containerized gitea build pipeline using archlinux runner image

- consolidate build.yaml and build-dev.yaml into a single workflow
- run Gradle in gitea-runner/archlinux with setup-java (graalvm 25) and setup-gradle
- pass the prepared docker build context to host jobs via artifacts
- bump gradle wrapper to 9.7.1

.gitea/workflows/build-dev.yaml

@@ -1,97 +0,0 @@
-name: CI
-on:
-  push:
-    branches:
-      - 'dev'
-jobs:
-  build:
-    runs-on: woryzen
-    steps:
-      - name: Checkout sources
-        uses: actions/checkout@v4
-      - name: Execute Gradle build
-        run: ./gradlew build
-      - name: Prepare Docker image build
-        run: ./gradlew prepareDockerBuild
-      - name: Get project version
-        id: retrieve-version
-        run: ./gradlew -q version >> "$GITHUB_OUTPUT"
-      - name: Login to Gitea container registry
-        uses: docker/login-action@v3
-        with:
-          registry: gitea.woggioni.net
-          username: woggioni
-          password: ${{ secrets.PUBLISHER_TOKEN }}
-      -
-        name: Build rbcs Docker image
-        uses: docker/build-push-action@v5.3.0
-        with:
-          builder: "multiplatform-builder"
-          context: "docker/build/docker"
-          platforms: linux/amd64,linux/arm64
-          push: true
-          pull: true
-          tags: |
-            gitea.woggioni.net/woggioni/rbcs:dev-vanilla
-          target: release-vanilla
-      -
-        name: Build rbcs memcache Docker image
-        uses: docker/build-push-action@v5.3.0
-        with:
-          builder: "multiplatform-builder"
-          context: "docker/build/docker"
-          platforms: linux/amd64,linux/arm64
-          push: true
-          pull: true
-          tags: |
-            gitea.woggioni.net/woggioni/rbcs:dev-memcache
-          target: release-memcache
-      -
-        name: Build rbcs redis Docker image
-        uses: docker/build-push-action@v5.3.0
-        with:
-          builder: "multiplatform-builder"
-          context: "docker/build/docker"
-          platforms: linux/amd64,linux/arm64
-          push: true
-          pull: true
-          tags: |
-            gitea.woggioni.net/woggioni/rbcs:dev-redis
-          target: release-redis
-      -
-        name: Build rbcs full Docker image
-        uses: docker/build-push-action@v5.3.0
-        with:
-          builder: "multiplatform-builder"
-          context: "docker/build/docker"
-          platforms: linux/amd64,linux/arm64
-          push: true
-          pull: true
-          tags: |
-            gitea.woggioni.net/woggioni/rbcs:dev-full
-          target: release-full
-      -
-        name: Build rbcs native Docker image
-        uses: docker/build-push-action@v5.3.0
-        with:
-          builder: "multiplatform-builder"
-          context: "docker/build/docker"
-          platforms: linux/amd64
-          push: true
-          pull: true
-          tags: |
-            gitea.woggioni.net/woggioni/rbcs:dev-native
-          target: release-native
-      -
-        name: Build rbcs jlink Docker image
-        uses: docker/build-push-action@v5.3.0
-        with:
-          builder: "multiplatform-builder"
-          context: "docker/build/docker"
-          platforms: linux/amd64
-          push: true
-          pull: true
-          tags: |
-            gitea.woggioni.net/woggioni/rbcs:dev-jlink
-          target: release-jlink
-

