Merge pull request #9 from oracle/develop

Release 5.1.4

Author: jhalexand

.github/workflows/maven.yml

@@ -0,0 +1,28 @@
+  
+# This workflow will build a Java project with Maven
+# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
+
+name: OLCUT CI, OpenJDK 8, 11 and latest - Ubuntu x86_64
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # test against supported LTS versions and latest
+        java: [ 8, 11, 14 ]
+    name: OLCUT - OpenJDK ${{ matrix.java }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Setup OpenJDK
+        uses: actions/setup-java@v1
+        with:
+          java-version: ${{ matrix.java }}
+      - name: Build with Maven
+        run: mvn -B package --file pom.xml

README-Configuration.md

@@ -41,7 +41,7 @@ The configuration file defines an instance of a Pipeline that has two stages
 in it - a LowPassFilter and an EchoCanceller.  Each of the stages has their own
 parameters specified as properties.
 
-The Pipeline class that correspond to the component would look as follow:
+The Pipeline class that corresponds to the component would look as follow:
 
 ```java
     public class Pipeline implements Configurable {
@@ -329,10 +329,16 @@ Documentation about how to start a class server, run a registry, specify an
 object as remote, provide `ConfigurationEntries`, deal with `RemoteComponentManager`
 and `RemoteMultiComponentManager`, etc will eventually be added here.
 
-OLCUT in general works fine with Java 9, but we have experienced some weird class 
+Remote loading in general works fine with Java 9+, but we have experienced some weird class 
 loader issues when using serialization in RMI calls with Jini in another project. 
 It's TBD on what the root cause is or how to fix it.
 
+Note: remote components are currently deprecated as they depend on features
+deprecated by the integration of [JEP 385](https://openjdk.java.net/jeps/385)
+in Java 15. We are considering alternative approaches which will keep this 
+functionality, though it will likely be structured differently to the current
+implementation.
+
 ## Other config formats
 
 OLCUT 4.1 and above support json and edn (a Clojure based format) configuration files

README.md

@@ -16,9 +16,27 @@ the needs of a varied user-base.
 # Quick Start
 
 ## Maven Coordinates
-Please check back soon as we are working out the logistics for publishing to Maven Central.
+OLCUT's main components (i.e. `olcut-core`, `olcut-config-json` and `olcut-config-edn`) are available on Maven Central.
 
-[![wercker status](https://app.wercker.com/status/1615cf1d81ce750e730d50cec2309458/s/master "wercker status")](https://app.wercker.com/project/byKey/1615cf1d81ce750e730d50cec2309458)
+Maven:
+```xml
+<dependency>
+    <groupId>com.oracle.labs.olcut</groupId>
+    <artifactId>olcut-core</artifactId>
+    <version>5.1.4</version>
+</dependency>
+```
+or from Gradle:
+```groovy
+implementation 'com.oracle.labs.olcut:olcut-core:5.1.4'
+```
+
+The Jini-based remote configuration system in `olcut-config-jini` is deprecated as aspects of Jini are deprecated by 
+[JEP 385](https://openjdk.java.net/jeps/385). At the moment we don't have
+a replacement approach which will function after the rmid tool is removed.
+
+The `olcut-extras` artifact is designed as a small tool for developers, as such you should compile the appropriate 
+version based on your needs.
 
 ## Configuration System
 
@@ -208,7 +226,7 @@ Channel, File, & IO Utils | `ChannelUtil` has helpers for interacting with `java
 Log Formatter | There are two `java.util.logging log formatters` (`LabsLogFormatter` and `SimpleLabsLogFormatter` that have a nice single line logging output. They also have a static method that sets all the loggers to use the appropriate formatter, which makes integrating them simpler.
 LRA Cache | An extennsion of a LinkedHashMap that acts as a least recently accessed cache.
 Date Parser | The CDateParser can parse dates in almost 90 different formats that we've seen, returning a Java Date object without complaining.
-Getopt | Getopt is now deprecated. Use [Options Processing](README-Options.md) instead. This is still here if you need something small and stupid simple.
+Getopt | Getopt is now deprecated. Use [Options Processing](README-Options.md) instead. This is still here if you need something small and simple.
 Mutable Primitive Objects | Mutable types for Double, Long, and Number for use in, for example, Maps when you don't want to unbox and rebox the true primitives with every update.
 Pair | It's a pair class. The fields are final and it has equals and hash code so you can use it as a key in a map or store it in a set. Having Pair here greatly reduces the number of other places you have a Pair class defined. 
 Timers | `StopWatch` and `NanoWatch` provide handy timers, at millisecond or nanosecond granularity.

SECURITY.md

@@ -0,0 +1,17 @@
+# Reporting Security Vulnerabilities
+
+Oracle values the independent security research community and believes that responsible disclosure of security vulnerabilities helps us ensure the security and privacy of all our users.
+
