Merge pull request #4583 from wireapp/release_2025-05-16_16_41

Release 2025-05-16 - (chart version 5.15.0)

Author: stefanwire

.github/pull_request_template.md

@@ -1,4 +1,4 @@
 ## Checklist
 
  - [ ] Add a new entry in an appropriate subdirectory of `changelog.d`
- - [ ] Read and follow the [PR guidelines](https://docs.wire.com/developer/developer/pr-guidelines.html)
+ - [ ] Read and follow the [PR guidelines](https://docs.wire.com/latest/developer/developer/pr-guidelines.html)

.github/workflows/build.yaml

@@ -4,7 +4,6 @@ on:
   pull_request:
     branches:
       - develop
-  push:
     paths:
       - 'docs/**'
       - cassandra-schema.cql
@@ -33,7 +32,7 @@ jobs:
               CURRENT_BRANCH="${GITHUB_REF#refs/heads/}"
           fi
 
-          sed -i "s|url = https://github.com/mohitrajain/wire-server.git|url = ${CURRENT_REPO_URL}|g" .gitmodules
+          sed -i "s|url = https://github.com/wireapp/wire-server.git|url = ${CURRENT_REPO_URL}|g" .gitmodules
           sed -i "s|branch = clean-wire-server-docs|branch = ${CURRENT_BRANCH}|g" .gitmodules
           
           cat .gitmodules

CHANGELOG.md

@@ -1,3 +1,81 @@
+# [2025-05-16] (Chart Release 5.15.0)
+
+## API changes
+
+
+* From API version V9 on, the `POST /domain-verification/{domain}/backend` and
+  `POST /get-domain-registration` endpoints are adjusted to also carry the
+  `webapp_url` in their payloads. The structure of these payloads changes as
+  well: The former `backend_url` and the new `webapp_url` are now combined in one
+  object in the `backend` field:
+
+  ```json
+  {
+  ...
+    "backend": {
+      "config_url": "{url}",
+      "webapp_url": "{url}"
+    }
+  }
+  ```
+
+  The same change is applied to the internal endpoints `PUT
+  /i/domain-registration` and `GET /i/domain-registration`. (#4559)
+
+
+## Features
+
+
+* Team admins can create a channel without joining (#4527, #4553)
+
+* Add adminHost setting for rabbitmq admin interface (#4581)
+
+
+## Bug fixes and other updates
+
+
+* Only forward one conversation create event to pydio (#4535, #4551)
+
+* Fixed channel permissions for external partners. They are allowed to add members if they are channel admins or if add-permissions are set to everyone. (#4534)
+
+* gundeck: Send notifications to temp clients only when there are no rabbitmq clients in the recipient list.  Before this, it was wrongly sending the notification to all recipients. (#4556)
+
+* hxt doesn't support all of unicode (it decodes utf8-encoded bytestrings as ascii-encoded using LBS.unpack).  the related code and fix are now in saml2-web-sso. (#4577)
+
+* charts/{cannon,nginz}: Add the events endpoint to nginz config (#4540, #4540)
+
+* Lazy streams were broken due to
+  https://github.com/haskell-servant/servant/pull/1781 . So, in specific cases,
+  the playload of a streamed response was realised in the application's memory
+  instead of streaming it piecewise. (#4538)
+
+* Use [multipart upload](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html) to S3 for all assets (#4548)
+
+
+## Internal changes
+
+
+* Remove wai-routes, wai-predicates deps from proxy and translate routing table and handlers to servant.  New integration tests for proxy featuring mock services. (#4525)
+
+* Include untouched base64-encoded authentication response from http request body in error messages, not some intermediate parse result. (#4570)
+
+* Move zauth logic from brig to wire-subsystems (part 1: Brig.ZAuth, simplify implementation) (#4479)
+
+* Fix Redis replication in our docker-compose env (used to run integration tests
+  locally): We allow only TLS connections to the Redis nodes. Thus, replication
+  has to use TLS as well (by default it doesn't.) (#4566)
+
+* Bump redis version used by redis-ephemeral to 6.2.16 (#4524)
+
+* The backend now verifies that new leaf nodes occurring in an MLS commit match the signature key registered by the corresponding client (#4531)
+
+
+## Federation changes
+
+
+* Federation API version V2 is finalized. (#4546)
+
+
 # [2025-04-07] (Chart Release 5.14.0)
 
 ## Release notes

Makefile

@@ -256,10 +256,16 @@ add-license:
 	@echo ""
 	@echo "you might want to run 'make formatf' now to make sure ormolu is happy"
 
