Skip to content

Commit 89ccb83

Browse files
annkotsannkots
authored
Merge pull request #210 from sboldyreva/spring
Update Spring docs
2 parents f43ce91 + f9cc0a8 commit 89ccb83

File tree

2 files changed

+222
-57
lines changed

2 files changed

+222
-57
lines changed

‎docs/.vuepress/routes.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,9 @@
114114
"/els-for-runtimes-and-libraries/angular/#step-1-get-user-credentials": "/els-for-runtimes-and-libraries/angular/#step-1-get-token",
115115
"/els-for-runtimes-and-libraries/angularjs/#step-1-get-user-credentials": "/els-for-runtimes-and-libraries/angularjs/#step-1-get-token",
116116
"/els-for-runtimes-and-libraries/lodash/#step-1-get-user-credentials": "/els-for-runtimes-and-libraries/lodash/#step-1-get-token",
117+
"/els-for-runtimes-and-libraries/spring/#overview": "/els-for-runtimes-and-libraries/spring/#step-2-configure-registry",
118+
"/els-for-runtimes-and-libraries/spring/#step-2-create-or-modify-your-build-tool-settings": "/els-for-runtimes-and-libraries/spring/#step-4-verify-and-build",
119+
"/els-for-runtimes-and-libraries/spring/#verification": "/els-for-runtimes-and-libraries/spring/#step-4-verify-and-build",
117120
"/els-for-runtimes-and-libraries/python/#rpm-based": "/els-for-runtimes-and-libraries/python/#installation-instructions-for-linux",
118121
"/els-for-runtimes-and-libraries/python/#deb-based": "/els-for-runtimes-and-libraries/python/#installation-instructions-for-linux"
119122
}

‎docs/els-for-runtimes-and-libraries/spring/README.md‎

Lines changed: 219 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,97 +1,259 @@
11
# Spring
22

3-
TuxCare's Endless Lifecycle Support (ELS) for Spring provides security updates, system enhancement patches, and selected bug fixes, that are integral to the stable operation of applications running on these versions of Spring ecosystem components such as Spring Framework, Spring Boot, Spring Data, Spring Security, etc. These components have either reached their end of standard support from vendors or have reached End of Life (EOL).
3+
TuxCare's Endless Lifecycle Support (ELS) for Spring provides security updates, system enhancement patches, and selected bug fixes, that are integral to the stable operation of applications running on these versions of Spring ecosystem components. These components have either reached their end of standard support from vendors or have reached End of Life (EOL).
4+
5+
* Spring Framework
6+
* Spring Boot
7+
* Spring Data
8+
* Spring Security
9+
* etc
410

511
Our ELS for Spring service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Spring applications.
612

713
## Connection to ELS for Spring Repository
814

9-
## Overview
15+
This guide outlines the steps needed to integrate the TuxCare ELS for Spring repository into your Java application. The repository provides trusted Java libraries that can be easily used with both **Maven** and **Gradle** projects.
16+
17+
### Step 1: Get user credentials
18+
19+
You need a username and password in order to use TuxCare ELS Spring repository. Anonymous access is disabled. To receive a username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com)
20+
21+
### Step 2: Configure Registry
22+
23+
1. Navigate to the directory depending on your operating system.
24+
* Windows
25+
```text
26+
Maven: C:\Users\{username}\.m2
27+
Gradle: C:\Users\{username}\.gradle
28+
```
29+
* macOS
30+
```text
31+
Maven: /Users/{username}/.m2
32+
Gradle: /Users/{username}/.gradle
33+
```
34+
* Linux
35+
```text
36+
Maven: /home/{username}/.m2
37+
Gradle: /home/{username}/.gradle
38+
```
39+
40+
2. Add the TuxCare repository and plugin repository to your build configuration.
41+
42+
:::tip
43+
For Maven, you may choose any valid `<id>` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`.
44+
:::
45+
46+
<CodeTabs :tabs="[
47+
{ title: 'Maven (settings.xml)', content: mavencreds },
48+
{ title: 'Gradle (gradle.properties)', content: gradlecreds }
49+
]" />
50+
51+
Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials).
52+
53+
### Step 3: Update Build Configuration
54+
55+
Add the TuxCare Spring repository and plugins to your build configuration:
56+
57+
<CodeTabs :tabs="[
58+
{ title: 'Maven (pom.xml)', content: mavenrepo },
59+
{ title: 'Gradle (build.gradle)', content: gradlerepo }
60+
]" />
61+
62+
* To fully switch from the official Spring repository, replace it with the TuxCare repository.
63+
* To keep both, add TuxCare after the official one.
64+
65+
Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables.
66+
* [Maven](https://github.com/cloudlinux/securechain-java/blob/main/examples/maven)
67+
* [Gradle](https://github.com/cloudlinux/securechain-java/blob/main/examples/gradle)
68+
69+
### Step 4: Update Dependencies
70+
71+
Replace the Spring build dependencies in your build file with the TuxCare-maintained versions. Set the TuxCare release as the parent version. Your build tool will fetch the TuxCare versions of both your dependencies and their transitive dependencies.
72+
73+
<CodeTabs :tabs="[
74+
{ title: 'Maven (pom.xml)', content: mavendeps },
75+
{ title: 'Gradle (build.gradle)', content: gradledeps }
76+
]" />
77+
78+
You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_spring/) (anonymous access is restricted).
79+
80+
### Step 5: Verify and Build
81+
82+
1. To confirm the TuxCare Spring repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath.
83+
84+
<CodeTabs :tabs="[
85+
{ title: 'Maven', content: `mvn dependency:tree -Dverbose` },
86+
{ title: 'Gradle', content: `./gradlew dependencies --configuration runtimeClasspath` }
87+
]" />
88+
89+
2. After reviewing the dependencies, include any library from the repository into your project and then run a build:
90+
91+
<CodeTabs :tabs="[
92+
{ title: 'Maven', content: `mvn clean install` },
93+
{ title: 'Gradle', content: `./gradlew build` }
94+
]" />
1095