.gitea/workflows/build.yaml

@@ -3,67 +3,163 @@ on:
   push:
     tags:
       - '*'
+    branches:
+      - 'dev'
+env:
+  JAVA_VERSION: '25'
+  GRADLE_VERSION: '9.7.1'
 jobs:
   build:
-    runs-on: woryzen
+    name: Build and publish
+    runs-on: hostinger
+    timeout-minutes: 120
+    container:
+      image: gitea.woggioni.net/woggioni/gitea-runner/archlinux:latest
     steps:
-      - name: Checkout sources
+      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Set up JDK
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'graalvm'
+          java-version: ${{ env.JAVA_VERSION }}
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          gradle-version: ${{ env.GRADLE_VERSION }}
+          cache-read-only: false
       - name: Execute Gradle build
-        run: ./gradlew build
+        run: ./gradlew --no-daemon build
       - name: Prepare Docker image build
-        run: ./gradlew prepareDockerBuild
+        run: ./gradlew --no-daemon prepareDockerBuild
-      - name: Get project version
+      - name: Publish artifacts
-        id: retrieve-version
+        if: startsWith(github.ref, 'refs/tags/')
-        run: ./gradlew -q version >> "$GITHUB_OUTPUT"
+        env:
+          PUBLISHER_TOKEN: ${{ secrets.PUBLISHER_TOKEN }}
+        run: ./gradlew --no-daemon publish
+      - name: Upload Docker build context
+        uses: actions/upload-artifact@v3
+        with:
+          name: docker-context
+          path: docker/build/docker
+  docker-release:
+    name: Push release Docker images
+    runs-on: hostinger
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    timeout-minutes: 90
+    steps:
+      - name: Download Docker build context
+        uses: actions/download-artifact@v3
+        with:
+          name: docker-context
+          path: docker/build/docker
       - name: Login to Gitea container registry
         uses: docker/login-action@v3
         with:
           registry: gitea.woggioni.net
           username: woggioni
           password: ${{ secrets.PUBLISHER_TOKEN }}
-      -
+      - name: Build rbcs Docker image
-        name: Build rbcs Docker image
+        uses: docker/build-push-action@v6
-        uses: docker/build-push-action@v5.3.0
         with:
           builder: "multiplatform-builder"
           context: "docker/build/docker"
+          build-args: VERSION=${{ github.ref_name }},REVISION=${{ github.sha }}
           platforms: linux/amd64,linux/arm64
           push: true
           pull: true
           tags: |
             gitea.woggioni.net/woggioni/rbcs:latest
-            gitea.woggioni.net/woggioni/rbcs:${{ steps.retrieve-version.outputs.VERSION }}
+            gitea.woggioni.net/woggioni/rbcs:${{ github.ref_name }}
           target: release-vanilla
-      -
+      - name: Build rbcs memcache Docker image
-        name: Build rbcs memcache Docker image
+        uses: docker/build-push-action@v6
-        uses: docker/build-push-action@v5.3.0
         with:
           builder: "multiplatform-builder"
           context: "docker/build/docker"
+          build-args: VERSION=${{ github.ref_name }},REVISION=${{ github.sha }}
           platforms: linux/amd64,linux/arm64
           push: true
           pull: true
           tags: |
             gitea.woggioni.net/woggioni/rbcs:memcache
-            gitea.woggioni.net/woggioni/rbcs:${{ steps.retrieve-version.outputs.VERSION }}-memcache
+            gitea.woggioni.net/woggioni/rbcs:${{ github.ref_name }}-memcache
           target: release-memcache
-      -
+      - name: Build rbcs redis Docker image
-        name: Build rbcs redis Docker image
+        uses: docker/build-push-action@v6
-        uses: docker/build-push-action@v5.3.0
         with:
           builder: "multiplatform-builder"
           context: "docker/build/docker"
+          build-args: VERSION=${{ github.ref_name }},REVISION=${{ github.sha }}
           platforms: linux/amd64,linux/arm64
           push: true
           pull: true
           tags: |
             gitea.woggioni.net/woggioni/rbcs:redis
-            gitea.woggioni.net/woggioni/rbcs:${{ steps.retrieve-version.outputs.VERSION }}-redis
+            gitea.woggioni.net/woggioni/rbcs:${{ github.ref_name }}-redis
           target: release-redis
-      -
+      - name: Build rbcs full Docker image
-        name: Build rbcs full Docker image
+        uses: docker/build-push-action@v6
-        uses: docker/build-push-action@v5.3.0
+        with:
+          builder: "multiplatform-builder"
+          context: "docker/build/docker"
+          build-args: VERSION=${{ github.ref_name }},REVISION=${{ github.sha }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          pull: true
