temporary commit

build.gradle

@@ -1,19 +1,33 @@
 plugins {
-    alias catalog.plugins.kotlin
+    id 'application'
+    alias catalog.plugins.kotlin.jvm
+    alias catalog.plugins.graalvm.native.image
+    alias catalog.plugins.graalvm.jlink
     alias catalog.plugins.envelope
     id 'maven-publish'
 }
 
 import net.woggioni.gradle.envelope.EnvelopeJarTask
 import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 
 group = 'net.woggioni'
 
 version = getProperty('gbcs.version')
 
+application {
+    mainModule = 'net.woggioni.gbcs'
+    mainClass = 'net.woggioni.gbcs.GradleBuildCacheServer'
+//    mainClass = 'net.woggioni.gbcs.NettyPingServer'
+}
+
+configureNativeImage {
+    mainClass = 'net.woggioni.gbcs.GraalNativeImageConfiguration'
+}
+
 repositories {
     maven {
-        url = 'https://woggioni.net/mvn'
+        url = getProperty('gitea.maven.url')
         content {
             includeModule 'net.woggioni', 'jwo'
             includeGroup 'com.lys'
@@ -27,7 +41,11 @@ dependencies {
     implementation catalog.slf4j.api
     implementation catalog.netty.codec.http
 
-    runtimeOnly catalog.slf4j.jdk14
+//    runtimeOnly catalog.slf4j.jdk14
+    runtimeOnly catalog.logback.classic
+//    // https://mvnrepository.com/artifact/org.fusesource.jansi/jansi
+//    runtimeOnly group: 'org.fusesource.jansi', name: 'jansi', version: '2.4.1'
+
 
     testImplementation catalog.junit.jupiter.api
     testImplementation catalog.junit.jupiter.params
@@ -36,32 +54,38 @@ dependencies {
 
 java {
     withSourcesJar()
-}
-
-tasks.named(JavaPlugin.COMPILE_JAVA_TASK_NAME, JavaCompile) {
     modularity.inferModulePath = true
-    options.compilerArgs << '--patch-module' << 'net.woggioni.gbcs=' + project.sourceSets.main.output.asPath
-    options.release = 17
-}
-
-tasks.named("compileKotlin", KotlinCompile.class) {
-    kotlinOptions {
-        jvmTarget = 17
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(21)
+//        vendor = JvmVendorSpec.GRAAL_VM
     }
 }
 
-Provider<EnvelopeJarTask> envelopeJarTaskProvider = tasks.named('envelopeJar', EnvelopeJarTask.class) {
-    mainModule = 'net.woggioni.gbcs'
-    mainClass = 'net.woggioni.gbcs.GradleBuildCacheServer'
-    systemProperty 'java.util.logging.config.class', 'net.woggioni.gbcs.LoggingConfig'
-    systemProperty 'log.config.source', 'logging.properties'
+test {
+    useJUnitPlatform()
 }
 
-wrapper {
-    distributionType = Wrapper.DistributionType.BIN
-    gradleVersion = getProperty('gradle.version')
+tasks.named(JavaPlugin.COMPILE_JAVA_TASK_NAME, JavaCompile) {
+    options.compilerArgs << '--patch-module' << 'net.woggioni.gbcs=' + project.sourceSets.main.output.asPath
 }
 
+tasks.withType(JavaCompile) {
+    modularity.inferModulePath = true
+    options.release = 21
+}
+
+
+tasks.named("compileKotlin", KotlinCompile.class) {
+    compilerOptions.jvmTarget = JvmTarget.JVM_21
+}
+
+Provider<EnvelopeJarTask> envelopeJarTaskProvider = tasks.named('envelopeJar', EnvelopeJarTask.class) {
+//    systemProperties['java.util.logging.config.class'] = 'net.woggioni.gbcs.LoggingConfig'
+//    systemProperties['log.config.source'] = 'logging.properties'
+    systemProperties['logback.configurationFile'] = 'classpath:logback.xml'
+}
+
+
 def envelopeJarArtifact = artifacts.add('archives', envelopeJarTaskProvider.get().archiveFile.get().asFile) {
     type = 'jar'
     builtBy envelopeJarTaskProvider

gradle.properties

@@ -1,4 +1,5 @@
-gbcs.version = 0.1-SNAPSHOT
+gbcs.version = 2024.12.13
 
-gradle.version = 7.5.1
-lys.version = 0.1-SNAPSHOT
+lys.version = 2024.12.07
+
+gitea.maven.url = https://gitea.woggioni.net/api/packages/woggioni/maven

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.5.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.11.1-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -55,7 +55,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -80,13 +80,11 @@ do
     esac
 done
 
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-APP_NAME="Gradle"
+# This is normally unused
+# shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -133,22 +131,29 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
     case $MAX_FD in  #(
       '' | soft) :;; #(
       *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -193,11 +198,15 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

gradlew.bat

@@ -26,6 +26,7 @@ if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
@@ -42,11 +43,11 @@ set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
 if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -56,11 +57,11 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
 if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 

native-image/native-image.properties

@@ -0,0 +1 @@
+Args=-H:Optimize=3 -H:+TraceClassInitialization

settings.gradle

@@ -1,13 +1,8 @@
 pluginManagement {
     repositories {
+        mavenLocal()
         maven {
-            content {
-                includeModule 'net.woggioni.gradle', 'envelope'
-                includeModule 'net.woggioni.gradle.envelope', 'net.woggioni.gradle.envelope.gradle.plugin'
-                includeModule 'net.woggioni.gradle', 'lombok'
-                includeModule 'net.woggioni.gradle.lombok', 'net.woggioni.gradle.lombok.gradle.plugin'
-            }
-            url = 'https://woggioni.net/mvn/'
+            url = getProperty('gitea.maven.url')
         }
         gradlePluginPortal()
     }
@@ -16,7 +11,7 @@ pluginManagement {
 dependencyResolutionManagement {
     repositories {
         maven {
-            url = 'https://woggioni.net/mvn/'
+            url = getProperty('gitea.maven.url')
             content {
                 includeGroup 'com.lys'
             }
@@ -25,8 +20,10 @@ dependencyResolutionManagement {
     versionCatalogs {
         catalog {
             from group: 'com.lys', name: 'lys-catalog', version: getProperty('lys.version')
+            version('envelope', '2024.12.15')
         }
     }
 }
 
 rootProject.name = 'gbcs'
+

src/main/java/module-info.java

@@ -1,4 +1,7 @@
+import net.woggioni.gbcs.url.ClasspathUrlStreamHandlerFactoryProvider;
+
 module net.woggioni.gbcs {
+    requires java.sql;
     requires java.xml;
     requires java.logging;
     requires kotlin.stdlib;
@@ -12,4 +15,8 @@ module net.woggioni.gbcs {
     requires net.woggioni.jwo;
 
     exports net.woggioni.gbcs;
+    exports net.woggioni.gbcs.url;
+//    opens net.woggioni.gbcs to net.woggioni.envelope;
+    provides java.net.URLStreamHandlerFactory with ClasspathUrlStreamHandlerFactoryProvider;
+    uses java.net.URLStreamHandlerFactory;
 }

