API ML v3

.pax/pre-packaging.sh

@@ -192,7 +192,8 @@ BASE_DIR=$(
 
 # use node v16 to build
 export NODE_HOME=/ZOWE/node/node-v16.20.1-os390-s390x
-
+export JAVA_HOME=/ZOWE/node/J17.0_64
+export PATH=$JAVA_HOME/bin:$PATH
 ZOWE_ROOT_DIR="${BASE_DIR}/content"
 
 cd "${BASE_DIR}"

bin/commands/init/certificate/index.sh

@@ -340,7 +340,7 @@ elif [[ "${cert_type}" == JCE*KS ]]; then
   # should we clean up before creating new
   if [ "${ZWE_CLI_PARAMETER_ALLOW_OVERWRITE}" = "true" ]; then
     # warning
-    print_message "Warning ZWEL0300W: Keyring \"safkeyring:///${keyring_owner}/${keyring_name}\" will be overwritten during configuration."
+    print_message "Warning ZWEL0300W: Keyring \"safkeyring://${keyring_owner}/${keyring_name}\" will be overwritten during configuration."
 
     zwecli_inline_execute_command \
       certificate keyring-jcl clean \
@@ -384,7 +384,7 @@ elif [[ "${cert_type}" == JCE*KS ]]; then
 
       yaml_keyring_label="${keyring_label}"
       # keyring string for self-signed CA
-      yaml_pem_cas="safkeyring:////${keyring_owner}/${keyring_name}&${keyring_caLabel}"
+      yaml_pem_cas="safkeyring://${keyring_owner}/${keyring_name}&${keyring_caLabel}"
       ;;
     2)
       # connect existing certs to zowe keyring
@@ -433,9 +433,9 @@ elif [[ "${cert_type}" == JCE*KS ]]; then
       item=$(echo "${item}" | trim)
       if [ -n "${item}" ]; then
         if [ -n "${yaml_pem_cas}" ]; then
-          yaml_pem_cas="${yaml_pem_cas},safkeyring:////${keyring_owner}/${keyring_name}&${item}"
+          yaml_pem_cas="${yaml_pem_cas},safkeyring://${keyring_owner}/${keyring_name}&${item}"
         else
-          yaml_pem_cas="safkeyring:////${keyring_owner}/${keyring_name}&${item}"
+          yaml_pem_cas="safkeyring://${keyring_owner}/${keyring_name}&${item}"
         fi
       fi
     done <<EOF
@@ -447,12 +447,12 @@ EOF
   if [ "${ZWE_CLI_PARAMETER_UPDATE_CONFIG}" = "true" ]; then
     print_level1_message "Update certificate configuration to ${ZWE_CLI_PARAMETER_CONFIG}"
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.type" "${cert_type:-JCERACFKS}"
-    update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.file" "safkeyring:////${keyring_owner}/${keyring_name}"
+    update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.file" "safkeyring://${keyring_owner}/${keyring_name}"
     # we must set a dummy value here, other JDK will complain wrong parameter
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.password" "password"
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.alias" "${yaml_keyring_label}"
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.truststore.type" "${cert_type:-JCERACFKS}"
-    update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.truststore.file" "safkeyring:////${keyring_owner}/${keyring_name}"
+    update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.truststore.file" "safkeyring://${keyring_owner}/${keyring_name}"
     # we must set a dummy value here, other JDK will complain wrong parameter
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.truststore.password" "password"
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.pem.key" ""
@@ -467,12 +467,12 @@ EOF
     print_message "  certificate:"
     print_message "    keystore:"
     print_message "      type: ${cert_type:-JCERACFKS}"
-    print_message "      file: \"safkeyring:////${keyring_owner}/${keyring_name}\""
+    print_message "      file: \"safkeyring://${keyring_owner}/${keyring_name}\""
     print_message "      password: \"password\""
     print_message "      alias: \"${yaml_keyring_label}\""
     print_message "    truststore:"
     print_message "      type: ${cert_type:-JCERACFKS}"
-    print_message "      file: \"safkeyring:////${keyring_owner}/${keyring_name}\""
+    print_message "      file: \"safkeyring://${keyring_owner}/${keyring_name}\""
     print_message "      password: \"password\""
     print_message "    pem:"
     print_message "      key: \"\""

bin/libs/certificate.sh

@@ -28,6 +28,8 @@ ZWE_PRIVATE_DEFAULT_CERTIFICATE_VALIDITY="3650"
 ZWE_PRIVATE_DEFAULT_CERTIFICATE_KEY_USAGE="keyEncipherment,digitalSignature,nonRepudiation,dataEncipherment"
 ZWE_PRIVATE_DEFAULT_CERTIFICATE_EXTENDED_KEY_USAGE="clientAuth,serverAuth"
 
