diff --git a/.github/ACTION_PINS.md b/.github/ACTION_PINS.md index bc70a96..291479d 100644 --- a/.github/ACTION_PINS.md +++ b/.github/ACTION_PINS.md @@ -1,28 +1,32 @@ # Reviewed action pins Resolved release tags through each authoritative repository Git ref (including -annotated-tag dereferencing) on 2026-09-26 UTC. These are source pins, not claims -that runtime tool downloads are made immutable by pinning an action. +annotated-tag dereferencing) on 2026-10-18 UTC, matching the current workflows. +These are source pins, not claims that runtime tool downloads are made immutable +by pinning an action. | Repository/action | Release | Commit | | --- | --- | --- | | `actions/checkout` | [v7.0.1](https://github.com/actions/checkout/releases/tag/v7.0.1) | `3d3c42e5aac5ba805825da76410c181273ba90b1` | | `actions/setup-java` | [v6.0.1](https://github.com/actions/setup-java/releases/tag/v6.0.1) | `de7274f081f381c8f8158605e0321c36c376e2e6` | -| `actions/upload-artifact` | [v7.0.1](https://github.com/actions/upload-artifact/releases/tag/v7.0.1) | `043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` | -| `actions/download-artifact` | [v8.0.1](https://github.com/actions/download-artifact/releases/tag/v8.0.1) | `3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` | -| `github/codeql-action` | [v4.38.2](https://github.com/github/codeql-action/releases/tag/v4.38.2) | `2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2` | +| `actions/upload-artifact` | [v7.0.2](https://github.com/actions/upload-artifact/releases/tag/v7.0.2) | `cf430e030ddbb5b0abf93d22962f4752f3646cd9` | +| `actions/download-artifact` | [v8.0.2](https://github.com/actions/download-artifact/releases/tag/v8.0.2) | `9000827ccba6bdab643e8b6fd33ac0654aef8333` | +| `github/codeql-action` | [v4.38.3](https://github.com/github/codeql-action/releases/tag/v4.38.3) | `24c54180a607b1449ed407dd24f251e4e9147c8d` | | `advanced-security/maven-dependency-submission-action` | [v6.0.1](https://github.com/advanced-security/maven-dependency-submission-action/releases/tag/v6.0.1) | `a64327a7329c9939cf675e458452febe1894a70c` | CodeQL uses the `init` and `analyze` subactions at the same commit. No other external actions or reusable workflows are referenced. Upload/download were -reviewed together for PR #175; the two official lightweight release tags resolve +originally reviewed together for PR #175 and advanced with CodeQL in +[PR #240](https://github.com/OWASP/owasp-java-encoder/pull/240). The current +release-to-commit mappings were rechecked on 2026-10-18; this inventory refresh +does not claim a new full source audit. The two artifact-action release tags resolve directly to the commits above. All actions are JavaScript actions, not composite actions with hidden `uses` references. Their metadata, entrypoints and relevant credential/download paths were reviewed, along with the release changes. CodeQL's release tag is annotated: the Git ref points to tag object -`88585263c0627ee42c0e1c5143a112c8d6f4aa18`, which must be dereferenced to the +`cee97f86b972a3ded3c58d04148362b193ddc518`, which must be dereferenced to the commit in the table. Do not copy an annotated tag object's SHA into a commit pin. Verify the object's type and follow tag targets until it is a commit (equivalently, inspect the peeled `refs/tags/^{}` Git ref). diff --git a/.github/CI_SECURITY.md b/.github/CI_SECURITY.md index c4a26b8..1995063 100644 --- a/.github/CI_SECURITY.md +++ b/.github/CI_SECURITY.md @@ -67,7 +67,7 @@ for child or fixture POMs. Graph reports and submission JSON are retained for inspection. Inspect representative Jakarta Spring/Tomcat dependencies in the resulting graph; alert counts are not gates. -The immutable 1.5.0 Java Encoder artifacts used by japicmp are intentional +The immutable 1.6.0 Java Encoder artifacts used by japicmp are intentional development-only comparison inputs. Keep them visible in the build graph: an alert on a baseline artifact describes that historical input, not a dependency shipped to current development consumers, and must be assessed rather than hidden with a graph filter. @@ -143,9 +143,10 @@ unverified owners or treat review rules as CODEOWNERS validation. All tags prohibit update/deletion with no bypass; new signed release tags still follow `RELEASING.md`. GitHub `required_signatures` checks commit signatures, -not annotated tag signatures. Legacy Codacy and Travis webhooks have no current -workflow/required-check owner and return 404/502; disable them while retaining -their private configuration for recovery. Site retirement remains with #96. +not annotated tag signatures. The [September validation](../docs/archive/maintenance-2026-09/batch-02-validation.md#live-settings-and-negative-tests) +records disabling the legacy Codacy and Travis webhooks, with their private +configuration retained for recovery. Maven Site sources and publishing are +retired; the implicit Site lifecycle remains explicitly pinned and disabled. For recovery, an administrator uses Settings or the REST API, records the actor, reason and affected PR in #169, makes the narrowest temporary change, then diff --git a/BUILDING.md b/BUILDING.md index 5953bba..db7a1ee 100644 --- a/BUILDING.md +++ b/BUILDING.md @@ -5,7 +5,11 @@ Apache Maven Wrapper 3.3.4's unmodified `only-script` distribution; no wrapper JAR executes before the download check. It pins Maven 3.10.0 and its SHA-256. The downloaded Maven ZIP was independently compared to the SHA-512 served at [Apache's distribution site](https://downloads.apache.org/maven/maven-3/3.10.0/binaries/). -Wrapper archive SHA-256: `6cb584c2bc907b849a0b931d8266d3ff3214cdd3127115ed4f49fb7176413d36`. +The separate [Maven Wrapper 3.3.4 only-script archive](https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper-distribution/3.3.4/maven-wrapper-distribution-3.3.4-only-script.zip) +(`maven-wrapper-distribution-3.3.4-only-script.zip`) has SHA-256 +`6cb584c2bc907b849a0b931d8266d3ff3214cdd3127115ed4f49fb7176413d36`. +The Maven 3.10.0 ZIP checksum is recorded in +[the wrapper configuration](.mvn/wrapper/maven-wrapper.properties). Both bootstrap paths are CI gates, including a deliberately wrong checksum with an empty wrapper cache. `.mvn/maven.config` requires strict transfer checksums. These checks detect corruption against the recorded hash; checksums fetched from @@ -71,7 +75,8 @@ evidence. CI retains reports alongside test results. The old Site/Reflow/Velocity/Doxia, FindBugs, PMD, JXR and report-only bindings were dormant. Unique core/JSP examples moved to [docs/usage.md](docs/usage.md). -README/module docs and attached source/Javadoc JARs remain supported. Build-bound +The unused module `src/site` trees have been removed. README/module guides +and attached source/Javadoc JARs remain supported. Build-bound Checkstyle/JaCoCo, Surefire XML, CodeQL and dependency submission replace useful reports. Maven's implicit Site plugin is pinned to 3.22.0 and skipped to prevent falling back to an old lifecycle default; `mvn site` is not a publishing path. diff --git a/CHANGELOG.md b/CHANGELOG.md index 0aa1567..fe28c08 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,11 +4,13 @@ Released entries are grounded in the linked immutable tags, GitHub release notes and retained README announcements. Dates below are GitHub publication dates in UTC where a release record exists; older announcement/tag dates are labeled. An open proposal is not a release. Historical tags, assets and signatures remain -unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication.md). +unchanged. [1.6.0 is available from Central](releases/1.6.0-central-publication.md). ## Unreleased -No changes yet. +- Remove retired Maven Site sources and archive September maintenance records. +- Refresh build/dependency documentation and clarify the 1.6.0 review record. + Encoding behavior, public APIs, and published artifacts are unchanged. ## 1.6.0 — 2026-10-18 UTC @@ -110,7 +112,7 @@ Signed artifact availability and independent verification are tracked in the work (#111) are recorded in the [publication follow-up](releases/1.4.1-central-publication.md). The [maintenance tracker](https://github.com/OWASP/owasp-java-encoder/issues/169) -and [closeout record](releases/maintenance-closeout.md) record the corresponding +and [closeout record](docs/archive/maintenance-2026-09/maintenance-closeout.md) record the corresponding PRs, tests and dispositions; they are not approval to publish 1.5. ## 1.4.1 — 2026-09-26 UTC diff --git a/MAINTAINERS.md b/MAINTAINERS.md index f9dbc36..a753845 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -24,6 +24,42 @@ current. The key's public fingerprint is: The public key is in [KEYS](KEYS). This is a shared project signing identity; custody of it does not grant permission to publish Maven coordinates. +## Latest recorded custody and publishing status + +The latest custody and rehearsal confirmations remain those reported on +2026-09-26 below; this cleanup does not assert that new recovery drills ran. +The [1.6.0 publication record](releases/1.6.0-central-publication.md) documents +Jim's subsequent successful Central publication on 2026-10-18. + +### Central publication follow-up: 2026-09-26 (America/Los_Angeles) + +Jim's signed-in Portal account now shows the verified `org.owasp.encoder` +namespace in the Owasp organization. The exact retained signed 1.4.1 bundle was +validated and published as deployment `ce91e36f-756c-489f-bbea-3629b728ad28`. +All 17 POM/JAR files and their 17 signatures downloaded from Central matched +the retained release byte for byte. See the [publication record](releases/1.4.1-central-publication.md). + +This supersedes the earlier namespace-access and pending-publication status +for Jim and 1.4.1. + +Jim also confirmed on 2026-09-26 (America/Los_Angeles) that he and Jeremy both +completed the independent vault-recovery drills, namespace-access checks, and +separate validated-and-dropped Central staging rehearsals that day. This is +maintainer-reported completion; the individual private recovery records and +rehearsal deployment IDs were not supplied or independently inspected in this +publication session. Keep those operational records in each custodian's vault. + +| Custodian | Independent vault-recovery drill | Namespace access | Separate validated-and-dropped rehearsal | +| --- | --- | --- | --- | +| Jim Manico | Completed 2026-09-26, reported by Jim | Verified directly by 1.4.1 publication | Completed 2026-09-26, reported by Jim | +| Jeremy Long | Completed 2026-09-26, reported by Jim | Confirmed 2026-09-26, reported by Jim | Completed 2026-09-26, reported by Jim | + +Together with the publication verification and reconciled consumer notices, +this records completion of #111 on the stated evidence. Earlier observations +are retained in the [historical status record](docs/archive/maintenance-2026-09/maintainer-status.md). +Future recovery drills and release rehearsals follow the procedures below and +[RELEASING.md](RELEASING.md). + ## Independent recovery copies Each custodian's vault must contain a complete recovery set: @@ -127,74 +163,3 @@ coordinate with the OWASP Foundation and Central Support to establish project ownership and restore