src/main/java/net/woggioni/gbcs/NettyPingServer.java

@@ -0,0 +1,88 @@
+package net.woggioni.gbcs;
+
+import io.netty.bootstrap.ServerBootstrap;
+import io.netty.channel.*;
+import io.netty.channel.nio.NioEventLoopGroup;
+import io.netty.channel.socket.SocketChannel;
+import io.netty.channel.socket.nio.NioServerSocketChannel;
+import io.netty.handler.codec.string.StringDecoder;
+import io.netty.handler.codec.string.StringEncoder;
+import io.netty.util.CharsetUtil;
+
+public class NettyPingServer {
+    private final int port;
+
+    public NettyPingServer(int port) {
+        this.port = port;
+    }
+
+    public void start() throws Exception {
+        // Create event loop groups for handling incoming connections and processing
+        EventLoopGroup bossGroup = new NioEventLoopGroup();
+        EventLoopGroup workerGroup = new NioEventLoopGroup();
+
+        try {
+            // Create server bootstrap configuration
+            ServerBootstrap bootstrap = new ServerBootstrap()
+                    .group(bossGroup, workerGroup)
+                    .channel(NioServerSocketChannel.class)
+                    .childHandler(new ChannelInitializer<SocketChannel>() {
+                        @Override
+                        protected void initChannel(SocketChannel ch) throws Exception {
+                            ch.pipeline().addLast(
+                                    new StringDecoder(CharsetUtil.UTF_8),
+                                    new StringEncoder(CharsetUtil.UTF_8),
+                                    new PingServerHandler()
+                            );
+                        }
+                    })
+                    .option(ChannelOption.SO_BACKLOG, 128)
+                    .childOption(ChannelOption.SO_KEEPALIVE, true);
+
+            // Bind and start the server
+            ChannelFuture future = bootstrap.bind(port).sync();
+            System.out.println("Ping Server started on port: " + port);
+            try(final var handle = new GradleBuildCacheServer.ServerHandle(future, bossGroup, workerGroup)) {
+                Thread.sleep(5000);
+                future.channel().close();
+                // Wait until the server socket is closed
+                future.channel().closeFuture().sync();
+            }
+        } finally {
+            // Shutdown event loop groups
+//            workerGroup.shutdownGracefully();
+//            bossGroup.shutdownGracefully();
+        }
+    }
+
+    // Custom handler for processing ping requests
+    private static class PingServerHandler extends SimpleChannelInboundHandler<String> {
+        @Override
+        protected void channelRead0(ChannelHandlerContext ctx, String msg) throws Exception {
+            // Check if the received message is a ping request
+            if ("ping".equalsIgnoreCase(msg.trim())) {
+                // Respond with "pong"
+                ctx.writeAndFlush("pong\n");
+                System.out.println("Received ping, sent pong");
+            }
+        }
+
+        @Override
+        public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) {
+            // Log and close the connection in case of any errors
+            cause.printStackTrace();
+            ctx.close();
+        }
+    }
+
+    // Main method to start the server
+    public static void main(String[] args) throws Exception {
+        int port = 8080; // Default port
+        if (args.length > 0) {
+            port = Integer.parseInt(args[0]);
+        }
+
+        new NettyPingServer(port).start();
+    }
+}
+

src/main/java/net/woggioni/gbcs/url/ClasspathUrlStreamHandlerFactoryProvider.java

@@ -0,0 +1,41 @@
+package net.woggioni.gbcs.url;
+
+import java.io.IOException;
+import java.net.URL;
+import java.net.URLConnection;
+import java.net.URLStreamHandler;
+import java.net.URLStreamHandlerFactory;
+
+public class ClasspathUrlStreamHandlerFactoryProvider implements URLStreamHandlerFactory {
+
+    private static class Handler extends URLStreamHandler {
+        private final ClassLoader classLoader;
+
+        public Handler() {
+            this.classLoader = getClass().getClassLoader();
+        }
+
+        public Handler(ClassLoader classLoader) {
+            this.classLoader = classLoader;
+        }
+
+        @Override
+        protected URLConnection openConnection(URL u) throws IOException {
+            final URL resourceUrl = classLoader.getResource(u.getPath());
+            return resourceUrl.openConnection();
+        }
+    }
+
+    @Override
+    public URLStreamHandler createURLStreamHandler(String protocol) {
+        URLStreamHandler result;
+        switch (protocol) {
+            case "classpath":
+                result = new Handler();
+                break;
+            default:
+                result = null;
+        }
+        return result;
+    }
+}

src/main/kotlin/net/woggioni/gbcs/ClientCertificateValidator.kt

@@ -0,0 +1,77 @@
+package net.woggioni.gbcs
+
+import java.security.KeyStore
+import java.security.cert.CertPathValidator
+import java.security.cert.CertificateFactory
+import java.security.cert.PKIXParameters
+import java.security.cert.PKIXRevocationChecker
+import java.security.cert.X509Certificate
+import java.util.EnumSet
+import io.netty.channel.ChannelHandlerContext
+import io.netty.channel.ChannelInboundHandlerAdapter
+import io.netty.handler.ssl.SslHandler
+import io.netty.handler.ssl.SslHandshakeCompletionEvent
+import javax.net.ssl.SSLSession
+import javax.net.ssl.TrustManagerFactory
+import javax.net.ssl.X509TrustManager
+
+
+class ClientCertificateValidator private constructor(
+    private val sslHandler : SslHandler,
+    private val x509TrustManager: X509TrustManager) : ChannelInboundHandlerAdapter() {
+    override fun userEventTriggered(ctx: ChannelHandlerContext, evt: Any) {
+        if (evt is SslHandshakeCompletionEvent) {
+            if (evt.isSuccess) {
+                val session: SSLSession = sslHandler.engine().session
+                val clientCertificateChain = session.peerCertificates as Array<X509Certificate>
+                val authType: String = clientCertificateChain[0].publicKey.algorithm
+                x509TrustManager.checkClientTrusted(clientCertificateChain, authType)
+            } else {
+                // Handle the failure, for example by closing the channel.
+            }
+        }
+        super.userEventTriggered(ctx, evt)
+    }
+
+    companion object {
+        fun getTrustManager(trustStore : KeyStore?, certificateRevocationEnabled : Boolean) : X509TrustManager {
+            return if(trustStore != null) {
+                val certificateFactory = CertificateFactory.getInstance("X.509")
+                val validator = CertPathValidator.getInstance("PKIX").apply {
+                    val rc = revocationChecker as PKIXRevocationChecker
+                    rc.options = EnumSet.of(
+                        PKIXRevocationChecker.Option.NO_FALLBACK)
+                }
+                val params = PKIXParameters(trustStore).apply {
+                    isRevocationEnabled = certificateRevocationEnabled
+                }
+                object : X509TrustManager {
+                    override fun checkClientTrusted(chain: Array<out X509Certificate>, authType: String) {
+                        val clientCertificateChain = certificateFactory.generateCertPath(chain.toList())
+                        validator.validate(clientCertificateChain, params)
+                    }
+
+                    override fun checkServerTrusted(chain: Array<out X509Certificate>, authType: String) {
+                        throw NotImplementedError()
+                    }
+
+                    private val acceptedIssuers = trustStore.aliases().asSequence()
+                        .filter (trustStore::isCertificateEntry)
+                        .map(trustStore::getCertificate)
+                        .map { it as X509Certificate }
+                        .toList()
+                        .toTypedArray()
+
+                    override fun getAcceptedIssuers() = acceptedIssuers
+                }
+            } else {
+                val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
+                trustManagerFactory.trustManagers.asSequence().filter { it is X509TrustManager }.single() as X509TrustManager
+            }
+        }
+
+        fun of(sslHandler : SslHandler, trustStore : KeyStore?, certificateRevocationEnabled : Boolean) : ClientCertificateValidator {
+            return ClientCertificateValidator(sslHandler, getTrustManager(trustStore, certificateRevocationEnabled))
+        }
+    }
+}

