Merge pull request #485 from mirskifa/v9.2.4

V9.2.4

.travis.yml

@@ -18,18 +18,18 @@ sudo: required
 language: go
 
 go:
-  - "1.13.15"
+  - "1.16.7"
 
 services:
   - docker
 
 env:
   global:
-    - MAIN_BRANCH=v9.2.2
-    - MQ_LTS_VERSION=9.2.0.1
+    - MAIN_BRANCH=v9.2.4
+    - MQ_LTS_VERSION=9.2.0.2
     - TAGCACHE_FILE=tagcache
     - RELEASE=r1
-    - RELEASE_LTS=r1
+    - RELEASE_LTS=r2
 
 go_import_path: "github.com/ibm-messaging/mq-container"
 
@@ -40,50 +40,50 @@ go_import_path: "github.com/ibm-messaging/mq-container"
 jobs:
   include:
     - stage: basic-build
-      if: branch != v9.2.2 AND tag IS blank
+      if: branch != v9.2.4 AND tag IS blank
       name: "Basic AMD64 build"
       os: linux
       env:
-        - MQ_ARCHIVE_REPOSITORY_DEV=$MQ_922_ARCHIVE_REPOSITORY_DEV_AMD64
+        - MQ_ARCHIVE_REPOSITORY_DEV=$MQ_924_ARCHIVE_REPOSITORY_DEV_AMD64
       script: bash -e travis-build-scripts/run.sh
 
     # CD Build
 
     - stage: global-tag
-      if: branch = v9.2.2 AND type != pull_request OR tag =~ ^release-candidate*
+      if: branch = v9.2.4 AND type != pull_request OR tag =~ ^release-candidate*
       name: "Generate Global Tag"
       os: linux
       script: bash -e travis-build-scripts/global-tag.sh
     - stage: build
-      if: branch = v9.2.2 OR tag =~ ^release-candidate*
+      if: branch = v9.2.4 OR tag =~ ^release-candidate*
       name: "Multi-Arch AMD64 build"
       os: linux
       env:
         - BUILD_ALL=true
-        - MQ_ARCHIVE_REPOSITORY=$MQ_922_ARCHIVE_REPOSITORY_AMD64
-        - MQ_ARCHIVE_REPOSITORY_DEV=$MQ_922_ARCHIVE_REPOSITORY_DEV_AMD64
+        - MQ_ARCHIVE_REPOSITORY=$MQ_924_ARCHIVE_REPOSITORY_AMD64
+        - MQ_ARCHIVE_REPOSITORY_DEV=$MQ_924_ARCHIVE_REPOSITORY_DEV_AMD64
       script: bash -e travis-build-scripts/run.sh
-    # - if: branch = v9.2.2 OR tag =~ ^release-candidate*
+    # - if: branch = v9.2.4 OR tag =~ ^release-candidate*
     #   name: "Multi-Arch PPC64LE build"
     #   os: linux-ppc64le
     #   env:
     #     - BUILD_ALL=true
     #     - TEST_OPTS_DOCKER="-run TestGoldenPathWithMetrics"
-    #     # - MQ_ARCHIVE_REPOSITORY=$MQ_922_ARCHIVE_REPOSITORY_PPC64LE
-    #     - MQ_ARCHIVE_REPOSITORY_DEV=$MQ_922_ARCHIVE_REPOSITORY_DEV_PPC64LE
+    #     # - MQ_ARCHIVE_REPOSITORY=$MQ_924_ARCHIVE_REPOSITORY_PPC64LE
+    #     - MQ_ARCHIVE_REPOSITORY_DEV=$MQ_924_ARCHIVE_REPOSITORY_DEV_PPC64LE
     #   script: bash -e travis-build-scripts/run.sh
     - stage: build
-      if: branch = v9.2.2 OR tag =~ ^release-candidate*
+      if: branch = v9.2.4 OR tag =~ ^release-candidate*
       name: "Multi-Arch S390X build"
       os: linux-s390
       env:
         - BUILD_ALL=true
         - TEST_OPTS_DOCKER="-run TestGoldenPathWithMetrics"
-        - MQ_ARCHIVE_REPOSITORY=$MQ_922_ARCHIVE_REPOSITORY_S390X
-        - MQ_ARCHIVE_REPOSITORY_DEV=$MQ_922_ARCHIVE_REPOSITORY_DEV_S390X
+        - MQ_ARCHIVE_REPOSITORY=$MQ_924_ARCHIVE_REPOSITORY_S390X
+        - MQ_ARCHIVE_REPOSITORY_DEV=$MQ_924_ARCHIVE_REPOSITORY_DEV_S390X
       script: bash -e travis-build-scripts/run.sh
     - stage: push-manifest
-      if: branch = v9.2.2 AND type != pull_request OR tag =~ ^release-candidate*
+      if: branch = v9.2.4 AND type != pull_request OR tag =~ ^release-candidate*
       name: "Push Manifest-list to registry"
       env:
         - PUSH_MANIFEST_ONLY=true
@@ -92,7 +92,7 @@ jobs:
       # LTS Build
 
