release: 发布 0.5.2 版本.

CVE-2022-42004 漏洞报告指出, 由于 jackson-databind 的有关错误, 导致对象序列化过程可能存在数据错误的问题,
目前 jackson-databind 已发布 2.13.4.2 版本以解决该问题, 由于引入 jackson-databind 的 telegrambots 库尚未发布针对该问题的修复版本,
故在本项目中引入新版依赖项, 以确保用户不受该问题影响.
该版本已在 TelegramBots 项目(版本 6.1.0)中进行测试, 测试通过.
------------------------------------------
https://devhub.checkmarx.com/cve-details/CVE-2022-42004/

.dockerignore

@@ -0,0 +1,2 @@
+**/
+!scalabot-app/build/install/

.github/workflows/build-and-test.yml

@@ -18,17 +18,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
-    - name: Set up JDK 11
-      uses: actions/setup-java@v3
-      with:
-        java-version: '11'
-        distribution: 'adopt-hotspot'
-        cache: 'gradle'
-    - name: Grant execute permission for gradlew
-      run: chmod +x gradlew
-    - name: Build and test
-      uses: gradle/gradle-build-action@v2.2.1
-      with:
-        gradle-version: 'wrapper'
-        arguments: test
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt-hotspot'
+          cache: 'gradle'
+      - uses: gradle/wrapper-validation-action@v1
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+      - name: Build and test
+        uses: gradle/gradle-build-action@v2.2.1
+        with:
+          gradle-version: 'wrapper'
+          arguments: test

.github/workflows/create-release.yml

@@ -0,0 +1,65 @@
+name: Create release draft
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+
+# 该 Action 有以下步骤：
+# 1. 拉取并构建代码, 然后生成 Application 发行包;
+# 2. 创建 Release, 并标记为 Draft(草稿);
+# 3. 上传 Application 发行包;
+
+permissions:
+  contents: write
+
+jobs:
+  create-release:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      # 创建更新日志.
+      - name: 'Get Previous tag'
+        id: previous-tag
+        uses: younited/get-previous-tag-action@v1.0.0
+        with:
+          match: "v*.*.*"
+      - name: Set up Python 3
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install Commitizen
+        run: pip install -U commitizen
+      - name: Create Change log
+        run: cz ch --start-rev ${{ steps.previous-tag.outputs.previous-tag }} --file-name ${{ github.workspace }}/CURRENT_CHANGELOG.md
+
+      # 开始构建项目.
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt-hotspot'
+          cache: 'gradle'
+      - uses: gradle/wrapper-validation-action@v1
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+      - name: Build and test
+        uses: gradle/gradle-build-action@v2.2.1
+        with:
+          gradle-version: 'wrapper'
+          arguments: clean test assembleDist
+
+      # 创建新的发行版本
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        with:
+          draft: true
+          body_path: ${{ github.workspace }}/CURRENT_CHANGELOG.md
+          files: |
+            */build/distributions/*
+            */build/libs/*

.github/workflows/gradle-wrapper-validation.yml

@@ -1,10 +0,0 @@
-name: "Validate Gradle Wrapper"
-on: [push, pull_request]
-
-jobs:
-  validation:
-    name: "Validation"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: gradle/wrapper-validation-action@v1

.github/workflows/publish-artifacts.yml

@@ -0,0 +1,49 @@
+name: Publish artifacts
+
+on:
+  release:
+    types:
+      - published
+
+env:
+  IMAGE_NAME: lamgc/scalabot
+
+jobs:
+  publish-container-image:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt-hotspot'
+          cache: 'gradle'
+      - uses: gradle/wrapper-validation-action@v1
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+      - name: Build and test
+        uses: gradle/gradle-build-action@v2.2.1
+        with:
+          gradle-version: 'wrapper'
+          arguments: clean test installDist
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker BuildX
+        uses: docker/setup-buildx-action@v2
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push container image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          tags: ${{ env.IMAGE_NAME }}:latest, ${{ env.IMAGE_NAME }}:${{ github.ref_name }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/release-dev-container-image.yml

