Merge pull request #43284 from gsmet/3.15.0-backports-1

[3.15] 3.15.0 backports 1

.github/workflows/ci-actions-incremental.yml

@@ -903,7 +903,12 @@ jobs:
           CAPTURE_BUILD_SCAN: true
         run: |
           git clone --depth=1 -b ${{ steps.get-quickstarts-branch.outputs.result }} https://github.com/quarkusio/quarkus-quickstarts.git && cd quarkus-quickstarts
-          export LANG=en_US && ./mvnw -e -B -fae --settings .github/mvn-settings.xml clean verify -DskipTests
+          if [ "${{ steps.get-quickstarts-branch.outputs.result }}" != "development" ]; then
+             QUARKUS_VERSION_ARGS="-Dquarkus.platform.version=${{ steps.get-quickstarts-branch.outputs.result }}.999-SNAPSHOT"
+          else
+             QUARKUS_VERSION_ARGS=""
+          fi
+          export LANG=en_US && ./mvnw -e -B -fae --settings .github/mvn-settings.xml clean verify -DskipTests -Dquarkus.platform.group-id=io.quarkus $QUARKUS_VERSION_ARGS
       - name: Prepare build reports archive
         if: always()
         run: |

bom/application/pom.xml

@@ -120,7 +120,7 @@
         <httpasync.version>4.1.5</httpasync.version>
         <cronutils.version>9.2.1</cronutils.version>
         <quartz.version>2.3.2</quartz.version>
-        <h2.version>2.3.232</h2.version> <!-- When updating, needs to be matched in io.quarkus.hibernate.orm.runtime.config.DialectVersions
+        <h2.version>2.3.230</h2.version> <!-- When updating, needs to be matched in io.quarkus.hibernate.orm.runtime.config.DialectVersions
                                               and the dependency jts-core needs to be updated in extensions/jdbc/jdbc-h2/runtime/pom.xml -->
         <postgresql-jdbc.version>42.7.4</postgresql-jdbc.version>
         <mariadb-jdbc.version>3.4.1</mariadb-jdbc.version>

devtools/gradle/gradle/libs.versions.toml

@@ -1,5 +1,5 @@
 [versions]
-plugin-publish = "1.2.2"
+plugin-publish = "1.3.0"
 
 # updating Kotlin here makes QuarkusPluginTest > shouldNotFailOnProjectDependenciesWithoutMain(Path) fail
 kotlin = "2.0.10"

devtools/maven/src/main/java/io/quarkus/maven/QuarkusProjectMojoBase.java

@@ -1,14 +1,11 @@
 package io.quarkus.maven;
 
-import static io.quarkus.devtools.project.CodestartResourceLoadersBuilder.getCodestartResourceLoaders;
-
 import java.io.BufferedWriter;
 import java.io.IOException;
 import java.io.StringWriter;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import org.apache.maven.execution.MavenSession;
@@ -18,24 +15,23 @@
 import org.apache.maven.plugins.annotations.Component;
 import org.apache.maven.plugins.annotations.Parameter;
 import org.apache.maven.project.MavenProject;
-import org.eclipse.aether.RepositorySystem;
 import org.eclipse.aether.RepositorySystemSession;
 import org.eclipse.aether.artifact.Artifact;
 import org.eclipse.aether.artifact.DefaultArtifact;
-import org.eclipse.aether.impl.RemoteRepositoryManager;
 import org.eclipse.aether.repository.RemoteRepository;
 
