# The contents of this file are subject to the terms of the Common Development and
|
# Distribution License (the License). You may not use this file except in compliance with the
|
# License.
|
#
|
# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
# specific language governing permission and limitations under the License.
|
#
|
# When distributing Covered Software, include this CDDL Header Notice in each file and include
|
# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
# Header, with the fields enclosed by brackets [] replaced by your own identifying
|
# information: "Portions copyright [year] [name of copyright owner]".
|
#
|
# Copyright 2021-2026 3A Systems, LLC.
|
|
name: Build
|
|
on:
|
push:
|
branches: [ 'sustaining/4.10.x','master', 'issues/**', 'features/**' ]
|
pull_request:
|
|
concurrency:
|
group: ${{ github.workflow }}-${{ github.ref }}
|
cancel-in-progress: true
|
|
# Nothing in this workflow writes back to the repository: the docker jobs push to
|
# the local registry service, not to a remote one, and the other jobs only
|
# publish artifacts through the actions API. The docker jobs additionally get
|
# security-events: write to upload Trivy scan results to code scanning.
|
permissions:
|
contents: read
|
|
jobs:
|
build-maven:
|
runs-on: ${{ matrix.os }}
|
strategy:
|
# The full Java sweep runs on ubuntu only; macOS and Windows build with the
|
# minimum supported (11) and the latest (26) Java.
|
matrix:
|
os: [ 'ubuntu-latest' ]
|
java: [ '11','17','21','25','26']
|
include:
|
- { os: 'macos-latest', java: '11' }
|
- { os: 'macos-latest', java: '26' }
|
- { os: 'windows-latest', java: '11' }
|
- { os: 'windows-latest', java: '26' }
|
fail-fast: false
|
steps:
|
- name: Install rpm for distribution
|
if: runner.os == 'Linux'
|
shell: bash
|
run: |
|
sudo apt-get update
|
sudo apt-get install -y rpm
|
- uses: actions/checkout@v6
|
with:
|
fetch-depth: 0
|
submodules: recursive
|
- name: Java ${{ matrix.Java }} (${{ matrix.os }})
|
uses: actions/setup-java@v5
|
with:
|
java-version: ${{ matrix.java }}
|
distribution: 'zulu'
|
- name: Cache Maven packages
|
uses: actions/cache@v5
|
with:
|
path: ~/.m2/repository
|
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
|
restore-keys: ${{ runner.os }}-m2-repository
|
- name: Setup MSVC Developer Command Prompt (x86)
|
if: runner.os == 'Windows'
|
uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
|
env:
|
# Opt in to Node.js 24 for this action, which still ships on Node.js 20.
|
# See https://github.com/ilammy/msvc-dev-cmd/issues/99
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
|
with:
|
arch: x86
|
- name: Build Windows native executables
|
if: runner.os == 'Windows'
|
shell: cmd
|
run: |
|
cd opendj-server-legacy\src\build-tools\windows
|
nmake all || exit /b 1
|
xcopy /Y *.exe ..\..\..\lib\ || exit /b 1
|
git status
|
# Also the source of truth for the committed opendj-server-legacy/lib/*.exe: on a
|
# successful push build, deploy.yml downloads windows-exe-11 from this very run and
|
# commits its contents back to the branch. Nothing here compares them with what is
|
# committed - an MSVC toolchain bump on the runner image changes the bytes on its own,
|
# so a byte-for-byte gate would fire without a source change.
|
- name: Upload Windows exe artifacts
|
if: runner.os == 'Windows'
|
uses: actions/upload-artifact@v7
|
with:
|
name: windows-exe-${{ matrix.java }}
|
retention-days: 5
|
path: opendj-server-legacy/src/build-tools/windows/*.exe
|
- name: Set Integration Test Environment
|
id: failsafe
|
if: runner.os == 'Linux'
|
run: |
|
echo "MAVEN_PROFILE_FLAG=-P precommit" >> $GITHUB_OUTPUT
|
|
- name: Setup WiX (.NET tool) for MSI
|
# Only the java 11 job's MSI is consumed downstream (test-msi*, deploy.yml); without
|
# wix installed the distribution-windows-msi profile stays inactive, so the other
|
# Windows jobs skip the MSI build entirely instead of producing an artifact nothing
|
# uses.
|
if: runner.os == 'Windows' && matrix.java == '11'
|
shell: bash
|
run: |
|
# The MSI builds on Windows only (WiX cannot author MSIs on Linux/macOS). WiX 5 ships as a
|
# net6.0 tool; allow it to run on the newer .NET runtime present on the runner.
|
echo "DOTNET_ROLL_FORWARD=Major" >> "$GITHUB_ENV"
|
export DOTNET_ROLL_FORWARD=Major
|
dotnet tool install --global wix --version 5.0.2 || dotnet tool update --global wix --version 5.0.2
|
echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
|
export PATH="$HOME/.dotnet/tools:$PATH"
|
wix --version
|
wix extension add -g WixToolset.UI.wixext/5.0.2 || true
|
|
# The per-module javadoc:jar that runs during verify only ever sees one
|
# module's sources, so it cannot report a package declared by two modules
|
# at once. Only the aggregate on the root reactor can, and it used to run
|
# nowhere but deploy.yml, after the merge and under continue-on-error, so a
|
# broken aggregate blocked nothing and went unnoticed. This is the gate for
|
# it. Appending the goal to the same Maven invocation keeps it in the
|
# reactor that just built; one cell is enough, and this is the platform and
|
# Java version deploy.yml aggregates with.
|
- name: Set Aggregate Javadoc Goal
|
id: javadoc
|
if: runner.os == 'Linux' && matrix.java == '11'
|
run: |
|
echo "MAVEN_JAVADOC_GOAL=javadoc:aggregate" >> $GITHUB_OUTPUT
|
|
- name: Build with Maven
|
timeout-minutes: 180
|
env:
|
MAVEN_OPTS: -Dhttps.protocols=TLSv1.2 -Dmaven.wagon.httpconnectionManager.ttlSeconds=120 -Dmaven.wagon.http.retryHandler.requestSentEnabled=true -Dmaven.wagon.http.retryHandler.count=10
|
run: mvn --batch-mode --errors --update-snapshots verify ${{ steps.javadoc.outputs.MAVEN_JAVADOC_GOAL }} --file pom.xml ${{ steps.failsafe.outputs.MAVEN_PROFILE_FLAG }}
|
- name: Validate the MSI (ICE)
|
# wix build runs no ICE validation (only MSBuild projects or an explicit validate
|
# do), so a green build alone proves the authoring compiles, not that it validates -
|
# e.g. the ICE63 rule about script-generating actions sequenced before
|
# RemoveExistingProducts would go unnoticed without this step.
|
if: runner.os == 'Windows' && matrix.java == '11'
|
shell: bash
|
run: |
|
msi=$(ls opendj-packages/opendj-msi/opendj-msi-standard/target/*.msi)
|
# ICE61 fires by design: AllowSameVersionUpgrades authors an UpgradeVersion row
|
# whose range includes the product's own version, which is exactly what makes a
|
# rebuilt hotfix at the same 3-part version upgrade rather than install alongside.
|
# Left unsuppressed it is permanent noise this step could not tell from a real
|
# regression.
|
wix msi validate -sice ICE61 "$msi"
|
- name: Test on Unix
|
if: runner.os == 'Linux'
|
run: |
|
export OPENDJ_JAVA_ARGS="-server -Xmx512m"
|
opendj-server-legacy/target/package/opendj/setup -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS --generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com --sampleData 5000 --cli --acceptLicense --no-prompt
|
opendj-server-legacy/target/package/opendj/bin/status --hostname localhost --bindDN "cn=Directory Manager" --bindPassword password --trustAll
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 5000
|
# --- Load-testing tools smoke tests (server online, 5000 sample users) ---
|
echo "===== searchrate ====="
|
opendj-server-legacy/target/package/opendj/bin/searchrate --hostname localhost --port 1636 --useSSL --trustAll --bindDN "cn=Directory Manager" --bindPassword password --baseDN "ou=people,dc=example,dc=com" --searchScope sub -c 4 -t 1 -m 2000 -i 1 -g "rand(0,4999)" "(uid=user.%d)" 1.1
|
echo "===== authrate ====="
|
opendj-server-legacy/target/package/opendj/bin/authrate --hostname localhost --port 1636 --useSSL --trustAll -D "uid=user.%d,ou=people,dc=example,dc=com" -w password -c 4 -m 2000 -i 1 -g "rand(0,4999)"
|
echo "===== modrate ====="
|
opendj-server-legacy/target/package/opendj/bin/modrate --hostname localhost --port 1636 --useSSL --trustAll --bindDN "cn=Directory Manager" --bindPassword password -b "uid=user.%d,ou=people,dc=example,dc=com" -c 4 -t 1 -m 2000 -i 1 -g "rand(0,4999)" "description:modrate-load-test"
|
echo "===== addrate ====="
|
cat > /tmp/addrate.template <<'EOF'
|
define suffix=dc=example,dc=com
|
|
branch: ou=People,[suffix]
|
subordinateTemplate: person
|
|
template: person
|
rdnAttr: uid
|
objectClass: top
|
objectClass: person
|
objectClass: organizationalPerson
|
objectClass: inetOrgPerson
|
uid: addrate.<sequential:0>
|
cn: AddRate {uid}
|
sn: AddRate
|
userPassword: password
|
EOF
|
opendj-server-legacy/target/package/opendj/bin/addrate --hostname localhost --port 1636 --useSSL --trustAll --bindDN "cn=Directory Manager" --bindPassword password -c 4 -t 1 -m 2000 -i 1 -C fifo -s 100 /tmp/addrate.template
|
opendj-server-legacy/target/package/opendj/bin/dsconfig create-backend --hostname localhost --port 4444 --bindDN "cn=Directory Manager" --bindPassword password --backend-name=example2 --type je --set=base-dn:dc=example2,dc=com --set=enabled:true --no-prompt --trustAll
|
opendj-server-legacy/target/package/opendj/bin/makeldif -o /tmp/test.ldif -c suffix=dc=example2,dc=com opendj-server-legacy/target/package/opendj/config/MakeLDIF/example.template
|
opendj-server-legacy/target/package/opendj/bin/stop-ds
|
echo "4.9.9.0" > opendj-server-legacy/target/package/opendj/config/buildinfo
|
opendj-server-legacy/target/package/opendj/upgrade -n
|
opendj-server-legacy/target/package/opendj/bin/import-ldif --offline --ldifFile /tmp/test.ldif --backendID=example2
|
opendj-server-legacy/target/package/opendj/bin/rebuild-index --offline --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll
|
opendj-server-legacy/target/package/opendj/bin/start-ds
|
opendj-server-legacy/target/package/opendj/bin/rebuild-index --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll --trustAll
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example2,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 10000
|
opendj-server-legacy/target/package/opendj/bin/stop-ds
|
rm -rf opendj-server-legacy/target/package/opendj/{config,db,changelogDb,logs,tmp}
|
|
- name: Test on Unix FIPS
|
if: runner.os == 'Linux'
|
run: |
|
export OPENDJ_JAVA_ARGS="-server -Xmx512m"
|
echo password > /tmp/opendj.keystore.pin
|
|
keytool -genkey -alias server-cert -keyalg rsa \
|
-dname "CN=example.com,O=OpenDJ RSA Self-Signed Certificate" \
|
-keystore /tmp/opendj.bcfks -storetype BCFKS -validity 3650 -providername BCFIPS \
|
-provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \
|
-providerpath ./opendj-server-legacy/target/package/opendj/lib/org.bouncycastle.bc-fips.jar:./opendj-server-legacy/target/package/opendj/lib/org.bouncycastle.bcpkix-fips.jar \
|
-keypass:file /tmp/opendj.keystore.pin -storepass:file /tmp/opendj.keystore.pin -keysize 2048 -sigalg SHA256WITHRSA
|
|
keytool -selfcert -alias server-cert -keystore /tmp/opendj.bcfks \
|
-storetype BCFKS -validity 3650 -providername BCFIPS \
|
-provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \
|
-providerpath ./opendj-server-legacy/target/package/opendj/lib/org.bouncycastle.bc-fips.jar:./opendj-server-legacy/target/package/opendj/lib/org.bouncycastle.bcpkix-fips.jar \
|
-storepass:file /tmp/opendj.keystore.pin
|
|
keytool -genkey -alias admin-cert -keyalg rsa \
|
-dname "CN=example.com,O=Administration Connector RSA Self-Signed Certificate" \
|
-keystore /tmp/opendj.bcfks -storetype BCFKS -validity 3650 -providername BCFIPS \
|
-provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \
|
-providerpath ./opendj-server-legacy/target/package/opendj/lib/org.bouncycastle.bc-fips.jar:./opendj-server-legacy/target/package/opendj/lib/org.bouncycastle.bcpkix-fips.jar \
|
-keypass:file /tmp/opendj.keystore.pin -storepass:file /tmp/opendj.keystore.pin -keysize 2048 -sigalg SHA256WITHRSA
|
|
keytool -selfcert -alias admin-cert -keystore /tmp/opendj.bcfks \
|
-storetype BCFKS -validity 3650 -providername BCFIPS \
|
-provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \
|
-providerpath ./opendj-server-legacy/target/package/opendj/lib/org.bouncycastle.bc-fips.jar:./opendj-server-legacy/target/package/opendj/lib/org.bouncycastle.bcpkix-fips.jar \
|
-storepass:file /tmp/opendj.keystore.pin
|
|
echo "useBcfksKeystore=/tmp/opendj.bcfks
|
keyStorePasswordFile=/tmp/opendj.keystore.pin" > /tmp/opendj-setup.properties.bcfks
|
|
opendj-server-legacy/target/package/opendj/setup -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 \
|
--enableStartTLS --certNickname admin-cert --rootUserDN "cn=Directory Manager" --rootUserPassword password \
|
--baseDN dc=example,dc=com --sampleData 5000 --cli --acceptLicense --no-prompt \
|
--propertiesFilePath /tmp/opendj-setup.properties.bcfks --doNotStart
|
|
opendj-server-legacy/target/package/opendj/bin/start-ds
|
|
opendj-server-legacy/target/package/opendj/bin/status --hostname localhost --bindDN "cn=Directory Manager" --bindPassword password --trustAll
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 5000
|
opendj-server-legacy/target/package/opendj/bin/dsconfig create-backend --hostname localhost --port 4444 --bindDN "cn=Directory Manager" --bindPassword password --backend-name=example2 --type je --set=base-dn:dc=example2,dc=com --set=enabled:true --no-prompt --trustAll