+          tags: |
+            gitea.woggioni.net/woggioni/rbcs:full
+            gitea.woggioni.net/woggioni/rbcs:${{ github.ref_name }}-full
+          target: release-full
+      - name: Build rbcs native Docker image
+        uses: docker/build-push-action@v6
+        with:
+          builder: "multiplatform-builder"
+          context: "docker/build/docker"
+          build-args: VERSION=${{ github.ref_name }},REVISION=${{ github.sha }}
+          platforms: linux/amd64
+          push: true
+          pull: true
+          tags: |
+            gitea.woggioni.net/woggioni/rbcs:native
+            gitea.woggioni.net/woggioni/rbcs:${{ github.ref_name }}-native
+          target: release-native
+      - name: Build rbcs jlink Docker image
+        uses: docker/build-push-action@v6
+        with:
+          builder: "multiplatform-builder"
+          context: "docker/build/docker"
+          build-args: VERSION=${{ github.ref_name }},REVISION=${{ github.sha }}
+          platforms: linux/amd64
+          push: true
+          pull: true
+          tags: |
+            gitea.woggioni.net/woggioni/rbcs:jlink
+            gitea.woggioni.net/woggioni/rbcs:${{ github.ref_name }}-jlink
+          target: release-jlink
+  docker-dev:
+    name: Push dev Docker images
+    runs-on: hostinger
+    needs: build
+    if: github.ref == 'refs/heads/dev'
+    timeout-minutes: 90
+    steps:
+      - name: Download Docker build context
+        uses: actions/download-artifact@v3
+        with:
+          name: docker-context
+          path: docker/build/docker
+      - name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      - name: Build rbcs Docker image
+        uses: docker/build-push-action@v6
         with:
           builder: "multiplatform-builder"
           context: "docker/build/docker"
@@ -71,12 +167,43 @@ jobs:
           push: true
           pull: true
           tags: |
-            gitea.woggioni.net/woggioni/rbcs:full
+            gitea.woggioni.net/woggioni/rbcs:dev-vanilla
-            gitea.woggioni.net/woggioni/rbcs:${{ steps.retrieve-version.outputs.VERSION }}-full
+          target: release-vanilla
+      - name: Build rbcs memcache Docker image
+        uses: docker/build-push-action@v6
+        with:
+          builder: "multiplatform-builder"
+          context: "docker/build/docker"
+          platforms: linux/amd64,linux/arm64
+          push: true
+          pull: true
+          tags: |
+            gitea.woggioni.net/woggioni/rbcs:dev-memcache
+          target: release-memcache
+      - name: Build rbcs redis Docker image
+        uses: docker/build-push-action@v6
+        with:
+          builder: "multiplatform-builder"
+          context: "docker/build/docker"
+          platforms: linux/amd64,linux/arm64
+          push: true
+          pull: true
+          tags: |
+            gitea.woggioni.net/woggioni/rbcs:dev-redis
+          target: release-redis
+      - name: Build rbcs full Docker image
+        uses: docker/build-push-action@v6
+        with:
+          builder: "multiplatform-builder"
+          context: "docker/build/docker"
+          platforms: linux/amd64,linux/arm64
+          push: true
+          pull: true
+          tags: |
+            gitea.woggioni.net/woggioni/rbcs:dev-full
           target: release-full
-      -
+      - name: Build rbcs native Docker image
-        name: Build rbcs native Docker image
+        uses: docker/build-push-action@v6
-        uses: docker/build-push-action@v5.3.0
         with:
           builder: "multiplatform-builder"
           context: "docker/build/docker"
@@ -84,12 +211,10 @@ jobs:
           push: true
           pull: true
           tags: |
-            gitea.woggioni.net/woggioni/rbcs:native
+            gitea.woggioni.net/woggioni/rbcs:dev-native
-            gitea.woggioni.net/woggioni/rbcs:${{ steps.retrieve-version.outputs.VERSION }}-native
           target: release-native
-      -
+      - name: Build rbcs jlink Docker image
-        name: Build rbcs jlink Docker image
+        uses: docker/build-push-action@v6
-        uses: docker/build-push-action@v5.3.0
         with:
           builder: "multiplatform-builder"
           context: "docker/build/docker"
@@ -97,11 +222,5 @@ jobs:
           push: true
           pull: true
           tags: |
-            gitea.woggioni.net/woggioni/rbcs:jlink
+            gitea.woggioni.net/woggioni/rbcs:dev-jlink
-            gitea.woggioni.net/woggioni/rbcs:${{ steps.retrieve-version.outputs.VERSION }}-jlink
           target: release-jlink
-      - name: Publish artifacts
-        env:
-          PUBLISHER_TOKEN: ${{ secrets.PUBLISHER_TOKEN }}
-        run: ./gradlew publish
-