src/main/kotlin/net/woggioni/gbcs/Configuration.kt

@@ -1,10 +1,109 @@
 package net.woggioni.gbcs
 
 import java.nio.file.Path
+import java.nio.file.Paths
+import org.w3c.dom.Document
+import net.woggioni.gbcs.Xml.asIterable
+import org.w3c.dom.Element
+
+data class HostAndPort(val host: String, val port : Integer) {
+    override fun toString() = "$host:$port"
+}
+
+data class TlsConfiguration(val keyStore: KeyStore?, val trustStore: TrustStore?, val verifyClients : Boolean)
+data class KeyStore(
+    val file : Path,
+    val password : String?,
+    val keyAlias: String,
+    val keyPassword : String?
+)
+
+data class TrustStore(
+    val file : Path,
+    val password : String?,
+    val checkCertificateStatus : Boolean
+)
 
 data class Configuration(
     val cacheFolder : Path,
     val host : String,
     val port : Int,
-    val users : Map<String, Set<Role>>
-)
+    val users : Map<String, Set<Role>>,
+    val groups : Map<String, Set<Role>>,
+    val tlsConfiguration: TlsConfiguration?,
+    val serverPath : String,
+    val useVirtualThread : Boolean
+) {
+    companion object {
+        fun parse(document : Element) : Configuration {
+
+            var cacheFolder = Paths.get(System.getProperty("user.home")).resolve(".gbcs")
+            var host = "127.0.0.1"
+            var port = 11080
+            val users = emptyMap<String, Set<Role>>()
+            val groups = emptyMap<String, Set<Role>>()
+            var tlsConfiguration : TlsConfiguration? = null
+            val serverPath = document.getAttribute("path")
+                .takeIf(String::isNotEmpty)
+                ?: "/"
+            val useVirtualThread = document.getAttribute("useVirtualThreads")
+                .takeIf(String::isNotEmpty)
+                ?.let(String::toBoolean) ?: false
+
+            for(child in document.asIterable()) {
+                when(child.nodeName) {
+                    "bind" -> {
+                        host = child.getAttribute("host")
+                        port = Integer.parseInt(child.getAttribute("port"))
+                    }
+                    "cache" -> {
+                        cacheFolder = Paths.get(child.textContent)
+                    }
+                    "tls" -> {
+                        val verifyClients = child.getAttribute("verify-clients")
+                            .takeIf(String::isNotEmpty)
+                            ?.let(String::toBoolean) ?: false
+                        var keyStore : KeyStore? = null
+                        var trustStore : TrustStore? = null
+                        for(granChild in child.asIterable()) {
+                            when(granChild.nodeName) {
+                                "keystore" -> {
+                                    val trustStoreFile = Paths.get(granChild.getAttribute("file"))
+                                    val trustStorePassword = granChild.getAttribute("password")
+                                        .takeIf(String::isNotEmpty)
+                                    val keyAlias = granChild.getAttribute("key-alias")
+                                    val keyPasswordPassword = granChild.getAttribute("password")
+                                        .takeIf(String::isNotEmpty)
+                                    keyStore = KeyStore(
+                                        trustStoreFile,
+                                        trustStorePassword,
+                                        keyAlias,
+                                        keyPasswordPassword
+                                    )
+                                }
+                                "truststore" -> {
+                                    val trustStoreFile = Paths.get(granChild.getAttribute("file"))
+                                    val trustStorePassword = granChild.getAttribute("password")
+                                        .takeIf(String::isNotEmpty)
+                                    val checkCertificateStatus = granChild.getAttribute("check-certificate-status")
+                                        .takeIf(String::isNotEmpty)
+                                        ?.let(String::toBoolean)
+                                        ?: false
+                                    trustStore = TrustStore(
+                                        trustStoreFile,
+                                        trustStorePassword,
+                                        checkCertificateStatus
+                                    )
+                                }
+                            }
+                        }
+                        tlsConfiguration = TlsConfiguration(keyStore, trustStore, verifyClients)
+                    }
+                }
+
+            }
+
+            return Configuration(cacheFolder, host, port, users, groups, tlsConfiguration, serverPath, useVirtualThread)
+        }
+    }
+}

src/main/kotlin/net/woggioni/gbcs/GradleBuildCacheServer.kt

@@ -1,10 +1,27 @@
 package net.woggioni.gbcs
 
+import java.net.InetSocketAddress
+import java.net.URL
+import java.net.URLStreamHandlerFactory
+import java.nio.channels.FileChannel
+import java.nio.file.Files
+import java.nio.file.Path
+import java.nio.file.StandardCopyOption
+import java.nio.file.StandardOpenOption
+import java.security.KeyStore
+import java.security.MessageDigest
+import java.security.PrivateKey
+import java.security.cert.X509Certificate
+import java.util.AbstractMap.SimpleEntry
+import java.util.Arrays
+import java.util.Base64
+import java.util.concurrent.Executors
 import io.netty.bootstrap.ServerBootstrap
 import io.netty.buffer.ByteBuf
 import io.netty.buffer.Unpooled
 import io.netty.channel.Channel
 import io.netty.channel.ChannelDuplexHandler
+import io.netty.channel.ChannelFuture
 import io.netty.channel.ChannelFutureListener
 import io.netty.channel.ChannelHandlerContext
 import io.netty.channel.ChannelInitializer
@@ -15,11 +32,13 @@ import io.netty.channel.EventLoopGroup
 import io.netty.channel.SimpleChannelInboundHandler
 import io.netty.channel.nio.NioEventLoopGroup
 import io.netty.channel.socket.nio.NioServerSocketChannel
+import io.netty.handler.codec.DecoderException
 import io.netty.handler.codec.compression.CompressionOptions
 import io.netty.handler.codec.http.DefaultFullHttpResponse
 import io.netty.handler.codec.http.DefaultHttpContent
 import io.netty.handler.codec.http.DefaultHttpResponse
 import io.netty.handler.codec.http.FullHttpRequest
+import io.netty.handler.codec.http.FullHttpResponse
 import io.netty.handler.codec.http.HttpContentCompressor
 import io.netty.handler.codec.http.HttpHeaderNames
 import io.netty.handler.codec.http.HttpHeaderValues
@@ -29,26 +48,26 @@ import io.netty.handler.codec.http.HttpRequest
 import io.netty.handler.codec.http.HttpResponseStatus
 import io.netty.handler.codec.http.HttpServerCodec
 import io.netty.handler.codec.http.HttpUtil
+import io.netty.handler.codec.http.HttpVersion
 import io.netty.handler.codec.http.LastHttpContent
+import io.netty.handler.ssl.ClientAuth
+import io.netty.handler.ssl.SslContext
+import io.netty.handler.ssl.SslContextBuilder
 import io.netty.handler.stream.ChunkedNioFile
 import io.netty.handler.stream.ChunkedWriteHandler
 import io.netty.util.concurrent.DefaultEventExecutorGroup
+import io.netty.util.concurrent.DefaultThreadFactory
 import io.netty.util.concurrent.EventExecutorGroup
+import net.woggioni.gbcs.url.ClasspathUrlStreamHandlerFactoryProvider
+import javax.net.ssl.SSLPeerUnverifiedException
+import net.woggioni.jwo.Application
 import net.woggioni.jwo.JWO
-import java.nio.channels.FileChannel
-import java.nio.file.Files
-import java.nio.file.Path
-import java.nio.file.Paths
-import java.nio.file.StandardCopyOption
-import java.nio.file.StandardOpenOption
-import java.security.MessageDigest
-import java.util.AbstractMap.SimpleEntry
-import java.util.Base64
-import javax.net.ssl.SSLContext
-import javax.net.ssl.SSLEngine
+import net.woggioni.jwo.Tuple2
+import java.net.URI
+import java.util.concurrent.ForkJoinPool
 
 
-class GradleBuildCacheServer {
+class GradleBuildCacheServer(private val cfg : Configuration) {
 
     internal class HttpChunkContentCompressor(threshold : Int, vararg  compressionOptions: CompressionOptions = emptyArray())
         : HttpContentCompressor(threshold, *compressionOptions) {
@@ -115,33 +134,96 @@ class GradleBuildCacheServer {
         }
     }
 
