diff --git a/.agents/tasks/security-docs-tasks.md b/.agents/tasks/security-docs-tasks.md new file mode 100644 index 00000000..1bde4281 --- /dev/null +++ b/.agents/tasks/security-docs-tasks.md @@ -0,0 +1,204 @@ +# Security section on spine.io + +## Goal + +Give consumers of the Spine Event Engine SDK one place for everything security-related: +**Documentation → Security** on spine.io, with three pages: + +| Page | URL (proposed) | Source of the content | +|---|---|---| +| Security policy | `/docs/security/policy/` | `SpineEventEngine/.github` → `SECURITY.md` | +| Verifying artifacts | `/docs/security/verifying-artifacts/` | `config` README, "Verifying published artifacts" | +| Coordinated Vulnerability Disclosure Policy | `/docs/security/cvd-policy/` | the current https://spine.io/cvd-policy/ | + +The old https://spine.io/cvd-policy/ URL redirects to the new CVD page. The org-wide +`SECURITY.md` gets a short section that points to "Verifying artifacts", and the `config` +README section shrinks to a pointer to the same page. + +## Context + +- `config` now publishes every JVM artifact through the reusable `publishing.yml` workflow, + which attests all published files (JARs, POMs, Gradle module metadata, SPDX SBOMs) with + SLSA v1.0 build provenance. This setup meets SLSA Build Level 3. +- Consumers verify the provenance with: + + ```bash + gh attestation verify \ + -R SpineEventEngine/ \ + --signer-workflow SpineEventEngine/config/.github/workflows/publishing.yml \ + --source-ref refs/heads/ + ``` + + Checked on 2026-09-30 against `spine-base-2.0.0-SNAPSHOT.443.jar` from + `base-libraries`, without `--source-ref`; it passed. +- Other projects keep verification instructions in their docs, not in `SECURITY.md`. For + example: Argo CD, "Verification of Argo CD Artifacts" (operator manual); Kubernetes, + "Verify Signed Kubernetes Artifacts" (docs task page). Kyverno's `SECURITY.md` only links + out to its security docs. We follow that pattern: the site holds the full text, and + `SECURITY.md` points to it. +- Order matters: `SECURITY.md` and the `config` README should link to the site pages only + after those pages are live. + +## Plan + +### 1. `documentation` repository + +- [x] **Create the Security section** under Documentation, with the three pages below in the + section's navigation, in the order given in the table above. +- [x] **Security policy page.** Decide during implementation between: + - **Embed the content** of `.github/SECURITY.md`, pulled from that repository at build + time or by a sync job, so `.github` stays the single source and the two can't drift. + Headings and relative links need adapting to the site. + - **A short page that links out**: one or two paragraphs on how to report a vulnerability, + plus a link to `SECURITY.md` on GitHub. Nothing to sync, but readers leave the site. + + If we embed, don't let a copy edited by hand on the site become a second source. + + Done: embedded, fetched at build time by the `remote-markdown` shortcode (see Log). +- [x] **Verifying artifacts page.** Adapt the `config` README section "Verifying published + artifacts" for consumers, and leave out the internals that only maintainers need: + - What is attested: every file of every Maven publication, SBOMs included. The provenance + format is SLSA v1.0, built on GitHub-hosted runners by the reusable workflow in + `config`, and meets Build Level 3. + - What a successful verification means: the file was built by us, from the named + repository and branch, and hasn't been modified since. What it doesn't mean: the file + has no vulnerabilities (link to the Security policy page). + - Prerequisite: the GitHub CLI (`gh`). The file must first be downloaded locally, from the + Maven repository or the Gradle cache (`~/.gradle/caches/modules-2/files-2.1/...`). + - The general command and the worked example (`spine-base-2.0.0-SNAPSHOT.443.jar`, + `base-libraries`). + - Why each flag is there: + - `-R` names the repository the file was built from. + - `--signer-workflow` pins the workflow that signed the provenance. + - `--source-ref` pins the branch; the ref is matched exactly, one per check. + - Values for ``: + - `master` for the current line of development. + - `v.x` (e.g. `v2.x`) for releases of an earlier version family published from its + release branch. Versions built on `master` before that branch was cut still verify with + `master`. + - Older versions: + - Versions published before a repository got the attestation step have no provenance. + - Versions attested by the older inline step pass with `-R` alone and fail with + `--signer-workflow`, as intended. + - Optional strict pinning with `--signer-digest `. + - Reword the maintainer-facing parts of the README text, such as re-running the `attest` + job and `migrate`. +- [x] **CVD policy page.