+Please do NOT raise a GitHub Issue to report a security vulnerability. If you believe you have found a security vulnerability, please submit a report to [secalert\_us@oracle.com](mailto:secalert_us@oracle.com) preferably with a proof of concept. We provide additional information on [how to report security vulnerabilities to Oracle](https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting.html) which includes public encryption keys for secure email.
+
+We ask that you do not use other channels or contact project contributors directly. 
+
+Non-vulnerability related security issues such as new great new ideas for security features are welcome on GitHub Issues. 
+
+### Security Updates, Alerts and Bulletins
+
+Security updates will be released on a regular cadence. Many of our projects will typically release security fixes in conjunction with the [Oracle Critical Patch Update](https://www.oracle.com/security-alerts/) program. Security updates are released on the Tuesday closest to the 17th day of January, April, July and October. A pre-release announcement will be published on the Thursday preceding each release. Additional information, including past advisories, is available on our [Security Alerts](https://www.oracle.com/security-alerts/) page.
+
+### Security-Related Information
+
+We will provide security related information such as a threat model, considerations for secure use, or any known security issues in our documentation. Please note that labs and sample code are intended to demonstrate a concept and may not be sufficiently hardened for production use.

olcut-config-edn/pom.xml

@@ -32,7 +32,7 @@
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <parent>
-        <groupId>com.oracle.labs.mlrg.olcut</groupId>
+        <groupId>com.oracle.labs.olcut</groupId>
         <artifactId>olcut</artifactId>
         <version>${revision}</version>
         <relativePath>..</relativePath>
@@ -58,7 +58,7 @@
         <dependency>
             <groupId>us.bpsm</groupId>
             <artifactId>edn-java</artifactId>
-            <version>0.6.0</version>
+            <version>0.7.1</version>
         </dependency>
         <dependency>
             <groupId>${project.groupId}</groupId>

olcut-config-edn/src/main/java/com/oracle/labs/mlrg/olcut/config/edn/EdnLoader.java

@@ -39,6 +39,7 @@
 import com.oracle.labs.mlrg.olcut.config.SerializedObject;
 import com.oracle.labs.mlrg.olcut.config.property.SimpleProperty;
 import com.oracle.labs.mlrg.olcut.config.io.URLLoader;
+import com.oracle.labs.mlrg.olcut.util.IOUtil;
 import us.bpsm.edn.EdnException;
 import us.bpsm.edn.Keyword;
 import us.bpsm.edn.Symbol;
@@ -174,6 +175,8 @@ public final void load(URL url) throws ConfigLoaderException {
                 () -> {
                     if (url.getProtocol().equals("file")) {
                         workingDir = new File(url.getFile()).getParent();
+                    } else if (IOUtil.isDisallowedProtocol(url)) {
+                        throw new ConfigLoaderException("Unable to load configurations from URLs with protocol: " + url.getProtocol());
                     } else {
                         workingDir = "";
                     }

olcut-config-jini/pom.xml

@@ -30,7 +30,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <parent>
-        <groupId>com.oracle.labs.mlrg.olcut</groupId>
+        <groupId>com.oracle.labs.olcut</groupId>
         <artifactId>olcut</artifactId>
         <version>${revision}</version>
         <relativePath>..</relativePath>

olcut-config-jini/src/main/java/com/oracle/labs/mlrg/olcut/config/remote/ComponentRegistry.java

@@ -91,6 +91,7 @@
  * A configurable container that can be used to register object proxies with a Jini
  * registry.
  */
+@Deprecated
 public class ComponentRegistry implements Closeable, Configurable, DiscoveryListener,
         ServiceDiscoveryListener, LeaseListener {
     private static final Logger logger = Logger.getLogger(ComponentRegistry.class.getName());

olcut-config-jini/src/main/java/com/oracle/labs/mlrg/olcut/config/remote/ConfigurationEntry.java

@@ -36,6 +36,7 @@
  * A configurable entry type that we can pass to a service registrar to 
  * enable service matching.
  */
+@Deprecated
 public class ConfigurationEntry extends AbstractEntry implements Configurable {
 
     @Config

olcut-config-jini/src/main/java/com/oracle/labs/mlrg/olcut/config/remote/JiniConfigurationManager.java

@@ -55,6 +55,7 @@
  *
  * @see Configurable
  */
+@Deprecated
 public class JiniConfigurationManager extends ConfigurationManager {
     private static final Logger logger = Logger.getLogger(JiniConfigurationManager.class.getName());
 
@@ -471,6 +472,11 @@ public boolean equals(Object obj) {
         return cm.getImmutableGlobalProperties().equals(getImmutableGlobalProperties());
     }
 
+    @Override
+    public int hashCode() {
+        return super.hashCode();
+    }
+
     @Override
     protected <T extends Configurable> ServablePropertySheet<T> createPropertySheet(T conf, ConfigurationManager cm, ConfigurationData rpd) {
         return new ServablePropertySheet<>(conf,(JiniConfigurationManager)cm,rpd);