@@ -0,0 +1,49 @@
+name: Build development version container image
+
+on:
+  push:
+    branches:
+      - "main"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt-hotspot'
+          cache: 'gradle'
+      - uses: gradle/wrapper-validation-action@v1
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+      - name: Build project and install Distribution package
+        uses: gradle/gradle-build-action@v2.2.1
+        with:
+          gradle-version: 'wrapper'
+          arguments: installDist
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker BuildX
+        uses: docker/setup-buildx-action@v2
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push container image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          tags: lamgc/scalabot:dev
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Dockerfile

@@ -0,0 +1,8 @@
+FROM openjdk:18
+
+ENV BOT_DATA_PATH /scalabot/data/
+WORKDIR /scalabot/run/
+
+CMD ["/scalabot/app/bin/scalabot-app"]
+
+COPY scalabot-app/build/install/scalabot-app/ /scalabot/app/

build.gradle.kts

@@ -1,5 +1,5 @@
 plugins {
-    kotlin("jvm") version "1.6.10" apply false
+    kotlin("jvm") version "1.7.10" apply false
     id("org.jetbrains.kotlinx.kover") version "0.5.1" apply false
 }
 
@@ -12,5 +12,5 @@ allprojects {
 
     }
     group = "net.lamgc"
-    version = "0.5.0"
+    version = "0.5.2"
 }

scalabot-app/build.gradle.kts

@@ -10,9 +10,9 @@ dependencies {
     implementation(project(":scalabot-meta"))
     implementation(project(":scalabot-extension"))
 
-    implementation("org.slf4j:slf4j-api:1.7.36")
+    implementation("org.slf4j:slf4j-api:2.0.0")
     implementation("io.github.microutils:kotlin-logging:2.1.23")
-    implementation("ch.qos.logback:logback-classic:1.2.11")
+    implementation("ch.qos.logback:logback-classic:1.4.0")
 
     val aetherVersion = "1.1.0"
     implementation("org.eclipse.aether:aether-api:$aetherVersion")
@@ -23,7 +23,7 @@ dependencies {
     implementation("org.eclipse.aether:aether-connector-basic:$aetherVersion")
     implementation("org.apache.maven:maven-aether-provider:3.3.9")
 
-    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.2")
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.4")
     implementation("org.jetbrains.kotlin:kotlin-reflect:1.6.20")
     implementation("com.google.code.gson:gson:2.9.0")
 
@@ -32,11 +32,15 @@ dependencies {
     implementation("org.telegram:telegrambots-abilities:6.1.0")
     implementation("org.telegram:telegrambots:6.1.0")
 
-    implementation("io.prometheus:simpleclient:0.15.0")
-    implementation("io.prometheus:simpleclient_httpserver:0.15.0")
+    // Added as a mitigation measure for vulnerabilities.
+    // When the relevant reference dependency updates it, it will be removed.
+    implementation("com.fasterxml.jackson.core:jackson-databind:2.13.4.2")
+
+    implementation("io.prometheus:simpleclient:0.16.0")
+    implementation("io.prometheus:simpleclient_httpserver:0.16.0")
 
     testImplementation(kotlin("test"))
-    testImplementation("io.mockk:mockk:1.12.4")
+    testImplementation("io.mockk:mockk:1.12.7")
     testImplementation("com.github.stefanbirkner:system-lambda:1.2.1")
 }
 
@@ -56,3 +60,8 @@ application {
 tasks.jar.configure {
     exclude("**/logback-test.xml")
 }
+
+tasks.withType<AbstractArchiveTask>().configureEach {
+    isPreserveFileTimestamps = false
+    isReproducibleFileOrder = true
+}

scalabot-app/src/main/kotlin/AppConfigs.kt

@@ -18,6 +18,8 @@ import java.net.URL
 import java.nio.charset.StandardCharsets
 import java.util.concurrent.atomic.AtomicBoolean
 import java.util.concurrent.atomic.AtomicInteger
+import java.util.function.Supplier
+import kotlin.reflect.KProperty
 