** Move the content of https://spine.io/cvd-policy/ to + `/docs/security/cvd-policy/` unchanged. It's a policy document, so a move shouldn't + change its wording. +- [x] **Redirect** https://spine.io/cvd-policy/ to https://spine.io/docs/security/cvd-policy/. + - First find which repository serves `/cvd-policy/` today. It may be the main site + repository rather than `documentation`. The redirect goes wherever the old page lives. + - Prefer a permanent (301) redirect. If the site is on GitHub Pages, it can't send HTTP + redirects; the usual fallback is a redirect page (e.g. Hugo `aliases`, which emits a + `meta refresh` with a canonical link). Check that the result works for both the URL with + a trailing slash and the one without. + - Keep the redirect indefinitely: `/cvd-policy/` is referenced from `SECURITY.md` in every + repository of the organization, and from outside. +- [x] **Update internal links** on the site that point to `/cvd-policy/` (footer, other docs + pages) to the new URL. + +The redirect, the link updates, and the removal of the old page are on the `security-section` +branch of `SpineEventEngine.github.io` (the spine.io repository), because that repository +serves `/cvd-policy/` today. Merge order: + +1. The `documentation` PR. +2. The spine.io PR, after adding to it a bump of the `documentation` module pin + (`hugo mod get github.com/SpineEventEngine/documentation/docs@` in `site/`). + Without the bump, the PR deletes the old page before the new one exists, and + `/cvd-policy/` redirects to a missing page. + +### 2. `.github` repository + +To be merged after the site pages are live. + +- [ ] **Add a "Verifying our artifacts" section** to `SECURITY.md`, after "Third-party + components". It's a pointer, with no commands: + + ```markdown + Verifying our artifacts + ----------------------- + The artifacts we publish to Maven repositories carry signed build provenance: a record, in + the [SLSA][slsa] format, of the repository, branch, and workflow that built them. This + covers JARs, POMs, Gradle module metadata, and the SBOM published next to each module. The + builds run on GitHub-hosted runners, in a reusable workflow that the building repository + cannot modify, which meets SLSA v1.0 Build Level 3. + + With the provenance, you can check that a file you downloaded was built by us from a + protected branch and has not changed since. It does not say that the artifact is free of + vulnerabilities; to report one, please follow the instructions above. + + Artifacts published before a repository adopted this process carry no provenance, or + provenance at a lower level. See [Verifying artifacts][verify] for the command and the + versions it applies to. + + [slsa]: https://slsa.dev/spec/v1.0/levels + [verify]: https://spine.io/docs/security/verifying-artifacts/ + ``` + + Why it's worded this way: + - It says "artifacts we publish to Maven repositories", not "Spine", so it stays true in + repositories that publish nothing. + - It says what provenance does not prove. + - It ties "Build Level 3" to the mechanism rather than presenting it as a certification. + - It covers legacy artifacts, so someone whose older JAR fails to verify isn't alarmed. +- [ ] **Update the `[cvd-policy]` link** in `SECURITY.md` to + https://spine.io/docs/security/cvd-policy/. The redirect would cover the old link, but + the file should point to the canonical URL. +- [ ] **Check the other files for `/cvd-policy/` links**: `CONTRIBUTING.md`, `README.md`, + `profile/`, `workflow-templates/`. + +### 3. `config` repository + +After the "Verifying artifacts" page is live: + +- [ ] **Shrink "Verifying published artifacts" in `README.md` to a pointer**: one or two + sentences for maintainers (every `Publish` run attests through `publishing.yml`), plus + a link to https://spine.io/docs/security/verifying-artifacts/. The site page becomes + the only full text. +- [ ] **Keep maintainer-only notes in `config`**: re-running a failed `attest` job and the + caller template's trigger. They belong next to `publishing.yml` (its comments already + cover the recovery), not on the site. + +## Preconditions for the wording to hold + +These aren't tasks for the repositories above, but the published text depends on them: + +- **Rulesets on `master`** in every repository that publishes artifacts: changes only + through review, no force-push. Without these, "from a protected branch" in `SECURITY.md` + and the `--source-ref` guidance are overstated. +- **Release branches.