     - stage: global-tag
-      if: branch = v9.2.2 AND type != pull_request OR tag =~ ^release-candidate*
+      if: branch = v9.2.4 AND type != pull_request OR tag =~ ^release-candidate*
       name: "Generate Global Tag"
       os: linux
       env:
@@ -102,7 +102,7 @@ jobs:
         - RELEASE=$RELEASE_LTS
       script: bash -e travis-build-scripts/global-tag.sh
     - stage: build
-      if: branch = v9.2.2 OR tag =~ ^release-candidate*
+      if: branch = v9.2.4 OR tag =~ ^release-candidate*
       name: "Multi-Arch AMD64 build"
       os: linux
       env:
@@ -113,7 +113,7 @@ jobs:
         - RELEASE=$RELEASE_LTS
       script: bash -e travis-build-scripts/run.sh
     - stage: build
-      if: branch = v9.2.2 OR tag =~ ^release-candidate*
+      if: branch = v9.2.4 OR tag =~ ^release-candidate*
       name: "Multi-Arch S390X build"
       os: linux-s390
       env:
@@ -125,7 +125,7 @@ jobs:
         - RELEASE=$RELEASE_LTS
       script: bash -e travis-build-scripts/run.sh
     - stage: push-manifest
-      if: branch = v9.2.2 AND type != pull_request OR tag =~ ^release-candidate*
+      if: branch = v9.2.4 AND type != pull_request OR tag =~ ^release-candidate*
       name: "Push Manifest-list to registry"
       env:
         - LTS=true

.whitesource

@@ -0,0 +1,6 @@
+{
+  "settingsInheritedFrom": "whitesource-config/whitesource-config@master",
+  "scanSettings": {
+      "baseBranches": ["private-master", "v9.2.0.x-eus"]
+  }
+}

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Change log
 
+## 9.2.4.0 (2021-09-06)
+
+* Updated to MQ version 9.2.4.0
+
+## 9.2.3.0 (2021-07-22)
+
+* Updated to MQ version 9.2.3.0
+
 ## 9.2.2.0 (2021-03-26)
 
 * Updated to MQ version 9.2.2.0

Dockerfile-server

@@ -13,13 +13,15 @@
 # limitations under the License.
 
 ARG BASE_IMAGE=registry.redhat.io/ubi8/ubi-minimal
-ARG BASE_TAG=8.3-291
-ARG GO_WORKDIR=/go/src/github.com/ibm-messaging/mq-container
-ARG MQ_URL="https://public.dhe.ibm.com/ibmdl/export/pub/software/websphere/messaging/mqadv/9.2.2.0-IBM-MQ-Advanced-for-Developers-Non-Install-LinuxX64.tar.gz"
+ARG BASE_TAG=8.5-204
+ARG BUILDER_IMAGE=registry.redhat.io/ubi8/go-toolset
+ARG BUILDER_TAG=1.16.7-5
+ARG GO_WORKDIR=/opt/app-root/src/go/src/github.com/ibm-messaging/mq-container
+ARG MQ_URL="https://public.dhe.ibm.com/ibmdl/export/pub/software/websphere/messaging/mqadv/9.2.4.0-IBM-MQ-Advanced-for-Developers-Non-Install-LinuxX64.tar.gz"
 ###############################################################################
 # Build stage to build Go code
 ###############################################################################
-FROM docker.io/golang:1.14.15 as builder
+FROM $BUILDER_IMAGE:$BUILDER_TAG as builder
 # The URL to download the MQ installer from in tar.gz format
 # This assumes an archive containing the MQ Non-Install packages
 ARG MQ_URL
@@ -35,6 +37,7 @@ RUN mkdir /opt/mqm \
   && INSTALL_SDK=1 install-mq.sh \
   && chown -R 1001:root /opt/mqm/*
 WORKDIR $GO_WORKDIR/
+COPY go.mod go.sum ./
 COPY cmd/ ./cmd
 COPY internal/ ./internal
 COPY pkg/ ./pkg

Makefile

@@ -258,7 +258,7 @@ test-advancedserver: test/docker/vendor
 	cd test/docker && TEST_IMAGE=$(MQ_IMAGE_ADVANCEDSERVER):$(MQ_TAG) EXPECTED_LICENSE=Production go test -parallel $(NUM_CPU) -timeout $(TEST_TIMEOUT_DOCKER) $(TEST_OPTS_DOCKER)
 
 .PHONY: build-devjmstest
-build-devjmstest:
+build-devjmstest: registry-login
 	$(info $(SPACER)$(shell printf $(TITLE)"Build JMS tests for developer config"$(END)))
 	cd test/messaging && docker build --tag $(DEV_JMS_IMAGE) .
 

README.md

@@ -1,5 +1,6 @@
 # IBM MQ container
 
+
 [![Build Status](https://travis-ci.org/ibm-messaging/mq-container.svg?branch=master)](https://travis-ci.org/ibm-messaging/mq-container)
 
 **Note**: The `master` branch may be in an *unstable or even broken state* during development.
@@ -44,8 +45,8 @@ For issues relating specifically to the container image or Helm chart, please us
 The Dockerfiles and associated code and scripts are licensed under the [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0.html).
 Licenses for the products installed within the images are as follows:
 
-- [IBM MQ Advanced for Developers](http://www14.software.ibm.com/cgi-bin/weblap/lap.pl?la_formnum=Z125-3301-14&li_formnum=L-APIG-BMKG5H) (International License Agreement for Non-Warranted Programs). This license may be viewed from an image using the `LICENSE=view` environment variable as described above or by following the link above.
-- [IBM MQ Advanced](http://www14.software.ibm.com/cgi-bin/weblap/lap.pl?la_formnum=Z125-3301-14&li_formnum=L-APIG-BVJJB3) (International Program License Agreement). This license may be viewed from an image using the `LICENSE=view` environment variable as described above or by following the link above.
+- [IBM MQ Advanced for Developers](http://www14.software.ibm.com/cgi-bin/weblap/lap.pl?la_formnum=Z125-3301-14&li_formnum=L-APIG-BYHCL7) (International License Agreement for Non-Warranted Programs). This license may be viewed from an image using the `LICENSE=view` environment variable as described above or by following the link above.
+- [IBM MQ Advanced](http://www14.software.ibm.com/cgi-bin/weblap/lap.pl?la_formnum=Z125-3301-14&li_formnum=L-APIG-BZDDDY) (International Program License Agreement). This license may be viewed from an image using the `LICENSE=view` environment variable as described above or by following the link above.
 