namespace access; that process cannot recover a lost private key. If neither independent key copy is recoverable, arrange a new project key and publish the new fingerprint before signing any future release. - -## Recorded status: 2026-09-25 - -The encrypted local backup was successfully imported and used to sign and verify -a challenge in an isolated temporary keyring; that keyring was then removed. -The local release and recovery directories were checked as owner-only (`0700`). -These observations do not confirm the individual vault copies: - -| Custodian | Import into own vault | Drill from own vault copy | Central access and staging rehearsal | -| --- | --- | --- | --- | -| Jim Manico | Unconfirmed | Unconfirmed | Portal showed no namespaces and disabled publishing; validated-and-dropped rehearsal unconfirmed | -| Jeremy Long | Unconfirmed | Unconfirmed | Current namespace access and validated-and-dropped rehearsal unconfirmed | - -Central Support has acknowledged the existing access request. Continue that -request rather than opening a duplicate. The exact `encoder` 1.4.1 POM still -returned HTTP 404 from Maven Central at this check. Retain the pending notices -and the existing signed 1.4.1 bundle until publication is verified; do not rebuild -or replace those artifacts or move their tag. - -### Batch 00 follow-up: 2026-09-25 (America/Los_Angeles) - -Jim confirmed initial key setup on this date. This confirms setup only; retrieval -from his own vault, the isolated recovery drill, and a validated-and-dropped -Central staging rehearsal remain unconfirmed. No new independent confirmation -was received from Jeremy. - -The signed-in Central Portal account displayed `JIM MANICO`, **No Namespace(s) -Found**, and a disabled **Publish Component** button. All five exact 1.4.1 POM -URLs (the four libraries and parent) returned HTTP 404, and core metadata still -listed 1.4.0. Publication and Jim's staging rehearsal remain blocked on namespace -access; Jeremy's access remains unconfirmed. Continue the existing Support -request. No new request or deployment was created. - -The retained public GitHub bundle, all artifact signatures, and signed checksum -manifests were verified; see [batch 00 validation](releases/batch-00-validation.md). -Verification of public artifacts is separate from private-key recovery and -publisher access. - -Update this dated record only from each custodian's confirmation and actual -publishing evidence. [#111](https://github.com/OWASP/owasp-java-encoder/issues/111) -owns the remaining independent vault recovery, namespace access, publication, -and staging checks. [#95](https://github.com/OWASP/owasp-java-encoder/issues/95) -owns future release-tooling changes. - -### Central publication follow-up: 2026-09-26 (America/Los_Angeles) - -Jim's signed-in Portal account now shows the verified `org.owasp.encoder` -namespace in the Owasp organization. The exact retained signed 1.4.1 bundle was -validated and published as deployment `ce91e36f-756c-489f-bbea-3629b728ad28`. -All 17 POM/JAR files and their 17 signatures downloaded from Central matched -the retained release byte for byte. See the [publication record](releases/1.4.1-central-publication.md). - -This supersedes the earlier namespace-access and pending-publication status -for Jim and 1.4.1. - -Jim also confirmed on 2026-09-26 (America/Los_Angeles) that he and Jeremy both -completed the independent vault-recovery drills, namespace-access checks, and -separate validated-and-dropped Central staging rehearsals that day. This is -maintainer-reported completion; the individual private recovery records and -rehearsal deployment IDs were not supplied or independently inspected in this -publication session. Keep those operational records in each custodian's vault. - -| Custodian | Independent vault-recovery drill | Namespace access | Separate validated-and-dropped rehearsal | -| --- | --- | --- | --- | -| Jim Manico | Completed 2026-09-26, reported by Jim | Verified directly by 1.4.1 publication | Completed 2026-09-26, reported by Jim | -| Jeremy Long | Completed 2026-09-26, reported by Jim | Confirmed 2026-09-26, reported by Jim | Completed 2026-09-26, reported by Jim | - -Together with the publication verification and reconciled consumer notices, -this records completion of #111 on the stated evidence. The earlier dated -records remain as history. Future recovery drills and release rehearsals still -follow the procedures above; the 1.5 release gate remains unchanged. diff --git a/RELEASING.md b/RELEASING.md index 7e1f212..882eef3 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -10,7 +10,7 @@ this gate on its own. Keep current development at `1.6.1-SNAPSHOT` until maintai deliberately create the exact release commit after the technical gates pass. Changing that commit to a release version is release preparation, not release approval. -The [2026-09-26 maintenance closeout](releases/maintenance-closeout.md) records +The [2026-09-26 maintenance closeout](docs/archive/maintenance-2026-09/maintenance-closeout.md) records the final backlog inventory and dispositions for #110 and #169. A closed tracker does not waive this gate: repeat the complete open-issue/PR inventory when a new release is actually proposed and obtain release approval then. @@ -224,9 +224,11 @@ are verified separately from the deterministic unsigned payload. Never rebuild o replace the retained 1.4.1 release to retrofit reproducibility. The publisher's isolated dependencies override Jackson core/databind 2.22.3 and -annotations 2.22, HttpClient 5.6.4 and HttpCore/httpcore5-h2 5.4.4. The