 private val log = KotlinLogging.logger { }
 
@@ -102,9 +104,9 @@ private fun createDefaultRepositoryId(): String {
  * 必须提供 `pathSupplier` 或 `fileSupplier` 其中一个, 才能正常提供路径.
  */
 internal enum class AppPaths(
-    private val pathSupplier: () -> String = { fileSupplier.invoke().canonicalPath },
+    private val pathSupplier: PathSupplier,
     private val initializer: AppPaths.() -> Unit = AppPaths::defaultInitializer,
-    private val fileSupplier: () -> File = { File(pathSupplier()) }
+    private val fileSupplier: FileSupplier,
 ) {
     /**
      * 数据根目录.
@@ -113,7 +115,7 @@ internal enum class AppPaths(
      *
      * 提示: 结尾不带 `/`.
      */
-    DATA_ROOT(fileSupplier = {
+    DATA_ROOT(fileSupplier = FileSupplier {
         File(
             System.getProperty(PathConst.PROP_DATA_PATH) ?: System.getenv(PathConst.ENV_DATA_PATH)
             ?: System.getProperty("user.dir") ?: "."
@@ -125,7 +127,7 @@ internal enum class AppPaths(
         }
     }),
 
-    CONFIG_APPLICATION({ "$DATA_ROOT/config.json" }, {
+    CONFIG_APPLICATION(PathSupplier { "$DATA_ROOT/config.json" }, {
         if (!file.exists()) {
             file.bufferedWriter(StandardCharsets.UTF_8).use {
                 GsonConst.appConfigGson.toJson(
@@ -141,7 +143,7 @@ internal enum class AppPaths(
             }
         }
     }),
-    CONFIG_BOT({ "$DATA_ROOT/bot.json" }, {
+    CONFIG_BOT(PathSupplier { "$DATA_ROOT/bot.json" }, {
         if (!file.exists()) {
             file.bufferedWriter(StandardCharsets.UTF_8).use {
                 GsonConst.botConfigGson.toJson(
@@ -167,10 +169,25 @@ internal enum class AppPaths(
     TEMP({ "$DATA_ROOT/tmp/" })
     ;
 
-    val file: File
-        get() = fileSupplier.invoke()
-    val path: String
-        get() = pathSupplier.invoke()
+    constructor(pathSupplier: PathSupplier, initializer: AppPaths.() -> Unit = AppPaths::defaultInitializer) : this(
+        fileSupplier = FileSupplier { File(pathSupplier.path).canonicalFile },
+        pathSupplier = pathSupplier,
+        initializer = initializer
+    )
+
+    constructor(fileSupplier: FileSupplier, initializer: AppPaths.() -> Unit = AppPaths::defaultInitializer) : this(
+        fileSupplier = fileSupplier,
+        pathSupplier = PathSupplier { fileSupplier.file.canonicalPath },
+        initializer = initializer
+    )
+
+    constructor(pathSupplier: () -> String) : this(
+        fileSupplier = FileSupplier { File(pathSupplier.invoke()).canonicalFile },
+        pathSupplier = PathSupplier { pathSupplier.invoke() }
+    )
+
+    val file: File by fileSupplier
+    val path: String by pathSupplier
 
     private val initialized = AtomicBoolean(false)
 
@@ -206,6 +223,20 @@ internal enum class AppPaths(
         const val ENV_DATA_PATH = "BOT_DATA_PATH"
     }
 
+    private class FileSupplier(private val supplier: Supplier<File>) {
+        operator fun getValue(appPaths: AppPaths, property: KProperty<*>): File = supplier.get()
+
+        val file: File
+            get() = supplier.get()
+    }
+
+    private class PathSupplier(private val supplier: Supplier<String>) {
+        operator fun getValue(appPaths: AppPaths, property: KProperty<*>): String = supplier.get()
+
+        val path: String
+            get() = supplier.get()
+    }
+
 }
 
 /**

scalabot-app/src/main/kotlin/AppMain.kt

@@ -182,7 +182,7 @@ internal class Launcher(private val config: AppConfig = Const.config) : AutoClos
                         it.url == MavenRepositoryExtensionFinder.MAVEN_CENTRAL_URL
                                 || it.url == MavenRepositoryExtensionFinder.MAVEN_CENTRAL_URL.trimEnd('/')
                     }) {
-                    add(MavenRepositoryExtensionFinder.getMavenCentralRepository(proxy = config.proxy.toAetherProxy()))
+                    add(MavenRepositoryExtensionFinder.getMavenCentralRepository(proxy = proxyConfig.toAetherProxy()))
                 }
             }.toList()
         val extensionPackageFinders = setOf(

scalabot-app/src/main/kotlin/ExtensionComponents.kt

@@ -413,14 +413,14 @@ internal class ExtensionClassLoader(urls: Array<URL>, dependencyLoader: ClassLoa
     // 以免使用了不来自扩展包的机器人扩展.
 