+# without redirecting stdin/-out/-err, emacs does something weird that takes 3-5 seconds.
 .PHONY: treefmt
 treefmt:
-	treefmt -u debug --walk=git
- 
+	tempdir=$$(mktemp -d); \
+	  trap "rm -rf $$tempdir" EXIT; \
+	  treefmt -u debug --walk=git </dev/null >$$tempdir/treefmt.tmp 2>&1; \
+	  exit_code=$$?; \
+	  cat $$tempdir/treefmt.tmp; \
+	  exit $$exit_code
+
 .PHONY: treefmt-check
 treefmt-check:
 	treefmt --fail-on-change -u debug --walk=git

cassandra-schema.cql

@@ -565,7 +565,8 @@ CREATE TABLE brig_test.domain_registration (
     idp_id uuid,
     ownership_token_hash blob,
     team uuid,
-    team_invite int
+    team_invite int,
+    webapp_url blob
 ) WITH bloom_filter_fp_chance = 0.01
     AND caching = {'keys': 'ALL', 'rows_per_partition': 'NONE'}
     AND comment = ''

charts/background-worker/templates/configmap.yaml

@@ -36,6 +36,7 @@ data:
       port: {{ .port }}
       vHost: {{ .vHost }}
       {{- if $.Values.config.enableFederation }}
+      adminHost: {{ default .host .adminHost }}
       adminPort: {{ .adminPort }}
       {{- end }}
       enableTls: {{ .enableTls }}

charts/cannon/values.yaml

@@ -100,6 +100,10 @@ nginx_conf:
       envs:
       - all
       use_websockets: true
+    - path: /events
+      envs:
+      - all
+      use_websockets: true
 
 # FUTUREWORK: allow resources for cannon and nginz to be different
 resources:

charts/gundeck/values.yaml

@@ -21,7 +21,6 @@ config:
   rabbitmq:
     host: rabbitmq
     port: 5672
-    adminPort: 15672
     vHost: /
     enableTls: false
     insecureSkipVerifyTls: false

charts/integration/templates/configmap.yaml

@@ -77,6 +77,7 @@ data:
     rabbitmq:
       host: rabbitmq
       port: 5671
+      adminHost: rabbitmq
       adminPort: 15671
       enableTls: true
       insecureSkipVerifyTls: true
@@ -85,12 +86,14 @@ data:
     rabbitmq-v0:
       host: rabbitmq.wire-federation-v0.svc.cluster.local
       port: 5671
+      adminHost: rabbitmq.wire-federation-v0.svc.cluster.local
       adminPort: 15672
       vHost: /
 
     rabbitmq-v1:
       host: rabbitmq.wire-federation-v1.svc.cluster.local
       port: 5671
+      adminHost: rabbitmq.wire-federation-v1.svc.cluster.local
       adminPort: 15672
       vHost: /
 
@@ -257,5 +260,48 @@ data:
         port: 8080
       rabbitMqVHost: /
 
+    federation-v2:
+      originDomain: federation-test-helper.wire-federation-v2.svc.cluster.local
+      brig:
+        host: brig.wire-federation-v2.svc.cluster.local
+        port: 8080
+      cannon:
+        host: cannon.wire-federation-v2.svc.cluster.local
+        port: 8080
+      cargohold:
+        host: cargohold.wire-federation-v2.svc.cluster.local
+        port: 8080
+      federatorInternal:
+        host: federator.wire-federation-v2.svc.cluster.local
+        port: 8080
+      federatorExternal:
+        host: federator.wire-federation-v2.svc.cluster.local
+        port: 8081
+      galley:
+        host: galley.wire-federation-v2.svc.cluster.local
+        port: 8080
+      gundeck:
+        host: gundeck.wire-federation-v2.svc.cluster.local
+        port: 8080
+      nginz:
+        host: nginz-integration-http.wire-federation-v2.svc.cluster.local
+        port: 8080
+      spar:
+        host: spar.wire-federation-v2.svc.cluster.local
+        port: 8080
+      proxy:
+        host: proxy.wire-federation-v2.svc.cluster.local
+        port: 8080
+      backgroundWorker:
+        host: backgroundWorker.wire-federation-v2.svc.cluster.local
+        port: 8080
+      stern:
+        host: stern.wire-federation-v2.svc.cluster.local
+        port: 8080
+      wireServerEnterprise:
+        host: wireServerEnterprise.wire-federation-v2.svc.cluster.local
+        port: 8080
+      rabbitMqVHost: /
+
     integrationTestHostName: integration-headless.{{ .Release.Namespace }}.svc.cluster.local
     cellsEventQueue: cells_events

charts/integration/templates/integration-integration.yaml

@@ -68,6 +68,14 @@ spec:
       configMap:
         name: "backoffice"
 
+    - name: "proxy-config"
+      configMap:
+        name: "proxy"
+
+    - name: "proxy-secrets"
+      secret:
+        secretName: "proxy"
+
     - name: "nginz-config"
       configMap:
         name: "nginz"
@@ -245,6 +253,12 @@ spec:
     - name: stern-config
       mountPath: /etc/wire/stern/conf
 
+    - name: proxy-config
+      mountPath: /etc/wire/proxy/conf
+
+    - name: proxy-secrets
+      mountPath: /etc/wire/proxy/secrets
+
     - name: nginz-config
       mountPath: /etc/wire/nginz/conf
 
@@ -360,3 +374,5 @@ spec:
       value: "1"
     - name: ENABLE_FEDERATION_V1
       value: "1"
+    - name: ENABLE_FEDERATION_V2
+      value: "1"