+JAVA_KEYTOOL_FLAG=" -J-Dkeystore.pkcs12.legacy "
+
 #######################################################################
 # Notes: some keyring related functions, like ncert, are using R_datalib behind the scene. It requires proper
 #        permission setup on the server.
@@ -199,8 +201,6 @@ pkcs12_create_certificate_authority() {
   password="${3}"
   common_name=${4:-${ZWE_PRIVATE_DEFAULT_CERTIFICATE_CA_COMMON_NAME}}
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
   print_message ">>>> Generate PKCS12 format local CA with alias ${alias}:"
   mkdir -p "${keystore_dir}/${alias}"
   result=$(pkeytool -genkeypair -v \
@@ -212,7 +212,7 @@ pkcs12_create_certificate_authority() {
             -storepass "${password}" \
             -storetype "PKCS12" \
             -validity "${ZWE_PRIVATE_CERTIFICATE_CA_VALIDITY:-${ZWE_PRIVATE_DEFAULT_CERTIFICATE_CA_VALIDITY}}" \
-            ${flags} \
+            ${JAVA_KEYTOOL_FLAG} \
             -ext KeyUsage="keyCertSign" \
             -ext BasicConstraints:"critical=ca:true")
   if [ $? -ne 0 ]; then
@@ -237,11 +237,9 @@ pkcs12_create_certificate_and_sign() {
 
   print_message ">>>> Generate certificate \"${alias}\" in the keystore ${keystore_name}:"
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
   mkdir -p "${keystore_dir}/${keystore_name}"
   result=$(pkeytool -genkeypair -v \
-            ${flags} \
+            ${JAVA_KEYTOOL_FLAG} \
             -alias "${alias}" \
             -keyalg RSA -keysize 2048 \
             -keystore "${keystore_dir}/${keystore_name}/${keystore_name}.keystore.p12" \
@@ -259,7 +257,7 @@ pkcs12_create_certificate_and_sign() {
   fi
 
   print_message ">>>> Generate CSR for the certificate \"${alias}\" in the keystore \"${keystore_name}\":"
-  result=$(pkeytool ${flags} \
+  result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -certreq -v \
             -alias "${alias}" \
             -keystore "${keystore_dir}/${keystore_name}/${keystore_name}.keystore.p12" \
@@ -288,7 +286,7 @@ pkcs12_create_certificate_and_sign() {
   san="${san}dns:localhost.localdomain,dns:localhost,ip:127.0.0.1"
 
   print_message ">>>> Sign the CSR using the Certificate Authority \"${ca_alias}\":"
-  result=$(pkeytool ${flags} \
+  result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -gencert -v \
             -infile "${keystore_dir}/${keystore_name}/${alias}.csr" \
             -outfile "${keystore_dir}/${keystore_name}/${alias}.signed.cer" \
@@ -325,7 +323,7 @@ pkcs12_create_certificate_and_sign() {
     >/dev/null 2>/dev/null
   if [ "$?" != "0" ]; then
     print_message ">>>> Import the Certificate Authority \"${ca_alias}\" to the keystore \"${keystore_name}\":"
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
               -importcert -v \
               -trustcacerts -noprompt \
               -file "${ca_cert_file}" \
@@ -344,7 +342,7 @@ pkcs12_create_certificate_and_sign() {
     >/dev/null 2>/dev/null
   if [ "$?" != "0" ]; then
     print_message ">>>> Import the Certificate Authority \"${ca_alias}\" to the truststore \"${keystore_name}\":"
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
               -importcert -v \
               -trustcacerts -noprompt \
               -file "${ca_cert_file}" \
@@ -360,7 +358,7 @@ pkcs12_create_certificate_and_sign() {
   fi
 