     override fun getResources(name: String?): Enumeration<URL> {
-        if (BotExtensionFactory::class.java.equals(name)) {
+        if ("META-INF/services/${BotExtensionFactory::class.java.name}" == name) {
             return findResources(name)
         }
         return super.getResources(name)
     }
 
     override fun getResource(name: String?): URL? {
-        if (BotExtensionFactory::class.java.equals(name)) {
+        if ("META-INF/services/${BotExtensionFactory::class.java}" == name) {
             return findResource(name)
         }
         return super.getResource(name)

scalabot-app/src/main/kotlin/util/Utils.kt

@@ -74,7 +74,7 @@ fun <T : AutoCloseable> T.registerShutdownHook(): T {
 private object UtilsInternal {
 
     val autoCloseableSet = mutableSetOf<AutoCloseable>()
-    private val log = KotlinLogging.logger { }
+    private val log = KotlinLogging.logger(UtilsInternal::class.java.name)
 
     init {
         Runtime.getRuntime().addShutdownHook(Thread(this::doCloseResources, "Shutdown-AutoCloseable"))

scalabot-app/src/main/resources/base-logback.xml

@@ -24,7 +24,7 @@
     <appender name="FILE_OUT" class="ch.qos.logback.core.rolling.RollingFileAppender">
         <file>${DATA_LOGS}/latest.log</file>
         <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
-            <fileNamePattern>data/logs/%d{yyyy-MM-dd}.log.gz</fileNamePattern>
+            <fileNamePattern>${DATA_LOGS}/%d{yyyy-MM-dd}.log.gz</fileNamePattern>
             <maxHistory>30</maxHistory>
         </rollingPolicy>
         <encoder>

scalabot-app/src/test/kotlin/AppConfigTest.kt

@@ -21,6 +21,17 @@ import kotlin.test.*
 
 internal class AppPathsTest {
 
+    @Test
+    fun `Consistency check`() {
+        for (path in AppPaths.values()) {
+            assertEquals(
+                File(path.path).canonicalPath,
+                path.file.canonicalPath,
+                "路径 File 与 Path 不一致: ${path.name}"
+            )
+        }
+    }
+
     @Test
     fun `Data root path priority`() {
         System.setProperty(AppPaths.PathConst.PROP_DATA_PATH, "fromSystemProperties")

scalabot-ext-example/build.gradle.kts

@@ -5,7 +5,7 @@ plugins {
 dependencies {
     compileOnly(project(":scalabot-extension"))
 
-    testImplementation("org.junit.jupiter:junit-jupiter-api:5.8.2")
+    testImplementation("org.junit.jupiter:junit-jupiter-api:5.9.0")
     testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
 }
 

scalabot-extension/build.gradle.kts

@@ -1,16 +1,23 @@
 plugins {
     kotlin("jvm")
     java
+    jacoco
     `maven-publish`
     signing
+    id("org.jetbrains.kotlinx.binary-compatibility-validator") version "0.11.1"
 }
 
 dependencies {
+    implementation("commons-codec:commons-codec:1.15")
     api("org.telegram:telegrambots-abilities:6.1.0")
-    api("org.slf4j:slf4j-api:1.7.36")
+    api("org.slf4j:slf4j-api:2.0.0")
 
-    testImplementation("org.junit.jupiter:junit-jupiter-api:5.8.2")
-    testImplementation("org.mockito:mockito-core:4.6.1")
+    // Added as a mitigation measure for vulnerabilities.
+    // When the relevant reference dependency updates it, it will be removed.
+    implementation("com.fasterxml.jackson.core:jackson-databind:2.13.4.2")
+
+    testImplementation("org.junit.jupiter:junit-jupiter-api:5.9.0")
+    testImplementation("org.mockito:mockito-core:4.7.0")
     testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
 }
 