upstream -0.11.0 dependency versions matched current OSV advisories; these six reviewed -replacement coordinates did not on 2026-09-26. Local signed bundle validation +annotations 2.22, HttpClient 5.6.5 and HttpCore/httpcore5-h2 5.4.4. The upstream +0.11.0 dependency versions matched OSV advisories in the dated +[September validation](docs/archive/maintenance-2026-09/batch-04-validation.md#release-plugin-dependency-follow-up-187). +That check used HttpClient 5.6.4; the current 5.6.5 pin arrived later and is not +covered by that historical advisory result. Local signed bundle validation exercises the overridden plugin. This is not an audit of every plugin dependency or a claim that the plugin's live Central HTTP path has been tested. Jim's Portal namespace access and exact 1.4.1 publication are now [verified](releases/1.4.1-central-publication.md). diff --git a/core/src/site/markdown/index.md b/core/src/site/markdown/index.md deleted file mode 100644 index 4895021..0000000 --- a/core/src/site/markdown/index.md +++ /dev/null @@ -1,35 +0,0 @@ -## OWASP Java Encoder - -The OWASP Java Encoder is a collection of high-performance low-overhead -contextual encoders that, when utilized correctly, is an effective tool in -preventing Web Application security vulnerabilities such as Cross-Site -Scripting (XSS). - -Please see the [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) -for more information on preventing XSS. - -For use within JSP pages consider using the [JSP Encoder](../encoder-jsp/index.html) as it -provides a TLD to make the use of the core encoders easier. - -### Usage - -The JAR can be found in [Maven Central](https://central.sonatype.com/artifact/org.owasp.encoder/encoder). - -```xml - - org.owasp.encoder - encoder - 1.4.0 - -``` - -Utilize the encoder: - -```java -import org.owasp.encoder.Encode; - -//... - -PrintWriter out = ....; -out.println(""); -``` diff --git a/core/src/site/site.xml b/core/src/site/site.xml deleted file mode 100644 index 1b3cb62..0000000 --- a/core/src/site/site.xml +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/docs/archive/maintenance-2026-09/README.md b/docs/archive/maintenance-2026-09/README.md new file mode 100644 index 0000000..a13158d --- /dev/null +++ b/docs/archive/maintenance-2026-09/README.md @@ -0,0 +1,24 @@ +# September 2026 maintenance evidence + +These records preserve the dated work behind the September maintenance campaign. +Versions, test counts, open issues, access failures, and pending publication notices +describe those reviews; they are not current operating instructions. + +Use [RELEASING.md](../../../RELEASING.md), +[MAINTAINERS.md](../../../MAINTAINERS.md), and the +[1.6.0 publication record](../../../releases/1.6.0-central-publication.md) +for current procedures, latest recorded custody status, and release availability. + +| Record | Evidence | +| --- | --- | +| [Batch 00](batch-00-validation.md) | Retained 1.4.1 artifacts and publication/access checks | +| [Batch 02](batch-02-validation.md) | CI and repository controls | +| [Batch 04](batch-04-validation.md) | Build policy, reproducibility, and release tooling | +| [Batch 05](batch-05-validation.md) | Consumer documentation, metadata, and community settings | +| [PR queue](pr-queue-validation.md) | Dependency and Actions review | +| [Closeout](maintenance-closeout.md) | Backlog dispositions and completed follow-ups | +| [Maintainer status](maintainer-status.md) | Earlier custody and publishing observations | + +The historical wiki has its own [archive](../wiki-2019/README.md). +Release notes, publication verification, and historical signing-key evidence remain +under [releases](../../../releases/). Published tags and artifacts are unchanged. diff --git a/releases/batch-00-validation.md b/docs/archive/maintenance-2026-09/batch-00-validation.md similarity index 93% rename from releases/batch-00-validation.md rename to docs/archive/maintenance-2026-09/batch-00-validation.md index 9ec5a07..4f57bfe 100644 --- a/releases/batch-00-validation.md +++ b/docs/archive/maintenance-2026-09/batch-00-validation.md @@ -1,5 +1,8 @@ # Batch 00 validation — 2026-09-25 +> Historical evidence. Versions, outstanding work, and test counts describe +> the dated review below. See the [archive index](README.md) for current guidance. + Work tracked by [#169](https://github.com/OWASP/owasp-java-encoder/issues/169), [#111](https://github.com/OWASP/owasp-java-encoder/issues/111), and [#112](https://github.com/OWASP/owasp-java-encoder/issues/112). @@ -56,7 +59,7 @@ the checkout. No reactor build or existing local install supplied artifacts. | Central 1.4.0 with the documented `dependencyManagement` pin | 1.4.0 | 1.4.0 | 2.7.0.0 (managed from `[2.5.1.0,3)`) | PASS | | Signed 1.4.1 with no ESAPI override | 1.4.1 | 1.4.1 | 2.7.0.0 | PASS | -For the second consumer, first ran the [documented local installation](1.4.1.md#install-verified-artifacts-while-central-is-pending) +For the second consumer, first ran the [documented local installation](../../../releases/1.4.1.md#install-verified-artifacts-while-central-is-pending) with `maven-install-plugin:3.1.4`: the retained parent POM and all four libraries, including their original POMs, sources, and Javadocs. All five installations succeeded. No artifact was rebuilt or re-signed. @@ -87,7 +90,7 @@ The current Central Portal session identified Jim Manico, showed **No Namespace( Found**, and disabled **Publish Component**. No deployment or new Support request was created. Continue the existing Support request to restore access. Jim confirmed initial key setup on this date; independent