.gitignore

@@ -4,8 +4,6 @@
 # Ignore Gradle build output directory
 build
 
-rbcs-cli/native-image/*.json
-
 # Ignore JDTLS files
 .classpath
 .project

build.gradle

@@ -82,6 +82,9 @@ allprojects { subproject ->
         tasks.withType(KotlinCompile.class) {
             compilerOptions.jvmTarget = JvmTarget.JVM_25
         }
+        dependencies {
+            compileOnly catalog.lombok
+        }
     }
 
     pluginManager.withPlugin(catalog.plugins.lombok.get().pluginId) {

docker/Dockerfile

@@ -1,15 +1,25 @@
+ARG VERSION, REVISION
 FROM eclipse-temurin:25-jre-alpine AS base-release
+LABEL org.opencontainers.image.authors="Walter Oggioni <walter.oggioni@agentmail.to>"
+LABEL org.opencontainers.image.version="${VERSION}"
+LABEL org.opencontainers.image.revision="${REVISION}"
+LABEL org.opencontainers.image.source=https://gitea.woggioni.net/woggioni/rbcs
+
 RUN adduser -D rbcs
 USER rbcs
 ENV RBCS_CONFIGURATION_DIR="/etc/rbcs"
 WORKDIR /var/lib/rbcs
 
 FROM base-release AS release-vanilla
+LABEL org.opencontainers.image.title=rbcs
+LABEL org.opencontainers.image.description="RBCS vanilla image"
 ADD rbcs-cli-envelope-*.jar rbcs.jar
 ADD logback.xml /etc/rbcs/logback.xml
 ENTRYPOINT ["java", "-jar", "/var/lib/rbcs/rbcs.jar"]
 
 FROM base-release AS release-memcache
+LABEL org.opencontainers.image.title=rbcs-memcache
+LABEL org.opencontainers.image.description="RBCS image with memcache plugin"
 ADD --chown=rbcs:rbcs rbcs-cli-envelope-*.jar rbcs.jar
 RUN mkdir plugins
 WORKDIR /var/lib/rbcs/plugins
@@ -19,6 +29,8 @@ ADD logback.xml /etc/rbcs/logback.xml
 ENTRYPOINT ["java", "-jar", "/var/lib/rbcs/rbcs.jar"]
 
 FROM base-release AS release-redis
+LABEL org.opencontainers.image.title=rbcs-redis
+LABEL org.opencontainers.image.description="RBCS image with redis plugin"
 ADD --chown=rbcs:rbcs rbcs-cli-envelope-*.jar rbcs.jar
 RUN mkdir plugins
 WORKDIR /var/lib/rbcs/plugins
@@ -28,6 +40,8 @@ ADD logback.xml /etc/rbcs/logback.xml
 ENTRYPOINT ["java", "-jar", "/var/lib/rbcs/rbcs.jar"]
 