** When a repository starts publishing from a `v.x` branch: + - The ruleset must cover the `v*.x` pattern, including creating such branches. + - The caller template `.github-workflows/publish.yml` in `config` needs `'v*.x'` added to + its `push.branches` trigger. Today it's `[master]` only. +- **A ruleset on `master` of `.github`.** The Security policy page renders that branch's + `SECURITY.md` into spine.io, and the site renders raw HTML in Markdown. Whoever can push to + that branch can change a page of the site. + +- 2026-09-30 — drafted from the `config` session on attestation verification. Decided: + standalone task document; the Security policy page's embed-vs-link choice is left to + implementation; the `config` README shrinks to a pointer once the site page exists; the + repository serving `/cvd-policy/` is to be determined. +- 2026-09-30 — part 1 implemented, uncommitted, on `security-section` in `documentation` and + spine.io; parts 2 and 3 wait for go-live. Decided: + - Security policy page: fetched at build time. It's a real `policy.md` whose body is the + `remote-markdown` shortcode, not a content adapter: adapter pages have no `.File`, and + the site-commons sidenav finds the current section from `.File.Path`. A failed fetch + fails the build; under `hugo server` it's a warning. Both projects set + `[caches.getresource] maxAge = '1h'`: Hugo's default is to never refetch, and the + `check-links` workflows restore the Hugo cache between runs. + - `/cvd-policy/` is served by spine.io, so the redirect is a static page there + (`site/static/cvd-policy/index.html`), not `aliases` in `documentation`. lychee checks the + `rel=canonical` link of a redirect page, and a canonical URL that isn't live yet would + fail the `documentation` link check. The page uses site-relative URLs for the same reason. + - Security comes last in the navigation, after the Validation guides. The main sidenav + always precedes the sidenavs of the documentation modules, so Security has a sidenav of + its own, `data/docs/security/sidenav.yml`, placed last by `moduleOrder` in `hugo.toml`. + - Numbered headings: the CVD page keeps `has_numbered_headings: true`, and spine.io's docs + layout now honours it, as the privacy layout does. The local preview shows them + unnumbered, since it has no such styles. + - The preview gets its own `date` shortcode. spine.io's shortcode of the same name takes + precedence there. + - spine.io also got: `security.txt` `Policy:` pointing to the new URL, its `Expires:` fixed + (a stray space made it invalid under RFC 9116), and a `workflow_dispatch` trigger for + the deploy, limited to `master`, to publish `SECURITY.md` changes. diff --git a/.gitignore b/.gitignore index ecac2a22..8f9767bb 100644 --- a/.gitignore +++ b/.gitignore @@ -1,29 +1,15 @@ # >>> shared config (managed by ./config/pull -- do not edit inside this block) >>> +# Copyright 2026 CodeMatters, Lda. # -# Copyright 2025, TeamDev. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at +# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file +# except in compliance with the License. You may obtain a copy of the License at # # https://www.apache.org/licenses/LICENSE-2.0 # -# Redistribution and use in source and/or binary forms, with or without -# modification, must retain the above copyright notice and the following -# disclaimer. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -# +# Unless required by applicable law or agreed to in writing, software distributed under +# the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, +# either express or implied. See the License for the specific language governing permissions +# and limitations under the License. # # This file is used for two purposes: @@ -59,6 +45,10 @@ # indices, external-storage toggles) — so `.idea/*.xml` above keeps it ignored. # `./config/pull` (via `migrate`) untracks any copy an earlier pull committed. +# `.idea/kotlinc.xml` is likewise NOT re-included. It records the Kotlin compiler +# settings IDEA rewrites on its own (JVM target, bundled plugin version), so it +# churns per machine and per IDE build — `.idea/*.xml` above keeps it ignored. + # Do not ignore the following IDEA settings !.idea/codeStyleSettings.xml !.idea/codeStyles/ diff --git a/.idea/copyright/CodeMatters_Open_Source.xml b/.idea/copyright/CodeMatters_Open_Source.xml new file mode 100644 index 00000000..cf5d7135 --- /dev/null +++ b/.idea/copyright/CodeMatters_Open_Source.xml @@ -0,0 +1,6 @@ + + + + diff --git a/.idea/copyright/profiles_settings.xml b/.idea/copyright/profiles_settings.xml index 0b8f9a19..4f463a81 100644 --- a/.idea/copyright/profiles_settings.xml +++ b/.idea/copyright/profiles_settings.xml @@ -1,7 +1,7 @@ - + - + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml deleted file mode 100644 index ad582f4e..00000000 --- a/.idea/misc.xml +++ /dev/null @@ -1,44 