Merge pull request #2821 from wireapp/release_2022-11-03_13_56

Release 2022-11-03 - (expected chart version 4.26.0)

.envrc

@@ -1,26 +1,30 @@
-# Build a folder ./.env that contains all the tools
+# Build a folder ./.env that contains the dev-shell which load all the right env
+# vars.
+#
 # To speed up the nix evaluation, we only rebuild our environment when `./nix`
-# changes. We do this by adding its contents to the nix store and using its
-# store path as a cache key. We only use this to build the dev environment. This
-# will fail building in case anything inside the devEnv is reaching outside
-# the nix/ subfolder
-store_path=$(nix-store --add ./nix/)
+# or any of the `default.nix` files change. We do this by adding all these files
+# to the nix store and using the store paths as a cache key.
+
+store_paths=$(find . -name default.nix  | grep -v '^./nix' | grep -v '^./dist-newstyle' | xargs nix-store --add ./nix)
 layout_dir=$(direnv_layout_dir)
+env_dir=./.env
+
 [[ -d "$layout_dir" ]] || mkdir -p "$layout_dir"
-if [[ ! -d ./.env || ! -f "$layout_dir/nix-rebuild" || "$store_path" != $(< "$layout_dir/nix-rebuild" ) ]]; then
 
-  # this builds "devEnv" defined in ./nix/default.nix and outputs to ./.env
-  nix-build "$store_path" -A devEnv --out-link ./.env
+if [[ ! -d "$env_dir" || ! -f "$layout_dir/nix-rebuild" || "$store_paths" != $(< "$layout_dir/nix-rebuild" ) ]]; then
+  nix-build ./nix -A wireServer.devEnv --out-link ./.env
 
-  echo "$store_path" > "$layout_dir/nix-rebuild"
+  echo "$store_paths" > "$layout_dir/nix-rebuild"
 fi
 
 PATH_add "./.env/bin"
+path_add "PKG_CONFIG_PATH" "./.env/lib/pkgconfig"
+path_add "LIBRARY_PATH" "./.env/lib"
 
 # source .profile from `$env`. This sets NIX_PATH to pkgs defined in
 # ./nix/default.nix. Tis is useful for nix tooling that runs inside this direnv,
 # e.g. "nix-shell -p foo" will get "foo" for pkgs defined in ./nix/default.nix
- [[ -f "./.env/.profile" ]] && source_env "./.env/.profile"
+[[ -f "./.env/.profile" ]] && source_env "./.env/.profile"
 
 # allow local .envrc overrides
 [[ -f .envrc.local ]] && source_env .envrc.local

.github/workflows/ci.yml

@@ -4,30 +4,6 @@ on:
    branches: [master, develop]
 
 jobs:
-  build-dev-env:
-   name: Build dev env
-   environment: cachix # for secrets
-   strategy:
-     matrix:
-       os:
-         - ubuntu-latest
-         # This is too expensive
-         # - macos-latest
-   runs-on: ${{ matrix.os }}
-   steps:
-     - uses: actions/checkout@v2
-       with:
-         submodules: true
-     - uses: cachix/[email protected]
-     - uses: cachix/cachix-action@v10
-       with:
-         name: wire-server
-         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
-         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-     - name: Build the wire-server-direnv
-       run: nix-build --no-out-link ./nix -A devEnv
-     - name: Install the wire-server-direnv
-       run: nix-env -if ./nix -A devEnv
   build-docs:
     name: Build docs
     environment: cachix

.gitignore

@@ -60,8 +60,8 @@ integration-aws.yaml
 DOCKER_ID*
 swagger-ui
 !charts/nginz/static/swagger-ui
-deploy/services-demo/resources/templates/*
-deploy/services-demo/conf/nginz/zwagger-ui/*
+
+services/nginz/integration-test/conf/nginz/zwagger-ui/*
 
 deploy/dockerephemeral/build/airdock_base-all/
 deploy/dockerephemeral/build/airdock_base/
@@ -72,13 +72,6 @@ deploy/dockerephemeral/build/airdock_rvm/
 deploy/dockerephemeral/build/dynamodb_local/
 deploy/dockerephemeral/build/smtp/
 
-# Avoid storing generated keys
-/deploy/services-demo/resources/turn/secret.txt
-
-# Avoid storing generated keys (privkeys.txt and pubkeys.txt are generated by demo.sh)
-/deploy/services-demo/resources/zauth/privkeys.txt
-/deploy/services-demo/resources/zauth/pubkeys.txt
-
 /libs/libzauth/bzauth-c/deb/usr
 
 # Generated by "make hie.yaml"

.hlint.yaml

@@ -16,6 +16,7 @@
 # custom rules:
 - hint: { lhs: (() <$), rhs: void }
 - hint: { lhs: return, rhs: pure }
+- hint: { lhs:  maybe mempty, rhs: foldMap }
 
 # We want the latter function because it handles signals properly.
 - error: { name: Use shutdown, lhs: runSettings, rhs: runSettingsWithShutdown }

.ormolu

@@ -0,0 +1,5 @@
+infixr 10 .=
+infix 4 ===
+infix 4 =/=
+infixr 3 !!!
+infixr 3 <!!