 FROM base-release AS release-full
+LABEL org.opencontainers.image.title=rbcs-full
+LABEL org.opencontainers.image.description="RBCS image with all plugins"
 ADD --chown=rbcs:rbcs rbcs-cli-envelope-*.jar rbcs.jar
 RUN mkdir plugins
 WORKDIR /var/lib/rbcs/plugins
@@ -45,17 +59,22 @@ RUN adduser -D -u 1000 rbcs -h /var/lib/rbcs
 RUN chown rbcs:rbcs /var/tmp/rbcs
 
 FROM scratch AS release-native
+LABEL org.opencontainers.image.title=rbcs-native
+LABEL org.opencontainers.image.description="RBCS image with a native executable with GraalVM"
 COPY --from=base-native /etc/passwd /etc/passwd
 COPY --from=base-native /etc/rbcs /etc/rbcs
 COPY --from=base-native /var/lib/rbcs /var/lib/rbcs
 COPY --from=base-native /var/tmp/rbcs /var/tmp/rbcs
-ADD rbcs-cli.upx /usr/bin/rbcs-cli
+ADD --chmod=755 rbcs-cli.upx /usr/bin/rbcs-cli
+ADD logback.xml /etc/rbcs/logback.xml
 USER rbcs
 WORKDIR /var/lib/rbcs
 ENV RBCS_CONFIGURATION_DIR="/etc/rbcs"
 ENTRYPOINT ["/usr/bin/rbcs-cli", "-XX:MaximumHeapSizePercent=70", "-Dio.netty.tmpdir=/var/tmp/rbcs", "-Dlogback.configurationFile=/etc/rbcs/logback.xml"]
 
 FROM debian:12-slim AS release-jlink
+LABEL org.opencontainers.image.title=rbcs-jlink
+LABEL org.opencontainers.image.description="RBCS image with a jlink distribution"
 RUN mkdir -p /usr/share/java/rbcs
 RUN --mount=type=bind,source=.,target=/build/distributions tar -xf /build/distributions/rbcs-cli*.tar -C /usr/share/java/rbcs
 RUN chmod 755 /usr/share/java/rbcs/bin/*

gradle.properties

@@ -2,9 +2,9 @@ org.gradle.configuration-cache=false
 org.gradle.parallel=true
 org.gradle.caching=true
 
-rbcs.version = 0.5.0
+rbcs.version = 0.5.2
 
-lys.version = 2026.05.27
+lys.version = 2026.09.22
 
 gitea.maven.url = https://gitea.woggioni.net/api/packages/woggioni/maven
 docker.registry.url=gitea.woggioni.net

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

rbcs-cli/build.gradle

@@ -90,7 +90,7 @@ Provider<EnvelopeJarTask> envelopeJarTaskProvider = tasks.named(EnvelopePlugin.E
 tasks.named(NativeImagePlugin.CONFIGURE_NATIVE_IMAGE_TASK_NAME, NativeImageConfigurationTask) {
     toolchain {
         languageVersion = JavaLanguageVersion.of(25)
-        vendor = JvmVendorSpec.GRAAL_VM
+        vendor = JvmVendorSpec.ORACLE
     }
     mainClass = "net.woggioni.rbcs.cli.graal.GraalNativeImageConfiguration"
     classpath = project.files(
@@ -108,10 +108,10 @@ tasks.named(NativeImagePlugin.CONFIGURE_NATIVE_IMAGE_TASK_NAME, NativeImageConfi
 nativeImage {
     toolchain {
         languageVersion = JavaLanguageVersion.of(25)
-        vendor = JvmVendorSpec.GRAAL_VM
+        vendor = JvmVendorSpec.ORACLE
     }
     mainClass = mainClassName
-//    mainModule = mainModuleName
+    //mainModule = mainModuleName
     useMusl = true
     buildStaticImage = true
     linkAtBuildTime = false
@@ -119,6 +119,7 @@ nativeImage {
     compressExecutable = true
     compressionLevel = 6
     useLZMA = false
+    //verbose = true
 }
 