-    private class ServerInitializer(private val cacheDir: Path) : ChannelInitializer<Channel>() {
+    private class ServerInitializer(private val cfg : Configuration) : ChannelInitializer<Channel>() {
+
+        private fun createSslCtx(tlsConfiguration : TlsConfiguration) : SslContext {
+            val keyStore = tlsConfiguration.keyStore
+            return if(keyStore == null) {
+                throw IllegalArgumentException("No keystore configured")
+            } else {
+                val javaKeyStore = loadKeystore(keyStore.file, keyStore.password)
+                val serverKey = javaKeyStore.getKey(
+                    keyStore.keyAlias, keyStore.keyPassword?.let(String::toCharArray)) as PrivateKey
+                val serverCert : Array<X509Certificate> = Arrays.stream(javaKeyStore.getCertificateChain(keyStore.keyAlias))
+                    .map { it as X509Certificate }
+                    .toArray {size -> Array<X509Certificate?>(size) { null } }
+                SslContextBuilder.forServer(serverKey, *serverCert).apply {
+                    if(tlsConfiguration.verifyClients) {
+                        clientAuth(ClientAuth.REQUIRE)
+                        val trustStore = tlsConfiguration.trustStore
+                        if (trustStore != null) {
+                            val ts = loadKeystore(trustStore.file, trustStore.password)
+                            trustManager(
+                                ClientCertificateValidator.getTrustManager(ts, trustStore.checkCertificateStatus))
+                        }
+                    }
+                }.build()
+            }
+        }
+
+        private val sslContext : SslContext? = cfg.tlsConfiguration?.let(this::createSslCtx)
+
+        companion object {
+            val group: EventExecutorGroup = DefaultEventExecutorGroup(Runtime.getRuntime().availableProcessors())
+            fun loadKeystore(file : Path, password : String?) : KeyStore {
+                val ext = JWO.splitExtension(file)
+                    .map(Tuple2<String, String>::get_2)
+                    .orElseThrow {
+                        IllegalArgumentException(
+                            "Keystore file '${file}' must have .jks, .p12, .pfx extension")
+                    }
+                val keystore = when(ext.substring(1).lowercase()) {
+                    "jks" -> KeyStore.getInstance("JKS")
+                    "p12", "pfx" -> KeyStore.getInstance("PKCS12")
+                    else -> throw IllegalArgumentException(
+                        "Keystore file '${file}' must have .jks, .p12, .pfx extension")
+                }
+                Files.newInputStream(file).use {
+                    keystore.load(it, password?.let(String::toCharArray))
+                }
+                return keystore
+            }
+        }
 
         override fun initChannel(ch: Channel) {
-            val sslEngine: SSLEngine = SSLContext.getDefault().createSSLEngine()
-            sslEngine.useClientMode = false
+            val userAuthorizer = UserAuthorizer(cfg.users)
             val pipeline = ch.pipeline()
-//            pipeline.addLast(SslHandler(sslEngine))
+            if(sslContext != null) {
+                val sslHandler = sslContext.newHandler(ch.alloc())
+                pipeline.addLast(sslHandler)
+            }
             pipeline.addLast(HttpServerCodec())
             pipeline.addLast(HttpChunkContentCompressor(1024))
             pipeline.addLast(ChunkedWriteHandler())
             pipeline.addLast(HttpObjectAggregator(Int.MAX_VALUE))
-            pipeline.addLast(NettyHttpBasicAuthenticator(mapOf("user" to "password")) { user, _ -> user == "user" })
-            pipeline.addLast(group, ServerHandler(cacheDir, "/cache"))
+//            pipeline.addLast(NettyHttpBasicAuthenticator(mapOf("user" to "password")), userAuthorizer)
+            pipeline.addLast(group, ServerHandler(cfg.cacheFolder, cfg.serverPath))
             pipeline.addLast(ExceptionHandler())
-            Files.createDirectories(cacheDir)
-        }
-
-        companion object {
-            val group: EventExecutorGroup = DefaultEventExecutorGroup(Runtime.getRuntime().availableProcessors())
+            Files.createDirectories(cfg.cacheFolder)
         }
     }
 
     private class ExceptionHandler : ChannelDuplexHandler() {
         private val log = contextLogger()
+
+        private val NOT_AUTHORIZED: FullHttpResponse = DefaultFullHttpResponse(
+            HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER).apply {
+            headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+        }
         override fun exceptionCaught(ctx: ChannelHandlerContext, cause: Throwable) {
-            log.error(cause.message, cause)
-            ctx.close()
+            when(cause) {
+                is DecoderException -> {
+                    log.error(cause.message, cause)
+                    ctx.close()
+                }
+                is SSLPeerUnverifiedException -> {
+                    ctx.writeAndFlush(NOT_AUTHORIZED.retainedDuplicate()).addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+                }
+                else -> {
+                     log.error(cause.message, cause)
+                     ctx.close()
+                 }
+            }
         }
     }
 
@@ -243,38 +325,129 @@ class GradleBuildCacheServer {
         }
     }
 
-    fun run() {
-        // Create the multithreaded event loops for the server
-        val bossGroup: EventLoopGroup = NioEventLoopGroup()
-        val workerGroup: EventLoopGroup = NioEventLoopGroup()
-        try {
-            // A helper class that simplifies server configuration
-            val httpBootstrap = ServerBootstrap()
+    class ServerHandle(
+        private val httpChannel : ChannelFuture,
+        private val bossGroup: EventLoopGroup,
+        private val workerGroup: EventLoopGroup) : AutoCloseable {
 
-            // Configure the server
-            httpBootstrap.group(bossGroup, workerGroup)
-                    .channel(NioServerSocketChannel::class.java)
-                    .childHandler(ServerInitializer(Paths.get("/tmp/gbcs"))) // <-- Our handler created here
-                    .option(ChannelOption.SO_BACKLOG, 128)
-                    .childOption(ChannelOption.SO_KEEPALIVE, true)
+        private val closeFuture : ChannelFuture = httpChannel.channel().closeFuture()
 
-            // Bind and start to accept incoming connections.
-            val httpChannel = httpBootstrap.bind(HTTP_PORT).sync()
+        fun shutdown() : ChannelFuture {
+            return httpChannel.channel().close()
+        }
 
-            // Wait until server socket is closed
-            httpChannel.channel().closeFuture().sync()
-        } finally {
-            workerGroup.shutdownGracefully()
-            bossGroup.shutdownGracefully()
+        override fun close() {
+            try {
+                closeFuture.sync()
+            } finally {
+                val fut1 = workerGroup.shutdownGracefully()
+                val fut2 = if(bossGroup !== workerGroup) {
+                    bossGroup.shutdownGracefully()
+                } else null
+                fut1.sync()
+                fut2?.sync()
+            }
         }
     }
 