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/build.gradle.kts b/build.gradle.kts index 1845d051..a10759d2 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -1,27 +1,15 @@ /* - * Copyright 2026, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ /** diff --git a/config b/config index 91e13d43..3210ca6c 160000 --- a/config +++ b/config @@ -1 +1 @@ -Subproject commit 91e13d433c0e892f4cb48c7575bb05899018974d +Subproject commit 3210ca6cc05c77ee59961721cf5c1c08327aa86b diff --git a/docs/_code/samples/build.gradle b/docs/_code/samples/build.gradle index 8b18b574..f5c6e43b 100644 --- a/docs/_code/samples/build.gradle +++ b/docs/_code/samples/build.gradle @@ -1,27 +1,15 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ plugins { diff --git a/docs/_code/samples/settings.gradle b/docs/_code/samples/settings.gradle index 55ac0f44..71f94c8d 100644 --- a/docs/_code/samples/settings.gradle +++ b/docs/_code/samples/settings.gradle @@ -1,27 +1,15 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ rootProject.name = "samples" diff --git a/docs/_code/samples/src/main/java/io/spine/site/home/server/NanoPmContext.java b/docs/_code/samples/src/main/java/io/spine/site/home/server/NanoPmContext.java index d13ef299..974193f9 100644 --- a/docs/_code/samples/src/main/java/io/spine/site/home/server/NanoPmContext.java +++ b/docs/_code/samples/src/main/java/io/spine/site/home/server/NanoPmContext.java @@ -1,27 +1,15 @@ /* - * Copyright 2026, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ package io.spine.site.home.server; diff --git a/docs/_code/samples/src/main/java/io/spine/site/home/server/TaskAggregate.java b/docs/_code/samples/src/main/java/io/spine/site/home/server/TaskAggregate.java index 152f55f2..d9b026e8 100644 --- a/docs/_code/samples/src/main/java/io/spine/site/home/server/TaskAggregate.java +++ b/docs/_code/samples/src/main/java/io/spine/site/home/server/TaskAggregate.java @@ -1,27 +1,15 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ package io.spine.site.home.server; diff --git a/docs/_code/samples/src/main/java/io/spine/site/home/server/TaskProjection.java b/docs/_code/samples/src/main/java/io/spine/site/home/server/TaskProjection.java index 03752f9c..0daa0585 100644 --- a/docs/_code/samples/src/main/java/io/spine/site/home/server/TaskProjection.java +++ b/docs/_code/samples/src/main/java/io/spine/site/home/server/TaskProjection.java @@ -1,27 +1,15 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ package io.spine.site.home.server; diff --git a/docs/_code/samples/src/main/java/io/spine/site/home/server/package-info.java b/docs/_code/samples/src/main/java/io/spine/site/home/server/package-info.java index 07846fd3..61a28654 100644 --- a/docs/_code/samples/src/main/java/io/spine/site/home/server/package-info.java +++ b/docs/_code/samples/src/main/java/io/spine/site/home/server/package-info.java @@ -1,27 +1,15 @@ /* - * Copyright 2026, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ /** diff --git a/docs/_code/samples/src/main/proto/spine/example/events.proto b/docs/_code/samples/src/main/proto/spine/example/events.proto index ace437e0..5588c16a 100644 --- a/docs/_code/samples/src/main/proto/spine/example/events.proto +++ b/docs/_code/samples/src/main/proto/spine/example/events.proto @@ -1,28 +1,17 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ + syntax = "proto3"; package spine.example; diff --git a/docs/_code/samples/src/main/proto/spine/site/home/commands.proto b/docs/_code/samples/src/main/proto/spine/site/home/commands.proto index bd14cd4e..e5c10e7e 100644 --- a/docs/_code/samples/src/main/proto/spine/site/home/commands.proto +++ b/docs/_code/samples/src/main/proto/spine/site/home/commands.proto @@ -1,28 +1,17 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ + syntax = "proto3"; package spine.site.home; diff --git a/docs/_code/samples/src/main/proto/spine/site/home/events.proto b/docs/_code/samples/src/main/proto/spine/site/home/events.proto index b7d5b2f8..e328bdc6 100644 --- a/docs/_code/samples/src/main/proto/spine/site/home/events.proto +++ b/docs/_code/samples/src/main/proto/spine/site/home/events.proto @@ -1,27 +1,15 @@ /* - * Copyright 2026, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ syntax = "proto3"; diff --git a/docs/_code/samples/src/main/proto/spine/site/home/identifiers.proto b/docs/_code/samples/src/main/proto/spine/site/home/identifiers.proto index fee4bea5..a4df4d17 100644 --- a/docs/_code/samples/src/main/proto/spine/site/home/identifiers.proto +++ b/docs/_code/samples/src/main/proto/spine/site/home/identifiers.proto @@ -1,28 +1,17 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ + syntax = "proto3"; package spine.site.home; diff --git a/docs/_code/samples/src/main/proto/spine/site/home/task.proto