 Provider<UpxTask> upxTaskProvider = tasks.named(NativeImagePlugin.UPX_TASK_NAME, UpxTask) {
@@ -127,7 +128,7 @@ Provider<UpxTask> upxTaskProvider = tasks.named(NativeImagePlugin.UPX_TASK_NAME,
 Provider<JlinkTask> jlinkTaskProvider = tasks.named(JlinkPlugin.JLINK_TASK_NAME, JlinkTask) {
     toolchain {
         languageVersion = JavaLanguageVersion.of(25)
-        vendor = JvmVendorSpec.GRAAL_VM
+        vendor = JvmVendorSpec.ORACLE
     }
 
     mainClass = mainClassName
@@ -152,7 +153,6 @@ Provider<JlinkTask> jlinkTaskProvider = tasks.named(JlinkPlugin.JLINK_TASK_NAME,
 }
 
 Provider<Tar> jlinkDistTarTaskProvider = tasks.named(JlinkPlugin.JLINK_DIST_TAR_TASK_NAME, Tar) {
-    exclude 'lib/libjvmcicompiler.so'
 }
 
 tasks.named(JavaPlugin.PROCESS_RESOURCES_TASK_NAME, ProcessResources) {

rbcs-cli/native-image/native-image.properties

@@ -1,2 +1,11 @@
-Args=-O3 -march=x86-64-v2 --gc=serial --initialize-at-run-time=io.netty --enable-url-protocols=jpms -H:+UnlockExperimentalVMOptions -H:+SharedArenaSupport --initialize-at-build-time=net.woggioni.rbcs.common.RbcsUrlStreamHandlerFactory,net.woggioni.rbcs.common.RbcsUrlStreamHandlerFactory$JpmsHandler
+Args=-O3 \
+   -march=x86-64-v3 \
+   --gc=serial \
+   --enable-url-protocols=jpms \
+   --pgo=conf/default.iprof \
+   --initialize-at-run-time=io.netty \
+   --initialize-at-build-time=net.woggioni.rbcs.common.RbcsUrlStreamHandlerFactory,net.woggioni.rbcs.common.RbcsUrlStreamHandlerFactory$JpmsHandler \
+   --trace-object-instantiation=ch.qos.logback.classic.Logger \
+   -H:+UnlockExperimentalVMOptions \
+   -H:+SharedArenaSupport
 #-H:TraceClassInitialization=io.netty.handler.ssl.BouncyCastleAlpnSslUtils

rbcs-client/src/main/kotlin/net/woggioni/rbcs/client/RemoteBuildCacheClient.kt

@@ -10,6 +10,7 @@ import java.util.concurrent.TimeUnit
 import java.util.concurrent.TimeoutException
 import java.util.concurrent.atomic.AtomicInteger
 import javax.net.ssl.TrustManagerFactory
+import javax.net.ssl.X509ExtendedTrustManager
 import javax.net.ssl.X509TrustManager
 import kotlin.random.Random
 import io.netty.util.concurrent.Future as NettyFuture
@@ -74,13 +75,25 @@ class RemoteBuildCacheClient(private val profile: Configuration.Profile) : AutoC
                     )
                     profile.tlsTruststore?.let { trustStore ->
                         if (!trustStore.verifyServerCertificate) {
-                            trustManager(object : X509TrustManager {
+                            trustManager(object : X509ExtendedTrustManager() {
                                 override fun checkClientTrusted(certChain: Array<out X509Certificate>, p1: String?) {
                                 }
 
+                                override fun checkClientTrusted(certChain: Array<out X509Certificate>, p1: String?, socket: java.net.Socket) {
+                                }
+
+                                override fun checkClientTrusted(certChain: Array<out X509Certificate>, p1: String?, engine: javax.net.ssl.SSLEngine) {
+                                }
+
                                 override fun checkServerTrusted(certChain: Array<out X509Certificate>, p1: String?) {
                                 }
 