+    fun run() : ServerHandle {
+        // Create the multithreaded event loops for the server
+        val bossGroup = NioEventLoopGroup()
+        val serverSocketChannel = NioServerSocketChannel::class.java
+        val workerGroup = if(cfg.useVirtualThread) {
+            NioEventLoopGroup(0, Executors.newVirtualThreadPerTaskExecutor())
+        } else {
+            NioEventLoopGroup(0, Executors.newWorkStealingPool())
+        }
+        // A helper class that simplifies server configuration
+        val bootstrap = ServerBootstrap().apply {
+            // Configure the server
+            group(bossGroup, workerGroup)
+            channel(serverSocketChannel)
+            childHandler(ServerInitializer(cfg))
+            option(ChannelOption.SO_BACKLOG, 128)
+            childOption(ChannelOption.SO_KEEPALIVE, true)
+        }
+
+
+        // Bind and start to accept incoming connections.
+        val bindAddress = InetSocketAddress(cfg.host, cfg.port)
+        val httpChannel = bootstrap.bind(bindAddress).sync()
+        return ServerHandle(httpChannel, bossGroup, workerGroup)
+    }
+
     companion object {
-        private const val HTTP_PORT = 8080
+
+        private val log by lazy {
+            contextLogger()
+        }
+        private const val PROTOCOL_HANDLER = "java.protocol.handler.pkgs"
+        private const val HANDLERS_PACKAGE = "net.woggioni.gbcs.url"
+
+        /**
+         * Reset any cached handlers just in case a jar protocol has already been used. We
+         * reset the handler by trying to set a null [URLStreamHandlerFactory] which
+         * should have no effect other than clearing the handlers cache.
+         */
+        private fun resetCachedUrlHandlers() {
+            try {
+                URL.setURLStreamHandlerFactory(null)
+            } catch (ex: Error) {
+                // Ignore
+            }
+        }
+        fun registerUrlProtocolHandler() {
+            val handlers = System.getProperty(PROTOCOL_HANDLER, "")
+            System.setProperty(
+                PROTOCOL_HANDLER,
+                if (handlers == null || handlers.isEmpty()) HANDLERS_PACKAGE else "$handlers|$HANDLERS_PACKAGE"
+            )
+            resetCachedUrlHandlers()
+        }
+
+        fun loadConfiguration(args: Array<String>) : Configuration {
+            registerUrlProtocolHandler()
+            URL.setURLStreamHandlerFactory(ClasspathUrlStreamHandlerFactoryProvider())
+            Thread.currentThread().contextClassLoader = GradleBuildCacheServer::class.java.classLoader
+            val app = Application.builder("gbcs")
+                .configurationDirectoryEnvVar("GBCS_CONFIGURATION_DIR")
+                .configurationDirectoryPropertyKey("net.woggioni.gbcs.conf.dir")
+                .build()
+            val confDir = app.computeConfigurationDirectory()
+            val configurationFile = confDir.resolve("gbcs.xml")
+            log.info { "here" }
+            if(!Files.exists(configurationFile)) {
+                Files.createDirectories(confDir)
+                val defaultConfigurationFileResourcePath = "classpath:net/woggioni/gbcs/gbcs-default.xml"
+                val defaultConfigurationFileResource = URI(defaultConfigurationFileResourcePath).toURL()
+                Files.newOutputStream(configurationFile).use { outputStream ->
+                    defaultConfigurationFileResource.openStream().use { inputStream ->
+                        JWO.copy(inputStream, outputStream)
+                    }
+                }
+            }
+//            val schemaUrl = javaClass.getResource("/net/woggioni/gbcs/gbcs.xsd")
+            val schemaUrl = URL.of(URI("classpath:net/woggioni/gbcs/gbcs.xsd"), null)
+            val dbf = Xml.newDocumentBuilderFactory()
+//            dbf.schema = Xml.getSchema(this::class.java.module.getResourceAsStream("/net/woggioni/gbcs/gbcs.xsd"))
+            dbf.schema = Xml.getSchema(schemaUrl)
+            val db = dbf.newDocumentBuilder().apply {
+                setErrorHandler(Xml.ErrorHandler(schemaUrl))
+            }
+            val doc = Files.newInputStream(configurationFile).use(db::parse)
+            return Configuration.parse(doc.documentElement)
+        }
+
         @JvmStatic
         fun main(args: Array<String>) {
-            Thread.currentThread().contextClassLoader = GradleBuildCacheServer::class.java.classLoader
-            GradleBuildCacheServer().run()
+            val configuration = loadConfiguration(args)
+//            Runtime.getRuntime().addShutdownHook(Thread {
+//                    Thread.sleep(5000)
+//                    javaClass.classLoader.loadClass("net.woggioni.jwo.exception.ChildProcessException")
+//                }
+//            )
+            GradleBuildCacheServer(configuration).run().use {
+            }
         }
 
         fun digest(data : ByteArray,
@@ -288,4 +461,14 @@ class GradleBuildCacheServer {
             return JWO.bytesToHex(digest(data, md))
         }
     }
+}
+
+object GraalNativeImageConfiguration {
+    @JvmStatic
+    fun main(args: Array<String>) {
+        val conf = GradleBuildCacheServer.loadConfiguration(args)
+        val handle  = GradleBuildCacheServer(conf).run()
+        Thread.sleep(10_000)
+        handle.shutdown()
+    }
 }

src/main/kotlin/net/woggioni/gbcs/Logging.kt

@@ -8,9 +8,6 @@ import java.nio.file.Files
 import java.nio.file.Path
 import java.util.logging.LogManager
 
-
-
-
 inline fun <reified T> T.contextLogger() = LoggerFactory.getLogger(T::class.java)
 
 inline fun Logger.traceParam(messageBuilder : () -> Pair<String, Array<Any>>) {

src/main/kotlin/net/woggioni/gbcs/UserAuthorizer.kt

@@ -0,0 +1,22 @@
+package net.woggioni.gbcs
+
+import io.netty.handler.codec.http.HttpMethod
+import io.netty.handler.codec.http.HttpRequest
+
+class UserAuthorizer(private val users: Map<String, Set<Role>>) : Authorizer {
+
+    companion object {
+        private val METHOD_MAP = mapOf(
+            Role.Reader to setOf(HttpMethod.GET, HttpMethod.HEAD),
+            Role.Writer to setOf(HttpMethod.PUT, HttpMethod.POST)
+        )
+    }
+
+    override fun authorize(user: String, request: HttpRequest) = users[user]?.let { roles ->
+        val allowedMethods = roles.asSequence()
+            .mapNotNull(METHOD_MAP::get)
+            .flatten()
+            .toSet()
+        request.method() in allowedMethods
+    } ?: false
+}

src/main/kotlin/net/woggioni/gbcs/Xml.kt

@@ -1,11 +1,7 @@
 package net.woggioni.gbcs
 
-import org.slf4j.LoggerFactory
-import org.w3c.dom.Document
-import org.xml.sax.ErrorHandler
-import org.xml.sax.SAXNotRecognizedException
-import org.xml.sax.SAXNotSupportedException
-import org.xml.sax.SAXParseException
+import java.io.InputStream
+import java.io.InputStreamReader
 import java.net.URL
 import javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD
 import javax.xml.XMLConstants.ACCESS_EXTERNAL_SCHEMA
@@ -13,16 +9,72 @@ import javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING
 import javax.xml.XMLConstants.W3C_XML_SCHEMA_NS_URI
 import javax.xml.parsers.DocumentBuilder
 import javax.xml.parsers.DocumentBuilderFactory
+import javax.xml.transform.Source
+import javax.xml.transform.stream.StreamSource
 import javax.xml.validation.Schema
 import javax.xml.validation.SchemaFactory
+import net.woggioni.jwo.xml.Xml
+import org.slf4j.LoggerFactory
+import org.w3c.dom.Document
+import org.w3c.dom.Element
+import org.w3c.dom.Node
+import org.w3c.dom.NodeList
+import org.xml.sax.ErrorHandler as ErrHandler
+import org.xml.sax.SAXNotRecognizedException
+import org.xml.sax.SAXNotSupportedException
+import org.xml.sax.SAXParseException
 