b/docs/_code/samples/src/main/proto/spine/site/home/task.proto index 0232e7bd..3b2badf8 100644 --- a/docs/_code/samples/src/main/proto/spine/site/home/task.proto +++ b/docs/_code/samples/src/main/proto/spine/site/home/task.proto @@ -1,27 +1,15 @@ /* - * Copyright 2026, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ syntax = "proto3"; diff --git a/docs/_code/samples/src/test/java/io/spine/example/CompiledProtobuf.java b/docs/_code/samples/src/test/java/io/spine/example/CompiledProtobuf.java index 591de704..c12fb447 100644 --- a/docs/_code/samples/src/test/java/io/spine/example/CompiledProtobuf.java +++ b/docs/_code/samples/src/test/java/io/spine/example/CompiledProtobuf.java @@ -1,28 +1,17 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ + package io.spine.example; import org.junit.jupiter.api.DisplayName; diff --git a/docs/_code/samples/src/test/java/io/spine/site/home/server/TaskCreationTest.java b/docs/_code/samples/src/test/java/io/spine/site/home/server/TaskCreationTest.java index 5b7d0855..d9027e18 100644 --- a/docs/_code/samples/src/test/java/io/spine/site/home/server/TaskCreationTest.java +++ b/docs/_code/samples/src/test/java/io/spine/site/home/server/TaskCreationTest.java @@ -1,27 +1,15 @@ /* - * Copyright 2020, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ package io.spine.site.home.server; diff --git a/docs/_preview/hugo.toml b/docs/_preview/hugo.toml index b3766503..2b925e4f 100644 --- a/docs/_preview/hugo.toml +++ b/docs/_preview/hugo.toml @@ -15,6 +15,13 @@ disableKinds = ['taxonomy', 'term'] [[module.imports]] path = 'github.com/SpineEventEngine/site-commons' +# Remote files that the build fetches, such as `SECURITY.md` for the Security policy page, +# stay cached for an hour. Hugo never expires them by default, so a cache that CI restores +# between runs would keep serving the first copy. +[caches] + [caches.getresource] + maxAge = '1h' + # Enables HTML rendering in markdown files. [markup] [markup.goldmark] diff --git a/docs/assets/js/docs/architecture-diagram.js b/docs/assets/js/docs/architecture-diagram.js index eb162792..d2cb4376 100644 --- a/docs/assets/js/docs/architecture-diagram.js +++ b/docs/assets/js/docs/architecture-diagram.js @@ -1,27 +1,15 @@ /* - * Copyright 2026, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ /** diff --git a/docs/content/docs/_index.md b/docs/content/docs/_index.md index 5e2cabec..e642d770 100644 --- a/docs/content/docs/_index.md +++ b/docs/content/docs/_index.md @@ -35,3 +35,7 @@ the [example applications]({{% get-site-data "repositories.examples" %}}). ## [DDD Resources](docs/resources/) A brief selection of learning materials we recommend to the colleagues in DDD. + +## [Security](docs/security/policy/) +This section explains how to report a vulnerability, how we handle reports, and how to check +that an artifact you downloaded was built by us. diff --git a/docs/content/docs/security/cvd-policy.md b/docs/content/docs/security/cvd-policy.md new file mode 100644 index 00000000..ac679b68 --- /dev/null +++ b/docs/content/docs/security/cvd-policy.md @@ -0,0 +1,103 @@ +--- +title: Coordinated Vulnerability Disclosure Policy +description: How we handle vulnerability reports for Spine Event Engine, and what we ask of you. +headline: Documentation +lastmod: 2026-09-11 +has_numbered_headings: true +--- + +# Coordinated Vulnerability Disclosure Policy + +{{< date label="Last updated:" >}} + +## Why we have this Policy + +Security is an integral part of how we develop and maintain our product. + +We welcome responsible disclosure of security risks and product vulnerabilities by our customers, +security researchers, and anyone who may discover a potential vulnerability. + +This Policy explains how to report a security vulnerability affecting Spine Event Engine +(“Spine”), how we handle the information you provide, and what you can expect from us in +response. + +## What this Policy covers + +This Policy covers Spine, along with the third-party components we use inside it. + +## How to report + +Our single point of contact for vulnerability reports is {{< cloakemail "cra-request@codematters.ltd" >}}. + +When submitting a report, please indicate the affected version and include the following, where +available: + +- the name of the security risk and any relevant CWE and CVE identifiers; +- a description of the issue and clear steps to reproduce it; +- an illustrative example; and +- your assessment of the impact. + +We appreciate reports submitted in English. + +Please report the vulnerability to us before making any information about it public. + +## What happens next + +We will confirm receipt of your report within 3 business days. + +Within the next 10 business days, we will inform you of