From b9c44c13e54101e122ea436d0302024ac359f01c Mon Sep 17 00:00:00 2001 From: 07souravkunda Date: Thu, 20 Aug 2026 16:26:06 +0530 Subject: [PATCH 1/3] build: make the build reproducible and retire the unverified Travis download MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supply-chain hardening of the build. No runtime code changes — the published jar and its two dependencies (commons-io, org.json) are untouched, and source/target stay at 1.7. Remove .travis.yml. It fetched a Maven distribution over the network and ran it with no integrity check (CWE-494). Travis has not been wired to this repo for years (no Travis status context on any recent commit, and the repo is unknown to api.travis-ci.com), so the file was dead config — deleting the download removes the sink outright. Note that the usual "verify the SHA" remedy would not have worked here: no .sha512 is published for that 2010 artifact, and a checksum served by the same host as the archive gives no protection against that host being compromised. Add .github/workflows/build.yml to replace the build definition Travis used to carry. Every action is pinned by commit SHA, Maven comes from setup-java rather than an ad-hoc download, and -C makes a checksum mismatch on any resolved artifact fail the build instead of warning. Matrix: JDK 8, 11, 17. Pin every plugin version. maven-gpg-plugin, maven-source-plugin and maven-javadoc-plugin carried no at all, so Maven silently resolved whatever was newest at build time (3.2.8 / 3.4.0 / 3.12.0 today) — on the path that GPG-signs what we publish to Central. Six more took ~2013 defaults from the running Maven's super-POM, so the same source built differently on different machines. All are now explicit, and maven-enforcer-plugin keeps them that way: banDynamicVersions, requireReleaseDeps and requirePluginVersions run at validate with fail=true. Upgrade maven-compiler-plugin 2.3.2 (2011) -> 3.14.1 and maven-surefire-plugin 2.4.2 (2007) -> 3.5.6, and set UTF-8 explicitly so the build stops depending on the platform's default encoding. One reporting change to expect: surefire 2.4.2 did not report JUnit assumption failures, so the two tests that skip themselves without BROWSERSTACK_ACCESS_KEY (testIsRunning, testMultipleBinary) were counted as passes. 3.5.6 reports them as skips. Same tests, same behaviour — the old count was wrong. --- .github/workflows/build.yml | 39 +++++++++++++++ .travis.yml | 23 --------- pom.xml | 95 ++++++++++++++++++++++++++++++++++++- 3 files changed, 132 insertions(+), 25 deletions(-) create mode 100644 .github/workflows/build.yml delete mode 100644 .travis.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..0f3613b --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,39 @@ +# Build + unit tests. Replaces the abandoned Travis config, which fetched a Maven +# distribution over the network with no integrity check (CWE-494). +# +# Rules for this file: +# * every third-party action is pinned by full commit SHA, never a mutable tag; +# * Maven comes from the runner image / setup-java, never an ad-hoc download; +# * `-C` makes Maven FAIL (not warn) on a checksum mismatch for any artifact. +name: Build + +on: + pull_request: + branches: ["master", "main"] + push: + branches: ["master", "main"] + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + java: ['8', '11', '17'] + name: build (JDK ${{ matrix.java }}) + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + with: + distribution: temurin + java-version: ${{ matrix.java }} + cache: maven + + # -C = strict checksum policy: a checksum mismatch on any resolved artifact + # fails the build instead of printing a warning. + - name: Build and test + run: mvn -B -C -Dgpg.skip clean verify diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index 7a7f809..0000000 --- a/.travis.yml +++ /dev/null @@ -1,23 +0,0 @@ -language: java - -addons: - apt: - packages: - - openjdk-6-jdk - -jdk: - - openjdk6 - - oraclejdk8 - - openjdk7 - - openjdk8 - -install: - - echo "Downloading Maven 3.0"; - - wget https://archive.apache.org/dist/maven/binaries/apache-maven-3.0-bin.zip || travis_terminate 1 - - unzip -qq apache-maven-3.0-bin.zip || travis_terminate 1 - - export M2_HOME=$PWD/apache-maven-3.0 - - export PATH=$M2_HOME/bin:$PATH - - mvn -version - - mvn clean package install -DskipTests -Dgpg.skip - -after_failure: cat /home/travis/build/browserstack/browserstack-local-java/target/surefire-reports/* diff --git a/pom.xml b/pom.xml index 25a77c2..7f34677 100644 --- a/pom.xml +++ b/pom.xml @@ -16,6 +16,13 @@ + + + UTF-8 + UTF-8 + + BrowserStack @@ -72,6 +79,7 @@ org.apache.maven.plugins maven-gpg-plugin + 3.2.8 sign-artifacts @@ -96,6 +104,7 @@ org.apache.maven.plugins maven-source-plugin + 3.4.0 attach-sources @@ -108,6 +117,7 @@ org.apache.maven.plugins maven-javadoc-plugin + 3.12.0 attach-javadocs @@ -126,6 +136,46 @@ + + + + + org.apache.maven.plugins + maven-clean-plugin + 3.5.0 + + + org.apache.maven.plugins + maven-resources-plugin + 3.5.0 + + + org.apache.maven.plugins + maven-jar-plugin + 3.5.1 + + + org.apache.maven.plugins + maven-install-plugin + 3.1.4 + + + org.apache.maven.plugins + maven-deploy-plugin + 3.1.4 + + + org.apache.maven.plugins + maven-site-plugin + 3.22.0 + + + org.sonatype.central @@ -138,10 +188,51 @@ false + + org.apache.maven.plugins + maven-enforcer-plugin + 3.6.3 + + + enforce-deterministic-dependencies + validate + + enforce + + + + + + false + false + false + false + + + No SNAPSHOT dependencies allowed. + + + + true + true + true + clean,deploy,site + + + true + + + + org.apache.maven.plugins maven-compiler-plugin - 2.3.2 + 3.14.1 1.7 1.7 @@ -150,7 +241,7 @@ org.apache.maven.plugins maven-surefire-plugin - 2.4.2 + 3.5.6 From 2fb05a5e7e9f35623473fae227d45c67eca60e9e Mon Sep 17 00:00:00 2001 From: 07souravkunda Date: Thu, 20 Aug 2026 17:06:40 +0530 Subject: [PATCH 2/3] ci: skip the credential-gated tests in the build workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All three matrix legs were failing on the previous commit. 12 of the 14 tests reach LocalBinary.getBinary(), which downloads the real BrowserStackLocal binary from an authenticated endpoint; without BROWSERSTACK_ACCESS_KEY that returns HTTP 401, so a keyless runner cannot pass them. They only appeared to pass locally because a binary was already cached in ~/.browserstack — a fresh runner has none, and `cache: maven` caches ~/.m2 only, so it cannot self-heal. Run with -DskipTests, which still compiles the tests and so still covers what CI can actually prove here: the enforcer rules, every pinned plugin version, and main + test compilation at source/target 1.7 on each JDK. Verified green on 8, 11 and 17. Wiring a key in was the alternative, but it would run real tunnels on every push and still fail for pull requests from forks, which get no secrets. The full suite stays a local/credentialed run; the command is in the comment. --- .github/workflows/build.yml | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0f3613b..2eae9da 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -35,5 +35,21 @@ jobs: # -C = strict checksum policy: a checksum mismatch on any resolved artifact # fails the build instead of printing a warning. - - name: Build and test - run: mvn -B -C -Dgpg.skip clean verify + # + # -DskipTests still COMPILES the tests (it only skips running them), so this + # job covers what CI can actually prove here: the enforcer rules, every pinned + # plugin version, and that main + test sources compile at source/target 1.7 on + # each JDK. + # + # The tests themselves are deliberately NOT run. They are credential-gated + # live-integration tests, not offline units: 12 of the 14 reach + # LocalBinary.getBinary(), which downloads the real BrowserStackLocal binary + # from an authenticated endpoint and returns HTTP 401 without + # BROWSERSTACK_ACCESS_KEY. A keyless runner therefore cannot pass them, and + # wiring a key in would both run real tunnels on every push and still fail for + # pull requests from forks (which get no secrets). + # + # To run the full suite locally: + # BROWSERSTACK_ACCESS_KEY=... BROWSERSTACK_USERNAME=... mvn -B -C test + - name: Build (compile, tests skipped - see above) + run: mvn -B -C -Dgpg.skip -DskipTests clean verify From d31e6889be642db1c42031c2abc3fa15478adc5d Mon Sep 17 00:00:00 2001 From: 07souravkunda Date: Thu, 20 Aug 2026 17:12:12 +0530 Subject: [PATCH 3/3] docs: drop the dead Travis build badge travis-ci.org was decommissioned in 2021 and the config it reported on is removed in this branch, so the badge advertised a build status that had not existed for years. --- README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/README.md b/README.md index ea0369d..6f5b642 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,5 @@ # browserstack-local-java -[![Build Status](https://travis-ci.org/browserstack/browserstack-local-java.svg?branch=master)](https://travis-ci.org/browserstack/browserstack-local-java) - Java bindings for BrowserStack Local. ## Installation