+class NodeListIterator(private val nodeList: NodeList) : Iterator<Node> {
+    private var cursor : Int = 0
+    override fun hasNext(): Boolean {
+        return cursor < nodeList.length
+    }
+
+    override fun next(): Node {
+        return if (hasNext()) nodeList.item(cursor++) else throw NoSuchElementException()
+    }
+}
+
+class ElementIterator(parent: Element, name: String? = null) : Iterator<Element> {
+    private val it: NodeListIterator
+    private val name: String?
+    private var next: Element?
+
+    init {
+        it = NodeListIterator(parent.childNodes)
+        this.name = name
+        next = getNext()
+    }
+
+    override fun hasNext(): Boolean {
+        return next != null
+    }
+
+    override fun next(): Element {
+        val result = next ?: throw NoSuchElementException()
+        next = getNext()
+        return result
+    }
+
+    private fun getNext(): Element? {
+        var result: Element? = null
+        while (it.hasNext()) {
+            val node: Node = it.next()
+            if (node is Element && (name == null || name == node.tagName)) {
+                result = node
+                break
+            }
+        }
+        return result
+    }
+}
 
 object Xml {
 
-    private class XmlErrorHandler(private val fileURL: URL) : ErrorHandler {
+    class ErrorHandler(private val fileURL: URL) : ErrHandler {
 
         companion object {
-            private val log = LoggerFactory.getLogger(XmlErrorHandler::class.java)
+            private val log = LoggerFactory.getLogger(ErrorHandler::class.java)
         }
 
         override fun warning(ex: SAXParseException) {
@@ -66,17 +118,24 @@ object Xml {
         }
     }
 
-    private fun getSchema(schemaResourceURL: String): Schema {
+    fun getSchema(schema: URL): Schema {
         val sf = SchemaFactory.newInstance(W3C_XML_SCHEMA_NS_URI)
         sf.setFeature(FEATURE_SECURE_PROCESSING, true)
-        disableProperty(sf, ACCESS_EXTERNAL_SCHEMA)
-        disableProperty(sf, ACCESS_EXTERNAL_DTD)
-        val schemaUrl: URL = Xml::class.java.classLoader.getResource(schemaResourceURL)
-                ?: throw IllegalStateException(String.format("Missing configuration schema '%s'", schemaResourceURL))
-        return sf.newSchema(schemaUrl)
+//        disableProperty(sf, ACCESS_EXTERNAL_SCHEMA)
+//        disableProperty(sf, ACCESS_EXTERNAL_DTD)
+        sf.errorHandler = ErrorHandler(schema)
+        return sf.newSchema(schema)
     }
 
-    private fun newDocumentBuilderFactory(schemaResourceURL: String?): DocumentBuilderFactory {
+    fun getSchema(inputStream: InputStream): Schema {
+        val sf = SchemaFactory.newInstance(W3C_XML_SCHEMA_NS_URI)
+        sf.setFeature(FEATURE_SECURE_PROCESSING, true)
+//        disableProperty(sf, ACCESS_EXTERNAL_SCHEMA)
+//        disableProperty(sf, ACCESS_EXTERNAL_DTD)
+        return sf.newSchema(StreamSource(inputStream))
+    }
+
+    fun newDocumentBuilderFactory(): DocumentBuilderFactory {
         val dbf = DocumentBuilderFactory.newInstance()
         dbf.setFeature(FEATURE_SECURE_PROCESSING, true)
         disableProperty(dbf, ACCESS_EXTERNAL_SCHEMA)
@@ -84,35 +143,32 @@ object Xml {
         dbf.isExpandEntityReferences = false
         dbf.isIgnoringComments = true
         dbf.isNamespaceAware = true
-        val sf = SchemaFactory.newInstance(W3C_XML_SCHEMA_NS_URI)
-        sf.setFeature(FEATURE_SECURE_PROCESSING, true)
-        disableProperty(sf, ACCESS_EXTERNAL_SCHEMA)
-        disableProperty(sf, ACCESS_EXTERNAL_DTD)
-        if (schemaResourceURL != null) {
-            dbf.schema = getSchema(schemaResourceURL)
-        }
+        dbf.isValidating = false
         return dbf
     }
 
-    fun newDocumentBuilder(resource: URL, schemaResourceURL: String?): DocumentBuilder {
-        val db = newDocumentBuilderFactory(schemaResourceURL).newDocumentBuilder()
-        db.setErrorHandler(XmlErrorHandler(resource))
-        return db
-    }
+//    fun newDocumentBuilder(resource: URL, schemaResourceURL: String?): DocumentBuilder {
+//        val db = newDocumentBuilderFactory(schemaResourceURL).newDocumentBuilder()
+//        db.setErrorHandler(XmlErrorHandler(resource))
+//        return db
+//    }
 
-    fun parseXmlResource(resource: URL, schemaResourceURL: String?): Document {
-        val db = newDocumentBuilder(resource, schemaResourceURL)
-        return resource.openStream().use(db::parse)
-    }
+//    fun parseXmlResource(resource: URL, schemaResourceURL: String?): Document {
+//        val db = newDocumentBuilder(resource, schemaResourceURL)
+//        return resource.openStream().use(db::parse)
+//    }
+//
+//    fun newDocumentBuilder(resource: URL): DocumentBuilder {
+//        val db = newDocumentBuilderFactory(null).newDocumentBuilder()
+//        db.setErrorHandler(XmlErrorHandler(resource))
+//        return db
+//    }
 
-    fun newDocumentBuilder(resource: URL): DocumentBuilder {
-        val db = newDocumentBuilderFactory(null).newDocumentBuilder()
-        db.setErrorHandler(XmlErrorHandler(resource))
-        return db
-    }
+//    fun parseXmlResource(resource: URL): Document {
+//        val db = newDocumentBuilder(resource, null)
+//        return resource.openStream().use(db::parse)
+//    }
 
-    fun parseXmlResource(resource: URL): Document {
-        val db = newDocumentBuilder(resource, null)
-        return resource.openStream().use(db::parse)
-    }
+    fun Element.asIterable() = Iterable { ElementIterator(this, null) }
+    fun NodeList.asIterable() = Iterable { NodeListIterator(this) }
 }

src/main/resources/logback.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE configuration>
+
+<configuration>
+    <import class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"/>
+    <import class="ch.qos.logback.core.ConsoleAppender"/>
+
+    <appender name="console" class="ConsoleAppender">
+        <target>System.out</target>
+        <encoder class="PatternLayoutEncoder">
+            <pattern>%d [%highlight(%-5level)] \(%thread\) %logger{36} -%kvp- %msg %n</pattern>
+        </encoder>
+    </appender>
+
+    <root level="debug">
+        <appender-ref ref="console"/>
+    </root>
+</configuration>

src/main/resources/logging.properties

@@ -2,8 +2,8 @@
 
 handlers = java.util.logging.ConsoleHandler
 
-java.util.logging.ConsoleHandler.level     = FINEST
+java.util.logging.ConsoleHandler.level     = FINER
 java.util.logging.ConsoleHandler.filter    =
 java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
-java.util.logging.SimpleFormatter.format   = %1$tF %1$tT [%4$s] %2$s %5$s %n
+java.util.logging.SimpleFormatter.format   = %1$tF %1$tT [%4$s] %2$s %5$s %6$s%n
 java.util.logging.ConsoleHandler.encoding  =