the results of our initial assessment. + +After that, we will provide the issue status updates at least once every 30 business days until +the matter is resolved or otherwise closed. + +## Publication + +Once the fix is available, we publish an advisory on our website and reference it in the release +notes. + +We ask you to coordinate the timing of any public disclosure with us. As a general rule, this +means waiting until we have released a fix or until 90 days have passed since your report, +whichever is earlier. + +## Rules we ask you to follow + +When conducting security research and reporting a vulnerability under this Policy, we ask that you: + +- act in good faith, and only to identify and report a vulnerability; +- use your own systems, licences and test data; +- stop testing once you have confirmed the vulnerability, and collect only the information + reasonably necessary to demonstrate it; +- avoid any activity that could harm our systems, our customers, or other people's data; +- keep information about the vulnerability confidential until disclosure has been coordinated + with us. + +## What you can expect from us + +If you follow this Policy, we will keep your report confidential and will not take legal action +against you or report your research to law enforcement. + +## Third-party components + +Spine incorporates third-party components and other dependencies. Where a vulnerability in such a +component affects Spine, we will treat the vulnerability as an issue affecting our product and +address it accordingly. + +When such an issue is reported, we will assess its impact on Spine, coordinate with the relevant +third-party maintainer, publish a security advisory where users are affected, and make available +any fixes or updates provided by the third-party provider. + +Where no fix is available, we will identify appropriate measures to eliminate or mitigate the +risk and inform affected users of any actions they should take in the meantime. + +If we develop a fix for the affected third-party component ourselves, we will, where appropriate, +share or coordinate that fix with the component's maintainer. + +## Reporting to authorities + +Where required by applicable law, we will notify the competent authorities, including the +Portuguese CSIRT (CNCS/CERT.PT) and ENISA, of actively exploited vulnerabilities and severe security +incidents affecting Spine within the time limits prescribed by the Cyber Resilience Act. We will +also inform affected users where required. + +Such notifications describe the vulnerability, not the person who reported it. We do not share +your identity with authorities unless the law obliges us to. diff --git a/docs/content/docs/security/policy.md b/docs/content/docs/security/policy.md new file mode 100644 index 00000000..60a5b0d8 --- /dev/null +++ b/docs/content/docs/security/policy.md @@ -0,0 +1,16 @@ +--- +title: Security policy +headline: Documentation +description: How to report a security vulnerability in Spine Event Engine and what to expect in response. +# The body of this page is `SECURITY.md` of the `SpineEventEngine/.github` repository, fetched +# when the site is built. To change the text, edit that file; there is no copy here to update. +--- + +{{% remote-markdown url="https://raw.githubusercontent.com/SpineEventEngine/.github/master/SECURITY.md" %}} + +--- + +The source of this page is [`SECURITY.md`][security-md] in the +`SpineEventEngine/.github` repository. + +[security-md]: https://github.com/SpineEventEngine/.github/blob/master/SECURITY.md diff --git a/docs/content/docs/security/verifying-artifacts.md b/docs/content/docs/security/verifying-artifacts.md new file mode 100644 index 00000000..f839cfaa --- /dev/null +++ b/docs/content/docs/security/verifying-artifacts.md @@ -0,0 +1,136 @@ +--- +title: Verifying artifacts +headline: Documentation +description: How to check that a Spine Event Engine artifact was built by us, from the repository and branch you expect, and has not changed since. +--- + +# Verifying artifacts + +{{% note-block class="lead" %}} +The artifacts we publish to Maven repositories carry signed build provenance. This page shows +how to check it for a file you downloaded. +{{% /note-block %}} + +## What is attested + +Every file of every Maven publication is attested: the JARs, the POM, the Gradle module +metadata, and the software bill of materials (SBOM, `*.spdx.json`) published next to each +module. + +The attestation is a build provenance record in the format of [SLSA][slsa-provenance] +(Supply-chain Levels for Software Artifacts) v1.0, signed with [Sigstore][sigstore] and stored +on GitHub. It names the repository, the branch, and the workflow that built the file, together +with the