 Note: The IBM MQ Advanced for Developers license does not permit further distribution and the terms restrict usage to a developer machine.
 

cmd/chkmqstarted/main.go

@@ -43,20 +43,6 @@ func queueManagerStarted() (bool, error) {
 	if !strings.Contains(string(out), "(RUNNING)") && !strings.Contains(string(out), "(RUNNING AS STANDBY)") && !strings.Contains(string(out), "(STARTING)") && !strings.Contains(string(out), "(REPLICA)") {
 		return false, nil
 	}
-	if os.Getenv("MQ_NATIVE_HA") == "true" {
-		// Specify the queue manager name, just in case someone's created a second queue manager
-		// #nosec G204
-		cmd = exec.Command("dspmq", "-n", "-o", "nativeha", "-m", name)
-		// Run the command and wait for completion
-		out, err = cmd.CombinedOutput()
-		if err != nil {
-			fmt.Println(err)
-			return false, err
-		}
-		if !strings.Contains(string(out), "INSYNC(YES)") {
-			return false, nil
-		}
-	}
 	return true, nil
 }
 

config.env

@@ -1,6 +1,6 @@
 ###########################################################################################################################################################
 
 # MQ_VERSION is the fully qualified MQ version number to build
-MQ_VERSION ?= 9.2.2.0
+MQ_VERSION ?= 9.2.4.0
 
 ###########################################################################################################################################################

docs/building.md

@@ -20,7 +20,7 @@ From MQ 9.2.X, the MQ container adds support for MQ Long Term Support (LTS) **pr
 This procedure works for building the MQ Continuous Delivery release, on `amd64`, `ppc64le` and `s390x` architectures.
 
 1. Create a `downloads` directory in the root of this repository
-2. Download MQ from [IBM Passport Advantage](https://www.ibm.com/software/passportadvantage/) or [IBM Fix Central](https://www.ibm.com/support/fixcentral), and place the downloaded file (for example, `IBM_MQ_9.2.2_LINUX_X86-64_NOINST.tar.gz`) in the `downloads` directory
+2. Download MQ from [IBM Passport Advantage](https://www.ibm.com/software/passportadvantage/) or [IBM Fix Central](https://www.ibm.com/support/fixcentral), and place the downloaded file (for example, `IBM_MQ_9.2.4_LINUX_X86-64_NOINST.tar.gz`) in the `downloads` directory
 3. Login to the Red Hat Registry: `docker login registry.redhat.io` using your Customer Portal credentials.
 4. Run `make build-advancedserver`
 

docs/security.md

@@ -16,5 +16,5 @@ docker run \
   --env LICENSE=accept \
   --env MQ_QMGR_NAME=QM1 \
   --detach \
-  ibm-mqadvanced-server:9.2.2.0-amd64
+  ibm-mqadvanced-server:9.2.4.0-amd64
 ```

docs/testing.md

@@ -25,7 +25,7 @@ make advancedserver
 You can specify the image to use directly by using the `MQ_IMAGE_ADVANCEDSERVER` or `MQ_IMAGE_DEVSERVER` variables, for example:
 