vault recovery and -publisher rehearsals remain unconfirmed as recorded in [MAINTAINERS.md](../MAINTAINERS.md#batch-00-follow-up-2026-09-25-americalos_angeles). +publisher rehearsals remain unconfirmed as recorded in [MAINTAINERS.md](maintainer-status.md#batch-00-follow-up-2026-09-25-americalos_angeles). The [OWASP project page](https://owasp.org/www-project-java-encoder/) still tells consumers to use 1.3.0 in its Getting Started text and needs a follow-up update. @@ -98,4 +101,4 @@ after delivery, using the signed GitHub release for current consumer guidance. Keep #111 open until each publisher's access and distinct validated-then-dropped rehearsal, each custodian's vault drill, exact Central publication, and the post-publication comparisons and notice updates are evidenced. The full -[1.5 backlog gate](../RELEASING.md#release-gate-for-15) remains in force. +[1.5 backlog gate](../../../RELEASING.md#release-gate) remains in force. diff --git a/releases/batch-02-validation.md b/docs/archive/maintenance-2026-09/batch-02-validation.md similarity index 94% rename from releases/batch-02-validation.md rename to docs/archive/maintenance-2026-09/batch-02-validation.md index 8199ead..703bb6c 100644 --- a/releases/batch-02-validation.md +++ b/docs/archive/maintenance-2026-09/batch-02-validation.md @@ -1,5 +1,8 @@ # Batch 02 validation — 2026-09-26 UTC +> Historical evidence. Versions, outstanding work, and test counts describe +> the dated review below. See the [archive index](README.md) for current guidance. + Implementation: [PR #173](https://github.com/OWASP/owasp-java-encoder/pull/173), initial implementation `49bfc33`. This covers #102, #109, #97, #119 and #108 under [#169](https://github.com/OWASP/owasp-java-encoder/issues/169). No release artifacts, @@ -9,7 +12,7 @@ release tags, library algorithms or dependency versions were changed. - Actionlint 1.7.12 passes every workflow. Every external `uses` reference is a full 40-character SHA; authoritative release mappings and runtime trust review - are in [ACTION_PINS.md](../.github/ACTION_PINS.md). + are in [ACTION_PINS.md](../../../.github/ACTION_PINS.md). - Ten Python policy/parser tests pass. Negative cases cover accidental release versions, mismatched module/application versions, snapshot/tag mismatch, intentional release and next-snapshot flow, missing/failed/cancelled/skipped @@ -54,7 +57,7 @@ with its dereferenced commit SHA, preserving the reviewed release source. Final head check evidence is recorded in #169. The browser build took 2m39s versus the 3m14s baseline; packaged preparation took 1m52s versus 1m25s; Java 8 tests took 1m13s versus 1m27s. These are single-run observations, not a benchmark. See the baseline cache -inventory and preserved coverage in [CI_SECURITY.md](../.github/CI_SECURITY.md). +inventory and preserved coverage in [CI_SECURITY.md](../../../.github/CI_SECURITY.md). Fork behavior was checked against the real external-contributor PR #168 [Java CI run](https://github.com/OWASP/owasp-java-encoder/actions/runs/36220576710): @@ -105,7 +108,7 @@ a live negative probe caught this, and the exact allowlist was reapplied. after successful checks, verifying the normal review gate. Recovery steps were recorded before restrictions and are now in -[CI_SECURITY.md](../.github/CI_SECURITY.md#repository-controls-and-recovery). +[CI_SECURITY.md](../../../.github/CI_SECURITY.md#repository-controls-and-recovery). CODEOWNERS validation stays with #127; site retirement with #96; future release workflow pins with #95. Optional public Scorecard/best-practices registration and additional scheduled scanners are explicitly deferred. Existing ESAPI advisories diff --git a/releases/batch-04-validation.md b/docs/archive/maintenance-2026-09/batch-04-validation.md similarity index 98% rename from releases/batch-04-validation.md rename to docs/archive/maintenance-2026-09/batch-04-validation.md index 43c8929..02bc10c 100644 --- a/releases/batch-04-validation.md +++ b/docs/archive/maintenance-2026-09/batch-04-validation.md @@ -1,5 +1,8 @@ # Batch 04 validation +> Historical evidence. Versions, outstanding work, and test counts describe +> the dated review below. See the [archive index](README.md) for current guidance. + Validated 2026-09-26. #123 merged separately in PR #184 after all 26 checks and Sol then Astra reviews. This record covers the subsequent coordinated build policy/release changes; it is not release approval. diff --git a/releases/batch-05-validation.md b/docs/archive/maintenance-2026-09/batch-05-validation.md similarity index 98% rename from releases/batch-05-validation.md rename to docs/archive/maintenance-2026-09/batch-05-validation.md index feabbfe..6902382 100644 --- a/releases/batch-05-validation.md +++ b/docs/archive/maintenance-2026-09/batch-05-validation.md @@ -1,5 +1,8 @@ # Batch 05 validation +> Historical evidence. Versions, outstanding work, and test counts describe +> the dated review below. See the [archive index](README.md) for current guidance. + Checked 2026-09-26 against implementation based on `3bd8625`. This is maintenance validation, not release approval. No historical signed artifact, release title, release timestamp, key or tag was changed. diff --git a/docs/archive/maintenance-2026-09/maintainer-status.md b/docs/archive/maintenance-2026-09/maintainer-status.md new file mode 100644 index 0000000..829cbd9 --- /dev/null +++ b/docs/archive/maintenance-2026-09/maintainer-status.md @@ -0,0 +1,48 @@ +# Historical maintainer status — September 2026 + +These observations predate the completed publication and custody follow-up. +For the