11-
This guide outlines the steps needed to integrate the TuxCare ELS for Spring repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your Maven as well as Gradle project.
96+
The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Spring repository.
1297

13-
## Steps
98+
### Conclusion
1499

15-
## Step 1: Get user credentials
100+
You've successfully integrated the TuxCare ELS for Spring repository into your project. You can now benefit from the secure and vetted Spring libraries it provides.
101+
102+
## Vulnerability Exploitability eXchange (VEX)
103+
104+
VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks.
16105

17-
You need username and password in order to use TuxCare ELS Spring repository. Anonymous access is disabled. To receive username and password please contact [sales@tuxcare.com](mailto:sales@tuxcare.com)
106+
TuxCare provides VEX for Spring ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/).
18107

19-
## Step 2: Create or Modify Your Build Tool Settings
108+
## How to Upgrade to a Newer Version of TuxCare Packages
20109

21-
**Maven**
110+
If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update the version string in your Maven or Gradle build file.
22111

23-
* If you are using Maven as your build automation tool, you will need to make changes in your `${MAVEN_HOME}/settings.xml` file. If the file does not already exist in your `${MAVEN_HOME}` directory, you should create one. Open the `settings.xml` file with a text editor and include the following configuration:
112+
## Resolved CVEs in ELS for Spring
113+
114+
<CVETracker />
24115

25-
```text
26-
<?xml version="1.0" encoding="UTF-8"?>
116+
117+
<!-- data for spring instructions used in code blocks -->
118+
119+
<script setup>
120+
const mavencreds =
121+
`<?xml version="1.0" encoding="UTF-8"?>
27122
<settings xmlns="http://maven.apache.org/SETTINGS/1.1.0">
28123
<servers>
29124
<server>
30-
<id>repository-id</id>
31-
<username>${env.USERNAME}</username>
32-
<password>${env.PASSWORD}</password>
125+
<id>tuxcare-registry</id>
126+
<username>USERNAME</username>
127+
<password>PASSWORD</password>
33128
</server>
34129
</servers>
35-
</settings>
36-
```
37-
38-
* Set your credentials via the following environment variables:
39-
40-
```text
41-
export USERNAME=your-username
42-
export PASSWORD=your-password
43-
```
44-
45-
Here `your-username` and `your-password` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials).
130+
</settings>`
46131

47-
* You may choose an arbitrary allowed value instead of `repository-id` and use the same value in the following snippet from your `pom.xml` file:
132+
const gradlecreds =
133+
`tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_spring/
134+
tuxcare_registry_user=USERNAME
135+
tuxcare_registry_password=PASSWORD`
48136

49-
```text
50-
<repositories>
137+
const mavenrepo =
138+
`<repositories>
51139
<repository>
52-
<id>repository-id</id>
140+
<id>tuxcare-registry</id>
53141
<url>https://nexus.repo.tuxcare.com/repository/els_spring/</url>
54142
</repository>
55143
</repositories>
56-
```
57144
58-
* An example maven project can be found [here](https://github.com/cloudlinux/securechain-java/blob/main/examples/maven). Do not forget to set the environment variables.
145+
<pluginRepositories>
146+
<pluginRepository>
147+
<id>tuxcare-registry</id>
148+
<url>https://nexus.repo.tuxcare.com/repository/els_spring/</url>
149+
</pluginRepository>
150+
</pluginRepositories>`
59151