|
opendj-server-legacy/target/package/opendj/bin/makeldif -o /tmp/test.ldif -c suffix=dc=example2,dc=com opendj-server-legacy/target/package/opendj/config/MakeLDIF/example.template
|
opendj-server-legacy/target/package/opendj/bin/stop-ds
|
echo "4.9.9.0" > opendj-server-legacy/target/package/opendj/config/buildinfo
|
opendj-server-legacy/target/package/opendj/upgrade -n
|
opendj-server-legacy/target/package/opendj/bin/import-ldif --offline --ldifFile /tmp/test.ldif --backendID=example2
|
opendj-server-legacy/target/package/opendj/bin/rebuild-index --offline --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll
|
opendj-server-legacy/target/package/opendj/bin/start-ds
|
opendj-server-legacy/target/package/opendj/bin/rebuild-index --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll --trustAll
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example2,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 10000
|
opendj-server-legacy/target/package/opendj/bin/stop-ds
|
rm -rf opendj-server-legacy/target/package/opendj/{config,db,changelogDb,logs,tmp}
|
- name: Test LDAP in Cassandra
|
if: runner.os == 'Linux'
|
run: |
|
docker run --rm -it -d -p 9042:9042 --name cassandra cassandra
|
timeout 5m bash -c 'until docker logs cassandra | grep -q "Created default superuser role"; do sleep 5; done'
|
export OPENDJ_JAVA_ARGS="-server -Xmx512m -Ddatastax-java-driver.basic.contact-points.0=localhost:9042 -Ddatastax-java-driver.basic.load-balancing-policy.local-datacenter=datacenter1"
|
opendj-server-legacy/target/package/opendj/setup -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS --generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --cli --acceptLicense --no-prompt
|
opendj-server-legacy/target/package/opendj/bin/dsconfig create-backend -h localhost -p 4444 --bindDN "cn=Directory Manager" --bindPassword password --backend-name=userRoot --type cas --set base-dn:dc=example,dc=com --set db-directory:keyspace_name --set enabled:true --no-prompt --trustAll
|
opendj-server-legacy/target/package/opendj/bin/makeldif -o /tmp/test.ldif -c suffix=dc=example,dc=com opendj-server-legacy/target/package/opendj/config/MakeLDIF/example.template
|
opendj-server-legacy/target/package/opendj/bin/import-ldif --ldifFile /tmp/test.ldif --backendID=userRoot -h localhost -p 4444 --bindDN "cn=Directory Manager" --bindPassword password --trustAll
|
opendj-server-legacy/target/package/opendj/bin/status --hostname localhost --bindDN "cn=Directory Manager" --bindPassword password --trustAll
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 10000
|
opendj-server-legacy/target/package/opendj/bin/stop-ds
|
rm -rf opendj-server-legacy/target/package/opendj/{config,db,changelogDb,logs,tmp}
|
- name: Test LDAP in Postgres
|
if: runner.os == 'Linux'
|
run: |
|
docker run --rm -it -d -p 5432:5432 -e POSTGRES_DB=database_name -e POSTGRES_PASSWORD=password --name postgres postgres
|
timeout 5m bash -c 'until docker logs postgres | grep -q "database system is ready to accept connections"; do sleep 5; done'
|
export OPENDJ_JAVA_ARGS="-server -Xmx512m"
|
opendj-server-legacy/target/package/opendj/setup -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS --generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --cli --acceptLicense --no-prompt
|
opendj-server-legacy/target/package/opendj/bin/dsconfig create-backend -h localhost -p 4444 --bindDN "cn=Directory Manager" --bindPassword password --backend-name=userRoot --type jdbc --set base-dn:dc=example,dc=com --set db-directory:jdbc:postgresql://localhost:5432/database_name?user=postgres\&password=password --set enabled:true --no-prompt --trustAll
|
opendj-server-legacy/target/package/opendj/bin/makeldif -o /tmp/test.ldif -c suffix=dc=example,dc=com opendj-server-legacy/target/package/opendj/config/MakeLDIF/example.template
|
opendj-server-legacy/target/package/opendj/bin/ldapmodify --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll -f /tmp/test.ldif -a 1> /dev/null
|
opendj-server-legacy/target/package/opendj/bin/status --hostname localhost --bindDN "cn=Directory Manager" --bindPassword password --trustAll
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
opendj-server-legacy/target/package/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 10000
|
opendj-server-legacy/target/package/opendj/bin/stop-ds
|
rm -rf opendj-server-legacy/target/package/opendj/{config,db,changelogDb,logs,tmp}
|
- name: Test replication
|
if: runner.os == 'Linux'
|
# dsreplication enable can hang indefinitely; without a timeout a hang
|
# holds the runner until the 6-hour job limit. Normal duration is ~4 min.
|
timeout-minutes: 30
|
run: |
|
cp -r ./opendj-server-legacy/target/package/opendj ./opendj-server-legacy/target/package/opendj1
|
cp -r ./opendj-server-legacy/target/package/opendj ./opendj-server-legacy/target/package/opendj2
|
cp -r ./opendj-server-legacy/target/package/opendj ./opendj-server-legacy/target/package/opendj3
|
|
echo "Setup OpenDJ-1"
|
|
opendj-server-legacy/target/package/opendj1/setup -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS \
|
--generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com \
|
--sampleData 100000 --cli --acceptLicense --no-prompt
|
|
echo "Setup OpenDJ-2 with replication"
|
|
opendj-server-legacy/target/package/opendj2/setup -h localhost -p 2389 --ldapsPort 2636 --adminConnectorPort 24444 --enableStartTLS \
|
--generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com \
|
--addBaseEntry --cli --acceptLicense --no-prompt
|
|
opendj-server-legacy/target/package/opendj2/bin/dsreplication enable --no-prompt --host1 localhost --port1 4444 --bindDN1 "cn=Directory Manager" --bindPassword1 password --replicationPort1 8989 \
|
--host2 localhost --port2 24444 --bindDN2 "cn=Directory Manager" --bindPassword2 password --replicationPort2 28989 \
|
--adminUID admin --adminPassword password --baseDN dc=example,dc=com --trustAll --noPropertiesFile
|
|
opendj-server-legacy/target/package/opendj2/bin/dsreplication initialize --baseDN dc=example,dc=com --adminUID admin --adminPassword password --hostSource localhost \
|
--portSource 4444 --hostDestination localhost --portDestination 24444 -X -n
|
|
opendj-server-legacy/target/package/opendj2/bin/ldapsearch --port 2636 --hostname localhost --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll \
|
--baseDN "ou=people,dc=example,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 100000
|
|
echo "Setup OpenDJ-3 with replication"
|
|
opendj-server-legacy/target/package/opendj3/setup -h localhost -p 3389 --ldapsPort 3636 --adminConnectorPort 34444 --enableStartTLS \
|
--generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com \
|
--addBaseEntry --cli --acceptLicense --no-prompt
|
|
opendj-server-legacy/target/package/opendj3/bin/dsreplication enable --no-prompt --host1 localhost --port1 24444 --bindDN1 "cn=Directory Manager" --bindPassword1 password --replicationPort1 28989 \
|
--host2 localhost --port2 34444 --bindDN2 "cn=Directory Manager" --bindPassword2 password --replicationPort2 38989 \
|
--adminUID admin --adminPassword password --baseDN dc=example,dc=com --trustAll --noPropertiesFile
|
|
opendj-server-legacy/target/package/opendj3/bin/dsreplication initialize --baseDN dc=example,dc=com --adminUID admin --adminPassword password --hostSource localhost \
|
--portSource 24444 --hostDestination localhost --portDestination 34444 -X -n
|
|
opendj-server-legacy/target/package/opendj2/bin/ldapsearch --port 3636 --hostname localhost --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll \
|
--baseDN "ou=people,dc=example,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 100000
|
|
echo "Stopping and removing OpenDJ instances"
|
|
opendj-server-legacy/target/package/opendj1/bin/stop-ds
|
opendj-server-legacy/target/package/opendj2/bin/stop-ds
|
opendj-server-legacy/target/package/opendj3/bin/stop-ds
|
|
rm -rf ./opendj-server-legacy/target/package/opendj1
|
rm -rf ./opendj-server-legacy/target/package/opendj2
|
rm -rf ./opendj-server-legacy/target/package/opendj3
|
|
- name: Test on Windows
|
if: runner.os == 'Windows'
|
run: |
|
. .github\scripts\wait-server-stopped.ps1
|
set OPENDJ_JAVA_ARGS="-server -Xmx512m"
|
opendj-server-legacy\target\package\opendj\setup.bat -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS --generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com --sampleData 5000 --cli --acceptLicense --no-prompt
|
opendj-server-legacy\target\package\opendj\bat\status.bat --hostname localhost --bindDN "cn=Directory Manager" --bindPassword password --trustAll
|
opendj-server-legacy\target\package\opendj\bat\ldapsearch.bat --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
opendj-server-legacy\target\package\opendj\bat\ldapsearch.bat --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope sub "(uid=user.*)" dn | find /c '"dn:"' | findstr "5000"
|
# --- Load-testing tools smoke tests (server online, 5000 sample users) ---
|
Write-Host "===== searchrate ====="
|
opendj-server-legacy\target\package\opendj\bat\searchrate.bat --hostname localhost --port 1636 --useSSL --trustAll --bindDN "cn=Directory Manager" --bindPassword password --baseDN "ou=people,dc=example,dc=com" --searchScope sub -c 4 -t 1 -m 2000 -i 1 -g "rand(0,4999)" "(uid=user.%d)" 1.1
|
if ($LASTEXITCODE -ne 0) { throw "searchrate failed with exit code $LASTEXITCODE" }
|
Write-Host "===== authrate ====="
|
opendj-server-legacy\target\package\opendj\bat\authrate.bat --hostname localhost --port 1636 --useSSL --trustAll -D "uid=user.%d,ou=people,dc=example,dc=com" -w password -c 4 -m 2000 -i 1 -g "rand(0,4999)"
|
if ($LASTEXITCODE -ne 0) { throw "authrate failed with exit code $LASTEXITCODE" }
|
Write-Host "===== modrate ====="
|
opendj-server-legacy\target\package\opendj\bat\modrate.bat --hostname localhost --port 1636 --useSSL --trustAll --bindDN "cn=Directory Manager" --bindPassword password -b "uid=user.%d,ou=people,dc=example,dc=com" -c 4 -t 1 -m 2000 -i 1 -g "rand(0,4999)" "description:modrate-load-test"
|
if ($LASTEXITCODE -ne 0) { throw "modrate failed with exit code $LASTEXITCODE" }
|
Write-Host "===== addrate ====="
|
@'
|
define suffix=dc=example,dc=com
|
|
branch: ou=People,[suffix]
|
subordinateTemplate: person
|
|
template: person
|
rdnAttr: uid
|
objectClass: top
|
objectClass: person
|
objectClass: organizationalPerson
|
objectClass: inetOrgPerson
|
uid: addrate.<sequential:0>
|
cn: AddRate {uid}
|
sn: AddRate
|
userPassword: password
|
'@ | Set-Content -Encoding ascii addrate.template
|
opendj-server-legacy\target\package\opendj\bat\addrate.bat --hostname localhost --port 1636 --useSSL --trustAll --bindDN "cn=Directory Manager" --bindPassword password -c 4 -t 1 -m 2000 -i 1 -C fifo -s 100 addrate.template
|
if ($LASTEXITCODE -ne 0) { throw "addrate failed with exit code $LASTEXITCODE" }
|
opendj-server-legacy\target\package\opendj\bat\dsconfig.bat create-backend --hostname localhost --port 4444 --bindDN "cn=Directory Manager" --bindPassword password --backend-name=example2 --type je --set=base-dn:dc=example2,dc=com --set=enabled:true --no-prompt --trustAll
|
opendj-server-legacy\target\package\opendj\bat\makeldif.bat -o test.ldif -c suffix=dc=example2,dc=com opendj-server-legacy\target\package\opendj\config\MakeLDIF\example.template
|
opendj-server-legacy\target\package\opendj\bat\stop-ds.bat
|
if ($LASTEXITCODE -ne 0) { throw "stop-ds.bat failed with exit code $LASTEXITCODE" }
|
Wait-ServerStopped 'opendj-server-legacy\target\package\opendj\locks\server.lock'
|
echo "4.9.9.0" > opendj-server-legacy\target\package\opendj\config\buildinfo
|
opendj-server-legacy\target\package\opendj\upgrade.bat
|
opendj-server-legacy\target\package\opendj\bat\import-ldif.bat --offline --ldifFile test.ldif --backendID=example2
|
opendj-server-legacy\target\package\opendj\bat\rebuild-index.bat --offline --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll
|
opendj-server-legacy\target\package\opendj\bat\start-ds.bat
|
opendj-server-legacy\target\package\opendj\bat\rebuild-index.bat --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll --trustAll
|
opendj-server-legacy\target\package\opendj\bat\ldapsearch.bat --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example2,dc=com" --searchScope sub "(uid=user.*)" dn | find /c '"dn:"' | findstr "10000"
|
opendj-server-legacy\target\package\opendj\bat\stop-ds.bat
|
if ($LASTEXITCODE -ne 0) { throw "stop-ds.bat failed with exit code $LASTEXITCODE" }
|
Wait-ServerStopped 'opendj-server-legacy\target\package\opendj\locks\server.lock'
|
opendj-server-legacy\target\package\opendj\bat\windows-service.bat --enableService
|
net start "OpenDJ Server"
|
if ($LASTEXITCODE -ne 0) { throw "net start 'OpenDJ Server' failed with exit code $LASTEXITCODE" }
|
for ($i=0; $i -lt 12; $i++) { try { $c = New-Object System.Net.Sockets.TcpClient('localhost', 1636); $c.Close(); break } catch { Start-Sleep -Seconds 5 } }
|
opendj-server-legacy\target\package\opendj\bat\ldapsearch.bat --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example2,dc=com" --searchScope sub "(uid=user.*)" dn | find /c '"dn:"' | findstr "10000"
|
net stop "OpenDJ Server"
|