latest recorded status and current procedures, use +[MAINTAINERS.md](../../../MAINTAINERS.md). No new recovery result is asserted here. + +## Recorded status: 2026-09-25 + +The encrypted local backup was successfully imported and used to sign and verify +a challenge in an isolated temporary keyring; that keyring was then removed. +The local release and recovery directories were checked as owner-only (`0700`). +These observations do not confirm the individual vault copies: + +| Custodian | Import into own vault | Drill from own vault copy | Central access and staging rehearsal | +| --- | --- | --- | --- | +| Jim Manico | Unconfirmed | Unconfirmed | Portal showed no namespaces and disabled publishing; validated-and-dropped rehearsal unconfirmed | +| Jeremy Long | Unconfirmed | Unconfirmed | Current namespace access and validated-and-dropped rehearsal unconfirmed | + +Central Support has acknowledged the existing access request. Continue that +request rather than opening a duplicate. The exact `encoder` 1.4.1 POM still +returned HTTP 404 from Maven Central at this check. Retain the pending notices +and the existing signed 1.4.1 bundle until publication is verified; do not rebuild +or replace those artifacts or move their tag. + +### Batch 00 follow-up: 2026-09-25 (America/Los_Angeles) + +Jim confirmed initial key setup on this date. This confirms setup only; retrieval +from his own vault, the isolated recovery drill, and a validated-and-dropped +Central staging rehearsal remain unconfirmed. No new independent confirmation +was received from Jeremy. + +The signed-in Central Portal account displayed `JIM MANICO`, **No Namespace(s) +Found**, and a disabled **Publish Component** button. All five exact 1.4.1 POM +URLs (the four libraries and parent) returned HTTP 404, and core metadata still +listed 1.4.0. Publication and Jim's staging rehearsal remain blocked on namespace +access; Jeremy's access remains unconfirmed. Continue the existing Support +request. No new request or deployment was created. + +The retained public GitHub bundle, all artifact signatures, and signed checksum +manifests were verified; see [batch 00 validation](batch-00-validation.md). +Verification of public artifacts is separate from private-key recovery and +publisher access. + +Update this dated record only from each custodian's confirmation and actual +publishing evidence. [#111](https://github.com/OWASP/owasp-java-encoder/issues/111) +owns the remaining independent vault recovery, namespace access, publication, +and staging checks. [#95](https://github.com/OWASP/owasp-java-encoder/issues/95) +owns future release-tooling changes. diff --git a/releases/maintenance-closeout.md b/docs/archive/maintenance-2026-09/maintenance-closeout.md similarity index 89% rename from releases/maintenance-closeout.md rename to docs/archive/maintenance-2026-09/maintenance-closeout.md index c551ffd..a271b1e 100644 --- a/releases/maintenance-closeout.md +++ b/docs/archive/maintenance-2026-09/maintenance-closeout.md @@ -1,5 +1,8 @@ # Maintenance backlog closeout +> Historical evidence. Versions, outstanding work, and test counts describe +> the dated review below. See the [archive index](README.md) for current guidance. + Audited 2026-09-26 (America/Los_Angeles), after [PR #208](https://github.com/OWASP/owasp-java-encoder/pull/208) merged as `1111f7982e492c60abb4897844a02e7b3a44cef7`. The live GitHub inventory before this @@ -18,20 +21,20 @@ review/bypass provenance and scope limits; earlier statements of outstanding | Batch | Issues and final disposition | Delivery/evidence | | --- | --- | --- | -| 00 | #112 completed; #111 completed by the publication/access follow-up | PRs #171, #208; [publication and custody evidence](1.4.1-central-publication.md) | +| 00 | #112 completed; #111 completed by the publication/access follow-up | PRs #171, #208; [publication and custody evidence](../../../releases/1.4.1-central-publication.md) | | 01 | #100, #130 completed | PRs #170, #172; tracker validation and migration records | | 02 | #102, #109, #97, #119, #108 completed | PRs #173, #177; [batch 02 validation](batch-02-validation.md) | | 03 | #137, #131, #120, #93 completed | PRs #174, #168, #179, #180; tracker validation and consumer/browser evidence | -| 04 | #123, #96, #104, #122, #95, #103, #124, #125 completed; #110 resolved by this archival follow-up | PRs #184, #185, #187; [batch 04 validation](batch-04-validation.md) and [historical-key authentication](historical-key-authentication.md) | +| 04 | #123, #96, #104, #122, #95, #103, #124, #125 completed; #110 resolved by this archival follow-up | PRs #184, #185, #187; [batch 04 validation](batch-04-validation.md) and [historical-key authentication](../../../releases/historical-key-authentication.md) | | 05 | #128, #115, #116, #117, #127 completed; #114 consolidated into #128 and closed as not planned, not separately implemented | PR #189; [batch 05 validation](batch-05-validation.md) | -| 06 | #142 completed as a compatibility decision record; #149 rejected and closed as not planned | PR #190; [compatibility decisions](../docs/compatibility-decisions.md) | +| 06 | #142 completed as a compatibility decision record; #149 rejected and closed as not planned | PR #190; [compatibility decisions](../../compatibility-decisions.md) | The subsequent dependency queue is also accounted for: Actions PR #175 and focused Maven PR #191 merged; #176 and #188 closed as superseded. The sixteen individual proposals #192–#207 were inspected and closed with their specific compatibility rationale. These were explicit dispositions, not claims that