60-
**Gradle**
61-
62-
* If you are using Gradle as your build automation tool, make sure to include the following configuration in your project setup:
63-
64-
```text
65-
repositories {
66-
maven {
67-
url = uri("https://nexus.repo.tuxcare.com/repository/els_spring/")
68-
credentials {
69-
username = findProperty('USERNAME')
70-
password = findProperty('PASSWORD')
152+
const gradlerepo =
153+
`repositories {
154+
maven {
155+
url = uri(providers.gradleProperty("tuxcare_registry_url").get())
156+
credentials {
157+
username = providers.gradleProperty("tuxcare_registry_user").get()
158+
password = providers.gradleProperty("tuxcare_registry_password").get()
159+
}
160+
authentication {
161+
basic(BasicAuthentication)
162+
}
71163
}
72-
}
164+
mavenCentral()
73165
}
74-
```
75166
76-
* Set your credentials via the following environment variables:
167+
pluginManagement {
168+
repositories {
169+
//...
170+
maven {
171+
url = uri(providers.gradleProperty("tuxcare_registry_url").get())
172+
credentials {
173+
username = providers.gradleProperty("tuxcare_registry_user").get()
174+
password = providers.gradleProperty("tuxcare_registry_password").get()
175+
}
176+
authentication {
177+
basic(BasicAuthentication)
178+
}
179+
}
180+
mavenCentral()
181+
//...
182+
}
183+
}`
77184

78-
```text
79-
export ORG_GRADLE_PROJECT_USERNAME=your-username
80-
export ORG_GRADLE_PROJECT_PASSWORD=your-password
81-
```
185+
const mavendeps =
186+
`<parent>
187+
<groupId>org.springframework.boot</groupId>
188+
<artifactId>spring-boot-starter-parent</artifactId>
189+
<version>2.7.18-tuxcare.8</version>
190+
</parent>
82191
83-
Here `your-username` and `your-password` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials).
192+
<dependencies>
193+
<dependency>
194+
<groupId>org.springframework.boot</groupId>
195+
<artifactId>spring-boot-starter-web</artifactId>
196+
</dependency>
197+
<dependency>
198+
<groupId>org.springframework.boot</groupId>
199+
<artifactId>spring-boot-starter-test</artifactId>
200+
<scope>test</scope>
201+
</dependency>
202+
</dependencies>`
84203

85-
* An example gradle project can be found [here](https://github.com/cloudlinux/securechain-java/blob/main/examples/gradle). Do not forget to set the environment variables.
204+
const mavendeps2 =
205+
`<dependencyManagement>
206+
<dependencies>
207+
<dependency>
208+
<groupId>org.springframework.boot</groupId>
209+
<artifactId>spring-boot-starter-parent</artifactId>
210+
<version>2.7.18-tuxcare.8</version>
211+
<type>pom</type>
212+
<scope>import</scope>
213+
</dependency>
214+
</dependencies>
215+
</dependencyManagement>
86216
87-
## Verification
217+
<dependencies>
218+
<dependency>
219+
<groupId>org.springframework.boot</groupId>
220+
<artifactId>spring-boot-starter-web</artifactId>
221+
</dependency>
222+
<dependency>
223+
<groupId>org.springframework.boot</groupId>
224+
<artifactId>spring-boot-starter-test</artifactId>
225+
<scope>test</scope>
226+
</dependency>
227+
</dependencies>`
88228

89-
To confirm that the repository has been correctly established, include any library from the repository into your project and then run a build. The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Spring repository.
229+
const gradledeps =
230+
`plugins {
231+
id 'java'
232+
id 'org.springframework.boot' version '2.7.18-tuxcare.8'
233+
id 'io.spring.dependency-management' version '1.0.15.RELEASE'
234+
}
90235
91-
## Conclusion
236+
dependencies {
237+
implementation "org.springframework.boot:spring-boot-starter-web"
238+
implementation "org.springframework.boot:spring-boot-starter-security"
239+
implementation "org.springframework.boot:spring-boot-starter-validation"
240+
}`
92241

93-
You've successfully integrated the TuxCare ELS for Spring repository into your project. You can now benefit from the secure and vetted Spring libraries it provides.
242+
const gradledeps2 =
243+
`plugins {
244+
id 'java'
245+
id 'io.spring.dependency-management' version '1.0.15.RELEASE'
246+
}
94247
95-
## Resolved CVEs in ELS for Spring
248+
dependencyManagement {
249+
imports {
250+
mavenBom 'org.springframework.boot:spring-boot-dependencies:2.7.18.tuxcare.8'
251+
}
252+
}
96253
97-
<CVETracker />
254+
dependencies {
255+
implementation "org.springframework.boot:spring-boot-starter-web"
256+
implementation "org.springframework.boot:spring-boot-starter-security"
257+
implementation "org.springframework.boot:spring-boot-starter-validation"
258+
}`
259+
</script>

0 commit comments

Comments
 (0)