   print_message ">>>> Import the signed CSR to the keystore \"${keystore_name}\":"
-  result=$(pkeytool ${flags} \
+  result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -importcert -v \
             -trustcacerts -noprompt \
             -file "${keystore_dir}/${keystore_name}/${alias}.signed.cer" \
@@ -477,9 +475,7 @@ pkcs12_import_pkcs12_keystore() {
     return 1
   fi
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
-  result=$(pkeytool ${flags} \
+  result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -importkeystore -v \
             -noprompt \
             -deststoretype "PKCS12" \
@@ -508,14 +504,12 @@ pkcs12_import_certificates() {
   ca_files="${3}"
   alias="${4:-extca}"
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
   ca_index=1
   while read -r ca_file; do
     ca_file=$(echo "${ca_file}" | trim)
     if [ -n "${ca_file}" ]; then
       print_message ">>>> Import \"${ca_file}\" to the keystore \"${dest_keystore}\":"
-      result=$(pkeytool ${flags} \
+      result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
                 -importcert -v \
                 -trustcacerts -noprompt \
                 -file "${ca_file}" \
@@ -568,8 +562,6 @@ pkcs12_trust_service() {
     return 1
   fi
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
   # parse keytool output into separate files
   csplit -s -k -f "${keystore_dir}/${keystore_name}/${service_alias}" "${tmp_file}" /-----END\ CERTIFICATE-----/1 \
     {$(expr `grep -c -e '-----END CERTIFICATE-----' "${tmp_file}"` - 1)}
@@ -578,7 +570,7 @@ pkcs12_trust_service() {
     cert_file=$(basename "${cert}")
     cert_alias=${cert_file%.cer}
     echo ">>>> Import a certificate \"${cert_alias}\" to the truststore:"
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
               -importcert -v \
               -trustcacerts \
               -noprompt \
@@ -633,11 +625,6 @@ pkcs12_export_pem() {
       if [ $? -ne 0 ]; then
         return 1
       fi
-      if [ `uname` = "OS/390" ]; then
-        iconv -f ISO8859-1 -t IBM-1047 "${keystore_dir}/${alias_lc}.cer" > "${keystore_dir}/${alias_lc}.cer-ebcdic"
-        mv "${keystore_dir}/${alias_lc}.cer-ebcdic" "${keystore_dir}/${alias_lc}.cer"
-        ensure_file_encoding "${keystore_dir}/${alias_lc}.cer" "CERTIFICATE"
-      fi
     fi
   done <<EOF
 $(echo "${aliases}")
@@ -1195,12 +1182,11 @@ keyring_export_to_pkcs12() {
 
   print_debug ">>>> Export certificate \"${label}\" from safkeyring:////${keyring_owner}/${keyring_name} to PKCS#12 keystore ${keystore_file}"
 
- flags=$(get_java_pkcs12_keystore_flag)
 
   # create keystore if it doesn't exist
   if [ -f "${keystore_file}" ]; then
     print_debug "- Create keystore with dummy certificate ${dummy_cert}"
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -genkeypair \
             -alias "${dummy_cert}" \
             -dname "CN=Zowe Dummy Cert, OU=ZWELS, O=Zowe, C=US" \
@@ -1237,7 +1223,7 @@ keyring_export_to_pkcs12() {
   if [ "${cert_only}" = "true" ]; then
     # use keytool to import certificate
     print_debug "- Import certificate into keystore as \"${label}\""
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -import -v \
             -trustcacerts -noprompt \
             -alias "${label}" \

bin/libs/java.sh

@@ -57,12 +57,12 @@ detect_java_home() {
           break
         fi
       done
-    ) 
+    )
   fi
 
   # fall back to the most well-known java path
-  if [ -z "${java_home}" -a -f /usr/lpp/java/J8.0_64/bin/java ]; then
-    java_home=/usr/lpp/java/J8.0_64
+  if [ -z "${java_home}" -a -f /usr/lpp/java/J17.0_64/bin/java ]; then
+    java_home=/usr/lpp/java/J17.0_64
   fi
 