@@ -29,6 +36,16 @@ java {
 
 tasks.test {
     useJUnitPlatform()
+    finalizedBy(tasks.jacocoTestReport)
+}
+
+tasks.jacocoTestReport {
+    dependsOn(tasks.test)
+}
+
+tasks.withType<AbstractArchiveTask>().configureEach {
+    isPreserveFileTimestamps = false
+    isReproducibleFileOrder = true
 }
 
 publishing {

scalabot-meta/build.gradle.kts

@@ -4,6 +4,7 @@ plugins {
     id("org.jetbrains.dokka") version "1.7.0"
     `maven-publish`
     signing
+    id("org.jetbrains.kotlinx.binary-compatibility-validator") version "0.11.1"
 }
 
 dependencies {
@@ -13,14 +14,18 @@ dependencies {
 
     implementation("org.telegram:telegrambots-meta:6.1.0")
 
+    // Added as a mitigation measure for vulnerabilities.
+    // When the relevant reference dependency updates it, it will be removed.
+    implementation("com.fasterxml.jackson.core:jackson-databind:2.13.4.2")
+
     api("com.google.code.gson:gson:2.9.0")
 
     testImplementation(kotlin("test"))
-    testImplementation("io.mockk:mockk:1.12.4")
-    testImplementation("org.junit.jupiter:junit-jupiter-api:5.8.2")
-    testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:5.8.2")
+    testImplementation("io.mockk:mockk:1.12.7")
+    testImplementation("org.junit.jupiter:junit-jupiter-api:5.9.0")
+    testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:5.9.0")
 
-    dokkaHtmlPlugin("org.jetbrains.dokka:javadoc-plugin:1.7.0")
+    dokkaHtmlPlugin("org.jetbrains.dokka:javadoc-plugin:1.7.10")
 }
 
 tasks.withType<org.jetbrains.kotlin.gradle.tasks.KotlinCompile>().configureEach {
@@ -36,6 +41,11 @@ java {
     targetCompatibility = JavaVersion.VERSION_11
 }
 
+tasks.withType<AbstractArchiveTask>().configureEach {
+    isPreserveFileTimestamps = false
+    isReproducibleFileOrder = true
+}
+
 tasks.getByName<Test>("test") {
     useJUnitPlatform()
 }

scalabot-meta/src/main/kotlin/Configs.kt

@@ -28,6 +28,13 @@ data class BotAccount(
 
 /**
  * 机器人配置.
+ *
+ * 使用 Gson 解析时, 请添加以下类型适配器:
+ * - [net.lamgc.scalabot.config.serializer.ProxyTypeSerializer]
+ * - [net.lamgc.scalabot.config.serializer.BotConfigSerializer]
+ * - [net.lamgc.scalabot.config.serializer.BotAccountSerializer]
+ * - [net.lamgc.scalabot.config.serializer.ArtifactSerializer]
+ *
  * @property enabled 是否启用机器人.
  * @property account 机器人帐号信息, 用于访问 API.
  * @property disableBuiltInAbility 是否禁用 AbilityBot 自带命令.
@@ -126,6 +133,13 @@ data class MavenRepositoryConfig(
  * ScalaBot App 配置.
  *
  * App 配置信息与 BotConfig 分开, 分别存储在各自单独的文件中.
+ *
+ * 使用 Gson 解析时, 请添加以下类型适配器:
+ * - [net.lamgc.scalabot.config.serializer.ProxyTypeSerializer]
+ * - [net.lamgc.scalabot.config.serializer.MavenRepositoryConfigSerializer]
+ * - [net.lamgc.scalabot.config.serializer.AuthenticationSerializer]
+ * - [net.lamgc.scalabot.config.serializer.UsernameAuthenticatorSerializer]
+ *
  * @property proxy Telegram API 代理配置.
  * @property metrics 运行指标数据配置. 可通过时序数据库记录运行数据.
  * @property mavenRepositories Maven 远端仓库配置.

scalabot-meta/src/test/kotlin/ConfigsTest.kt

@@ -219,6 +219,12 @@ internal class ProxyConfigTest {
         assertEquals(8080, actualConfig.port)
         assertEquals(ProxyType.HTTP, actualConfig.type)
     }
+
+    @Test
+    fun `toString test`() {
+        assertEquals("NO_PROXY", ProxyConfig(ProxyType.NO_PROXY).toString())
+        assertEquals("HTTP://example.org:1008", ProxyConfig(ProxyType.HTTP, "example.org", 1008).toString())
+    }
 }
 
 internal class MetricsConfigTest {