every proposed upgrade was applied. See the -[dependency decisions](../.github/DEPENDENCY_DECISIONS.md) and +[dependency decisions](../../../.github/DEPENDENCY_DECISIONS.md) and [PR queue validation](pr-queue-validation.md). Future proposals remain subject to review, and existing scoped dependency/advisory decisions retain their reconsideration requirements. @@ -65,7 +68,7 @@ reconsideration requirements. Closing the maintenance tracker is not approval to release 1.5. Development remains **`1.5.0-SNAPSHOT`**. When a 1.5 release is actually proposed, repeat the complete then-open issue/PR inventory and satisfy every requirement in -[RELEASING.md](../RELEASING.md), including review of new work, final artifact +[RELEASING.md](../../../RELEASING.md), including review of new work, final artifact validation and explicit release approval. Deferrals and an empty queue alone do not authorize signing, tagging or publication. This closeout changes public key archives and documentation only; it does not change artifact inputs, diff --git a/releases/pr-queue-validation.md b/docs/archive/maintenance-2026-09/pr-queue-validation.md similarity index 95% rename from releases/pr-queue-validation.md rename to docs/archive/maintenance-2026-09/pr-queue-validation.md index 2c1fc05..ae7a338 100644 --- a/releases/pr-queue-validation.md +++ b/docs/archive/maintenance-2026-09/pr-queue-validation.md @@ -1,5 +1,8 @@ # PR queue cleanup validation — 2026-09-26 +> Historical evidence. Versions, outstanding work, and test counts describe +> the dated review below. See the [archive index](README.md) for current guidance. + ## Reviewed changes and preserved contracts PR #175 updates verified artifact-action pins together, retains named same-run ZIP @@ -9,7 +12,7 @@ on `9fafc772b8e7f55d44417a8b1f59b2ea69de2568`; all 28 checks passed before merge as `011734abc029726a115811b53228cdaa789e7232`. Post-merge workflow evidence is in #169. The focused Maven change replaces Bundle Plugin 6.1.2 with 6.2.0, which uses bnd -7.4.0. The [dependency decision record](../.github/DEPENDENCY_DECISIONS.md) accounts +7.4.0. The [dependency decision record](../../../.github/DEPENDENCY_DECISIONS.md) accounts for every proposal in #176/#188 and its reconsideration conditions. Eleven exact coordinates are excluded only from the broad version-update group. Parsed YAML comparison confirms all directories, schedules, existing ignores and the separate diff --git a/docs/archive/wiki-2019/README.md b/docs/archive/wiki-2019/README.md index a47c978..5fccf5d 100644 --- a/docs/archive/wiki-2019/README.md +++ b/docs/archive/wiki-2019/README.md @@ -18,7 +18,7 @@ its advice before making it public again. | Historical page | Disposition and current destination | | --- | --- | | Home | Java 1.5/version 1.2 claims replaced by [README](../../../README.md); original-author credit retained. News goes to [CHANGELOG](../../../CHANGELOG.md). | -| Deploy | Old download links replaced by signed 1.4.1 verification/install instructions; Central pending is explicit. No old artifact is recommended. | +| Deploy | At migration, old links were replaced by signed 1.4.1 instructions while Central publication was pending. Use the [current README](../../../README.md) and [verification guide](../../../VERIFYING.md) for supported releases. | | Use | HTML text/attribute, URL, JSP and Writer examples migrated to [usage](../../usage.md) and [contexts](../../contexts.md). Corrected unquoted CSS examples and the URL example that validated one variable but emitted another. | | Grave Accent Issue | Historical unpatched-IE `innerHTML` round-trip bug; do not migrate the replacement/filter workaround into current library behavior. Prefer safe DOM text APIs and supported browsers. It is distinct from 1.5's ordinary JavaScript template-literal support. | diff --git a/docs/dependencies.md b/docs/dependencies.md index b6a0e3b..8eac275 100644 --- a/docs/dependencies.md +++ b/docs/dependencies.md @@ -3,22 +3,27 @@ The core `encoder` artifact has **no runtime dependencies**. `encoder-jsp` and `encoder-jakarta-jsp` depend on core and declare their matching JSP API as `provided`; the container supplies it. No third-party classes are shaded into -the three Java Encoder 1.5.0 JARs. +the three Java Encoder 1.6.0 JARs. The optional Boot/WAR fixture, parser and JSP-engine tests, build plugins, and release tooling are development infrastructure. They are not dependencies of a published Java Encoder library. Review the [live dependency graph][graph] for their separate scopes. -`encoder-esapi` was retired after version 1.4.1 and is absent from the 1.5.0 -reactor and dependency graph. Its historical artifact remains immutable but is +`encoder-esapi` was retired after version 1.4.1 and is absent from releases since +1.5.0, including 1.6.0. Its historical artifact remains immutable but is unsupported; see the [retirement and migration notice](encoder-esapi-retirement.md). -## Consumer dependency inventory — 2026-09-27 +## Consumer dependency inventory — verified for 1.6.0 on 2026-10-18 -Generated from dependency-plugin 3.11.0's resolved reactor `dependency:tree` -JSON for the reviewed `1.5.0-SNAPSHOT` candidate. The published 1.5.0 POMs retain -this consumer graph; see the [publication record](../releases/1.5.0-central-publication.md). +Originally generated from dependency-plugin 3.11.0's resolved reactor +`dependency:tree` JSON for the 1.5.0 candidate. The published 1.6.0 parent and +module POMs retain the same third-party consumer dependency declarations and +versions; the three downloaded binary JARs contain only encoder classes