 import io.quarkus.bootstrap.BootstrapConstants;
-import io.quarkus.bootstrap.resolver.maven.BootstrapMavenException;
+import io.quarkus.bootstrap.resolver.maven.BootstrapMavenContext;
 import io.quarkus.bootstrap.resolver.maven.MavenArtifactResolver;
 import io.quarkus.devtools.messagewriter.MessageWriter;
 import io.quarkus.devtools.project.BuildTool;
+import io.quarkus.devtools.project.CodestartResourceLoadersBuilder;
 import io.quarkus.devtools.project.JavaVersion;
 import io.quarkus.devtools.project.QuarkusProject;
 import io.quarkus.devtools.project.QuarkusProjectHelper;
 import io.quarkus.devtools.project.buildfile.MavenProjectBuildFile;
+import io.quarkus.maven.components.QuarkusWorkspaceProvider;
 import io.quarkus.maven.dependency.ArtifactCoords;
-import io.quarkus.maven.utilities.MojoUtils;
 import io.quarkus.platform.descriptor.loader.json.ResourceLoader;
 import io.quarkus.platform.tools.ToolsConstants;
 import io.quarkus.platform.tools.ToolsUtils;
@@ -56,9 +52,6 @@ public abstract class QuarkusProjectMojoBase extends AbstractMojo {
     @Parameter(defaultValue = "${session}", readonly = true)
     MavenSession session;
 
-    @Component
-    protected RepositorySystem repoSystem;
-
     @Parameter(defaultValue = "${repositorySystemSession}", readonly = true)
     protected RepositorySystemSession repoSession;
 
@@ -75,7 +68,7 @@ public abstract class QuarkusProjectMojoBase extends AbstractMojo {
     private String bomVersion;
 
     @Component
-    RemoteRepositoryManager remoteRepositoryManager;
+    QuarkusWorkspaceProvider workspaceProvider;
 
     private List<ArtifactCoords> importedPlatforms;
 
@@ -108,10 +101,14 @@ public void execute() throws MojoExecutionException {
                 throw new MojoExecutionException("Failed to initialize Quarkus Maven extension manager", e);
             }
         } else {
-            final List<ResourceLoader> codestartsResourceLoader = getCodestartResourceLoaders(resolveExtensionCatalog());
-            quarkusProject = QuarkusProject.of(baseDir(), resolveExtensionCatalog(),
-                    codestartsResourceLoader,
-                    log, buildTool, JavaVersion.NA);
+            final ExtensionCatalog extensionCatalog = resolveExtensionCatalog();
+            final List<ResourceLoader> codestartsResourceLoader = CodestartResourceLoadersBuilder
+                    .codestartLoadersBuilder()
+                    .artifactResolver(artifactResolver())
+                    .catalog(extensionCatalog)
+                    .build();
+            quarkusProject = QuarkusProject.of(baseDir(), extensionCatalog,
+                    codestartsResourceLoader, log, buildTool, JavaVersion.NA);
         }
 
         doExecute(quarkusProject, getMessageWriter());
@@ -155,7 +152,7 @@ protected List<ArtifactCoords> getImportedPlatforms() throws MojoExecutionExcept
         if (importedPlatforms == null) {
             if (project.getFile() == null) {
                 if (bomGroupId == null && bomArtifactId == null && bomVersion == null) {
-                    return Collections.emptyList();
+                    return List.of();
                 }
                 final ExtensionCatalogResolver catalogResolver = getExtensionCatalogResolver();
                 if (!catalogResolver.hasRegistries()) {
@@ -172,39 +169,35 @@ protected List<ArtifactCoords> getImportedPlatforms() throws MojoExecutionExcept
                 } catch (RegistryResolutionException e) {
                     throw new MojoExecutionException("Failed to resolve the catalog of Quarkus platforms", e);
                 }
-                return importedPlatforms = Collections.singletonList(platformBom);
+                return importedPlatforms = List.of(platformBom);
             }
             importedPlatforms = collectImportedPlatforms();
         }
         return importedPlatforms;
     }
 
     protected MavenArtifactResolver catalogArtifactResolver() throws MojoExecutionException {
-        return artifactResolver;
+        return artifactResolver();
     }
 
     protected MavenArtifactResolver artifactResolver() throws MojoExecutionException {
         return artifactResolver == null ? artifactResolver = initArtifactResolver() : artifactResolver;
     }
 