if ($LASTEXITCODE -ne 0) { throw "net stop 'OpenDJ Server' failed with exit code $LASTEXITCODE" }
|
opendj-server-legacy\target\package\opendj\bat\windows-service.bat --disableService
|
|
- name: Upload artifacts OpenDJ Server
|
uses: actions/upload-artifact@v7
|
with:
|
name: ${{ matrix.os }}-${{ matrix.java }}
|
retention-days: 5
|
path: |
|
opendj-server-legacy/target/package/*.zip
|
opendj-ldap-toolkit/target/*.zip
|
opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb
|
opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm
|
opendj-packages/opendj-msi/opendj-msi-standard/target/*.msi
|
opendj-packages/opendj-docker/target/Dockerfile.zip
|
opendj-packages/opendj-openshift-template/*.yaml
|
opendj-doc-generated-ref/target/*.zip
|
opendj-dsml-servlet/target/*.war
|
opendj-rest2ldap-servlet/target/*.war
|
build-docker:
|
needs: build-maven
|
runs-on: 'ubuntu-latest'
|
permissions:
|
contents: read
|
security-events: write
|
services:
|
registry:
|
image: registry:3
|
ports:
|
- 5000:5000
|
steps:
|
- uses: actions/checkout@v6
|
with:
|
sparse-checkout: .github/benchmark
|
- name: Download artifacts
|
uses: actions/download-artifact@v8
|
with:
|
name: ubuntu-latest-11
|
- name: Get latest release version
|
shell: bash
|
run: |
|
export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
|
echo "release_version=$git_version_last" >> $GITHUB_ENV
|
echo "image_repository=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
|
- name: Docker meta
|
id: meta
|
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
|
with:
|
images: |
|
localhost:5000/${{ github.repository }}
|
tags: |
|
type=raw,value=${{ env.release_version }}
|
- name: Set up QEMU
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
- name: Set up Docker Buildx
|
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
with:
|
driver-opts: network=host
|
- name: Prepare Dockerfile
|
shell: bash
|
run: |
|
unzip -d ./opendj-packages/opendj-docker ./opendj-packages/opendj-docker/target/Dockerfile.zip
|
cp ./opendj-server-legacy/target/package/opendj-*.zip ./opendj-packages/opendj-docker
|
sed -i -E '/^#COPY opendj/s/^#//' ./opendj-packages/opendj-docker/Dockerfile
|
- name: Build image (default)
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
with:
|
context: ./opendj-packages/opendj-docker
|
file: ./opendj-packages/opendj-docker/Dockerfile
|
build-args: |
|
VERSION=${{ env.release_version }}
|
platforms: linux/amd64, linux/arm64/8, linux/ppc64le, linux/s390x, linux/riscv64 #, linux/arm/v7
|
push: true
|
tags: ${{ steps.meta.outputs.tags }}
|
labels: ${{ steps.meta.outputs.labels }}
|
- name: Docker test
|
shell: bash
|
run: |
|
trap 'code=$?; echo "::group::container logs (test)"; docker logs test 2>&1 || true; echo "::endgroup::"; exit $code' ERR
|
docker run --rm -it -d --memory="512m" --name=test localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
|
timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test | grep -q \"healthy\"; do sleep 10; done'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/dsconfig create-backend --hostname localhost --port 4444 --bindDN "cn=Directory Manager" --bindPassword password --backend-name=example2 --type je --set=base-dn:dc=example2,dc=com --set=enabled:true --no-prompt --trustAll'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/makeldif -o /tmp/test.ldif -c suffix=dc=example2,dc=com /opt/opendj/data/config/MakeLDIF/example.template'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/stop-ds'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/import-ldif --offline --ldifFile /tmp/test.ldif --backendID=example2'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/rebuild-index --offline --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/start-ds'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/rebuild-index --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll --trustAll'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example2,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 10000'
|
docker kill test
|
- name: Docker test custom password
|
shell: bash
|
run: |
|
trap 'code=$?; echo "::group::container logs (test_custom)"; docker logs test_custom 2>&1 || true; echo "::endgroup::"; exit $code' ERR
|
docker run --rm -it -d --memory="512m" -e ADD_BASE_ENTRY="--addBaseEntry" -e ROOT_PASSWORD=custom_password --name=test_custom localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
|
timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test_custom | grep -q \"healthy\"; do sleep 10; done'
|
docker exec test_custom 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword custom_password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1'
|
docker kill test_custom
|
- name: Scan image for vulnerabilities (Trivy)
|
# trivy resolves the image from the local Docker daemon, so only the runner's
|
# linux/amd64 manifest is scanned; cache: false keeps the ~1GB trivy DBs from
|
# evicting the m2-repository caches out of the repo's 10GB actions-cache quota
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
with:
|
image-ref: localhost:5000/${{ env.image_repository }}:${{ env.release_version }}
|
format: sarif
|
output: trivy-results.sarif
|
severity: CRITICAL,HIGH
|
limit-severities-for-sarif: true
|
ignore-unfixed: true
|
scanners: vuln
|
cache: false
|
- name: Upload Trivy report to GitHub Security
|
uses: github/codeql-action/upload-sarif@v4
|
# upload even if a preceding step failed, but not without a report to upload
|
if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
|
with:
|
sarif_file: trivy-results.sarif
|
# distinct from the docker-scan.yml categories, which track the published images
|
category: trivy-build-default
|
- name: Cache JMeter
|
uses: actions/cache@v5
|
with:
|
path: ~/jmeter
|
key: jmeter-5.6.3
|
- name: Benchmark PDB vs JE
|
shell: bash
|
run: |
|
A_BACKEND=je B_BACKEND=pdb THREADS=200 DURATION=150 bash .github/benchmark/compare-opendj.sh \
|
"JE" localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }} \
|
"PDB" localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
|
- name: Upload benchmark artifacts (PDB vs JE)
|
if: always()
|
uses: actions/upload-artifact@v7
|
with:
|
name: benchmark-pdb-vs-je
|
path: |
|
a/
|
b/
|
*.jtl
|
*.docker.log
|
*.jmeter.out
|
if-no-files-found: warn
|
retention-days: 3
|
- name: Benchmark Build vs Release
|
shell: bash
|
run: |
|
THREADS=200 DURATION=150 bash .github/benchmark/compare-opendj.sh \
|
"Build" localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }} \
|
"Release" openidentityplatform/opendj:latest
|
- name: Upload benchmark artifacts
|
if: always()
|
uses: actions/upload-artifact@v7
|
with:
|
name: benchmark-build-vs-release
|
path: |
|
a/
|
b/
|
*.jtl
|
*.docker.log
|
*.jmeter.out
|
if-no-files-found: warn
|
retention-days: 3
|
|
build-docker-alpine:
|
needs: build-maven
|
runs-on: 'ubuntu-latest'
|
permissions:
|
contents: read
|
security-events: write
|
services:
|
registry:
|
image: registry:3
|
ports:
|
- 5000:5000
|
steps:
|
- uses: actions/checkout@v6
|
with:
|
sparse-checkout: .github/benchmark
|
- name: Download artifacts
|
uses: actions/download-artifact@v8
|
with:
|
name: ubuntu-latest-11
|
- name: Get latest release version
|
shell: bash
|
run: |
|
export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
|
echo "release_version=$git_version_last" >> $GITHUB_ENV
|
echo "image_repository=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
|
- name: Docker meta
|
id: meta
|
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
|
with:
|
images: |
|
localhost:5000/${{ github.repository }}
|
tags: |
|
type=raw,value=alpine
|
type=raw,value=${{ env.release_version }}-alpine
|
- name: Set up QEMU
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
- name: Set up Docker Buildx
|
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
with:
|
driver-opts: network=host
|
- name: Prepare Dockerfile
|
shell: bash
|
run: |
|
unzip -d ./opendj-packages/opendj-docker ./opendj-packages/opendj-docker/target/Dockerfile.zip
|
cp ./opendj-server-legacy/target/package/opendj-*.zip ./opendj-packages/opendj-docker
|
sed -i -E '/^#COPY opendj/s/^#//' ./opendj-packages/opendj-docker/Dockerfile-alpine
|
- name: Build image
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
with:
|
context: ./opendj-packages/opendj-docker
|
file: ./opendj-packages/opendj-docker/Dockerfile-alpine
|
build-args: |
|
VERSION=${{ env.release_version }}
|
platforms: linux/amd64, linux/arm64/8, linux/s390x, linux/ppc64le, linux/386, linux/riscv64
|
push: true
|
tags: ${{ steps.meta.outputs.tags }}
|
labels: ${{ steps.meta.outputs.labels }}
|
- name: Docker test
|
shell: bash
|
run: |
|
trap 'code=$?; echo "::group::container logs (test)"; docker logs test 2>&1 || true; echo "::endgroup::"; exit $code' ERR
|
docker run --rm -it -d --memory="1g" --name=test localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}-alpine
|
timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test | grep -q \"healthy\"; do sleep 10; done'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/dsconfig create-backend --hostname localhost --port 4444 --bindDN "cn=Directory Manager" --bindPassword password --backend-name=example2 --type je --set=base-dn:dc=example2,dc=com --set=enabled:true --no-prompt --trustAll'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/makeldif -o /tmp/test.ldif -c suffix=dc=example2,dc=com /opt/opendj/data/config/MakeLDIF/example.template'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/stop-ds'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/import-ldif --offline --ldifFile /tmp/test.ldif --backendID=example2'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/rebuild-index --offline --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/start-ds'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/rebuild-index --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll --trustAll'
|
docker exec test 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example2,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 10000'
|
docker kill test
|
- name: Docker test custom password
|
shell: bash
|
run: |
|
trap 'code=$?; echo "::group::container logs (test_custom)"; docker logs test_custom 2>&1 || true; echo "::endgroup::"; exit $code' ERR
|
docker run --rm -it -d --memory="1g" -e ADD_BASE_ENTRY="--addBaseEntry" -e ROOT_PASSWORD=custom_password --name=test_custom localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}-alpine
|
timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test_custom | grep -q \"healthy\"; do sleep 10; done'
|
docker exec test_custom 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword custom_password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1'
|
docker kill test_custom
|
- name: Scan image for vulnerabilities (Trivy)
|
# trivy resolves the image from the local Docker daemon, so only the runner's
|
# linux/amd64 manifest is scanned; cache: false keeps the ~1GB trivy DBs from
|
# evicting the m2-repository caches out of the repo's 10GB actions-cache quota
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
with:
|
image-ref: localhost:5000/${{ env.image_repository }}:${{ env.release_version }}-alpine
|
format: sarif
|
output: trivy-results.sarif
|
severity: CRITICAL,HIGH
|
limit-severities-for-sarif: true
|
ignore-unfixed: true
|
scanners: vuln
|
cache: false
|
- name: Upload Trivy report to GitHub Security
|
uses: github/codeql-action/upload-sarif@v4
|
# upload even if a preceding step failed, but not without a report to upload
|
if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
|
with:
|
sarif_file: trivy-results.sarif
|
# distinct from the docker-scan.yml categories, which track the published images
|
category: trivy-build-alpine
|
- name: Cache JMeter
|
uses: actions/cache@v5
|
with:
|
path: ~/jmeter
|
key: jmeter-5.6.3
|
- name: Benchmark Build-alpine vs Release-alpine
|
shell: bash
|
run: |
|
THREADS=200 DURATION=150 bash .github/benchmark/compare-opendj.sh \
|
"Build-alpine" localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}-alpine \
|
"Release-alpine" openidentityplatform/opendj:alpine
|
- name: Upload benchmark artifacts
|
if: always()
|
uses: actions/upload-artifact@v7
|
with:
|
name: benchmark-build-vs-release-alpine
|
path: |
|
a/
|
b/
|
*.jtl
|
*.docker.log
|
*.jmeter.out
|
if-no-files-found: warn
|
retention-days: 90
|
|
test-deb:
|
needs: build-maven
|
runs-on: 'ubuntu-latest'
|
steps:
|
- uses: actions/checkout@v6
|
- name: Download artifacts
|
uses: actions/download-artifact@v8
|
with:
|
name: ubuntu-latest-11
|
- name: Clean-room install + SysV start/stop (debian:12 container)
|
shell: bash
|
run: |
|
docker run --rm -v "$PWD:/work" -w /work debian:12 bash -c '
|
set -e
|
export DEBIAN_FRONTEND=noninteractive
|
DEB=$(ls opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb | head -1)
|
echo "Found $DEB"
|
apt-get update
|
apt-get install -y lintian
|
lintian --info --no-tag-display-limit "$DEB" || true
|
dpkg-deb -I "$DEB"
|
# Both service files must be present (two greps: a single alternation
|
# would pass with either one missing).
|
dpkg-deb -c "$DEB" | grep "lib/systemd/system/opendj.service"
|
dpkg-deb -c "$DEB" | grep "etc/init.d/opendj"