file's digest. + +The builds run on GitHub-hosted runners, in a reusable workflow kept in +the [`config`][config] repository. The repository that builds an artifact calls this workflow +but cannot change its steps. The job that signs the provenance runs none of that repository's +code. Together, these properties meet [SLSA v1.0 Build Level 3][slsa-levels]. + +## What a successful check means + +When the check passes, you know that: + +- the file was built by our workflow, in the repository you named, from the branch you named; +- the file has not been modified since it was built. + +A passing check does not mean that the artifact is free of vulnerabilities. To report +a vulnerability, please follow the [“Security policy”](docs/security/policy/). + +## Before you start + +1. Install the [GitHub CLI][gh] and sign in with `gh auth login`. The check fetches + the attestation through the GitHub API. +2. Get the file you want to check. Download it from the Maven repository that hosts it, or + take it from the Gradle cache, where Gradle keeps the files your build resolved: + + ```text + ~/.gradle/caches/modules-2/files-2.1///// + ``` + + A file from the cache is the exact file your build used. + +## Running the check + +```bash +gh attestation verify \ + -R SpineEventEngine/ \ + --signer-workflow SpineEventEngine/config/.github/workflows/publishing.yml \ + --source-ref refs/heads/ +``` + +Where: + +- `` is the path to the downloaded file. +- `` is the GitHub repository that built the artifact. The `` section of + the artifact's POM names it. +- `` is the branch the artifact was built from. + See [“Choosing the branch”](#choosing-the-branch). + +For example, to check `spine-base-2.0.0-SNAPSHOT.443.jar`, which is built in +the `base-libraries` repository: + +```bash +gh attestation verify spine-base-2.0.0-SNAPSHOT.443.jar \ + -R SpineEventEngine/base-libraries \ + --signer-workflow SpineEventEngine/config/.github/workflows/publishing.yml \ + --source-ref refs/heads/master +``` + +When the check passes, the command reports that the verification succeeded and exits with +status 0. Otherwise, it prints the reason and exits with a non-zero status. +See [“If the check fails”](#if-the-check-fails). + +## Why each flag is there + +- `-R` (`--repo`) names the repository the file was built from. An attestation made in any + other repository does not pass. +- `--signer-workflow` pins the workflow that signed the attestation: the reusable workflow in + `config`, which defines the steps of the build. +- `--source-ref` pins the branch. The workflow fixes the steps of the build, but not the code + they build: a caller workflow added to an unreviewed branch could run the same reusable + workflow over that branch's code and get an attestation signed the same way. Pinning + a branch whose changes go through review closes that gap. The value is compared exactly, + and each check accepts one ref. + +## Choosing the branch + +- `master` is the current line of development. Most artifacts are built from it. +- `v.x`, e.g. `v2.x`, is the release branch of an earlier version family, in + repositories that maintain one. Releases of that family published from the branch verify with + `refs/heads/v2.x`. Versions of the family built on `master` before the branch was cut still + verify with `refs/heads/master`. + +When unsure, check with `master` first. + +## If the check fails + +A check fails for one of these reasons: + +- **The branch does not match.** An artifact built from a release branch fails a check with + `master`, and the other way around. Check with the other branch. +- **The version has no attestation.** Versions published before their repository started + attesting its artifacts carry none. Their check fails whatever the flags, with + an `HTTP 404: Not Found` error: GitHub has no attestation for the file. +- **The version was attested by an earlier workflow.** Versions published before their + repository moved to the reusable workflow were attested by the repository's own workflow. + They pass with `-R` and `--source-ref`, and fail with `--signer-workflow`. That is the check + working as intended: the building repository could change the steps that built them. + +If none of these explains the failure (say, a recently published version fails with +`HTTP 404`), the file may have been modified since it was built. Please do not use it, and +report the failure as described in the [“Security policy”](docs/security/policy/), rather +than in a public issue. + +## Stricter pinning + +`--signer-workflow` accepts the reusable workflow at any commit of `config`. To pin the exact +commit that built the file, add `--signer-digest `. The commit is the one named in +the `uses:` line of the building