     protected MavenArtifactResolver initArtifactResolver() throws MojoExecutionException {
-        try {
-            return MavenArtifactResolver.builder()
-                    .setRepositorySystem(repoSystem)
-                    .setRepositorySystemSession(
-                            getLog().isDebugEnabled() ? repoSession : MojoUtils.muteTransferListener(repoSession))
-                    .setRemoteRepositories(repos)
-                    .setRemoteRepositoryManager(remoteRepositoryManager)
-                    .build();
-        } catch (BootstrapMavenException e) {
-            throw new MojoExecutionException("Failed to initialize Maven artifact resolver", e);
-        }
+        var config = BootstrapMavenContext.config()
+                .setArtifactTransferLogging(getLog().isDebugEnabled())
+                .setRemoteRepositoryManager(workspaceProvider.getRemoteRepositoryManager())
+                .setRepositorySystem(workspaceProvider.getRepositorySystem())
+                .setRemoteRepositories(repos)
+                .setWorkspaceDiscovery(false)
+                .setRepositorySystemSession(repoSession);
+        return workspaceProvider.createArtifactResolver(config);
     }
 
-    private List<ArtifactCoords> collectImportedPlatforms()
-            throws MojoExecutionException {
+    private List<ArtifactCoords> collectImportedPlatforms() {
         final List<ArtifactCoords> descriptors = new ArrayList<>(4);
-        final List<Dependency> constraints = project.getDependencyManagement() == null ? Collections.emptyList()
+        final List<Dependency> constraints = project.getDependencyManagement() == null ? List.of()
                 : project.getDependencyManagement().getDependencies();
         if (!constraints.isEmpty()) {
             final MessageWriter log = getMessageWriter();
@@ -222,17 +215,6 @@ private List<ArtifactCoords> collectImportedPlatforms()
         return descriptors;
     }
 
-    private String getQuarkusCoreVersion() {
-        final List<Dependency> constraints = project.getDependencyManagement() == null ? Collections.emptyList()
-                : project.getDependencyManagement().getDependencies();
-        for (Dependency d : constraints) {
-            if (d.getArtifactId().endsWith("quarkus-core") && d.getGroupId().equals("io.quarkus")) {
-                return d.getVersion();
-            }
-        }
-        return null;
-    }
-
     protected void validateParameters() throws MojoExecutionException {
     }
 
@@ -241,8 +223,8 @@ protected abstract void doExecute(QuarkusProject quarkusProject, MessageWriter l
 
     private Artifact projectArtifact() {
         return projectArtifact == null
-                ? projectArtifact = new DefaultArtifact(project.getGroupId(), project.getArtifactId(), null, "pom",
-                        project.getVersion())
+                ? projectArtifact = new DefaultArtifact(project.getGroupId(), project.getArtifactId(), null,
+                        ArtifactCoords.TYPE_POM, project.getVersion())
                 : projectArtifact;
     }
 

devtools/maven/src/main/java/io/quarkus/maven/QuarkusProjectStateMojoBase.java

@@ -141,7 +141,7 @@ protected MavenArtifactResolver catalogArtifactResolver() throws MojoExecutionEx
     protected MavenArtifactResolver initArtifactResolver() throws MojoExecutionException {
         return workspaceProvider.createArtifactResolver(BootstrapMavenContext.config()
                 .setUserSettings(session.getRequest().getUserSettingsFile())
-                .setRemoteRepositoryManager(remoteRepositoryManager)
+                .setRemoteRepositoryManager(workspaceProvider.getRemoteRepositoryManager())
                 // The system needs to be initialized with the bootstrap model builder to properly interpolate system properties set on the command line
                 // e.g. -Dquarkus.platform.version=xxx
                 //.setRepositorySystem(workspaceProvider.getRepositorySystem())

docs/src/main/asciidoc/amqp-reference.adoc

@@ -478,6 +478,19 @@ public AmqpClientOptions getNamedOptions() {
 }
 ----
 
+== TLS Configuration
+
+AMQP 1.0 Messaging extension integrates with the xref:./tls-registry-reference.adoc[Quarkus TLS registry] to configure the Vert.x AMQP client.
+
+To configure the TLS for an AMQP 1.0 channel, you need to provide a named TLS configuration in the `application.properties`:
+
+[source, properties]
+----
+quarkus.tls.your-tls-config.trust-store.pem.certs=ca.crt,ca2.pem
+# ...
+mp.messaging.incoming.prices.tls-configuration-name=your-tls-config
+----
+
 == Health reporting
 