|
# /etc/default/opendj must be a real conffile, so admin edits survive
|
# upgrades and the file survives "apt remove".
|
dpkg-deb -e "$DEB" /tmp/ctrl
|
grep -qx "/etc/default/opendj" /tmp/ctrl/conffiles
|
apt-get install -y "./$DEB"
|
id opendj
|
test "$(stat -c %U /opt/opendj)" = opendj
|
# No JAVA_HOME in this clean container: Java resolves from the PATH
|
# java that the package JRE dependency pulled in.
|
runuser -u opendj -- /opt/opendj/setup --cli --no-prompt --acceptLicense --doNotStart \
|
--rootUserDN "cn=Directory Manager" --rootUserPassword password \
|
--hostname localhost --ldapPort 1389 --adminConnectorPort 4444 \
|
--baseDN dc=example,dc=com --addBaseEntry
|
/etc/init.d/opendj start
|
bash .github/scripts/wait-for-ldap.sh 1389
|
/etc/init.d/opendj status
|
/etc/init.d/opendj stop
|
apt-get purge -y opendj
|
'
|
- name: Live systemd install + start/stop (runner)
|
shell: bash
|
run: |
|
DEB=$(ls opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb | head -1)
|
sudo apt-get update
|
sudo apt-get install -y "$PWD/$DEB"
|
test "$(stat -c '%U' /opt/opendj)" = opendj
|
# postinst must have enabled the unit; do not enable by hand here or
|
# the postinst registration would go untested.
|
sudo systemctl is-enabled --quiet opendj
|
# Before setup the unit's start condition must keep it from
|
# start-bursting: "start" succeeds but no process may appear.
|
sudo systemctl start opendj
|
sleep 2
|
if sudo systemctl is-failed --quiet opendj; then echo "unit failed before setup"; exit 1; fi
|
# sudo/runuser/systemd strip JAVA_HOME -> the service uses the PATH java.
|
# Privileged port 389: only AmbientCapabilities=CAP_NET_BIND_SERVICE lets
|
# the non-root service bind it - the very reason it can drop root. setup
|
# itself runs via runuser WITHOUT that capability, so it must skip its
|
# own bind probe; the systemd start below performs the real 389 bind.
|
sudo runuser -u opendj -- /opt/opendj/setup --cli --no-prompt --acceptLicense --doNotStart \
|
--rootUserDN "cn=Directory Manager" --rootUserPassword password \
|
--hostname localhost --ldapPort 389 --adminConnectorPort 4444 \
|
--baseDN dc=example,dc=com --addBaseEntry --skipPortCheck
|
sudo systemctl start opendj
|
bash .github/scripts/wait-for-ldap.sh 389
|
sudo systemctl is-active --quiet opendj
|
echo "OpenDJ is active under systemd"
|
sudo systemctl stop opendj
|
sleep 3
|
if sudo systemctl is-active --quiet opendj; then echo "still active"; exit 1; fi
|
sudo apt-get purge -y opendj
|
|
# Known coverage limit: the container has no booted systemd (/run/systemd/system
|
# is absent), so only the SysV/chkconfig path of the scriptlets is exercised
|
# here; start/stop through systemd is covered by the deb live-systemd jobs on
|
# the runner. The enable registration IS asserted below - systemctl enable is
|
# a pure symlink operation and works without a booted systemd.
|
test-rpm:
|
needs: build-maven
|
runs-on: 'ubuntu-latest'
|
steps:
|
- uses: actions/checkout@v6
|
- name: Download artifacts
|
uses: actions/download-artifact@v8
|
with:
|
name: ubuntu-latest-11
|
- name: Install and start/stop in Rocky Linux 9
|
shell: bash
|
run: |
|
docker run --rm -v "$PWD:/work" -w /work rockylinux:9 bash -c '
|
set -e
|
RPM=$(ls opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm | head -1)
|
echo "Found $RPM"
|
# Both service files must be shipped.
|
rpm -qlp "$RPM" | grep "^/usr/lib/systemd/system/opendj.service$"
|
rpm -qlp "$RPM" | grep "^/etc/init.d/opendj$"
|
# The %pre user-creation dependency must be declared for minimal images.
|
rpm -qp --requires "$RPM" | grep "shadow-utils"
|
# A real EL9 host always has systemd, but the container image ships no
|
# systemctl at all - %post then (correctly) skips the enable in silence.
|
# Preinstall it as host infrastructure, deliberately NOT a package
|
# Requires, so the is-enabled assertion below tests the enable path.
|
dnf install -y systemd
|
# No further manual dependencies: the package must pull everything else
|
# itself (Requires).
|
dnf install -y "$RPM"
|
id opendj
|
test "$(stat -c %U /opt/opendj)" = opendj
|
# %post must have enabled the unit on initial install.
|
systemctl is-enabled opendj.service
|
# No JAVA_HOME here: Java resolves from the PATH java pulled in by
|
# the java-headless dependency.
|
runuser -u opendj -- /opt/opendj/setup --cli --no-prompt --acceptLicense --doNotStart \
|
--rootUserDN "cn=Directory Manager" --rootUserPassword password \
|
--hostname localhost --ldapPort 1389 --adminConnectorPort 4444 \
|
--baseDN dc=example,dc=com --addBaseEntry
|
/etc/init.d/opendj start
|
bash .github/scripts/wait-for-ldap.sh 1389
|
/etc/init.d/opendj status
|
/etc/init.d/opendj stop
|
rpm -e opendj
|
'
|
|
# Upgrade path: released 5.1.2 deb (root-owned, SysV) -> this build's deb, on the
|
# runner's LIVE systemd. The new package must stop the running server, create the
|
# opendj user, migrate ownership, run the upgrade tool and restart the server with
|
# the old data - through deb-systemd-invoke and the native unit, the path a real
|
# systemd host takes (docs: chap-upgrade).
|
test-deb-upgrade:
|
needs: build-maven
|
runs-on: 'ubuntu-latest'
|
steps:
|
- uses: actions/checkout@v6
|
- name: Download artifacts
|
uses: actions/download-artifact@v8
|
with:
|
name: ubuntu-latest-11
|
- name: Download released 5.1.2 deb
|
shell: bash
|
run: |
|
curl -fsSL -o opendj-5.1.2.deb https://github.com/OpenIdentityPlatform/OpenDJ/releases/download/5.1.2/opendj_5.1.2-1_all.deb
|
# Pin the upgrade source: a retagged release asset must fail loudly here,
|
# not surface as an unrelated upgrade-job failure.
|
echo "8f7f8bdd526b2d63eaef0621545be6aa55749cb60200d3bc2a2849d9ab69eb59 opendj-5.1.2.deb" | sha256sum -c -
|
- name: Upgrade 5.1.2 -> new deb (live systemd on the runner)
|
shell: bash
|
run: |
|
NEW=$(ls opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb | head -1)
|
echo "New deb: $NEW"
|
sudo apt-get update
|
# No manual dependencies: even the released 5.1.2 deb declares a JRE dependency.
|
sudo apt-get install -y "$PWD/opendj-5.1.2.deb"
|
# 5.1.2 model: no dedicated user, root-owned tree, SysV only - on this
|
# booted host its unit comes from the systemd-sysv-generator.
|
sudo /opt/opendj/setup --cli --no-prompt --acceptLicense --doNotStart \
|
--rootUserDN "cn=Directory Manager" --rootUserPassword password \
|
--hostname localhost --ldapPort 1389 --adminConnectorPort 4444 \
|
--baseDN dc=example,dc=com --addBaseEntry
|
sudo systemctl daemon-reload
|
sudo /etc/init.d/opendj start
|
bash .github/scripts/wait-for-ldap.sh 1389
|
# Leave the server RUNNING: the new package must stop it, upgrade and
|
# restart it - through deb-systemd-invoke and the native unit this time.
|
sudo apt-get install -y "$PWD/$NEW"
|
id opendj
|
test "$(stat -c %U /opt/opendj)" = opendj
|
test -f /opt/opendj/config/config.ldif
|
# The systemd-hosted upgrade must leave the unit enabled and active.
|
sudo systemctl is-enabled --quiet opendj
|
sudo systemctl is-active --quiet opendj
|
# The pre-upgrade data must be served again, now by the dedicated user.
|
bash .github/scripts/wait-for-ldap.sh 1389
|
test "$(stat -c %U /proc/$(cat /opt/opendj/logs/server.pid))" = opendj
|
sudo systemctl stop opendj
|
sleep 3
|
if sudo systemctl is-active --quiet opendj; then echo "still active"; exit 1; fi
|
sudo apt-get purge -y opendj
|
|
test-rpm-upgrade:
|
needs: build-maven
|
runs-on: 'ubuntu-latest'
|
steps:
|
- uses: actions/checkout@v6
|
- name: Download artifacts
|
uses: actions/download-artifact@v8
|
with:
|
name: ubuntu-latest-11
|
- name: Download released 5.1.2 rpm
|
shell: bash
|
run: |
|
curl -fsSL -o opendj-5.1.2.rpm https://github.com/OpenIdentityPlatform/OpenDJ/releases/download/5.1.2/opendj-5.1.2-1.noarch.rpm
|
# Pin the upgrade source: a retagged release asset must fail loudly here,
|
# not surface as an unrelated upgrade-job failure.
|
echo "9622ef7c3292f0c156c96029a647ca704064aa93b567e5608734fe07d224ec58 opendj-5.1.2.rpm" | sha256sum -c -
|
- name: Upgrade 5.1.2 -> new rpm (Rocky Linux 9 container)
|
shell: bash
|
run: |
|
docker run --rm -v "$PWD:/work" -w /work rockylinux:9 bash -c '
|
set -e
|
NEW=$(ls opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm | head -1)
|
echo "New rpm: $NEW"
|
# No manual dependencies: the released 5.1.2 rpm already declares its runtime
|
# requirements (#677), and everything the NEW package needs must come from its
|
# own Requires.
|
dnf install -y ./opendj-5.1.2.rpm
|
# 5.1.2 model: no dedicated user, root-owned tree, SysV only
|
/opt/opendj/setup --cli --no-prompt --acceptLicense --doNotStart \
|
--rootUserDN "cn=Directory Manager" --rootUserPassword password \
|
--hostname localhost --ldapPort 1389 --adminConnectorPort 4444 \
|
--baseDN dc=example,dc=com --addBaseEntry
|
/etc/init.d/opendj start
|
bash .github/scripts/wait-for-ldap.sh 1389
|
# Leave the server RUNNING: the new package must stop it, upgrade and restart it.
|
dnf install -y "./$NEW"
|
id opendj
|
test "$(stat -c %U /opt/opendj)" = opendj
|
test -f /opt/opendj/config/config.ldif
|
# 5.1.2 was chkconfig-enabled and the native unit now shadows the
|
# sysv-generator unit: %post must have migrated that enable state
|
# (a pure symlink operation, asserted fine without booted systemd).
|
systemctl is-enabled opendj.service
|
# The package restarted the server; the pre-upgrade data must be served again,
|
# now by the dedicated user.
|
bash .github/scripts/wait-for-ldap.sh 1389
|
test "$(stat -c %U /proc/$(cat /opt/opendj/logs/server.pid))" = opendj
|
/etc/init.d/opendj stop
|
rpm -e opendj
|
'
|
|
# The gate both MSI jobs wait on. Deliberately not "needs: build-maven": that waits for
|
# the whole matrix, whose ubuntu legs run for about two hours, so any push landing inside
|
# that window cancels the run before those two-minute jobs have started - which is how the
|
# MSI work reached its eighth review round with no completed run behind it. The only input
|
# they have is the windows-latest-11 artifact, so wait for exactly that.
|
#
|
# On ubuntu, and in a job of its own, for two reasons. A waiter on windows-latest holds a
|
# Windows runner from t=0 for the whole wait, competing for the capacity the leg it is
|
# waiting for needs - in run 31578978374 the windows-latest-11 leg sat in the queue for 38
|
# minutes while windows-latest-26 started within one. And the wait was duplicated
|
# verbatim in both jobs, with a 45-minute budget measured from t=0 that covered the leg's
|
# runtime but not its queue time: in that same run the artifact appeared at +52 minutes,
|
# so both jobs would have failed a perfectly healthy build.
|
wait-msi-artifact:
|
runs-on: 'ubuntu-latest'
|
# Well past any queue seen so far, and only reached if the Windows leg neither publishes
|
# nor finishes; the usual exits are the artifact appearing or the leg failing.
|
timeout-minutes: 130
|
permissions:
|
contents: read
|
# Listing the run's artifacts and jobs, which the wait below polls.
|
actions: read
|
steps:
|
- name: Wait for the Windows build artifact
|
shell: bash
|
env:
|
GH_TOKEN: ${{ github.token }}
|
run: |
|
deadline=$(( $(date +%s) + 120 * 60 ))
|
while true; do
|
if gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts" \
|
--jq '.artifacts[].name' | grep -qx 'windows-latest-11'; then
|
echo 'windows-latest-11 is available'
|
exit 0
|
fi
|
# Stop waiting the moment the leg that would publish it has finished without
|
# doing so, instead of sitting out the deadline.
|
# || true: a transient API error is a reason to poll again, not to fail the run.
|
conclusion=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/jobs?per_page=100" \
|
--jq '.jobs[] | select(.name | startswith("build-maven (windows-latest, 11)")) | .conclusion' || true)
|
if [ -n "$conclusion" ] && [ "$conclusion" != "null" ]; then
|
echo "the Windows build leg finished as '$conclusion' without publishing windows-latest-11" >&2
|
exit 1
|
fi
|
if [ "$(date +%s)" -ge "$deadline" ]; then
|
echo 'windows-latest-11 was not published within 120 minutes' >&2
|
exit 1
|
fi
|
sleep 30
|
done
|
|
test-msi:
|
needs: wait-msi-artifact
|
runs-on: 'windows-latest'
|
permissions:
|
contents: read
|
steps:
|
# Only for .github/scripts/wait-server-stopped.ps1 and the MSI authoring the guard
|
# step below reads, and it has to come first: checkout cleans the workspace the
|
# artifact is unpacked into. Sparse because those two are the entire reason for it.
|
- uses: actions/checkout@v6
|
with:
|
sparse-checkout: |
|
.github/scripts
|
opendj-packages/opendj-msi/opendj-msi-standard/resources/msi
|
- name: Download artifacts
|
uses: actions/download-artifact@v8
|
with:
|
name: windows-latest-11
|
- name: Set up Java
|
uses: actions/setup-java@v5
|
with:
|
java-version: '25'
|
distribution: 'zulu'
|
- name: The upgrade guards must hold up on their own
|
shell: pwsh
|
run: |
|
# Two things no install scenario can see, both of which have already gone wrong here.
|
# The first is what a guard is allowed to READ: the execute sequence is processed in
|
# the installer service, so a private property set in the UI sequence is empty by the
|
# time the guard evaluates - which inverts it in exactly the full-UI sessions that no
|
# /qn scenario runs. The second is the inline PowerShell itself: the scenarios reach
|
# it only through a ten-minute install and can then only look at msiexec's exit code,
|
# so a guard that always exits 0 looks the same as one that never has to refuse.
|
# Read from the authoring rather than from the built MSI's tables: wix copies both
|
# the sequence conditions and ExeCommand across verbatim, and it is test-msi-upgrade
|
# that judges the artifact - those scenarios now assert the refusal's own 1603 and
|
# "Return value 3" rather than any non-zero exit code.
|
$wxs = Get-Content -Raw opendj-packages/opendj-msi/opendj-msi-standard/resources/msi/package.wxs
|
$sequence = [regex]::Match($wxs, '(?s)<InstallExecuteSequence>(.*?)</InstallExecuteSequence>')
|
if (-not $sequence.Success) { throw "package.wxs has no InstallExecuteSequence" }
|
foreach ($action in @('RequireDirOnCustomUpgrade', 'RefuseRelocatingUpgrade')) {
|
$scheduled = [regex]::Match($sequence.Groups[1].Value, '(?s)<Custom Action="' + $action + '"(.*?)/>')
|
if (-not $scheduled.Success) { throw "$action is not scheduled in InstallExecuteSequence" }
|
$found = [regex]::Match($scheduled.Groups[1].Value, '(?s)Condition="([^"]*)"')
|
if (-not $found.Success) { throw "$action is scheduled without a condition" }
|
$condition = [System.Net.WebUtility]::HtmlDecode($found.Groups[1].Value)
|
# Property names in these conditions are upper case, and so are AND/NOT: a
|
# lower-case letter is a private property, which reads as empty in the service.
|
if ($condition -cmatch '[a-z]') { throw "$action reads a private property, which never reaches the installer service: $condition" }
|
Write-Host "$action : $condition"
|
}
|
foreach ($property in @('OPENDJ', 'OPENDJ_GIVEN')) {
|
if ($wxs -notmatch ('<Property Id="' + $property + '"[^>]*Secure="yes"')) { throw "$property must be Secure: the guards read it in the service, where a non-administrator's value is dropped otherwise" }
|
}
|
# Sequence="first" is what keeps OPENDJ_GIVEN meaning "the directory was named":
|
# without it the action re-runs in the execute sequence of a full-UI install, where
|
# OPENDJ has long been resolved, and the guards' prefix test would be comparing a
|
# value with itself. Every msiexec call in this workflow is /qn, which runs no UI
|
# sequence, so nothing else here would notice it going.
|
if ($wxs -notmatch '<SetProperty Id="OPENDJ_GIVEN"[^>]*Sequence="first"') { throw 'OPENDJ_GIVEN must be captured with Sequence="first", or it stops meaning "named" in a full-UI install' }
|
# CheckServerNotRunning, run exactly as msiexec runs it: the Formatted field
|
# resolved - [\[] and [\]] are its escapes for literal brackets, [property]
|
# references become their values - and handed to cmd.exe. Windows PowerShell 5.1 is
|
# what the command names, so that is what this exercises.
|
$found = [regex]::Match($wxs, '(?s)<CustomAction Id="CheckServerNotRunning".*?ExeCommand="([^"]*)"')
|
if (-not $found.Success) { throw "CheckServerNotRunning has no ExeCommand" }
|
$target = [System.Net.WebUtility]::HtmlDecode($found.Groups[1].Value)
|
$probeRoot = Join-Path $PWD 'guard-probe'
|
New-Item -ItemType Directory -Force (Join-Path $probeRoot 'locks') | Out-Null
|
$command = $target.Replace('[\[]', '[').Replace('[\]]', ']').Replace('[System64Folder]', "$env:SystemRoot\System32\").Replace('[OPENDJ]', "$probeRoot\")
|
Set-Content -Encoding Ascii -Path guard-probe.cmd -Value $command
|
Write-Host $command
|
function Invoke-Guard { (Start-Process cmd.exe -Wait -PassThru -ArgumentList '/c', 'guard-probe.cmd' -WorkingDirectory $PWD).ExitCode }
|
$lock = Join-Path $probeRoot 'locks\server.lock'
|
Remove-Item $lock -Force -ErrorAction SilentlyContinue
|
$rc = Invoke-Guard
|
if ($rc -ne 0) { throw "no lock file at all must let the upgrade proceed, got $rc" }
|
Set-Content -Path $lock -Value ''
|
$rc = Invoke-Guard
|
if ($rc -ne 0) { throw "an unlocked server.lock must let the upgrade proceed, got $rc" }
|
# A running server holds a mandatory byte-range lock over the whole file
|
# (LockFileManager: RandomAccessFile "rw" plus tryLock) and opens it shared, so the
|
# open succeeds by design and only the Lock call raises IOException - the exception
|
# PowerShell hands to the catch wrapped in a MethodInvocationException.
|
Set-Content -Path guard-holder.ps1 -Value @(
|
'$fs = [System.IO.File]::Open($env:GUARD_PROBE_LOCK, ''Open'', ''ReadWrite'', ''ReadWrite'')',
|
'$fs.Lock(0, [Int64]::MaxValue)',
|
'New-Item -ItemType File -Force -Path "$env:GUARD_PROBE_LOCK.held" | Out-Null',
|
'Start-Sleep -Seconds 300'
|
)
|
$env:GUARD_PROBE_LOCK = $lock
|
Remove-Item "$lock.held" -Force -ErrorAction SilentlyContinue
|
$holder = Start-Process pwsh -PassThru -ArgumentList '-NoProfile', '-File', 'guard-holder.ps1' -WorkingDirectory $PWD
|
for ($i = 0; $i -lt 30 -and -not (Test-Path "$lock.held"); $i++) { Start-Sleep -Seconds 1 }
|
if (-not (Test-Path "$lock.held")) { throw "the holder process never took the lock" }
|
$started = Get-Date
|
$rc = Invoke-Guard
|
$elapsed = [int]((Get-Date) - $started).TotalSeconds
|
Stop-Process -Id $holder.Id -Force -ErrorAction SilentlyContinue
|
if ($rc -ne 1) { throw "a held server.lock must refuse the upgrade (exit 1), got $rc after ${elapsed}s" }
|
# Refusing before the grace is up would mean the loop exited for some other reason.
|
if ($elapsed -lt 55) { throw "the refusal came after ${elapsed}s, so the 60 s grace was not polled through" }
|
Write-Host "CheckServerNotRunning: 0 with no lock file, 0 unlocked, 1 while held (after ${elapsed}s)"
|
Remove-Item -Recurse -Force $probeRoot, guard-probe.cmd, guard-holder.ps1 -ErrorAction SilentlyContinue
|
- name: Install MSI (silent)
|
shell: pwsh
|
run: |
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
if (-not $msi) { throw "MSI not found in the windows-latest-11 artifact" }
|
Write-Host "MSI: $msi"
|
# No OPENDJ property: exercise the x64 default C:\Program Files\OpenDJ (a path with
|
# spaces, which the server scripts must handle).
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v install.log"
|
if ($p.ExitCode -ne 0) { Get-Content install.log -Tail 80; throw "msiexec /i failed: $($p.ExitCode)" }
|
$root = "C:\Program Files\OpenDJ"
|
if (-not (Test-Path "$root\setup.bat")) { Get-Content install.log -Tail 80; throw "OpenDJ not installed into the x64 default $root" }
|
Write-Host "Installed to $root"
|
# The package lays the files down and registers no service: enabling one stays
|
# the administrator's explicit step (windows-service.bat / setup), exactly as
|
# for the zip distribution, so start-ds.bat keeps starting the server directly.
|
if (Get-Service OpenDJ -ErrorAction SilentlyContinue) { throw "the package must not register a service of its own" }
|
if (Get-Service "OpenDJ Server" -ErrorAction SilentlyContinue) { throw "the package must not register a service of its own" }
|
# The SCM wrapper is harvested with the rest of lib; windows-service.bat needs it.
|
if (-not (Test-Path "$root\lib\opendj_service.exe")) { throw "lib\opendj_service.exe missing from the MSI install" }
|
# Custom extension jars go into lib\extensions; the server warns on startup
|
# (WARN_ADMIN_NO_EXTENSIONS_DIR) when it is missing.
|
if (-not (Test-Path "$root\lib\extensions")) { throw "lib\extensions missing from the MSI install" }
|
"OPENDJ_ROOT=$root" | Out-File -FilePath $env:GITHUB_ENV -Append
|
- name: Setup, then start and stop the server without a service
|
shell: pwsh
|
run: |
|
# An MSI install that was never asked for service mode must behave exactly like
|
# a zip one: start-ds.bat starts the server in this very session rather than
|
# dispatching to the SCM, and needs no elevation to do it.
|
$root = $env:OPENDJ_ROOT
|
$env:OPENDJ_JAVA_ARGS = "-server -Xmx512m"
|
& "$root\setup.bat" -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS --generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com --addBaseEntry --cli --acceptLicense --no-prompt --doNotStart
|
if ($LASTEXITCODE -ne 0) { throw "setup.bat failed: $LASTEXITCODE" }
|
& "$root\bat\start-ds.bat"
|
if ($LASTEXITCODE -ne 0) { throw "start-ds.bat failed: $LASTEXITCODE" }
|
for ($i=0; $i -lt 12; $i++) { try { $c = New-Object System.Net.Sockets.TcpClient('localhost', 1636); $c.Close(); break } catch { Start-Sleep -Seconds 5 } }
|
& "$root\bat\ldapsearch.bat" --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
if ($LASTEXITCODE -ne 0) { throw "ldapsearch failed: $LASTEXITCODE" }
|
& "$root\bat\stop-ds.bat"
|
if ($LASTEXITCODE -ne 0) { throw "stop-ds.bat failed: $LASTEXITCODE" }
|
# A zero exit code from stop-ds does not mean the JVM let go of the lock (#768),
|
# and the next step registers and starts the service against this same instance.
|
. .github\scripts\wait-server-stopped.ps1
|
Wait-ServerStopped "$root\locks\server.lock"
|
- name: Enable, start, stop and disable the Windows service
|
shell: pwsh
|
run: |
|
# Service mode is opt-in and driven entirely by windows-service.bat, the same
|
# command the zip distribution uses. The service it registers takes the display
|
# name "OpenDJ Server" for the first instance on the host.
|
$root = $env:OPENDJ_ROOT
|
& "$root\bat\windows-service.bat" --enableService
|
if ($LASTEXITCODE -ne 0) { throw "--enableService failed: $LASTEXITCODE" }
|
if (-not (Get-Service -DisplayName "OpenDJ Server" -ErrorAction SilentlyContinue)) { sc.exe query; throw "--enableService did not register the service" }
|
net start "OpenDJ Server"
|
if ($LASTEXITCODE -ne 0) { throw "net start failed: $LASTEXITCODE" }
|
for ($i=0; $i -lt 12; $i++) { try { $c = New-Object System.Net.Sockets.TcpClient('localhost', 1636); $c.Close(); break } catch { Start-Sleep -Seconds 5 } }
|
& "$root\bat\ldapsearch.bat" --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
if ($LASTEXITCODE -ne 0) { throw "ldapsearch (as a service) failed: $LASTEXITCODE" }
|
net stop "OpenDJ Server"
|
if ($LASTEXITCODE -ne 0) { throw "net stop failed: $LASTEXITCODE" }
|
& "$root\bat\windows-service.bat" --disableService
|
if ($LASTEXITCODE -ne 0) { throw "--disableService failed: $LASTEXITCODE" }
|
if (Get-Service -DisplayName "OpenDJ Server" -ErrorAction SilentlyContinue) { throw "--disableService left the service registered" }
|
- name: uninstall.bat disables the service it finds and removes the instance
|
shell: pwsh
|
run: |
|
# Re-enable the service so the uninstaller exercises its disable path: nothing
|
# in the package owns the service, so removing it is the uninstaller's job.
|
$root = $env:OPENDJ_ROOT
|
& "$root\bat\windows-service.bat" --enableService
|
if ($LASTEXITCODE -ne 0) { throw "--enableService failed: $LASTEXITCODE" }
|
& "$root\uninstall.bat" --cli --remove-all --no-prompt --forceOnError --quiet
|
if ($LASTEXITCODE -ne 0) { throw "uninstall.bat failed: $LASTEXITCODE" }
|
if (Test-Path "$root\config\config.ldif") { throw "uninstall.bat did not remove the instance files" }
|
if (Get-Service -DisplayName "OpenDJ Server" -ErrorAction SilentlyContinue) { throw "uninstall.bat left the service registered" }
|
Write-Host "uninstall.bat removed the instance and disabled the service"
|
exit 0
|
- name: Uninstall MSI
|
shell: pwsh
|
run: |
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall.log -Tail 80; throw "msiexec /x failed: $($p.ExitCode)" }
|
if (Test-Path "$env:OPENDJ_ROOT\lib\opendj_service.exe") { throw "msiexec /x left the payload behind" }
|
Write-Host "Uninstalled OK"