src/main/resources/net/woggioni/gbcs/gbcs-default.xml

@@ -1,14 +1,48 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<server xmlns="urn:gradle-build-cache-server">
-    <bind host="127.0.0.1" port="5680"/>
+<gbcs:server xmlns:gbcs="urn:net.woggioni.gbcs" path="/cache" useVirtualThreads="false">
+    <bind host="127.0.0.1" port="11443"/>
     <cache path="/tmp/gbcs"/>
-    <groups>
-        <readers>
-<!--            <user name="reader"/>-->
-        </readers>
-        <writers>
-<!--            <user name="writer"/>-->
-        </writers>
-    </groups>
-    <tls name=""/>
-</server>
+    <authorization>
+        <users>
+            <user name="user1" password="password"/>
+            <user name="user2" password="password"/>
+            <user name="user3" password="password"/>
+            <user name="user4" password="password"/>
+            <user name="user5" password="password">
+                <roles>
+                    <reader/>
+                    <writer/>
+                </roles>
+            </user>
+        </users>
+        <groups>
+            <group name="group1">
+                <users>
+                    <user ref="user1"/>
+                </users>
+                <roles>
+                    <reader/>
+                    <writer/>
+                </roles>
+            </group>
+            <group name="group2">
+                <users>
+                    <user ref="user1"/>
+                    <user ref="user2"/>
+                </users>
+                <roles>
+                    <reader/>
+                    <writer/>
+                </roles>
+            </group>
+        </groups>
+    </authorization>
+    <tls-certificate-authorization>
+        <group-extractor attribute-name="CN" pattern="(.*)"/>
+        <user-extractor attribute-name="CN" pattern="(.*)"/>
+    </tls-certificate-authorization>
+<!--    <tls verify-clients="false">-->
+<!--        <keystore file="" key-alias=""/>-->
+<!--        <truststore file=""/>-->
+<!--    </tls>-->
+</gbcs:server>

src/main/resources/net/woggioni/gbcs/gbcs.xsd

@@ -1,15 +1,28 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<xs:schema elementFormDefault="qualified" targetNamespace="urn:gradle-build-cache-server" version="1.0"
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<xs:schema targetNamespace="urn:net.woggioni.gbcs"
            xmlns:xs="http://www.w3.org/2001/XMLSchema"
-           xmlns:gbcs="urn:gradle-build-cache-server">
+           xmlns:gbcs="urn:net.woggioni.gbcs">
     <xs:element name="server" type="gbcs:serverType"/>
+
     <xs:complexType name="serverType">
         <xs:sequence minOccurs="0">
-            <xs:element name="bind" type="gbcs:bindType"/>
-            <xs:element name="cache" type="gbcs:cacheDirType"/>
-            <xs:element name="groups" type="gbcs:groupsType"/>
-            <xs:element name="tls" type="gbcs:tlsType"/>
+            <xs:element name="bind" type="gbcs:bindType" maxOccurs="1"/>
+            <xs:element name="cache" type="gbcs:cacheDirType" maxOccurs="1"/>
+            <xs:element name="authorization" type="gbcs:authorizationType" maxOccurs="1">
+                <xs:key name="userId">
+                    <xs:selector xpath="users/user"/>
+                    <xs:field xpath="@name"/>
+                </xs:key>
+                <xs:keyref name="userRef" refer="gbcs:userId">
+                    <xs:selector xpath="groups/group/users/user"/>
+                    <xs:field xpath="@ref"/>
+                </xs:keyref>
+            </xs:element>
+            <xs:element name="tls-certificate-authorization" type="gbcs:tlsCertificateAuthorizationType" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="tls" type="gbcs:tlsType" minOccurs="0" maxOccurs="1"/>
         </xs:sequence>
+        <xs:attribute name="path" type="xs:string"/>
+        <xs:attribute name="useVirtualThreads" type="xs:boolean" use="optional"/>
     </xs:complexType>
 
     <xs:complexType name="bindType">
@@ -21,46 +34,113 @@
         <xs:attribute name="path" type="xs:string" use="required"/>
     </xs:complexType>
 
-    <xs:complexType name="groupsType">
+    <xs:complexType name="tlsCertificateAuthorizationType">
+        <xs:sequence>
+            <xs:element name="group-extractor" type="gbcs:X500NameExtractorType"/>
+            <xs:element name="user-extractor" type="gbcs:X500NameExtractorType"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="X500NameExtractorType">
+        <xs:attribute name="attribute-name" type="xs:string"/>
+        <xs:attribute name="pattern" type="xs:string"/>
+    </xs:complexType>
+
+    <xs:complexType name="authorizationType">
         <xs:all>
-            <xs:element name="readers" type="gbcs:groupType"/>
-            <xs:element name="writers" type="gbcs:groupType"/>
+            <xs:element name="users" type="gbcs:usersType"/>
+            <xs:element name="groups" type="gbcs:groupsType">
+                <xs:unique name="groupKey">
+                    <xs:selector xpath="group"/>
+                    <xs:field xpath="@name"/>
+                </xs:unique>
+            </xs:element>
         </xs:all>
     </xs:complexType>
 
-    <xs:complexType name="groupType">
+    <xs:complexType name="usersType">
         <xs:sequence>
-            <xs:element maxOccurs="unbounded" minOccurs="0" name="user" type="gbcs:userType"/>
+            <xs:element name="user" type="gbcs:userType" minOccurs="0" maxOccurs="unbounded"/>
         </xs:sequence>
     </xs:complexType>
 
     <xs:complexType name="userType">
+        <xs:all minOccurs="0" maxOccurs="1">
+            <xs:element name="roles" type="gbcs:rolesType"/>
+        </xs:all>
         <xs:attribute name="name" type="xs:string" use="required"/>
+        <xs:attribute name="password" type="xs:string" use="optional"/>
     </xs:complexType>
 
-    <xs:complexType name="tlsType">
-        <xs:attribute name="name" type="xs:string" use="required"/>
-    </xs:complexType>
-
-
-    <xs:complexType name="instancesType">
+    <xs:complexType name="groupsType">
         <xs:sequence>
-            <xs:element maxOccurs="unbounded" minOccurs="0" name="instance" type="contour:instanceType"/>
+            <xs:element name="group" type="gbcs:groupType" maxOccurs="unbounded" minOccurs="0"/>
         </xs:sequence>
     </xs:complexType>
 
-    <xs:complexType name="instanceType">
+    <xs:complexType name="groupType">
+        <xs:sequence>
+            <xs:element name="users" type="gbcs:userRefsType" maxOccurs="1" minOccurs="0">
+                <xs:unique name="userRefWriterKey">
+                    <xs:selector xpath="user"/>
+                    <xs:field xpath="@ref"/>
+                </xs:unique>
+            </xs:element>
+            <xs:element name="roles" type="gbcs:rolesType" maxOccurs="1" minOccurs="0"/>
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:string"/>
+    </xs:complexType>
+
+    <xs:simpleType name="role" final="restriction" >
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="READER" />
+            <xs:enumeration value="WRITER" />
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:complexType name="rolesType">
+        <xs:sequence>
+            <xs:choice maxOccurs="unbounded">
+                <xs:element name="writer"/>
+                <xs:element name="reader"/>
+            </xs:choice>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="userRefsType">
+        <xs:sequence>
+            <xs:element name="user" type="gbcs:userRefType" maxOccurs="unbounded" minOccurs="0"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="userRefType">
+        <xs:attribute name="ref" type="xs:string" use="required"/>
+    </xs:complexType>
+
+    <xs:complexType name="tlsType">
         <xs:all>
-            <xs:element name="database" type="contour:databaseType"/>
-            <xs:element name="application-properties" type="contour:propertiesType"/>
-            <xs:element name="corda-node" type="contour:cordaNodeType" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="keystore" type="gbcs:keyStoreType" />
+            <xs:element name="truststore" type="gbcs:trustStoreType" minOccurs="0"/>
         </xs:all>
-        <xs:attribute name="name" type="xs:token" use="required"/>
+        <xs:attribute name="verify-clients" type="xs:boolean" use="optional"/>
+    </xs:complexType>
+
+    <xs:complexType name="keyStoreType">
+        <xs:attribute name="file" type="xs:string" use="required"/>
+        <xs:attribute name="password" type="xs:string"/>
+        <xs:attribute name="key-alias" type="xs:string" use="required"/>
+        <xs:attribute name="key-password" type="xs:string"/>
+    </xs:complexType>
+
+    <xs:complexType name="trustStoreType">
+        <xs:attribute name="file" type="xs:string" use="required"/>
+        <xs:attribute name="password" type="xs:string"/>
+        <xs:attribute name="check-certificate-status" type="xs:boolean"/>
     </xs:complexType>
 