 ```
-MQ_IMAGE_ADVANCEDSERVER=ibm-mqadvanced-server:9.2.2.0-amd64 make test-advancedserver
+MQ_IMAGE_ADVANCEDSERVER=ibm-mqadvanced-server:9.2.4.0-amd64 make test-advancedserver
 ```
 
 You can pass parameters to `go test` with an environment variable.  For example, to run the "TestGoldenPath" test, run the following command:

go.mod

@@ -1,6 +1,6 @@
 module github.com/ibm-messaging/mq-container
 
-go 1.14
+go 1.15
 
 require (
 	github.com/genuinetools/amicontained v0.4.0

install-build-deps.sh

@@ -22,5 +22,5 @@ set -ex
 sudo curl -Lo /usr/local/bin/dep https://github.com/golang/dep/releases/download/v0.5.1/dep-linux-$ARCH
 sudo chmod +x /usr/local/bin/dep
 
-go get -u golang.org/x/lint/golint
+go install golang.org/x/lint/golint@latest
 curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s -- -b $GOPATH/bin 2.0.0 || echo "Gosec not installed. Platform may not be supported."

internal/ha/ha.go

@@ -41,7 +41,7 @@ func ConfigureNativeHA(log *logger.Logger) error {
 	templateMap["NativeHAInstance2_ReplicationAddress"] = os.Getenv("MQ_NATIVE_HA_INSTANCE_2_REPLICATION_ADDRESS")
 
 	if os.Getenv("MQ_NATIVE_HA_TLS") == "true" {
-		keyLabel, _, err := tls.ConfigureHATLSKeystore()
+		keyLabel, _, _, err := tls.ConfigureHATLSKeystore()
 		if err != nil {
 			return err
 		}

internal/tls/tls.go

@@ -76,23 +76,22 @@ type TLSStore struct {
 	Truststore KeyStoreData
 }
 
-// ConfigureDefaultTLSKeystores configures the CMS Keystore & PKCS#12 Truststore
-func ConfigureDefaultTLSKeystores() (string, KeyStoreData, KeyStoreData, error) {
+func configureTLSKeystores(keystoreDir, keyDir, trustDir string, p12TruststoreRequired bool) (string, KeyStoreData, KeyStoreData, error) {
 
-	// Create the CMS Keystore & PKCS#12 Truststore
-	tlsStore, err := generateAllDefaultKeystores()
+	// Create the CMS Keystore & PKCS#12 Truststore (if required)
+	tlsStore, err := generateAllKeystores(keystoreDir, p12TruststoreRequired)
 	if err != nil {
 		return "", tlsStore.Keystore, tlsStore.Truststore, err
 	}
 
 	// Process all keys - add them to the CMS KeyStore
-	keyLabel, err := processKeys(&tlsStore, keystoreDirDefault, keyDirDefault)
+	keyLabel, err := processKeys(&tlsStore, keystoreDir, keyDir)
 	if err != nil {
 		return "", tlsStore.Keystore, tlsStore.Truststore, err
 	}
 
-	// Process all trust certificates - add them to the CMS KeyStore & PKCS#12 Truststore
-	err = processTrustCertificates(&tlsStore, trustDirDefault)
+	// Process all trust certificates - add them to the CMS KeyStore & PKCS#12 Truststore (if required)
+	err = processTrustCertificates(&tlsStore, trustDir)
 	if err != nil {
 		return "", tlsStore.Keystore, tlsStore.Truststore, err
 	}
@@ -100,22 +99,15 @@ func ConfigureDefaultTLSKeystores() (string, KeyStoreData, KeyStoreData, error)
 	return keyLabel, tlsStore.Keystore, tlsStore.Truststore, err
 }
 
+// ConfigureDefaultTLSKeystores configures the CMS Keystore & PKCS#12 Truststore
+func ConfigureDefaultTLSKeystores() (string, KeyStoreData, KeyStoreData, error) {
+	return configureTLSKeystores(keystoreDirDefault, keyDirDefault, trustDirDefault, true)
+}
+
 // ConfigureHATLSKeystore configures the CMS Keystore & PKCS#12 Truststore
-func ConfigureHATLSKeystore() (string, KeyStoreData, error) {
-
-	// Create a CMS Keystore only
-	tlsStore, err := generateHAKeystore()
-	if err != nil {
-		return "", tlsStore.Keystore, err
-	}
-
-	// Process all keys - add them to the CMS KeyStore
-	keyLabel, err := processKeys(&tlsStore, keystoreDirHA, keyDirHA)
-	if err != nil {
-		return "", tlsStore.Keystore, err
-	}
-
-	return keyLabel, tlsStore.Keystore, err
+func ConfigureHATLSKeystore() (string, KeyStoreData, KeyStoreData, error) {
+	// *.crt files mounted to the HA TLS dir keyDirHA will be processed as trusted in the CMS keystore
+	return configureTLSKeystores(keystoreDirHA, keyDirHA, keyDirHA, false)
 }
 
 // ConfigureTLS configures TLS for the queue manager
@@ -166,8 +158,8 @@ func configureTLSDev(log *logger.Logger) error {
 	return nil
 }
 
-// generateAllDefaultKeystores creates the CMS Keystore & PKCS#12 Truststore
-func generateAllDefaultKeystores() (TLSStore, error) {
+// generateAllKeystores creates the CMS Keystore & PKCS#12 Truststore (if required)