CHANGELOG.md

@@ -1,3 +1,112 @@
+# [2022-11-03] (Chart Release 4.26.0)
+
+## Release notes
+
+
+* If you have not upgraded to [release 2021-03-21 (Chart Release 2.103.0)](https://github.com/wireapp/wire-server/releases/tag/v2021-03-21) yet, please do that now!
+
+  NB: we only support releases 6 months back, so this should not be an issue.  But in this particular case we are positive that things will break if you don't do an intermediate upgrade. (#2768)
+
+* Build docker images using nix derivations instead of Dockerfiles (#2331, #2771, #2772, #2775, #2776)
+
+* Upgrade team-settings version to 4.13.0-v0.31.5-0-4754212 (#2180)
+
+* Upgrade webapp version to 2022-11-02-production.0-v0.31.9-0-337e400 (#2302)
+
+* The experimental wire-server-metrics helm chart has been removed.
+
+  These were mostly a wrapper around prometheus operator. It makes more sense to
+  refer to the upstream docs of Prometheus Operator or Grafana Agent Operator for
+  installation instead. (#2740)
+
+
+## API changes
+
+
+* Do not expose swagger-ui on prod systems (to minimize attack surface) (#2800)
+
+* Change mime type of body of /v3/mls/commit-bundles endpoint (#2773)
+
+* Stop rate-limiting asset-signed-url requests on /assets/.* (#2786)
+
+* The `/access` endpoint now takes an optional `client_id` query parameter. The first time it is provided, a new user token will be generated containing the given client ID. Successive invocations of `/access` will ignore the `client_id` parameter. Some endpoints can now potentially require a client ID as part of the access token. When trying to invoke them with an access token that does not contain a client ID, an authentication error will occur. (#2764)
+
+
+## Features
+
+
+* Introduce support for external commits in MLS (#2765)
+
+* The `GET /teams/{tid}/members` endpoint now supports pagination (#2802)
+
+
+## Bug fixes and other updates
+
+
+* Clients without any prekeys are not deleted completely (#2758)
+
+
+## Documentation
+
+
+* tentatively allow `GET /api/event-notification-schemas` for json schemas of server-initiated events (missing pieces tracked in https://wearezeta.atlassian.net/browse/FS-1008) (#2739)
+
+* Fix copyright date on docs.wire.com (#2792)
+
+* Improve and cross-link documentation on SNS / push notifications. (#PR_NOT_FOUND)
+
+* Add extension sphinx-reredirects and configuration to generate simple JavaScript based redirects to new locations of previously inconsistently named files/URLs. (#2811)
+
+
+## Internal changes
+
+
+* Convert brig's auth endpoints to servant (#2750)
+
+* bump nginx-module-vts from v0.1.15 to v0.2.1 (#2793)
+
+* Remove deprecated table for storing scim external_ids.
+
+  Data has been migrated away in [release 2021-03-21 (Chart Release 2.103.0)](https://github.com/wireapp/wire-server/releases/tag/v2021-03-21) (see `/services/spar/migrate-data/src/Spar/DataMigration/V1_ExternalIds.hs`); last time it has been touched in production is before upgrade to [release 2021-03-23 (Chart Release 2.104.0)](https://github.com/wireapp/wire-server/releases/tag/v2021-03-23). (#2768)
+
+* Refactor some internal Scim user tests (#2762)
+
+* Reduce the payload size of internal `client.delete` event (#2807, #2816)
+
+* Bump servant-swagger-ui package. (#2747)
+
+* Increase charts/galley memory limit to 500M. (#2798)
+
+* Add RPC, ServiceRPC and GalleyProvider effects to brig (#2653)
+
+* Use locally build schema binaries for db migrations and execute them right before running integration tests. (#2791)
+
+* Rename the make targets from `db-migrate-package` and `db-reset-package` to `db-migrate` and `db-reset` and allow migrating and resetting all keyspaces. (#2791)
+
+* Add a Make target for ghci (#2749)
+
+* Upgrade nginz/nginx to 1.22.1 (#2777)
+
+* The dev environment provided by nix now contains all the haskell packages
+  compiled by nix. This could casue linker errors while compiling haskell code in
+  this repo. One way to get resolve them is to delete the 'dist-newstyle'
+  directory. (#2331)
+
+* Implemented a new intersperse combinator for Polysemy (#2767)
+
+* Add a Concurrency effect for Polysemy (#2748)
+
+* Don't fail client deletion when mls remove key is undefined (#2738)
+
+* Migrate stern to swagger2-ui (remaining backwards compatible with circulating backoffice images) (see also #2742 from last release) (#2744)
+
+* Gundeck push token API and notification API is migrated to Servant (#2769)
+
+* Delete `deploy/services-demo` directory (#2789)
+
+* Upgrade Servant to 0.19 (#2809)
+
+
 # [2022-10-04] (Chart Release 4.25.0)
 
 ## Release notes
@@ -487,7 +596,7 @@
   removed.
 
   Instead, all services that expose metrics will now create `ServiceMonitor`
-  resources, if their helm chart is applied with `metrics.serviceMonitor.enable`
+  resources, if their helm chart is applied with `metrics.serviceMonitor.enabled`
   set to true.
 
   This prevents scraping agents from querying services that don't expose metrics