and no +embedded JARs. +These POM and package checks were repeated on 2026-10-18; see the +[publication record](../releases/1.6.0-central-publication.md) for artifact links. +The license declarations below retain their cited upstream provenance. This inventory includes the publishable modules' compile/runtime and provided scopes, excludes test/plugin dependencies and this project's own BSD-3-Clause modules, and identifies the consuming module. diff --git a/jakarta/src/site/markdown/index.md b/jakarta/src/site/markdown/index.md deleted file mode 100644 index a8c4d06..0000000 --- a/jakarta/src/site/markdown/index.md +++ /dev/null @@ -1,31 +0,0 @@ -## OWASP Jakarta JSP - -The OWASP Jakarta JSP Encoder is a collection of high-performance low-overhead -contextual encoders that, when utilized correctly, is an effective tool in -preventing Web Application security vulnerabilities such as Cross-Site -Scripting (XSS). - -Please see the [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) -for more information on preventing XSS. - -### JSP Usage - -The JSP Encoder makes the use of the Java Encoder within JSP simple via a TLD that -includes tags and a set of JSP EL functions: - -```xml - - org.owasp.encoder - encoder-jakarta-jsp - 1.4.0 - -``` - -```JSP -<%@taglib prefix="e" uri="owasp.encoder.jakarta" %> - -<%-- ... --%> - -

Dynamic data via EL: ${e:forHtml(param.value)}

-

Dynamic data via tag:

-``` diff --git a/jakarta/src/site/site.xml b/jakarta/src/site/site.xml deleted file mode 100644 index dde2b60..0000000 --- a/jakarta/src/site/site.xml +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/jsp/src/site/markdown/index.md b/jsp/src/site/markdown/index.md deleted file mode 100644 index 1da61df..0000000 --- a/jsp/src/site/markdown/index.md +++ /dev/null @@ -1,31 +0,0 @@ -## OWASP JSP - -The OWASP JSP Encoder is a collection of high-performance low-overhead -contextual encoders that, when utilized correctly, is an effective tool in -preventing Web Application security vulnerabilities such as Cross-Site -Scripting (XSS). - -Please see the [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) -for more information on preventing XSS. - -### JSP Usage - -The JSP Encoder makes the use of the Java Encoder within JSP simple via a TLD that -includes tags and a set of JSP EL functions: - -```xml - - org.owasp.encoder - encoder-jsp - 1.4.0 - -``` - -```JSP -<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %> - -<%-- ... --%> - -

Dynamic data via EL: ${e:forHtml(param.value)}

-

Dynamic data via tag:

-``` diff --git a/jsp/src/site/site.xml b/jsp/src/site/site.xml deleted file mode 100644 index dde2b60..0000000 --- a/jsp/src/site/site.xml +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/releases/1.6.0.md b/releases/1.6.0.md index 546961b..bd6f420 100644 --- a/releases/1.6.0.md +++ b/releases/1.6.0.md @@ -80,7 +80,7 @@ and the exact source, tag, bundle and downloaded-file identities. The complete open-issue/PR inventory was empty on **2026-10-18 at 17:27 UTC**, after #247 merged as `300ef20c1bfff8c3d4c68216d68f3fe742b0a559` and #243 closed. -Repeat the inventory immediately before publication. +The [publication record](1.6.0-central-publication.md) confirms the final pre-publication inventory. Model-assisted review followed [MODELS.md](../MODELS.md). Astra coordinated resolution; Sol 6.1, Opus 5.5, Mythos 5.1 and Sonnet 5.5 recommended merging @@ -88,11 +88,19 @@ the final implementation/documentation revision `da8b7a0d298c952aee9064f67dec75e0ab16a32f`. Claude Code 2.1.302 response metadata confirmed `claude-opus-5-5`, `claude-mythos-5-1`, and `claude-sonnet-5-5`. Codex agent slots requested `gpt-6-astra` and `gpt-6.1-sol`; the agent interface -did not independently attest their runtime identities. Daybreak eligibility was -unavailable, so no Daybreak review is claimed. AI review is not independent +did not independently attest their runtime identities. No Daybreak review was +completed before release; see the dated correction below. AI review is not independent maintainer approval. Jim Manico explicitly authorized the existing audit-visible PR-only review bypass for #247; all required CI/security gates passed. +**Correction — 2026-10-18:** The original review record described Daybreak +access as unavailable, but the explicit picker-route probe had not been +attempted. A subsequent probe succeeded, as recorded in +[MODELS.md](../MODELS.md#daybreak-blue-preflight) and +[PR #251](https://github.com/OWASP/owasp-java-encoder/pull/251). This establishes +later access, not a pre-release review. The release tag and signed artifacts +retain their original bytes. + On that revision, the local clean reactor, 36 repository tests, 17 compatibility tests and Java 17 packaged consumers passed. The unchanged implementation passed 12 Chrome tests, and 36 focused Chrome 155 cases checked the latest issue comment. diff --git a/scripts/check-taglib-parity.py b/scripts/check-taglib-parity.py index 65cae4a..0896821 100644 --- a/scripts/check-taglib-parity.py +++ b/scripts/check-taglib-parity.py @@ -79,11 +79,6 @@ def translated(text, path): text = text.replace("owasp.encoder.jsp", "owasp.encoder.jakarta") text = text.replace("JspConsumer", "JakartaConsumer") text = text.replace("exercises the JSP tag API", "exercises the Jakarta JSP tag API") - elif path == "site/markdown/index.md": - text = text.replace("OWASP JSP", "OWASP Jakarta JSP") - text = text.replace("encoder-jsp", "encoder-jakarta-jsp") - text = text.replace('uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project"', - 'uri="owasp.encoder.jakarta"') return text