repository's `.github/workflows/publish.yml` at the time +the version was published. + +[slsa-provenance]: https://slsa.dev/spec/v1.0/provenance +[slsa-levels]: https://slsa.dev/spec/v1.0/levels +[sigstore]: https://www.sigstore.dev/ +[gh]: https://cli.github.com/ +[config]: https://github.com/SpineEventEngine/config diff --git a/docs/data/docs/security/sidenav.yml b/docs/data/docs/security/sidenav.yml new file mode 100644 index 00000000..0c19efe9 --- /dev/null +++ b/docs/data/docs/security/sidenav.yml @@ -0,0 +1,16 @@ +# The Security section has a sidenav of its own, rather than an entry in +# `docs/data/docs/1/sidenav.yml`, so that it comes after the sidenavs of the documentation +# modules (such as Validation), which follow the main one. `moduleOrder` in `docs/hugo.toml` +# sets its place among them. +# +# The `file_path` is relative to `docs/content/docs/security`. + +- page: Security + key: security + children: + - page: Security policy + file_path: policy + - page: Verifying artifacts + file_path: verifying-artifacts + - page: CVD Policy + file_path: cvd-policy diff --git a/docs/hugo.toml b/docs/hugo.toml index 3539ed83..ce61b059 100644 --- a/docs/hugo.toml +++ b/docs/hugo.toml @@ -1,6 +1,7 @@ [params] - # Specifies the order of the sidenav modules. - moduleOrder = ["framework", "validation", "compiler"] + # Specifies the order of the sidenav modules. `security` is not a module, but its sidenav + # is ordered like a module's, so that it comes last. See `docs/data/docs/security/sidenav.yml`. + moduleOrder = ["framework", "validation", "compiler", "security"] [module] [[module.imports]] diff --git a/docs/layouts/_shortcodes/date.html b/docs/layouts/_shortcodes/date.html new file mode 100644 index 00000000..84284201 --- /dev/null +++ b/docs/layouts/_shortcodes/date.html @@ -0,0 +1,19 @@ +{{- /* +Renders the page `lastmod` date. + +Usage: +{{< date label="Last updated:" >}} + +The spine.io site has a shortcode of the same name and output, which takes +precedence there. This one lets the preview render the pages that use it. +*/ -}} + +{{- $label := .Get "label" -}} +{{- $formattedDate := .Page.Lastmod | time.Format ":date_long" -}} +{{- $isoDate := .Page.Lastmod | time.Format "2006-01-02" -}} +

+ {{- with $label -}} + {{ . }}  + {{- end -}} + +

diff --git a/docs/layouts/_shortcodes/remote-markdown.html b/docs/layouts/_shortcodes/remote-markdown.html new file mode 100644 index 00000000..b56ec063 --- /dev/null +++ b/docs/layouts/_shortcodes/remote-markdown.html @@ -0,0 +1,36 @@ +{{- /* +Renders a Markdown file fetched from a URL when the site is built. + +Usage: +{{% remote-markdown url="https://raw.githubusercontent.com////.md" %}} + +Call it with `%` delimiters, on a line of its own between blank lines. The fetched +text is then rendered as part of the page, and its headings appear in the page TOC. + +If the file cannot be fetched, the build fails, so the page is never published +without its content. Under `hugo server`, the failure is only a warning, and the +page shows a link to the file instead, so the site can still be authored offline. +*/ -}} + +{{- $url := .Get "url" -}} +{{- $markdown := "" -}} +{{- $failure := "" -}} +{{- with try (resources.GetRemote $url) -}} + {{- with .Err -}} + {{- $failure = . -}} + {{- else with .Value -}} + {{- $markdown = .Content -}} + {{- else -}} + {{- /* `GetRemote` returns nothing, not an error, for HTTP 404. */ -}} + {{- $failure = "not found" -}} + {{- end -}} +{{- end -}} + +{{- if not $failure -}} + {{- $markdown | safeHTML -}} +{{- else if hugo.IsServer -}} + {{- warnf "%s: cannot fetch %s: %s" .Position $url $failure -}} + {{- printf "This content could not be loaded; see [the source file](%s)." $url | safeHTML -}} +{{- else -}} + {{- errorf "%s: cannot fetch %s: %s" .Position $url $failure -}} +{{- end -}} diff --git a/settings.gradle.kts b/settings.gradle.kts index e84e6015..7b0cfaf5 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -1,27 +1,15 @@ /* - * Copyright 2025, TeamDev. All rights reserved. + * Copyright 2026 CodeMatters, Lda. * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file + * except in compliance with the License. You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * https://www.apache.org/licenses/LICENSE-2.0 * - * Redistribution and use in source and/or binary forms, with or without - * modification, must retain the above copyright notice and the following - * disclaimer. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * Unless required by applicable law or agreed to in writing, software distributed under + * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific language governing permissions + * and limitations under the License. */ rootProject.name = "spine-docs"