+func generateAllKeystores(keystoreDir string, p12TruststoreRequired bool) (TLSStore, error) {
 
 	var cmsKeystore, p12Truststore KeyStoreData
 
@@ -178,52 +170,30 @@ func generateAllDefaultKeystores() (TLSStore, error) {
 
 	// Create the Keystore directory - if it does not already exist
 	// #nosec G301 - write group permissions are required
-	err := os.MkdirAll(keystoreDirDefault, 0770)
+	err := os.MkdirAll(keystoreDir, 0770)
 	if err != nil {
 		return TLSStore{cmsKeystore, p12Truststore}, fmt.Errorf("Failed to create Keystore directory: %v", err)
 	}
 
 	// Create the CMS Keystore
-	cmsKeystore.Keystore = keystore.NewCMSKeyStore(filepath.Join(keystoreDirDefault, cmsKeystoreName), cmsKeystore.Password)
+	cmsKeystore.Keystore = keystore.NewCMSKeyStore(filepath.Join(keystoreDir, cmsKeystoreName), cmsKeystore.Password)
 	err = cmsKeystore.Keystore.Create()
 	if err != nil {
 		return TLSStore{cmsKeystore, p12Truststore}, fmt.Errorf("Failed to create CMS Keystore: %v", err)
 	}
 
-	// Create the PKCS#12 Truststore
-	p12Truststore.Keystore = keystore.NewPKCS12KeyStore(filepath.Join(keystoreDirDefault, p12TruststoreName), p12Truststore.Password)
-	err = p12Truststore.Keystore.Create()
-	if err != nil {
-		return TLSStore{cmsKeystore, p12Truststore}, fmt.Errorf("Failed to create PKCS#12 Truststore: %v", err)
+	// Create the PKCS#12 Truststore (if required)
+	if p12TruststoreRequired {
+		p12Truststore.Keystore = keystore.NewPKCS12KeyStore(filepath.Join(keystoreDir, p12TruststoreName), p12Truststore.Password)
+		err = p12Truststore.Keystore.Create()
+		if err != nil {
+			return TLSStore{cmsKeystore, p12Truststore}, fmt.Errorf("Failed to create PKCS#12 Truststore: %v", err)
+		}
 	}
+
 	return TLSStore{cmsKeystore, p12Truststore}, nil
 }
 
-// generateHAKeystore creates the CMS Keystore for Native HA replication
-func generateHAKeystore() (TLSStore, error) {
-	var cmsKeystore KeyStoreData
-
-	// Generate a pasword for use with the CMS Keystore
-	pw := generateRandomPassword()
-	cmsKeystore.Password = pw
-
-	// Create the Keystore directory - if it does not already exist
-	// #nosec G301 - write group permissions are required
-	err := os.MkdirAll(keystoreDirHA, 0770)
-	if err != nil {
-		return TLSStore{Keystore: cmsKeystore}, fmt.Errorf("Failed to create HA Keystore directory: %v", err)
-	}
-
-	// Create the CMS Keystore
-	cmsKeystore.Keystore = keystore.NewCMSKeyStore(filepath.Join(keystoreDirHA, cmsKeystoreName), cmsKeystore.Password)
-	err = cmsKeystore.Keystore.Create()
-	if err != nil {
-		return TLSStore{Keystore: cmsKeystore}, fmt.Errorf("Failed to create CMS Keystore: %v", err)
-	}
-
-	return TLSStore{Keystore: cmsKeystore}, nil
-}
-
 // processKeys processes all keys - adding them to the CMS KeyStore
 func processKeys(tlsStore *TLSStore, keystoreDir string, keyDir string) (string, error) {
 
@@ -273,7 +243,7 @@ func processKeys(tlsStore *TLSStore, keystoreDir string, keyDir string) (string,
 			// Import the new PKCS#12 Keystore into the CMS Keystore
 			err = tlsStore.Keystore.Keystore.Import(filepath.Join(keystoreDir, keySet.Name()+".p12"), tlsStore.Keystore.Password)
 			if err != nil {
-				return "", fmt.Errorf("Failed tp import keys from %s into CMS Keystore: %v", filepath.Join(keystoreDir, keySet.Name()+".p12"), err)
+				return "", fmt.Errorf("Failed to import keys from %s into CMS Keystore: %v", filepath.Join(keystoreDir, keySet.Name()+".p12"), err)
 			}
 
 			// Relabel the certificate in the CMS Keystore
@@ -292,7 +262,7 @@ func processKeys(tlsStore *TLSStore, keystoreDir string, keyDir string) (string,
 	return keyLabel, nil
 }
 
-// processTrustCertificates processes all trust certificates - adding them to the CMS KeyStore & PKCS#12 Truststore
+// processTrustCertificates processes all trust certificates - adding them to the CMS KeyStore & PKCS#12 Truststore (if required)
 func processTrustCertificates(tlsStore *TLSStore, trustDir string) error {
 
 	// Process all trust certiifcates
@@ -324,10 +294,12 @@ func processTrustCertificates(tlsStore *TLSStore, trustDir string) error {
 							return fmt.Errorf("Failed to add to know certificates for CMS Keystore")
 						}
 