+                                override fun checkServerTrusted(certChain: Array<out X509Certificate>, p1: String?, socket: java.net.Socket) {
+                                }
+
+                                override fun checkServerTrusted(certChain: Array<out X509Certificate>, p1: String?, engine: javax.net.ssl.SSLEngine) {
+                                }
+
                                 override fun getAcceptedIssuers() = null
                             })
                         } else {

rbcs-common/src/main/kotlin/net/woggioni/rbcs/common/RBCS.kt

@@ -19,6 +19,7 @@ import java.security.cert.X509Certificate
 import java.util.EnumSet
 import java.util.ServiceLoader
 import javax.net.ssl.TrustManagerFactory
+import javax.net.ssl.X509ExtendedTrustManager
 import javax.net.ssl.X509TrustManager
 import net.woggioni.jwo.JWO
 import net.woggioni.jwo.Tuple2
@@ -124,7 +125,7 @@ object RBCS {
         return keystore
     }
 
-    fun getTrustManager(trustStore: KeyStore?, certificateRevocationEnabled: Boolean): X509TrustManager {
+    fun getTrustManager(trustStore: KeyStore?, certificateRevocationEnabled: Boolean): X509ExtendedTrustManager {
         return if (trustStore != null) {
             val certificateFactory = CertificateFactory.getInstance("X.509")
             val validator = CertPathValidator.getInstance("PKIX").apply {
@@ -136,7 +137,7 @@ object RBCS {
             val params = PKIXParameters(trustStore).apply {
                 isRevocationEnabled = certificateRevocationEnabled
             }
-            object : X509TrustManager {
+            object : X509ExtendedTrustManager() {
                 override fun checkClientTrusted(chain: Array<out X509Certificate>, authType: String) {
                     val clientCertificateChain = certificateFactory.generateCertPath(chain.toList())
                     try {
@@ -146,10 +147,26 @@ object RBCS {
                     }
                 }
 
+                override fun checkClientTrusted(chain: Array<out X509Certificate>, authType: String, socket: java.net.Socket) {
+                    checkClientTrusted(chain, authType)
+                }
+
+                override fun checkClientTrusted(chain: Array<out X509Certificate>, authType: String, engine: javax.net.ssl.SSLEngine) {
+                    checkClientTrusted(chain, authType)
+                }
+
                 override fun checkServerTrusted(chain: Array<out X509Certificate>, authType: String) {
                     throw NotImplementedError()
                 }
 
+                override fun checkServerTrusted(chain: Array<out X509Certificate>, authType: String, socket: java.net.Socket) {
+                    checkServerTrusted(chain, authType)
+                }
+
+                override fun checkServerTrusted(chain: Array<out X509Certificate>, authType: String, engine: javax.net.ssl.SSLEngine) {
+                    checkServerTrusted(chain, authType)
+                }
+
                 private val acceptedIssuers = trustStore.aliases().asSequence()
                     .filter(trustStore::isCertificateEntry)
                     .map(trustStore::getCertificate)
@@ -161,8 +178,8 @@ object RBCS {
             }
         } else {
             val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
-            trustManagerFactory.trustManagers.asSequence().filter { it is X509TrustManager }
+            trustManagerFactory.trustManagers.asSequence().filter { it is X509ExtendedTrustManager }
-                .single() as X509TrustManager
+                .single() as X509ExtendedTrustManager
         }
     }
 

