KEY_ID (optional): If AWS CodeArtifact is used as registry, an AWS access key can be spedified.
|
|
15
16
|
# AWS_SECRET_ACCESS_KEY (optional): Secret access key that belongs to the AWS access key.
|
|
@@ -34,13 +35,19 @@ if ! [ -z "${NPM_REGISTRY:-}" ] && [[ $NPM_REGISTRY =~ .codeartifact.*.amazonaws
|
|
|
34
35
|
export AWS_SESSION_TOKEN="$(echo $credentials | cut -d' ' -f5)"
|
|
35
36
|
fi
|
|
36
37
|
NPM_TOKEN=`aws codeartifact get-authorization-token --domain $codeartifact_domain --domain-owner $codeartifact_account --region $codeartifact_region --query authorizationToken --output text`
|
|
37
|
-
elif [ -z "${NPM_TOKEN:-}" ]; then
|
|
38
|
-
echo "NPM_TOKEN is required"
|
|
38
|
+
elif [ -z "${NPM_TOKEN:-}" ] && [ -z "${NPM_TRUSTED_PUBLISHER:-}" ]; then
|
|
39
|
+
echo "NPM_TOKEN=<token> or NPM_TRUSTED_PUBLISHER=true is required"
|
|
39
40
|
exit 1
|
|
40
41
|
fi
|
|
41
42
|
|
|
43
|
+
if ! [ -z "${NPM_TRUSTED_PUBLISHER:-}" ]; then
|
|
44
|
+
unset NPM_TOKEN
|
|
45
|
+
fi
|
|
46
|
+
|
|
42
47
|
NPM_REGISTRY=${NPM_REGISTRY:-"registry.npmjs.org"}
|
|
43
|
-
|
|
48
|
+
if ! [ -z "${NPM_TOKEN:-}" ]; then
|
|
49
|
+
echo "//${NPM_REGISTRY%%/}/:_authToken=${NPM_TOKEN}" > ~/.npmrc
|
|
50
|
+
fi
|
|
44
51
|
|
|
45
52
|
# this overrides any registry configuration defined externally. For example, yarn sets the registry to the yarn proxy
|
|
46
53
|
# which requires `yarn login`. but since we are logging in through ~/.npmrc, we must make sure we publish directly to npm.
|
package/bin/publib-pypi
CHANGED
|
@@ -9,27 +9,74 @@ set -euo pipefail
|
|
|
9
9
|
#
|
|
10
10
|
# DIR is where *.whl files are looked up (default is "dist/python")
|
|
11
11
|
#
|
|
12
|
-
# TWINE_USERNAME (
|
|
13
|
-
# TWINE_PASSWORD (
|
|
12
|
+
# TWINE_USERNAME (optional, ignored when using Trusted Publishers)
|
|
13
|
+
# TWINE_PASSWORD (optional, ignored when using Trusted Publishers)
|
|
14
|
+
# PYPI_TRUSTED_PUBLISHER (optional) - set to any value to use Trusted Publisher authentication
|
|
15
|
+
# PYPI_DISABLE_ATTESTATIONS (optional) - set to any value to disable attestations
|
|
14
16
|
#
|
|
15
17
|
###
|
|
16
18
|
|
|
17
19
|
cd "${1:-"dist/python"}"
|
|
18
20
|
|
|
19
|
-
[ -z "${TWINE_USERNAME:-}" ] && {
|
|
20
|
-
echo "Missing TWINE_USERNAME"
|
|
21
|
-
exit 1
|
|
22
|
-
}
|
|
23
|
-
|
|
24
|
-
[ -z "${TWINE_PASSWORD:-}" ] && {
|
|
25
|
-
echo "Missing TWINE_PASSWORD"
|
|
26
|
-
exit 1
|
|
27
|
-
}
|
|
28
|
-
|
|
29
21
|
if [ -z "$(ls *.whl)" ]; then
|
|
30
22
|
echo "cannot find any .whl files in $PWD"
|
|
31
23
|
exit 1
|
|
32
24
|
fi
|
|
33
25
|
|
|
34
|
-
|
|
35
|
-
|
|
26
|
+
# Validate credentials before installing packages
|
|
27
|
+
if [ -z "${PYPI_TRUSTED_PUBLISHER:-}" ]; then
|
|
28
|
+
[ -z "${TWINE_USERNAME:-}" ] && {
|
|
29
|
+
echo "Missing TWINE_USERNAME (required when not using Trusted Publishers)"
|
|
30
|
+
exit 1
|
|
31
|
+
}
|
|
32
|
+
|
|
33
|
+
[ -z "${TWINE_PASSWORD:-}" ] && {
|
|
34
|
+
echo "Missing TWINE_PASSWORD (required when not using Trusted Publishers)"
|
|
35
|
+
exit 1
|
|
36
|
+
}
|
|
37
|
+
fi
|
|
38
|
+
|
|
39
|
+
# Install required packages
|
|
40
|
+
packages="twine"
|
|
41
|
+
if [ -n "${PYPI_TRUSTED_PUBLISHER:-}" ]; then
|
|
42
|
+
packages="$packages id"
|
|
43
|
+
fi
|
|
44
|
+
if [ -z "${PYPI_DISABLE_ATTESTATIONS:-}" ]; then
|
|
45
|
+
packages="$packages pypi-attestations"
|
|
46
|
+
fi
|
|
47
|
+
python3 -m pip install --user --upgrade $packages
|
|
48
|
+
|
|
49
|
+
# Check for Trusted Publisher
|
|
50
|
+
if [ -n "${PYPI_TRUSTED_PUBLISHER:-}" ]; then
|
|
51
|
+
echo "Using PyPI Trusted Publisher authentication"
|
|
52
|
+
|
|
53
|
+
# Determine audience based on repository
|
|
54
|
+
audience="pypi"
|
|
55
|
+
mint_url="https://pypi.org/_/oidc/mint-token"
|
|
56
|
+
if [ "${TWINE_REPOSITORY:-}" = "testpypi" ]; then
|
|
57
|
+
audience="testpypi"
|
|
58
|
+
mint_url="https://test.pypi.org/_/oidc/mint-token"
|
|
59
|
+
fi
|
|
60
|
+
|
|
61
|
+
# Generate OIDC token and mint API token
|
|
62
|
+
oidc_token=$(python3 -m id "$audience")
|
|
63
|
+
resp=$(curl -s -X POST "$mint_url" -d "{\"token\": \"${oidc_token}\"}")
|
|
64
|
+
api_token=$(jq -r '.token' <<< "${resp}")
|
|
65
|
+
|
|
66
|
+
export TWINE_USERNAME="__token__"
|
|
67
|
+
export TWINE_PASSWORD="$api_token"
|
|
68
|
+
fi
|
|
69
|
+
|
|
70
|
+
if [ -z "${PYPI_DISABLE_ATTESTATIONS:-}" ]; then
|
|
71
|
+
echo "Signing packages with pypi-attestations"
|
|
72
|
+
python3 -m pypi_attestations sign *
|
|
73
|
+
fi
|
|
74
|
+
|
|
75
|
+
# Build upload command with optional attestations
|
|
76
|
+
upload_opts="--verbose --skip-existing"
|
|
77
|
+
if [ -z "${PYPI_DISABLE_ATTESTATIONS:-}" ]; then
|
|
78
|
+
upload_opts="$upload_opts --attestations"
|
|
79
|
+
fi
|
|
80
|
+
|
|
81
|
+
echo "Uploading packages to PyPI"
|
|
82
|
+
python3 -m twine upload $upload_opts *
|
package/package.json
CHANGED