     <xs:complexType name="propertiesType">
         <xs:sequence>
-            <xs:element maxOccurs="unbounded" minOccurs="0" name="property" type="contour:propertyType"/>
+            <xs:element maxOccurs="unbounded" minOccurs="0" name="property" type="gbcs:propertyType"/>
         </xs:sequence>
     </xs:complexType>
 
@@ -72,114 +152,10 @@
         </xs:simpleContent>
     </xs:complexType>
 
-    <xs:complexType name="servicesType">
-        <xs:all>
-            <xs:element name="postgresDatabase" type="contour:postgresDatabaseType"/>
-            <xs:element name="mailhogServer" type="contour:mailhogServerType"/>
-        </xs:all>
-    </xs:complexType>
-
     <xs:complexType name="hostAndPortType">
         <xs:attribute name="host" type="xs:string" use="required"/>
         <xs:attribute name="port" type="xs:unsignedShort" use="required"/>
     </xs:complexType>
 
-    <xs:complexType name="postgresDatabaseType">
-        <xs:all>
-            <xs:element name="container-name" type="xs:token"/>
-            <xs:element name="port" type="xs:unsignedShort"/>
-            <xs:element name="password" type="xs:token"/>
-            <xs:element name="image" type="xs:token"/>
-        </xs:all>
-    </xs:complexType>
 
-    <xs:complexType name="mailhogServerType">
-        <xs:all>
-            <xs:element name="container-name" type="xs:token"/>
-            <xs:element name="http-port" type="xs:unsignedShort"/>
-            <xs:element name="smtp-port" type="xs:unsignedShort"/>
-            <xs:element name="image" type="xs:token"/>
-        </xs:all>
-    </xs:complexType>
-
-    <xs:complexType name="codeType">
-        <xs:all>
-            <xs:element name="front-end" type="contour:codeRepositoryType"/>
-            <xs:element name="back-end" type="contour:codeRepositoryType"/>
-            <xs:element name="cordapps" type="contour:codeRepositoryType"/>
-        </xs:all>
-    </xs:complexType>
-
-    <xs:complexType name="codeRepositoryType">
-        <xs:attribute name="location" type="xs:token" use="required"/>
-    </xs:complexType>
-
-    <xs:complexType name="databaseType">
-        <xs:all>
-            <xs:element name="url" type="xs:string"/>
-            <xs:element name="name">
-                <xs:complexType>
-                    <xs:simpleContent>
-                        <xs:extension base="xs:string"/>
-                    </xs:simpleContent>
-                </xs:complexType>
-            </xs:element>
-        </xs:all>
-    </xs:complexType>
-
-    <xs:complexType name="urlType">
-        <xs:simpleContent>
-            <xs:extension base="xs:string"/>
-        </xs:simpleContent>
-    </xs:complexType>
-
-    <xs:complexType name="jvmType">
-        <xs:attribute name="location" type="xs:token" use="required"/>
-    </xs:complexType>
-
-    <xs:complexType name="artifactsType">
-        <xs:all>
-            <xs:element name="contract-cordapp" type="contour:mavenArtifactType"/>
-            <xs:element name="workflow-cordapp" type="contour:mavenArtifactType"/>
-            <xs:element name="business-tool-cordapp" type="contour:mavenArtifactType"/>
-            <xs:element name="spring-backend" type="contour:mavenArtifactType"/>
-        </xs:all>
-    </xs:complexType>
-
-    <xs:complexType name="mavenArtifactType">
-        <xs:attribute name="groupId" type="xs:string" use="required"/>
-        <xs:attribute name="artifactId" type="xs:string" use="required"/>
-        <xs:attribute name="version" type="xs:string" use="required"/>
-        <xs:attribute name="ext" type="xs:string" use="required"/>
-    </xs:complexType>
-
-    <xs:complexType name="cordaNodeType">
-        <xs:choice>
-            <xs:element name="config" type="contour:simpleCordaConfigType"/>
-            <xs:element name="configFile" type="xs:string"/>
-        </xs:choice>
-        <xs:attribute name="x500Name" type="xs:string" use="required"/>
-    </xs:complexType>
-
-    <xs:complexType name="rpcUsersType">
-        <xs:sequence>
-            <xs:element name="user" type="contour:rpcUserType" minOccurs="0" maxOccurs="unbounded"/>
-        </xs:sequence>
-    </xs:complexType>
-
-    <xs:complexType name="rpcUserType">
-        <xs:attribute name="name" type="xs:string" use="required"/>
-        <xs:attribute name="password" type="xs:string" use="required"/>
-    </xs:complexType>
-
-    <xs:complexType name="simpleCordaConfigType">
-        <xs:all>
-            <xs:element name="h2Port" type="xs:unsignedShort"/>
-            <xs:element name="devMode" type="xs:boolean"/>
-            <xs:element name="p2p-address" type="contour:hostAndPortType"/>
-            <xs:element name="rpc-address" type="contour:hostAndPortType"/>
-            <xs:element name="rpc-admin-address" type="contour:hostAndPortType"/>
-            <xs:element name="rpc-users" type="contour:rpcUsersType"/>
-        </xs:all>
-    </xs:complexType>
 </xs:schema>

src/test/kotlin/net/woggioni/gbcs/CertificateValidationTest.kt

@@ -0,0 +1,35 @@
+package net.woggioni.gbcs
+
+import java.nio.file.Files
+import java.nio.file.Path
+import java.security.KeyStore
+import java.security.cert.CertPathValidator
+import java.security.cert.CertificateFactory
+import java.security.cert.PKIXParameters
+import org.junit.jupiter.api.Test
+
+class CertificateValidationTest {
+
+    @Test
+    fun test() {
+        val keystore = KeyStore.getInstance("PKCS12")
+        val keystorePath = Path.of("/home/woggioni/ssl/woggioni@f6aa5663ef26.pfx")
+        Files.newInputStream(keystorePath).use {
+            keystore.load(it, System.getenv("KEYPASS").toCharArray())
+        }
+        val pkix = CertPathValidator.getInstance("PKIX")
+        val trustStore = KeyStore.getInstance("PKCS12")
+        val trustStorePath = Path.of("/home/woggioni/ssl/truststore.pfx")
+
+        Files.newInputStream(trustStorePath).use {
+            trustStore.load(it, "123456".toCharArray())
+        }
+
+        val certificateFactory = CertificateFactory.getInstance("X.509")
+        val cert = keystore.getCertificateChain("woggioni@f6aa5663ef26").toList()
+            .let(certificateFactory::generateCertPath)
+        val params = PKIXParameters(trustStore)
+        params.isRevocationEnabled = false
+        pkix.validate(cert, params)
+    }
+}

src/test/kotlin/net/woggioni/gbcs/ConfigurationTest.kt

@@ -0,0 +1,22 @@
+package net.woggioni.gbcs
+
+import java.net.URI
+import java.net.URL
+import org.junit.jupiter.api.Test
+
+class ConfigurationTest {
+
+    @Test
+    fun test() {
+        GradleBuildCacheServer.registerUrlProtocolHandler()
+        val schemaUrl = this::class.java.getResource("/net/woggioni/gbcs/gbcs.xsd")
+        val dbf = Xml.newDocumentBuilderFactory()
+        dbf.schema = Xml.getSchema(schemaUrl)
+        val db = dbf.newDocumentBuilder().apply {
+            setErrorHandler(Xml.ErrorHandler(schemaUrl))
+        }
+        val configurationUrl = this::class.java.getResource("/net/woggioni/gbcs/gbcs-default.xml")
+        val doc = configurationUrl.openStream().use(db::parse)
+        Configuration.parse(doc.documentElement)
+    }
+}