-						// Add to known certificates for the PKCS#12 Truststore
-						err = addToKnownCertificates(block, &tlsStore.Truststore, true)
-						if err != nil {
-							return fmt.Errorf("Failed to add to know certificates for PKCS#12 Truststore")
+						if tlsStore.Truststore.Keystore != nil {
+							// Add to known certificates for the PKCS#12 Truststore
+							err = addToKnownCertificates(block, &tlsStore.Truststore, true)
+							if err != nil {
+								return fmt.Errorf("Failed to add to know certificates for PKCS#12 Truststore")
+							}
 						}
 					}
 				}
@@ -335,8 +307,8 @@ func processTrustCertificates(tlsStore *TLSStore, trustDir string) error {
 		}
 	}
 
-	// Add all trust certificates to PKCS#12 Truststore
-	if len(tlsStore.Truststore.TrustedCerts) > 0 {
+	// Add all trust certificates to PKCS#12 Truststore (if required)
+	if tlsStore.Truststore.Keystore != nil && len(tlsStore.Truststore.TrustedCerts) > 0 {
 		err = addCertificatesToTruststore(&tlsStore.Truststore)
 		if err != nil {
 			return err
@@ -438,7 +410,7 @@ func processCertificates(keyDir string, keySetName, keyPrefix string, keys []os.
 					return nil, nil, fmt.Errorf("Failed to add to know certificates for CMS Keystore")
 				}
 
-				if p12Truststore != nil {
+				if p12Truststore.Keystore != nil {
 					// Add to known certificates for the PKCS#12 Truststore
 					err = addToKnownCertificates(block, p12Truststore, true)
 					if err != nil {

test/docker/docker_api_test.go

@@ -991,7 +991,7 @@ func TestMQIniMergeOnTheSameVolumeButTwoContainers(t *testing.T) {
 		RUN chmod 0660 /etc/mqm/test1.ini
 		USER 1001`, imageName())},
 		{"test1.ini",
-			"Log:\n   LogFilePages=5000"},
+			"Log:\n   LogBufferPages=128"},
 	}
 
 	secondImage := createImage(t, cli, filesSecondContainer)
@@ -1011,7 +1011,7 @@ func TestMQIniMergeOnTheSameVolumeButTwoContainers(t *testing.T) {
 	waitForReady(t, cli, ctr2.ID)
 
 	_, test2 := execContainer(t, cli, ctr2.ID, "", []string{"bash", "-c", catIniFileCommand})
-	changedStanza := strings.Contains(test2, "LogFilePages=5000")
+	changedStanza := strings.Contains(test2, "LogBufferPages=128")
 	//check if stanza that was merged in the first container doesnt exist in this one.
 	firstMergedStanza := strings.Contains(test2, "ApplicationTrace:\n   ApplName=amqsact*\n   Trace=OFF")
 

test/docker/docker_api_test_util.go

@@ -826,12 +826,23 @@ func copyFromContainer(t *testing.T, cli *client.Client, id string, file string)
 }
 
 func getPort(t *testing.T, cli *client.Client, ID string, port int) string {
-	i, err := cli.ContainerInspect(context.Background(), ID)
-	if err != nil {
-		t.Fatal(err)
+	var inspectInfo types.ContainerJSON
+	var err error
+	for attemptsRemaining := 3; attemptsRemaining > 0; attemptsRemaining-- {
+		inspectInfo, err = cli.ContainerInspect(context.Background(), ID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		portNat := nat.Port(fmt.Sprintf("%d/tcp", port))
+		if inspectInfo.NetworkSettings.Ports[portNat] == nil || len(inspectInfo.NetworkSettings.Ports[portNat]) == 0 {
+			t.Log("Container port not yet bound")
+			time.Sleep(1 * time.Second)
+			continue
+		}
+		return inspectInfo.NetworkSettings.Ports[portNat][0].HostPort
 	}
-	portNat := nat.Port(fmt.Sprintf("%d/tcp", port))
-	return i.NetworkSettings.Ports[portNat][0].HostPort
+	t.Fatal("Failed to get port")
+	return ""
 }
 
 func countLines(t *testing.T, r io.Reader) int {

test/docker/go.mod

@@ -1,6 +1,6 @@
 module github.com/ibm-messaging/mq-container/test/docker
 
-go 1.14
+go 1.15
 
 require (
 	github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 // indirect

test/messaging/Dockerfile

@@ -15,23 +15,24 @@
 ###############################################################################
 # Application build environment (Maven)
 ###############################################################################
-FROM docker.io/maven:3-ibmjava as builder
-COPY pom.xml /usr/src/mymaven/
-WORKDIR /usr/src/mymaven
+FROM registry.redhat.io/ubi8/openjdk-8 as builder
+COPY pom.xml .
+#WORKDIR /usr/src/mymaven
 # Download dependencies separately, so Docker caches them
 RUN mvn dependency:go-offline install
 # Copy source
-COPY src /usr/src/mymaven/src