 If you use the AMQP connector with the `quarkus-smallrye-health` extension, it contributes to the readiness and liveness probes.

docs/src/main/asciidoc/hibernate-orm.adoc

@@ -1395,6 +1395,9 @@ and annotating the implementation with the appropriate qualifiers:
 
 [source,java]
 ----
+import io.quarkus.hibernate.orm.JsonFormat;
+import org.hibernate.type.format.FormatMapper;
+
 @JsonFormat // <1>
 @PersistenceUnitExtension // <2>
 public class MyJsonFormatMapper implements FormatMapper { // <3>
@@ -1412,6 +1415,9 @@ public class MyJsonFormatMapper implements FormatMapper { // <3>
 <1> Annotate the format mapper implementation with the `@JsonFormat` qualifier
 to tell Quarkus that this mapper is specific to JSON serialization/deserialization.
 +
+WARNING: Make sure the Quarkus-specific `@io.quarkus.hibernate.orm.JsonFormat` annotation is used
+and not the one from Jackson.
++
 <2> Annotate the format mapper implementation with the `@PersistenceUnitExtension` qualifier
 to tell Quarkus it should be used in the default persistence unit.
 +
@@ -1422,6 +1428,9 @@ In case of a custom XML format mapper, a different CDI qualifier must be applied
 
 [source,java]
 ----
+import io.quarkus.hibernate.orm.XmlFormat;
+import org.hibernate.type.format.FormatMapper;
+
 @XmlFormat // <1>
 @PersistenceUnitExtension // <2>
 public class MyJsonFormatMapper implements FormatMapper { // <3>

docs/src/main/asciidoc/kafka.adoc

@@ -2153,6 +2153,36 @@ Update the `oauth.client.id`, `oauth.client.secret` and `oauth.token.endpoint.ur
 
 OAuth authentication works for both JVM and native modes. Since SSL in not enabled by default in native mode, `quarkus.ssl.native=true` must be added to support JaasClientOauthLoginCallbackHandler, which uses SSL. (See the xref:native-and-ssl.adoc[Using SSL with Native Executables] guide for more details.)
 
+== TLS Configuration
+
+Kafka client extension integrates with the xref:./tls-registry-reference.adoc[Quarkus TLS registry] to configure clients.
+
+To configure the TLS for the default Kafka configuration, you need to provide a named TLS configuration in the `application.properties`:
+
+[source, properties]
+----
+quarkus.tls.your-tls-config.trust-store.pem.certs=target/certs/kafka.crt,target/certs/kafka-ca.crt
+# ...
+kafka.tls-configuration-name=your-tls-config
+# enable ssl security protocol
+kafka.security.protocol=ssl
+----
+
+This will in turn provide the Kafka client with a `ssl.engine.factory.class` implementation.
+
+[IMPORTANT]
+====
+Make sure also to enable the SSL channel security protocol using the `security.protocol` property configured to `SSL` or `SASL_SSL`.
+====
+
+Quarkus Messaging channels can be configured individually to use a specific TLS configuration:
+
+[source, properties]
+----
+mp.messaging.incoming.your-channel.tls-configuration-name=your-tls-config
+mp.messaging.incoming.your-channel.security.protocol=ssl
+----
+
 == Testing a Kafka application
 
 === Testing without a broker

docs/src/main/asciidoc/messaging.adoc

@@ -600,6 +600,33 @@ You can disable tracing for a specific channel using the following configuration
 mp.messaging.incoming.data.tracing-enabled=false
 ----
 