|
|
# Upgrade path: released 5.1.2 x86 MSI (wine-built, WiX3) -> this build's x64 MSI.
|
# Verifies the new installer detects the legacy Program Files (x86) install, keeps the
|
# instance data in place, stops the running service for the file replacement and leaves
|
# its registration alone, and that the upgraded server starts with the old data.
|
test-msi-upgrade:
|
needs: wait-msi-artifact
|
runs-on: 'windows-latest'
|
permissions:
|
contents: read
|
steps:
|
- name: Download artifacts
|
uses: actions/download-artifact@v8
|
with:
|
name: windows-latest-11
|
- name: Set up Java
|
uses: actions/setup-java@v5
|
with:
|
java-version: '25'
|
distribution: 'zulu'
|
- name: Install released 5.1.2 MSI and configure an instance
|
shell: pwsh
|
run: |
|
$uri = "https://github.com/OpenIdentityPlatform/OpenDJ/releases/download/5.1.2/opendj-5.1.2.msi"
|
for ($i = 1; $i -le 5; $i++) {
|
try { Invoke-WebRequest -Uri $uri -OutFile opendj-5.1.2.msi; break }
|
catch { if ($i -eq 5) { throw }; Write-Host "download attempt $i failed, retrying"; Start-Sleep -Seconds (10 * $i) }
|
}
|
# 5.1.2 already contains the script-quoting fixes from #671 (the tag post-dates
|
# the merge), so install it into its own x86 default - spaces and parentheses
|
# included - to reproduce the real upgrade starting point.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart /l*v install-old.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-old.log -Tail 80; throw "msiexec /i (5.1.2) failed: $($p.ExitCode)" }
|
$root = "C:\Program Files (x86)\OpenDJ"
|
if (-not (Test-Path "$root\setup.bat")) { Get-Content install-old.log -Tail 80; throw "5.1.2 install root not found at $root" }
|
$env:OPENDJ_JAVA_ARGS = "-server -Xmx512m"
|
& "$root\setup.bat" -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS --generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com --addBaseEntry --cli --acceptLicense --no-prompt --doNotStart
|
if ($LASTEXITCODE -ne 0) { throw "setup.bat (5.1.2) failed: $LASTEXITCODE" }
|
# Register the service the pre-MSI way, prove it works, and LEAVE IT RUNNING:
|
# the upgrade itself must stop it (StopServiceBeforeUpgrade runs elevated here)
|
# before CheckServiceStopped would otherwise refuse.
|
& "$root\bat\windows-service.bat" --enableService
|
if ($LASTEXITCODE -ne 0) { throw "windows-service --enableService failed: $LASTEXITCODE" }
|
net start "OpenDJ Server"
|
if ($LASTEXITCODE -ne 0) { throw "net start (5.1.2) failed: $LASTEXITCODE" }
|
- name: Upgrade with the newly built MSI (no OPENDJ - location auto-detected)
|
shell: pwsh
|
run: |
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
if (-not $msi) { throw "MSI not found in the windows-latest-11 artifact" }
|
# The headline upgrade path: no OPENDJ property, the installer must find the
|
# legacy default directory on its own.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v upgrade.log"
|
if ($p.ExitCode -ne 0) { Get-Content upgrade.log -Tail 120; throw "msiexec /i (upgrade) failed: $($p.ExitCode)" }
|
$root = "C:\Program Files (x86)\OpenDJ"
|
# New package files landed in the old directory, not the x64 default
|
if (-not (Test-Path "$root\setup.bat")) { throw "upgrade did not keep the old install dir" }
|
if (Test-Path "C:\Program Files\OpenDJ") { throw "upgrade unexpectedly installed into the x64 default dir" }
|
# Instance data survived
|
if (-not (Test-Path "$root\config\config.ldif")) { throw "instance data (config\config.ldif) lost by the upgrade" }
|
# The service registration is the administrator's, not the package's: the upgrade
|
# stopped it to free the jars, and must have left it registered and pointing at
|
# the same tree - the wrapper it names has just been replaced in place.
|
$svc = Get-Service -DisplayName "OpenDJ Server" -ErrorAction SilentlyContinue
|
if (-not $svc) { sc.exe query; throw "the upgrade unregistered the administrator's service" }
|
if ($svc.Status -ne "Stopped") { throw "the upgrade left the service $($svc.Status), expected Stopped" }
|
if (Get-Service OpenDJ -ErrorAction SilentlyContinue) { sc.exe query; throw "the package registered a service of its own" }
|
sc.exe qc "$($svc.Name)"
|
"OPENDJ_ROOT=$root" | Out-File -FilePath $env:GITHUB_ENV -Append
|
- name: Run upgrade.bat and start the upgraded server through the service
|
shell: pwsh
|
run: |
|
$root = $env:OPENDJ_ROOT
|
$env:OPENDJ_JAVA_ARGS = "-server -Xmx512m"
|
& "$root\upgrade.bat" --no-prompt --acceptLicense --force
|
if ($LASTEXITCODE -ne 0) { throw "upgrade.bat failed: $LASTEXITCODE" }
|
# The service registered before the upgrade still drives the refreshed tree.
|
net start "OpenDJ Server"
|
if ($LASTEXITCODE -ne 0) { throw "net start (upgraded) failed: $LASTEXITCODE" }
|
for ($i=0; $i -lt 12; $i++) { try { $c = New-Object System.Net.Sockets.TcpClient('localhost', 1636); $c.Close(); break } catch { Start-Sleep -Seconds 5 } }
|
# The pre-upgrade data must still be served
|
& "$root\bat\ldapsearch.bat" --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
if ($LASTEXITCODE -ne 0) { throw "ldapsearch after upgrade failed: $LASTEXITCODE" }
|
net stop "OpenDJ Server"
|
if ($LASTEXITCODE -ne 0) { throw "net stop (upgraded) failed: $LASTEXITCODE" }
|
- name: Repair must leave the service registration alone
|
shell: pwsh
|
run: |
|
# Nothing in the package controls a service, so a repair must not disturb the
|
# registration the administrator made - neither the one this upgrade inherited
|
# nor one belonging to an unrelated instance.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
$before = (Get-Service -DisplayName "OpenDJ Server").Name
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" REINSTALL=ALL REINSTALLMODE=vomus /quiet /qn /norestart /l*v repair.log"
|
if ($p.ExitCode -ne 0) { Get-Content repair.log -Tail 80; throw "repair failed: $($p.ExitCode)" }
|
$after = Get-Service -DisplayName "OpenDJ Server" -ErrorAction SilentlyContinue
|
if (-not $after) { throw "repair unregistered the service" }
|
if ($after.Name -ne $before) { throw "repair changed the service key name: $before -> $($after.Name)" }
|
Write-Host "Repair left the '$before' service in place"
|
- name: Disabling the service before uninstalling leaves no orphan
|
shell: pwsh
|
run: |
|
# msiexec /x removes the files it installed and nothing else - as the WiX3-era
|
# package did. Disabling the service is the administrator's step (the install
|
# guide says so, and uninstall.bat does it too); skipping it would leave an
|
# auto-start service pointing at a deleted tree.
|
$root = $env:OPENDJ_ROOT
|
& "$root\bat\windows-service.bat" --disableService
|
if ($LASTEXITCODE -ne 0) { throw "--disableService failed: $LASTEXITCODE" }
|
if (Get-Service -DisplayName "OpenDJ Server" -ErrorAction SilentlyContinue) { throw "--disableService left the service registered" }
|
- name: Auto-detect the legacy default directory on a fresh install
|
shell: pwsh
|
run: |
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
# Clean up the previous scenario first.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall1.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall1.log -Tail 80; throw "msiexec /x failed: $($p.ExitCode)" }
|
# An existing legacy default directory must be picked up when OPENDJ is not given.
|
New-Item -ItemType Directory -Force "C:\Program Files (x86)\OpenDJ" | Out-Null
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v install-autodetect.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-autodetect.log -Tail 80; throw "msiexec /i (autodetect) failed: $($p.ExitCode)" }
|
if (-not (Test-Path "C:\Program Files (x86)\OpenDJ\setup.bat")) { Get-Content install-autodetect.log -Tail 80; throw "installer did not auto-detect the legacy default dir" }
|
if (Test-Path "C:\Program Files\OpenDJ") { throw "installer used the x64 default dir despite an existing legacy dir" }
|
Write-Host "Legacy default directory auto-detected OK"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall2.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall2.log -Tail 80; throw "msiexec /x (cleanup) failed: $($p.ExitCode)" }
|
- name: Registry install-location detection on a fresh install
|
shell: pwsh
|
run: |
|
# The InstallDir registry value must be picked up when OPENDJ is not given, and it
|
# must beat the legacy Program Files (x86) directory (explicit SetProperty order).
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
New-Item -ItemType Directory -Force "C:\opendj-registry" | Out-Null
|
New-Item -ItemType Directory -Force "C:\Program Files (x86)\OpenDJ" | Out-Null
|
New-Item -Path HKLM:\SOFTWARE\OpenDJ -Force | Out-Null
|
Set-ItemProperty -Path HKLM:\SOFTWARE\OpenDJ -Name InstallDir -Value 'C:\opendj-registry\'
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v install-registry.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-registry.log -Tail 80; throw "msiexec /i (registry detect) failed: $($p.ExitCode)" }
|
if (-not (Test-Path "C:\opendj-registry\setup.bat")) { Get-Content install-registry.log -Tail 80; throw "installer did not use the registry InstallDir" }
|
if (Test-Path "C:\Program Files (x86)\OpenDJ\setup.bat") { throw "legacy directory beat the registry InstallDir" }
|
Write-Host "Registry install location detected OK"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall3.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall3.log -Tail 80; throw "msiexec /x (registry cleanup) failed: $($p.ExitCode)" }
|
- name: Silent upgrade from an undetectable directory must refuse with guidance
|
shell: pwsh
|
run: |
|
# A 5.1.x at a custom directory wrote no registry value: a /quiet upgrade
|
# without OPENDJ used to relocate to the default while RemoveExistingProducts
|
# emptied the old tree. The installer must refuse instead.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
# No detection signals at all - the guard under test is the one that fires when
|
# none resolves, so clear every one of them here rather than rely on the
|
# preceding step's uninstall having removed the registry value.
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart OPENDJ=C:\opendj-custom /l*v install-custom.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-custom.log -Tail 80; throw "msiexec /i (5.1.2 custom dir) failed: $($p.ExitCode)" }
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v upgrade-custom.log"
|
if ($p.ExitCode -eq 0) { Get-Content upgrade-custom.log -Tail 80; throw "upgrade without OPENDJ must refuse when the old location cannot be determined" }
|
# Match on the part of the message that states the condition, not on the
|
# instruction: the wording of the guidance has already been reworded once.
|
if (-not (Select-String -Path upgrade-custom.log -Pattern "location could not be determined" -Quiet)) { Get-Content upgrade-custom.log -Tail 60; throw "expected the explicit-OPENDJ guidance message in the log" }
|
if (-not (Test-Path "C:\opendj-custom\setup.bat")) { throw "the refused upgrade damaged the original install" }
|
Write-Host "Upgrade refused with guidance, original install untouched (exit $($p.ExitCode))"
|
# A named directory that is not the installation strands exactly as much data as
|
# naming none. With no registry value and no server in the legacy default, a typo
|
# used to satisfy this guard - the resolved directory is not the default - and the
|
# relocation guard had nothing to compare it against, so RemoveExistingProducts
|
# emptied C:\opendj-custom while the new tree landed one letter away.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=C:\opendj-custmo /quiet /qn /norestart /l*v upgrade-typo.log"
|
if ($p.ExitCode -ne 1603) { Get-Content upgrade-typo.log -Tail 120; throw "a named directory holding no server must be refused (expected 1603, got $($p.ExitCode))" }
|
if (-not (Select-String -Path upgrade-typo.log -Pattern "location could not be determined" -Quiet)) { Get-Content upgrade-typo.log -Tail 60; throw "expected the explicit-OPENDJ guidance message in the log" }
|
if (Test-Path "C:\opendj-custmo") { throw "the refused upgrade still created the mistyped directory" }
|
if (-not (Test-Path "C:\opendj-custom\setup.bat")) { throw "the refused upgrade damaged the original install" }
|
Write-Host "A mistyped target was refused, original install untouched (exit $($p.ExitCode))"
|
# ...and naming the directory makes the very same upgrade proceed. This is what
|
# a GUI administrator does by browsing to it in InstallDirDlg, which the refusal
|
# must leave reachable: it fires on the resolved directory, not on the absence
|
# of a command-line property.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=C:\opendj-custom /quiet /qn /norestart /l*v upgrade-custom-ok.log"
|
if ($p.ExitCode -ne 0) { Get-Content upgrade-custom-ok.log -Tail 120; throw "upgrade with an explicit OPENDJ must succeed: $($p.ExitCode)" }
|
if (-not (Test-Path "C:\opendj-custom\lib\opendj_service.exe")) { throw "the upgrade did not land in C:\opendj-custom" }
|
if (Test-Path "C:\Program Files\OpenDJ") { throw "the upgrade installed into the default directory as well" }
|
Write-Host "Upgrade into the named directory succeeded"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall-custom.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-custom.log -Tail 80; throw "msiexec /x (custom cleanup) failed: $($p.ExitCode)" }
|
Remove-Item -Recurse -Force "C:\opendj-custom" -ErrorAction SilentlyContinue
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
- name: An empty legacy directory must not be adopted during an upgrade
|
shell: pwsh
|
run: |
|
# NOT Installed holds during a major upgrade too, so the legacy-directory
|
# fallback used to fire on a leftover EMPTY Program Files (x86)\OpenDJ: the new
|
# tree would land there while RemoveExistingProducts emptied the real install
|
# somewhere else. During an upgrade the directory must prove it holds a server.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart OPENDJ=C:\opendj-old /l*v install-old-custom.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-old-custom.log -Tail 80; throw "msiexec /i (5.1.2 at C:\opendj-old) failed: $($p.ExitCode)" }
|
New-Item -ItemType Directory -Force "C:\Program Files (x86)\OpenDJ" | Out-Null
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v upgrade-emptylegacy.log"
|
if ($p.ExitCode -eq 0) { Get-Content upgrade-emptylegacy.log -Tail 120; throw "an upgrade with no determinable location must be refused, not routed to an empty legacy directory" }