+COPY src .
 # Run the main build
 RUN mvn --offline install
 # Print a list of all the files (useful for debugging)
-RUN find /usr/src/mymaven
+RUN find .
 
 ###############################################################################
 # Application runtime (JRE only, no build environment)
 ###############################################################################
-FROM docker.io/ibmjava:8-jre
-COPY --from=builder /usr/src/mymaven/target/*.jar /opt/app/
-COPY --from=builder /usr/src/mymaven/target/lib/*.jar /opt/app/
+# OpenJDK is not technically supported with the MQ client, but is good enough for these tests
+FROM registry.redhat.io/ubi8/openjdk-8-runtime
+COPY --from=builder /home/jboss/target/*.jar /opt/app/
+COPY --from=builder /home/jboss/target/lib/*.jar /opt/app/
 USER 1001
 ENTRYPOINT ["java", "-classpath", "/opt/app/*", "org.junit.platform.console.ConsoleLauncher", "-p", "com.ibm.mqcontainer.test", "--details", "verbose"]

test/tls/generate-test-cert.sh

@@ -1,6 +1,6 @@
-#!/bin/bash
+#!/bin/bash -ex
 # -*- mode: sh -*-
-# © Copyright IBM Corporation 2018
+# © Copyright IBM Corporation 2018, 2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@ PASSWORD=passw0rd
 openssl req \
        -newkey rsa:2048 -nodes -keyout ${KEY} \
        -subj "/CN=localhost" \
+       -addext "subjectAltName = DNS:localhost" \
        -x509 -days 3650 -out ${CERT}
 
 # Add the key and certificate to a PKCS #12 key store, for the server to use

test/tls/server.crt

@@ -1,17 +1,17 @@
 -----BEGIN CERTIFICATE-----
-MIICpDCCAYwCCQC6vpJFnfYO6TANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
-b2NhbGhvc3QwHhcNMTkwMzIxMTYxMzUxWhcNMjkwMzE4MTYxMzUxWjAUMRIwEAYD
-VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCu
-48qtIDwmihFqj2HY3dZjPfROA1MJ+D0c6aEA08ooOczthLB7XdZBQDapj8LFldyt
-4ZMbTkqtF5QtPXmJY0wi39foLYlcGXPL1b7y3mypaFou88BcSM3VmfILKXhNeAlt
-rXevnuT5kDU7sLVgKGhGwas20T1MU7d0I3bQ5z5c7egL76Hk9fYucjN6RkbwlrJ3
-TrCXrGIziofn3Zq1t51ygv21c80JD3XJ44YmuCrede4rhOS/4NpwRuZyiwpJ6tlv
-0L0QSDGCmt2JT3ty28UAsGznFzC5Qu9KyaR+9Gk4aftiyKxrYWZkgtJmMRU+C1X2
-kFLOHsucGmJswjwubSR7AgMBAAEwDQYJKoZIhvcNAQELBQADggEBAEdlmXVGy86P
-XIX5a4ZmHQ5Ns4wm7rY8vzUxlymEQ86En1PN1zAO9gV94tLyNeMptjsFEEo/uJhC
-Yvg3l5TIr/WCiY2+2XsSHvnbXrlbF3S0fRHa9VaCMRKjzRT68uq2Y891906YGtUE
-m6fCjHqVzX8qaplDf79aVkPydYaYOIZ1a/mCfQcD9XMZ/v5zI9IUDhdoq97bgPhB
-gBOzWLI+hkzyU8jxKAFw1Hwi9lD/P6RXL5arNb/+arOgA3vTW+xGWGevgjVK1Ay9
-81beWiQmn0KbeLZxj+WJ9Nntlf1M4EqPYgsSYs/IlJTYS8W1B0mDJEoovPdFTryY
-GyIuQEVcjUE=
+MIICwzCCAaugAwIBAgIJAKnwG0VGiDelMA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNV
+BAMMCWxvY2FsaG9zdDAeFw0yMTA5MDYxNTIyMDlaFw0zMTA5MDQxNTIyMDlaMBQx
+EjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBALLmDX3OB/4DlzJzKz/Edc5qVdjdIN/u8pApSQPevT0mAsSK1uw2MObeOo4C
+DCBmabYeuvGzZ4t3SiejdsHK+qAYMFW51lxTbulv5kUPvTBOY2JCENkVDFjqcK8S
+9ItI/UzTmnBolvZmUKzROHzA/pFb/jkhlzqJO+TqIBXKLF5gdFFTiHHcqfoUyVOV
+n+49V8z6W2rokz4QIWa5Dlh6VS1B6VXdihJv5P9HV8P8FOtefhA85yaSVKlFS/AC
+XRb5FmtmYHBnghLktHS71s/KcPeX27Q1NcKhmZMvHRH95hqEcP25S6SGu69eiCLk
+xpbJKqG3fntfooLUDfR2PHQUJ7UCAwEAAaMYMBYwFAYDVR0RBA0wC4IJbG9jYWxo
+b3N0MA0GCSqGSIb3DQEBCwUAA4IBAQBamIH23oDh1XxOeMPUEyPLHm5M8LM8FNhT
+GEpf1ICy4TSLipSFhIs3hGzVt22zBBzU59apQ8rXUME5SK+9PLag/t/48rG1SfUA
+VyYvaeu/cA5NQMWwuyCLqZL1MWn+BLsdAiNtbNHANesnl0i+vUb0GPzSP8soe3PP
+N7Fh8SO3Qq6e9zT3iE2tP2OFxzcpg538Xn3qoVPJwmLIfBtvsiK07zqAWdqBWtt6
+cBXyagnmgKvOyv6sKAlTpwP9HqVem3XxZVrhm1KiPHs4Dnks6e79txmB8lqzvWu5
+tu4h2ePGJjqUy5JkkoDY0j6hALwEe3ZXBvJ6XUQDi9Hou2k+MaQd
 -----END CERTIFICATE-----

test/tls/server.key

@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCu48qtIDwmihFq
-j2HY3dZjPfROA1MJ+D0c6aEA08ooOczthLB7XdZBQDapj8LFldyt4ZMbTkqtF5Qt
-PXmJY0wi39foLYlcGXPL1b7y3mypaFou88BcSM3VmfILKXhNeAltrXevnuT5kDU7
-sLVgKGhGwas20T1MU7d0I3bQ5z5c7egL76Hk9fYucjN6RkbwlrJ3TrCXrGIziofn
-3Zq1t51ygv21c80JD3XJ44YmuCrede4rhOS/4NpwRuZyiwpJ6tlv0L0QSDGCmt2J
-T3ty28UAsGznFzC5Qu9KyaR+9Gk4aftiyKxrYWZkgtJmMRU+C1X2kFLOHsucGmJs
-wjwubSR7AgMBAAECggEAH9t6teKjUlngJksMBdcTEGzerb9JRw2jBDtCisYJkx5E
-SBfdlftX5fbufiCj2B4eXsYyZ8zxKWqcIUmLdA1Udx3TVIXG+bHhOAYtjEwb+xf5
-JYhdR/IzHG+4eXQKaAIvpXztyl3lU9iC+eaMg4GYzRrGN2wSAG9XgZ5cLF2TLJYU
-jPxp7goz9X6V57aL2G/EFlbFsMaI/6cW7+XoRdo0I4N2Z766gz7GgyxtTVwR5Peq