rbcs-server/src/main/kotlin/net/woggioni/rbcs/server/RemoteBuildCacheServer.kt

@@ -188,7 +188,7 @@ class RemoteBuildCacheServer(private val cfg: Configuration) {
                 ?: return anonymousUserGroups?.let { AuthenticationResult(null, it) }
             val ldapName = try {
                 LdapName(subjectDn)
-            } catch (e: Exception) {
+            } catch (_: Exception) {
                 log.debug(ctx) {
                     "Invalid subject DN in header $headerName: $subjectDn"
                 }
@@ -354,7 +354,7 @@ class RemoteBuildCacheServer(private val cfg: Configuration) {
                     }?.let {
                         pattern.matcher(it.value.toString())
                     }?.takeIf(Matcher::matches)?.group(1)
-                    cfg.users[userName] ?: throw java.lang.RuntimeException("Failed to extract user")
+                    cfg.users[userName] ?: throw RuntimeException("Failed to extract user")
                 }
             }
 
@@ -368,7 +368,7 @@ class RemoteBuildCacheServer(private val cfg: Configuration) {
                     }?.let {
                         pattern.matcher(it.value.toString())
                     }?.takeIf(Matcher::matches)?.group(1)
-                    cfg.groups[groupName] ?: throw java.lang.RuntimeException("Failed to extract group")
+                    cfg.groups[groupName] ?: throw RuntimeException("Failed to extract group")
                 }
             }
 

rbcs-server/src/main/kotlin/net/woggioni/rbcs/server/configuration/Parser.kt

@@ -344,14 +344,14 @@ object Parser {
                         roles = parseRoles(child)
                     }
                     "group-quota" -> {
-                        userQuota = parseQuota(child)
-                    }
-                    "user-quota" -> {
                         groupQuota = parseQuota(child)
                     }
+                    "user-quota" -> {
+                        userQuota = parseQuota(child)
                     }
                 }
-            groupName to Group(groupName, roles, userQuota, groupQuota)
+            }
+            groupName to Group(groupName, roles, groupQuota, userQuota)
         }.toMap()
         val users = knownUsersMap.map { (name, user) ->
             name to User(name, user.password, userGroups[name]?.mapNotNull { groups[it] }?.toSet() ?: emptySet(), user.quota)

rbcs-server/src/main/kotlin/net/woggioni/rbcs/server/handler/ProxyProtocolHandler.kt

@@ -23,24 +23,22 @@ class ProxyProtocolHandler(private val trustedProxyIPs : List<Cidr>) : SimpleCha
     ) {
         val sourceAddress = ctx.channel().remoteAddress()
         if (sourceAddress is InetSocketAddress &&
-            trustedProxyIPs.isEmpty() ||
+            (trustedProxyIPs.isEmpty() ||
-            trustedProxyIPs.any { it.contains((sourceAddress as InetSocketAddress).address) }.also {
+            trustedProxyIPs.any { it.contains(sourceAddress.address) }.also {
-                if(!it && log.isTraceEnabled) {
+                if(!it) {
                     log.trace {
                         "Received a proxied connection request from $sourceAddress which is not a trusted proxy address, " +
                                 "the proxy server address will be used instead"
                     }
                 }
-            }) {
+            })) {
             val proxiedClientAddress = InetSocketAddress(
                 InetAddress.ofLiteral(msg.sourceAddress()),
                 msg.sourcePort()
             )
-            if(log.isTraceEnabled) {
             log.trace {
                 "Received proxied connection request from $sourceAddress forwarded for $proxiedClientAddress"
             }
-            }
             ctx.channel().attr(RemoteBuildCacheServer.clientIp).set(proxiedClientAddress)
         }
     }

rbcs-server/src/main/kotlin/net/woggioni/rbcs/server/handler/ServerHandler.kt

@@ -171,7 +171,6 @@ class ServerHandler(private val serverPrefix: Path, private val cacheHandlerSupp
                 ctx.pipeline().addBefore(ExceptionHandler.NAME, null, cacheHandler)
                 key.let(::CacheGetRequest)
                     .let(ctx::fireChannelRead)
-                    ?: ctx.channel().write(CacheValueNotFoundResponse(key))
             } else {
                 cacheRequestInProgress = false
                 log.warn(ctx) {