+== TLS Configuration
+
+Some messaging extensions integrate with the xref:./tls-registry-reference.adoc[Quarkus TLS Registry] to configure the underlying client.
+To configure the TLS on a channel, you need to provide the named TLS configuration to the `tls-configuration-name` property:
+
+[source, properties]
+----
+quarkus.tls.my-tls-config.trust-store=truststore.jks
+quarkus.tls.my-tls-config.trust-store-password=secret
+mp.messaging.incoming.my-channel.tls-configuration-name=my-tls-config
+----
+
+Or you can configure it globally on all channels of a connector:
+
+[source, properties]
+----
+mp.messaging.connector.smallrye-pulsar.tls-configuration-name=my-tls-config
+----
+
+Currently, the following messaging extensions support configuration through the Quarkus TLS Registry:
+
+* Kafka: Provides the `ssl.engine.factory.class` property for the Kafka client.
+* Pulsar: Only mTLS authentication is supported.
+* RabbitMQ
+* AMQP 1.0
+* MQTT
+
 == Testing
 
 === Testing with Dev Services

docs/src/main/asciidoc/pulsar-getting-started.adoc

@@ -405,7 +405,7 @@ version: '3.8'
 services:
 
   pulsar:
-    image: apachepulsar/pulsar:3.0.0
+    image: apachepulsar/pulsar:3.2.4
     command: [
       "sh", "-c",
       "bin/apply-config-from-env.py conf/standalone.conf && bin/pulsar standalone -nfw -nss"

docs/src/main/asciidoc/pulsar.adoc

@@ -1118,6 +1118,23 @@ class PulsarConfig {
 }
 ----
 
+==== Configuring authentication to Pulsar using mTLS
+
+Pulsar Messaging extension integrates with the xref:./tls-registry-reference.adoc[Quarkus TLS registry] to authenticate clients using mTLS.
+
+To configure the mTLS for a Pulsar channel, you need to provide a named TLS configuration in the `application.properties`:
+
+[source, properties]
+----
+quarkus.tls.my-tls-config.trust-store.p12.path=target/certs/pulsar-client-truststore.p12
+quarkus.tls.my-tls-config.trust-store.p12.password=secret
+quarkus.tls.my-tls-config.key-store.p12.path=target/certs/pulsar-client-keystore.p12
+quarkus.tls.my-tls-config.key-store.p12.password=secret
+
+mp.messaging.incoming.prices.tls-configuration-name=my-tls-config
+----
+
+
 ==== Configuring access to Datastax Luna Streaming
 
 Luna Streaming is a production-ready distribution of Apache Pulsar, with tools and support from DataStax.

docs/src/main/asciidoc/rabbitmq-reference.adoc

@@ -389,6 +389,19 @@ You need to indicate the name of the client using the `client-options-name` attr
 mp.messaging.incoming.prices.client-options-name=my-named-options
 ----
 
+== TLS Configuration
+
+RabbitMQ Messaging extension integrates with the xref:./tls-registry-reference.adoc[Quarkus TLS registry] to configure the Vert.x RabbitMQ client.
+
+To configure the TLS for a channel, you need to provide a named TLS configuration in the `application.properties`:
+
+[source, properties]
+----
+quarkus.tls.your-tls-config.trust-store.pem.certs=ca.crt,ca2.pem
+# ...
+mp.messaging.incoming.prices.tls-configuration-name=your-tls-config
+----
+
 == Health reporting
 
 If you use the RabbitMQ connector with the `quarkus-smallrye-health` extension, it contributes to the readiness and liveness probes.

docs/src/main/asciidoc/security-oidc-code-flow-authentication.adoc

@@ -347,7 +347,7 @@ public class OidcTokenRequestCustomizer implements OidcRequestFilter {
 <1> Get `OidcConfigurationMetadata`, which contains all supported OIDC endpoint addresses.
 <2> Use `OidcConfigurationMetadata` to filter requests to the OIDC token endpoint only.
 
-Alternatively, you can use `OidcRequestFilter.Endpoint` enum to apply this filter to the token endpoint requests only:
+Alternatively, you can use an `@OidcEndpoint` annotation to apply this filter to the token endpoint requests only:
 
 [source,java]
 ----