   if [ -n "${java_home}" ]; then
@@ -132,32 +132,3 @@ validate_java_home() {
 
   print_debug "Java check is successful."
 }
-
-get_java_pkcs12_keystore_flag() {
-  java_version=$("${JAVA_HOME}/bin/java" -version 2>&1) # Capture stderr to stdout, so we can print below if error
-
-
-  # As we know the java -version command works then strip out the line we need
-  java_version_short=$(echo "${java_version}" | grep ^"java version" | sed -e "s/java version //g"| sed -e "s/\"//g")
-  if [[ $java_version_short == "" ]]; then
-    java_version_short=$(echo "${java_version}" | grep ^"openjdk version" | sed -e "s/openjdk version //g"| sed -e "s/\"//g")
-  fi
-  java_major_version=$(echo "${java_version_short}" | cut -d '.' -f 1)
-  java_minor_version=$(echo "${java_version_short}" | cut -d '.' -f 2)
-  java_fix_version=$(echo "${java_version_short}" | cut -d '_' -f 2)
-
-  if [ ${java_major_version} -eq 1 -a ${java_minor_version} -eq 8 ]; then
-    if [ ${java_fix_version} -lt 341 ]; then
-      printf " "
-    elif [ ${java_fix_version} -lt 361 ]; then
-      printf " -J-Dkeystore.pkcs12.certProtectionAlgorithm=PBEWithSHAAnd40BitRC2 -J-Dkeystore.pkcs12.certPbeIterationCount=50000 -J-Dkeystore.pkcs12.keyProtectionAlgorithm=PBEWithSHAAnd3KeyTripleDES -J-Dkeystore.pkcs12.keyPbeIterationCount=50000 "
-    else
-      printf " -J-Dkeystore.pkcs12.legacy "
-    fi
-  elif [ ${java_major_version} -eq 1 -a ${java_minor_version} -gt 8 ]; then
-    printf " -J-Dkeystore.pkcs12.legacy "
-  else
-    printf " "  
-  fi
-}
-

bin/libs/java.ts

@@ -16,7 +16,7 @@ import * as common from './common';
 import * as shell from './shell';
 import * as config from './config';
 
-const JAVA_MIN_VERSION=8;
+const JAVA_MIN_VERSION=17;
 
 export function ensureJavaIsOnPath(): void {
   let path=std.getenv('PATH') || '/bin:.:/usr/bin';
@@ -48,8 +48,8 @@ export function detectJavaHome(): string|undefined {
     }
   }
 
-  if (!javaBinHome && fs.fileExists('/usr/lpp/java/J8.0_64/bin/java')) {
-    return '/usr/lpp/java/J8.0_64';
+  if (!javaBinHome && fs.fileExists('/usr/lpp/java/J17.0_64/bin/java')) {
+    return '/usr/lpp/java/J17.0_64';
   }
   return undefined;
 }

bin/utils/ExportPrivateKeyZos.java

@@ -14,7 +14,7 @@
 import java.security.Key;
 import java.security.KeyStore;
 import java.util.Base64;
-import com.ibm.crypto.provider.RACFInputStream;
+import com.ibm.crypto.zsecurity.provider.RACFInputStream;
 
 public class ExportPrivateKeyZos {
     private String keystoreName;

manifest.json.template

@@ -57,27 +57,27 @@
       "artifact": "*.pax"
     },
     "org.zowe.apiml.api-catalog-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "api-catalog-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.discovery-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "discovery-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.gateway-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "gateway-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.caching-service-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "caching-service-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.apiml-common-lib-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "apiml-common-lib-*.zip",
       "exclusions": ["*PR*.zip"]
     },
@@ -87,12 +87,12 @@
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.sdk.apiml-sample-extension-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "apiml-sample-extension-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.cloud-gateway-package": {
-      "version": "^2.4.4-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "cloud-gateway-*.zip",
       "exclusions": ["*PR*.zip"]
     },
@@ -365,23 +365,23 @@
     "api-catalog": {
       "registry": "zowe-docker-snapshot.jfrog.io",
       "name": "ompzowe/api-catalog-services",
-      "tag" : "2.1.1-SNAPSHOT-ubuntu.v2-x-x"
+      "tag" : "3.0.0-SNAPSHOT-ubuntu.v2-x-x"
     },
     "caching": {
       "registry": "zowe-docker-snapshot.jfrog.io",
       "name": "ompzowe/caching-service",
-      "tag" : "2.1.1-SNAPSHOT-ubuntu.v2-x-x"
+      "tag" : "3.0.0-SNAPSHOT-ubuntu.v2-x-x"
     },
     "discovery": {
       "kind": "statefulset",
       "registry": "zowe-docker-snapshot.jfrog.io",
       "name": "ompzowe/discovery-service",
-      "tag" : "2.1.1-SNAPSHOT-ubuntu.v2-x-x"
+      "tag" : "3.0.0-SNAPSHOT-ubuntu.v2-x-x"
     },
     "gateway": {
         "registry": "zowe-docker-snapshot.jfrog.io",
         "name": "ompzowe/gateway-service",
-        "tag" : "2.1.1-SNAPSHOT-ubuntu.v2-x-x"
+        "tag" : "3.0.0-SNAPSHOT-ubuntu.v2-x-x"
     },
     "app-server": {
       "registry": "zowe-docker-snapshot.jfrog.io",