-LjOpqSNS0W57KJxReURfySok9CP1DfyigopsYW8O4jGVDDRLdiN3I8+JhWya2E0j
-96hHpN04Oz6HnMm7bdZDVtkZCOiu6xIzLJJxZ4o+kQKBgQDYqOA/hSod7s7w4LBE
-A6Mp+e0//PYH6/N9SKmSIgQNec9bMGI4yanoblMbg4GM1g7pkvjlC0nTdjnUbLkB
-vIvtVh3XwTIlrZ/4lc7VB23/hmKU+lRc+NJP5fgasAQu0W3+qp2cXo0pnHVwBEku
-Z7FwDPX0JNDIi/Or2I7dt8JojQKBgQDOpU1AnIXv1/cToYK4nz8BWLxRxwLTxy5A
-ucafNKacPlxb5luZRCExiPZwAM8Z3zI9o99rYXOPQmsnknZWJV66Zx0Vo0yTD1CT
-DWMUj0ugI1wORNMhwZP6YBYWjAeupyU9a7FyU1Geg4sdQt5rMyAEQOoECc8x8foP
-rySHuO/TJwKBgBjMM2ZxymFErQDa5rHSLMGoLmRtgodjlSnYwDfOluIn9/i67/MJ
-+d11iyOSCKji8y/+t2gXw6plVLcgfohZWTaf7ah9H006sx2Tn+m4APoHGo9sm21M
-uV2Vt7DuRnxJUiqcwo9cLxH9K1/Xzbx299MYWKpJ8G+TvR8FGUz9NE4dAoGAM5gs
-KKSsAE1QwFMEG2qPRZvNMTHaL9w8XSbFQ7zWmI4tazihyCutifujZCWfj9sdZSyE
-PQBQ5QT1UiUMbMfZ1fqm1V83YERjnsOp6Fk6zZnmgx2GBZiahNn2ydxekqni72nz
-HRNWfphjZIPsmqFiLg2zIBz+4X6EK+RT35s6LeMCgYEAwF/9jX8kONW5KKZdoNHa
-opkLpa9qkwTGQ9M3AZiRUjM4rtvggYt8FBEP+3BLDLHqfUOkPq82MCRXm+6Cz+sT
-gyPnsPlAh/sr3Pys3olJbUDE9H24k1LU0CI/sSwAFkka0+Q7PVTTe/Dcavitrcrm
-+fyiT2oSPZeHSjQE9iIW3OY=
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy5g19zgf+A5cy
+cys/xHXOalXY3SDf7vKQKUkD3r09JgLEitbsNjDm3jqOAgwgZmm2Hrrxs2eLd0on
+o3bByvqgGDBVudZcU27pb+ZFD70wTmNiQhDZFQxY6nCvEvSLSP1M05pwaJb2ZlCs
+0Th8wP6RW/45IZc6iTvk6iAVyixeYHRRU4hx3Kn6FMlTlZ/uPVfM+ltq6JM+ECFm
+uQ5YelUtQelV3YoSb+T/R1fD/BTrXn4QPOcmklSpRUvwAl0W+RZrZmBwZ4IS5LR0
+u9bPynD3l9u0NTXCoZmTLx0R/eYahHD9uUukhruvXogi5MaWySqht357X6KC1A30
+djx0FCe1AgMBAAECggEAagD5A49+mtwjzigB+4H80Def8KVuomIi5psgAaQM+9u3
+DiC6ozKlHVeW2KiL6PLmNpzU5v0IINKpZP1uE/yjLxPGKDW6t/BUKww8JLXjw2jf
+aMx+0TKwo0sfRA32S0YPmWNVAsBmm1AbA5vhXcK51QXuiInH406H5+d25ZJrYevF
+liKWSjx9CM/0XO7t20j18mCa8RjBEdsZoHxHsoWNvFJ6DCR25cFShAhR7s4OtkUk
+yELm1tYYrFOffUM0Q/Fp9uSlCHWMSqPtf/6NEfnszfFEtzDh/N+YqC1Bexv0XPsD
+dBPOkUZjWA2Sc8Se1t2GLfrRURzj3GvWH1+GssjsAQKBgQDeIdyzQSqce4Kn0opa
+vdS5moCiv3pyfNd0nYe0awgVos4kHY7/nBq0eyMZAatRHeD3DunVsw3LmvWyEw53
+app7MTTjVrYaadoBlB6jy2elyF5RcW2jGchZExoNh+0ZQWUiMbYEozPLQTy9ZxMz
+t0OcZ1hHPngGgmj5TELZKkwEtQKBgQDOLLh7pdKrdudtim+o4H20jl5yYKl25Iq/
+DKVodwUd94cM7xAIOQJrx2XK/YPCfRkKRN1wxzAhYdIVkaaKDVhI8Jeu+H18QOa6
+5OlzzZcqJCtACpbVqLaDcmq8pRrAYekiwMIKwC95llvktjilvLfoUnQoXAaX8E8B
+yCSUvDh3AQKBgQCxa0h04DLho4Da/D3HdmHHERF3bAqoEPCh0wTF5MsjRNLzY6yI
+mq11w/hni77C3mOF0SKRrh7xpcZiQfhHBx12EfpVLjfq5uraYe0LFHanol87G6bf
+I8Oy6Z/geNW2W1YktqHUGGpRCL0z5nUe1FyrOpv2431Ibbbcj73A6JipFQKBgHdl
+vJyWpk73+AQe1JUnFIU4oYd5ZQpeRd9n8m5x5ru4+jPKSi2I3lcOTWvlrqU2Dwc8
+ZEUIhV3/qUsmYxy1p7ft5NnGO912NGhtYqjWmcEk2wsmVr17C99JpniC4OAik4G1
+wWm6bIPsSGFGCb4pcROQlIY+7O6WkxqEDnM4ITcBAoGAHXBKmadFpupUeGSkCwEo
+/VjeI4QoKKcWj9K8z8ifCVPz1FiQ1AJ91WMTM7PAmpEDX058Hor9xxJ2bEtQFwUS
+QKvjeU+/Ig0TWjsJBgBPvc0xYLaJptAbjvG4a5nBn7hwbRzLTcKx2OVTmdAkz00H
+1lq8cwizfwNgt8ldFFDDRvw=
 -----END PRIVATE KEY-----

travis-build-scripts/push.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# © Copyright IBM Corporation 2019, 2020
+# © Copyright IBM Corporation 2019, 2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -32,11 +32,9 @@ function push_developer {
 }
 
 function push_production {
-    if [[ "$ARCH" = "amd64" || "$ARCH" = "s390x" ]] ; then
-        echo 'Pushing Production image...' && echo -en 'travis_fold:start:push-advancedserver\\r'
-        make push-advancedserver
-        echo -en 'travis_fold:end:push-advancedserver\\r'
-    fi
+    echo 'Pushing Production image...' && echo -en 'travis_fold:start:push-advancedserver\\r'
+    make push-advancedserver
+    echo -en 'travis_fold:end:push-advancedserver\\r'
 }
 
 # call relevant push function

travis-build-scripts/run.sh

@@ -18,6 +18,9 @@ set -e
 
 if [ "$(uname -m)" = "x86_64" ] ; then export ARCH="amd64" ; else export ARCH=$(uname -m) ; fi
 
+# if DOCKER_USER is set, authenticate with docker.io to mitigate rate limit (https://www.docker.com/increase-rate-limits)
+if [ -n "$DOCKER_USER" ] ; then echo 'Authenticating with docker.io...' && docker login -u $DOCKER_USER -p $DOCKER_PASS docker.io ; fi
+
 if [ "$PUSH_MANIFEST_ONLY" = true ] ; then
   echo 'Retrieving remote tagcache' && echo -en 'travis_fold:start:retrieve-tag-cache\\r'
   ./travis-build-scripts/artifact-util.sh -c ${CACHE_PATH} -u ${REPOSITORY_USER} -p ${REPOSITORY_CREDENTIAL} -f cache/${TAGCACHE_FILE} -l ./.tagcache --get