|
# A non-zero exit code on its own only says msiexec failed; both neighbouring
|
# scenarios name the guard they are about, and so must this one.
|
if (-not (Select-String -Path upgrade-emptylegacy.log -Pattern "location could not be determined" -Quiet)) { Get-Content upgrade-emptylegacy.log -Tail 60; throw "expected the explicit-OPENDJ guidance message in the log" }
|
if (Test-Path "C:\Program Files (x86)\OpenDJ\setup.bat") { throw "the upgrade installed into the empty legacy directory" }
|
if (-not (Test-Path "C:\opendj-old\setup.bat")) { throw "the refused upgrade damaged the original install" }
|
Write-Host "Empty legacy directory not adopted, upgrade refused (exit $($p.ExitCode))"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x opendj-5.1.2.msi /quiet /qn /norestart /l*v uninstall-old-custom.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-old-custom.log -Tail 80; throw "msiexec /x (5.1.2 cleanup) failed: $($p.ExitCode)" }
|
Remove-Item -Recurse -Force "C:\opendj-old" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
- name: An upgrade that would relocate the installation must refuse
|
shell: pwsh
|
run: |
|
# Passing a different OPENDJ over a detected installation is not a move:
|
# RemoveExistingProducts would empty the old tree while the new one is installed
|
# elsewhere, stranding config/db/logs (and any service registration) behind.
|
#
|
# The older package has to be a different ProductCode for this to be an upgrade
|
# at all: reinstalling this very MSI over itself is maintenance mode, where
|
# FindRelatedProducts does not run, so WIX_UPGRADE_DETECTED would never be set
|
# and the guard could not fire. Hence the released 5.1.2 package, installed at
|
# its native legacy default so both branches of the guard have something to
|
# compare against.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
# Clear every location this scenario reasons about itself, rather than inheriting
|
# the previous step's teardown: the starting state is what the guard is judged
|
# against, so it belongs in the step that makes the judgement.
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\opendj-b" -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart /l*v install-old-legacy.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-old-legacy.log -Tail 80; throw "msiexec /i (5.1.2) failed: $($p.ExitCode)" }
|
if (-not (Test-Path "C:\Program Files (x86)\OpenDJ\setup.bat")) { throw "5.1.2 did not install into the legacy default" }
|
# (a) the recorded-location branch: a host that came through a 5.2.0-or-later
|
# package has its install directory in the registry.
|
New-Item -Path HKLM:\SOFTWARE\OpenDJ -Force | Out-Null
|
Set-ItemProperty -Path HKLM:\SOFTWARE\OpenDJ -Name InstallDir -Value 'C:\Program Files (x86)\OpenDJ\'
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=C:\opendj-b /quiet /qn /norestart /l*v relocate-reg.log"
|
if ($p.ExitCode -eq 0) { Get-Content relocate-reg.log -Tail 120; throw "a relocating upgrade must be refused (recorded location)" }
|
if (-not (Select-String -Path relocate-reg.log -Pattern "cannot move an existing installation" -Quiet)) { Get-Content relocate-reg.log -Tail 60; throw "expected the relocation guidance message in the log" }
|
if (Test-Path "C:\opendj-b") { throw "the refused relocation still created C:\opendj-b" }
|
# (b) the legacy-directory branch: no registry value, the old install proven by
|
# the setup.bat in the legacy default.
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=C:\opendj-b /quiet /qn /norestart /l*v relocate-legacy.log"
|
if ($p.ExitCode -eq 0) { Get-Content relocate-legacy.log -Tail 120; throw "a relocating upgrade must be refused (legacy directory)" }
|
if (-not (Select-String -Path relocate-legacy.log -Pattern "cannot move an existing installation" -Quiet)) { Get-Content relocate-legacy.log -Tail 60; throw "expected the relocation guidance message in the log" }
|
if (Test-Path "C:\opendj-b") { throw "the refused relocation still created C:\opendj-b" }
|
if (-not (Test-Path "C:\Program Files (x86)\OpenDJ\setup.bat")) { throw "the refused relocation damaged the original install" }
|
Write-Host "Relocating upgrade refused on both branches, original install untouched"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x opendj-5.1.2.msi /quiet /qn /norestart /l*v uninstall-old-legacy.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-old-legacy.log -Tail 80; throw "msiexec /x (5.1.2 cleanup) failed: $($p.ExitCode)" }
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
- name: A stray OpenDJ tree in the default directory must not be adopted
|
shell: pwsh
|
run: |
|
# The product being upgraded is a 5.1.x in a custom directory, which recorded
|
# nothing, while some unrelated OpenDJ tree - a zip install, a copy - sits in the
|
# x64 default. A setup.bat existence test cannot tell the two apart, so a guard
|
# keyed on it stood down: RemoveExistingProducts gutted the real installation
|
# while InstallFiles landed on the stranger, and msiexec exited 0.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart OPENDJ=C:\opendj-real /l*v install-old-real.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-old-real.log -Tail 80; throw "msiexec /i (5.1.2 at C:\opendj-real) failed: $($p.ExitCode)" }
|
# The decoy: everything the installer is able to ask about a directory.
|
New-Item -ItemType Directory -Force "C:\Program Files\OpenDJ\lib" | Out-Null
|
Set-Content "C:\Program Files\OpenDJ\setup.bat" '@echo off'
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v upgrade-decoy.log"
|
if ($p.ExitCode -eq 0) { Get-Content upgrade-decoy.log -Tail 120; throw "an upgrade must not adopt a stray tree in the default directory" }
|
if (-not (Select-String -Path upgrade-decoy.log -Pattern "location could not be determined" -Quiet)) { Get-Content upgrade-decoy.log -Tail 60; throw "expected the explicit-OPENDJ guidance message in the log" }
|
if (Test-Path "C:\Program Files\OpenDJ\lib\opendj_service.exe") { throw "the refused upgrade installed into the stray tree" }
|
if (-not (Test-Path "C:\opendj-real\setup.bat")) { throw "the refused upgrade damaged the original install" }
|
# ...and naming the real directory gets the administrator through, decoy or not.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=C:\opendj-real /quiet /qn /norestart /l*v upgrade-decoy-ok.log"
|
if ($p.ExitCode -ne 0) { Get-Content upgrade-decoy-ok.log -Tail 120; throw "upgrade with an explicit OPENDJ must succeed: $($p.ExitCode)" }
|
if (-not (Test-Path "C:\opendj-real\lib\opendj_service.exe")) { throw "the upgrade did not land in C:\opendj-real" }
|
if (Test-Path "C:\Program Files\OpenDJ\lib\opendj_service.exe") { throw "the upgrade also installed into the stray tree" }
|
Write-Host "Stray default-directory tree ignored: refused, then upgraded where told"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall-real.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-real.log -Tail 80; throw "msiexec /x (decoy cleanup) failed: $($p.ExitCode)" }
|
Remove-Item -Recurse -Force "C:\opendj-real" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
- name: An old server in the default directory upgrades once it is named
|
shell: pwsh
|
run: |
|
# The price of the scenario above: a 5.1.x that really does live in the x64
|
# default recorded nothing either, so the package cannot tell it from the decoy
|
# and refuses the silent upgrade that would have gone through before. What it
|
# must not do is dead-end - the directory is a configurable property, and naming
|
# it (which is also what browsing to it in the wizard amounts to) has to work.
|
#
|
# The old tree gets there by hand rather than through OPENDJ=: the released
|
# 5.1.x package is x86, and a 32-bit package cannot install into the 64-bit
|
# Program Files at all - Windows Installer resolves its [ProgramFilesFolder] to
|
# Program Files (x86) whatever the directory property says, so msiexec exits 0
|
# while the files land in the legacy default, which is a different scenario (one
|
# the legacy-directory search resolves on its own). Installing into a custom
|
# directory and moving the tree leaves exactly what this one needs: an
|
# upgradable 5.1.x registration, no recorded location, no legacy directory, and
|
# a real old server sitting in C:\Program Files\OpenDJ. That the registration is
|
# left pointing at the directory the move emptied costs nothing - no guard reads
|
# it, and RemoveExistingProducts tolerates the files being gone.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\opendj-x64src" -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart OPENDJ=C:\opendj-x64src /l*v install-old-x64.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-old-x64.log -Tail 80; throw "msiexec /i (5.1.2 at C:\opendj-x64src) failed: $($p.ExitCode)" }
|
# Exit code 0 says msiexec ran, not that it put the files where it was told, and
|
# a directory it silently declined to use is worth naming in the failure.
|
if (-not (Test-Path "C:\opendj-x64src\setup.bat")) { Get-ChildItem "C:\Program Files\OpenDJ","C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue | Select-Object -First 5 -ExpandProperty FullName; Get-Content install-old-x64.log -Tail 80; throw "5.1.2 did not install into C:\opendj-x64src" }
|
Move-Item "C:\opendj-x64src" "C:\Program Files\OpenDJ"
|
if (-not (Test-Path "C:\Program Files\OpenDJ\setup.bat")) { throw "the 5.1.2 tree did not move into C:\Program Files\OpenDJ" }
|
# 5.1.x ships lib\opendj_service.exe itself, so the file cannot say whose tree
|
# this is; its content can. Both halves below are judged on the two things only
|
# the new package produces: this payload, and the InstallDir registry value.
|
$oldWrapper = (Get-FileHash "C:\Program Files\OpenDJ\lib\opendj_service.exe").Hash
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v upgrade-x64-silent.log"
|
if ($p.ExitCode -eq 0) { Get-Content upgrade-x64-silent.log -Tail 120; throw "a silent upgrade with nothing recording the location must refuse" }
|
if (-not (Select-String -Path upgrade-x64-silent.log -Pattern "location could not be determined" -Quiet)) { Get-Content upgrade-x64-silent.log -Tail 60; throw "expected the explicit-OPENDJ guidance message in the log" }
|
if (Test-Path HKLM:\SOFTWARE\OpenDJ) { throw "the refused upgrade registered an install location" }
|
if ((Get-FileHash "C:\Program Files\OpenDJ\lib\opendj_service.exe").Hash -ne $oldWrapper) { throw "the refused upgrade overwrote the old server" }
|
# The signal that says "this directory was named" has to be public - a private
|
# property set in the UI sequence never reaches the installer service, where the
|
# guards run - so it must not be usable as a switch. It holds the named path and
|
# the guard requires the resolved directory to START WITH it: a flag-shaped value
|
# disarms nothing, and a value that does pass has spelled out the directory, which
|
# is naming it. It is not the only conjunct either - the target still has to hold a
|
# server - so even a matching prefix cannot stand in for that evidence.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ_GIVEN=1 /quiet /qn /norestart /l*v upgrade-x64-switch.log"
|
if ($p.ExitCode -ne 1603) { Get-Content upgrade-x64-switch.log -Tail 120; throw "OPENDJ_GIVEN=1 must not switch the guard off (expected 1603, got $($p.ExitCode))" }
|
if (-not (Select-String -Path upgrade-x64-switch.log -Pattern "location could not be determined" -Quiet)) { Get-Content upgrade-x64-switch.log -Tail 60; throw "the refusal must still come from the same guard" }
|
if ((Get-FileHash "C:\Program Files\OpenDJ\lib\opendj_service.exe").Hash -ne $oldWrapper) { throw "the upgrade that OPENDJ_GIVEN=1 let through overwrote the old server" }
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=`"C:\Program Files\OpenDJ`" /quiet /qn /norestart /l*v upgrade-x64-named.log"
|
if ($p.ExitCode -ne 0) { Get-Content upgrade-x64-named.log -Tail 120; throw "the named upgrade into the default directory must succeed: $($p.ExitCode)" }
|
if ((Get-FileHash "C:\Program Files\OpenDJ\lib\opendj_service.exe").Hash -eq $oldWrapper) { Get-Content upgrade-x64-named.log -Tail 120; throw "the upgrade did not land in C:\Program Files\OpenDJ" }
|
# The only OPENDJ in this workflow whose value carries spaces: what the package
|
# recorded proves it survived the command line and the elevation intact.
|
$recorded = (Get-ItemProperty -Path HKLM:\SOFTWARE\OpenDJ -Name InstallDir -ErrorAction SilentlyContinue).InstallDir
|
if ($recorded -notlike "C:\Program Files\OpenDJ*") { throw "the upgrade recorded '$recorded', not the directory it was told to use" }
|
Write-Host "Default-directory upgrade refused silently, accepted when named"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall-x64.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-x64.log -Tail 80; throw "msiexec /x (x64 default cleanup) failed: $($p.ExitCode)" }
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\opendj-x64src" -ErrorAction SilentlyContinue
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
- name: Fresh install must not touch a service registered by another instance
|
shell: pwsh
|
run: |
|
# A leftover Program Files (x86)\OpenDJ plus an "OpenDJ Server" belonging to a
|
# zip instance elsewhere: installing to a third directory must leave that
|
# registration completely alone. The package controls no service at all, so this
|
# holds by construction - the scenario guards against reintroducing one.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
New-Item -ItemType Directory -Force "C:\Program Files (x86)\OpenDJ" | Out-Null
|
sc.exe create "OpenDJ Server" binPath= "C:\zip-instance\lib\opendj_service.exe start ""C:\zip-instance.""" start= demand
|
if ($LASTEXITCODE -ne 0) { throw "sc create failed: $LASTEXITCODE" }
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=C:\opendj-elsewhere /quiet /qn /norestart /l*v install-elsewhere.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-elsewhere.log -Tail 80; throw "msiexec /i (elsewhere) failed: $($p.ExitCode)" }
|
if (-not (Test-Path "C:\opendj-elsewhere\setup.bat")) { throw "install did not land in C:\opendj-elsewhere" }
|
if (-not (Get-Service "OpenDJ Server" -ErrorAction SilentlyContinue)) { throw "fresh install elsewhere deleted an unrelated instance's service" }
|
sc.exe delete "OpenDJ Server"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall-elsewhere.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-elsewhere.log -Tail 80; throw "msiexec /x (elsewhere cleanup) failed: $($p.ExitCode)" }
|
Write-Host "Fresh install elsewhere left the unrelated 'OpenDJ Server' service in place"
|
- name: An upgrade must refuse while the service is still starting
|
shell: pwsh
|
run: |
|
# The SCM takes no controls in a pending state: StopServiceBeforeUpgrade's
|
# 'net stop' fails instantly with ERROR_SERVICE_CANNOT_ACCEPT_CTRL and
|
# Return="ignore" eats it. StartPending is not 'Running', so a check that
|
# sampled the state once waved the upgrade through with a JVM coming up on the
|
# tree being replaced - and the jars are unversioned, so the delete-on-reboot
|
# entries left behind by the nested uninstall name the paths the NEW jars
|
# occupy. Reproducible because the wrapper reports START_PENDING for as long as
|
# bat\start-ds.bat runs, which service.c gives 300 s.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart /l*v install-old-pending.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-old-pending.log -Tail 80; throw "msiexec /i (5.1.2) failed: $($p.ExitCode)" }
|
$root = "C:\Program Files (x86)\OpenDJ"
|
$env:OPENDJ_JAVA_ARGS = "-server -Xmx512m"
|
& "$root\setup.bat" -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS --generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com --addBaseEntry --cli --acceptLicense --no-prompt --doNotStart
|
if ($LASTEXITCODE -ne 0) { throw "setup.bat (5.1.2) failed: $LASTEXITCODE" }
|
& "$root\bat\windows-service.bat" --enableService
|
if ($LASTEXITCODE -ne 0) { throw "windows-service --enableService failed: $LASTEXITCODE" }
|
# Hold the start open: the wrapper waits for this script, reporting START_PENDING
|
# the whole time. No JVM is needed - the guard is being asked about a service
|
# state, not about a lock.
|
Copy-Item "$root\bat\start-ds.bat" "$root\bat\start-ds.bat.orig"
|
Set-Content "$root\bat\start-ds.bat" "@echo off`r`nping -n 240 127.0.0.1 >nul"
|
sc.exe start "OpenDJ Server" | Out-Null
|
for ($i = 0; $i -lt 15; $i++) {
|
$st = (Get-Service "OpenDJ Server" -ErrorAction SilentlyContinue).Status
|
if ($st -eq 'StartPending') { break }
|
Start-Sleep -Seconds 1
|
}
|
$st = (Get-Service "OpenDJ Server" -ErrorAction SilentlyContinue).Status
|
if ($st -ne 'StartPending') { throw "expected the service to be StartPending, got '$st'" }
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v upgrade-pending.log"
|
# A refusal from a Return="check" custom action is 1722 in the log and 1603 out of
|
# msiexec, and nothing else. "-ne 0" would also accept 3010 - which is the FAIL-OPEN
|
# outcome, the upgrade going through and leaving the files it could not replace to a
|
# reboot - so the exact code is what gets asserted. Same reasoning for the log: the
|
# action NAME appears whether it ran and passed, ran and failed, or was skipped by
|
# its condition, so the return value has to be part of the pattern.
|
if ($p.ExitCode -ne 1603) { Get-Content upgrade-pending.log -Tail 120; throw "the upgrade must refuse while the service is starting (expected 1603, got $($p.ExitCode))" }
|
if (-not (Select-String -Path upgrade-pending.log -Pattern "CheckServiceStopped\. Return value 3" -Quiet)) { Get-Content upgrade-pending.log -Tail 60; throw "the refusal must come from CheckServiceStopped" }
|
if (-not (Test-Path "$root\config\config.ldif")) { throw "the refused upgrade damaged the instance" }
|
if (-not (Test-Path "$root\setup.bat")) { throw "the refused upgrade damaged the installation" }
|
Write-Host "Upgrade refused while the service was StartPending (exit $($p.ExitCode))"
|
# Teardown: the wrapper is still sitting on the held-open start.
|
Stop-Process -Name opendj_service -Force -ErrorAction SilentlyContinue
|
Get-Process -Name PING -ErrorAction SilentlyContinue | Stop-Process -Force
|
Start-Sleep -Seconds 5
|
Move-Item -Force "$root\bat\start-ds.bat.orig" "$root\bat\start-ds.bat"
|
& "$root\bat\windows-service.bat" --disableService
|
if (Get-Service "OpenDJ Server" -ErrorAction SilentlyContinue) { sc.exe delete "OpenDJ Server" }
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x opendj-5.1.2.msi /quiet /qn /norestart /l*v uninstall-pending.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-pending.log -Tail 80; throw "msiexec /x (5.1.2 cleanup) failed: $($p.ExitCode)" }
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
- name: A decoy in the legacy default must not block the documented workaround
|
shell: pwsh
|
run: |
|
# The mirror of "a stray OpenDJ tree in the default directory must not be adopted",
|
# with the stray tree in the LEGACY default instead - where the install guide says
|
# to pass OPENDJ, and where the relocation guard used to refuse that very command:
|
# the legacy directory holds A server, the named directory is not it, refuse. The
|
# installation then had no upgrade path at all, silent or named.
|
# Both halves are asserted here, because the exception that fixes it is narrow: the
|
# named directory has to hold a server. Naming an empty one is still a relocation.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\opendj-b" -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart OPENDJ=C:\opendj-mine /l*v install-old-mine.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-old-mine.log -Tail 80; throw "msiexec /i (5.1.2 at C:\opendj-mine) failed: $($p.ExitCode)" }
|
if (-not (Test-Path "C:\opendj-mine\setup.bat")) { Get-Content install-old-mine.log -Tail 80; throw "5.1.2 did not install into C:\opendj-mine" }
|
# The decoy: a zip installation, a copy, a decommissioned instance - anything a
|
# setup.bat search cannot tell from the product being upgraded.
|
New-Item -ItemType Directory -Force "C:\Program Files (x86)\OpenDJ\lib" | Out-Null
|
Set-Content "C:\Program Files (x86)\OpenDJ\setup.bat" '@echo off'
|
# Naming a directory that holds no server is still a relocation, decoy or not.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=C:\opendj-b /quiet /qn /norestart /l*v relocate-decoy.log"
|
if ($p.ExitCode -eq 0) { Get-Content relocate-decoy.log -Tail 120; throw "naming an empty directory is a relocation and must be refused" }
|
if (-not (Select-String -Path relocate-decoy.log -Pattern "cannot move an existing installation" -Quiet)) { Get-Content relocate-decoy.log -Tail 60; throw "expected the relocation guidance message in the log" }
|
if (Test-Path "C:\opendj-b") { throw "the refused relocation still created C:\opendj-b" }
|
# ...and naming the real one is the workaround the install guide prescribes.
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" OPENDJ=C:\opendj-mine /quiet /qn /norestart /l*v upgrade-mine.log"
|
if ($p.ExitCode -ne 0) { Get-Content upgrade-mine.log -Tail 120; throw "the documented workaround must upgrade the named installation: $($p.ExitCode)" }
|
if (-not (Test-Path "C:\opendj-mine\lib\opendj_service.exe")) { throw "the upgrade did not land in C:\opendj-mine" }
|
if (Test-Path "C:\Program Files (x86)\OpenDJ\lib\opendj_service.exe") { throw "the upgrade also installed into the decoy" }
|
Write-Host "Legacy-default decoy: empty target refused, named installation upgraded"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall-mine.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-mine.log -Tail 80; throw "msiexec /x (decoy cleanup) failed: $($p.ExitCode)" }
|
Remove-Item -Recurse -Force "C:\opendj-mine" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
- name: An upgrade must refuse while a server runs without a service
|
shell: pwsh
|
run: |
|
# The mode this package ships by default: setup registers no service, so the
|
# server started by bat\start-ds.bat is a plain JVM holding lib\*.jar. There is no
|
# service key for the ImagePath-gated pair to match, and Restart Manager is not
|
# allowed to shut anything down, so CheckServerNotRunning - the byte-range lock on
|
# locks\server.lock - is the only thing standing between a running server and
|
# RemoveExistingProducts renaming its jars into delete-on-reboot entries.
|
$msi = (Get-ChildItem -Recurse -Filter *.msi -Path opendj-packages/opendj-msi | Select-Object -First 1).FullName
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Recurse -Force "C:\Program Files\OpenDJ" -ErrorAction SilentlyContinue
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i opendj-5.1.2.msi /quiet /qn /norestart /l*v install-old-running.log"
|
if ($p.ExitCode -ne 0) { Get-Content install-old-running.log -Tail 80; throw "msiexec /i (5.1.2) failed: $($p.ExitCode)" }
|
$root = "C:\Program Files (x86)\OpenDJ"
|
$env:OPENDJ_JAVA_ARGS = "-server -Xmx512m"
|
& "$root\setup.bat" -h localhost -p 1389 --ldapsPort 1636 --adminConnectorPort 4444 --enableStartTLS --generateSelfSignedCertificate --rootUserDN "cn=Directory Manager" --rootUserPassword password --baseDN dc=example,dc=com --addBaseEntry --cli --acceptLicense --no-prompt --doNotStart
|
if ($LASTEXITCODE -ne 0) { throw "setup.bat (5.1.2) failed: $LASTEXITCODE" }
|
& "$root\bat\start-ds.bat"
|
if ($LASTEXITCODE -ne 0) { throw "start-ds.bat failed: $LASTEXITCODE" }
|
for ($i=0; $i -lt 12; $i++) { try { $c = New-Object System.Net.Sockets.TcpClient('localhost', 1636); $c.Close(); break } catch { Start-Sleep -Seconds 5 } }
|
if (Get-Service "OpenDJ Server" -ErrorAction SilentlyContinue) { throw "this scenario is about a server with NO service registered" }
|
# The headline auto-detected upgrade, which would otherwise proceed straight into
|
# the running server's tree. The refusal costs the full 60 s grace inside the
|
# check: a server that is genuinely up never releases the lock.
|
$pendingKey = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager"
|
$pendingBefore = @((Get-ItemProperty -Path $pendingKey -Name PendingFileRenameOperations -ErrorAction SilentlyContinue).PendingFileRenameOperations)
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v upgrade-running.log"
|
# Exactly 1603 (custom action 1722), for the reason spelled out in the StartPending
|
# scenario above: 3010 is what a guard that fails open produces here, and "-ne 0"
|
# cannot tell the two apart. The action name alone cannot either - it is written to
|
# the log whether the action refused or waved the upgrade through.
|
if ($p.ExitCode -ne 1603) { Get-Content upgrade-running.log -Tail 120; throw "the upgrade must refuse while a server is running out of the tree (expected 1603, got $($p.ExitCode))" }
|
if (-not (Select-String -Path upgrade-running.log -Pattern "CheckServerNotRunning\. Return value 3" -Quiet)) { Get-Content upgrade-running.log -Tail 60; throw "the refusal must come from CheckServerNotRunning" }
|
# The signature of the fail-open, and the damage it does: RemoveExistingProducts
|
# cannot rename a jar the JVM holds, so it leaves a delete-on-reboot entry naming
|
# the path the new jar occupies. A refusal leaves none.
|
$pendingAfter = @((Get-ItemProperty -Path $pendingKey -Name PendingFileRenameOperations -ErrorAction SilentlyContinue).PendingFileRenameOperations)
|
$pendingNew = $pendingAfter | Where-Object { $_ -and $pendingBefore -notcontains $_ }
|
if ($pendingNew) { throw "the refused upgrade still scheduled files for delete-on-reboot: $($pendingNew -join '; ')" }
|
if (-not (Test-Path "$root\config\config.ldif")) { throw "the refused upgrade damaged the instance" }
|
& "$root\bat\ldapsearch.bat" --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "dc=example,dc=com" --searchScope base "(objectClass=*)" 1.1
|
if ($LASTEXITCODE -ne 0) { throw "the refused upgrade disturbed the running server" }
|
Write-Host "Upgrade refused while a non-service server was running (exit $($p.ExitCode))"
|
# Stopping it makes the very same upgrade proceed - and the 60 s grace inside the
|
# check is what absorbs the gap between stop-ds returning and the JVM releasing
|
# the lock, so no wait is needed here to keep this half honest.
|
& "$root\bat\stop-ds.bat"
|
if ($LASTEXITCODE -ne 0) { throw "stop-ds.bat failed: $LASTEXITCODE" }
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/i `"$msi`" /quiet /qn /norestart /l*v upgrade-stopped.log"
|
if ($p.ExitCode -ne 0) { Get-Content upgrade-stopped.log -Tail 120; throw "the upgrade must proceed once the server is stopped: $($p.ExitCode)" }
|
if (-not (Test-Path "$root\lib\opendj_service.exe")) { throw "the upgrade did not land in $root" }
|
if (-not (Test-Path "$root\config\config.ldif")) { throw "the upgrade lost the instance data" }
|
Write-Host "The same upgrade proceeded once the server was stopped"
|
$p = Start-Process msiexec -Wait -PassThru -ArgumentList "/x `"$msi`" /quiet /qn /norestart /l*v uninstall-running.log"
|
if ($p.ExitCode -ne 0) { Get-Content uninstall-running.log -Tail 80; throw "msiexec /x (running-server cleanup) failed: $($p.ExitCode)" }
|
Remove-Item -Recurse -Force "C:\Program Files (x86)\OpenDJ" -ErrorAction SilentlyContinue
|
Remove-Item -Path HKLM:\SOFTWARE\OpenDJ -Recurse -Force -ErrorAction SilentlyContinue
|
