build.gradle

// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0

import groovy.xml.*

plugins {
    id 'java'
    id 'maven-publish'
    id 'signing'
    id "com.diffplug.spotless" version "6.18.0"
    id "com.google.osdetector" version "1.7.0"
    id "io.github.gradle-nexus.publish-plugin" version "1.1.0"
}

group = 'software.amazon.cryptools'
version = '2.5.0'
ext.isExperimentalFips = Boolean.getBoolean('EXPERIMENTAL_FIPS')
if (ext.isExperimentalFips) {
    ext.isFips = true
} else {
    ext.isFips = Boolean.getBoolean('FIPS')
}

if (ext.isExperimentalFips || !ext.isFips) {
    // Experimental FIPS uses the same AWS-LC version as non-FIPS builds.
    ext.awsLcGitVersionId = 'v1.42.0'
} else {
    ext.awsLcGitVersionId = 'AWS-LC-FIPS-3.0.0'
}

// Check for user inputted git version ID.
if (System.properties["AWSLC_GITVERSION"]) {
    ext.awsLcGitVersionId = System.properties["AWSLC_GITVERSION"]
}

ext.isLegacyBuild = Boolean.getBoolean('LEGACY_BUILD')

ext.lcovIgnore = System.properties['LCOV_IGNORE']
if (ext.lcovIgnore == null) {
    ext.lcovIgnore = 'source'
}

def getDescriptionForPom(isFips) {
    if (!isFips) {
        return [
            'The Amazon Corretto Crypto Provider (ACCP) is a collection of high-performance',
            'cryptographic implementations exposed via standard JCA/JCE interfaces.',
            'ACCP uses AWS-LC to implement its cryptographic operations.',
            'You can find the version of AWS-LC used with each version of ACCP here:',
            'https://github.com/corretto/amazon-corretto-crypto-provider/blob/main/README.md#notes-on-accp-fips',
        ].join(" ")
    }

    return [
        'The Amazon Corretto Crypto Provider FIPS (ACCP-FIPS) is a collection',
        'of high-performance cryptographic implementations exposed via standard',
        'JCA/JCE interfaces.',
        'ACCP-FIPS uses AWS-LC built in FIPS mode to implement its cryptographic',
        'operations, and is subject to the same compliance conditions as AWS-LC-FIPS.',
        'Please refer to AWS-LC documentation and your local compliance team for guidance.',
        'You can find the version of AWS-LC-FIPS used with each version of ACCP FIPS here:',
        'https://github.com/corretto/amazon-corretto-crypto-provider/blob/main/README.md#notes-on-accp-fips',
    ].join(" ")

}

spotless {
  java {
    target 'src/**/*.java', 'tst/**/*.java'
    licenseHeaderFile 'build-tools/license-headers/LicenseHeader.java'
    googleJavaFormat().reflowLongStrings()
  }

  // clang-format is difficult to configure across all of our platforms so we
  // avoid being really strict about enforcing it in our build for now. version
  // 17.x has a bug, so skip that version.
  def clangFormatVersion = getClangFormatVersion()
  if (!clangFormatVersion.equals('') && clangFormatVersion.indexOf('17') < 0) {
    cpp {
        target 'csrc/*'
        licenseHeaderFile 'build-tools/license-headers/LicenseHeader.h'
        clangFormat(clangFormatVersion)
    }
  }
}

/**
    Spotless depends on shelling out to the OS's clang-format binary which is
    stubbornly non-uniform in both version and version string across all
    native package managers. Work around this by shelling out and extracting
    the version string.
 */
def getClangFormatVersion() {
    def version_command = 'clang-format --version'
    def shell_output = new ByteArrayOutputStream()
    exec {
        commandLine "bash", "-c", version_command
        standardOutput = shell_output
        ignoreExitValue true
    }
    def shell_output_string = shell_output.toString().trim()
    def matcher = shell_output_string =~ /version ([\w\.-]+)/
    if (matcher.find()) {
        return matcher.group(1)
    } else {
        return ''
    }
}

def awslcSrcPath = "${projectDir}/aws-lc/"

// Check for user inputted AWS-LC source directory. 
if (System.properties["AWSLC_SRC_DIR"]) {
    awslcSrcPath = System.properties["AWSLC_SRC_DIR"]
}

// Execute cmake3 command to see if it exists. Mainly to support AL2.
def detect_cmake3 = {
    def exec_cmake3 = exec {
        executable "bash" args "-l", "-c", 'command -v cmake3'
        ignoreExitValue true
        standardOutput = new ByteArrayOutputStream()
        errorOutput = standardOutput
    }
    if(exec_cmake3.getExitValue() == 0) {
        return "cmake3"
    }
    return "cmake"
}

def cmakeBin = detect_cmake3()

ext.isJceSigned = { pathToJar ->
    def stdout = new ByteArrayOutputStream()
    exec {
        executable "jarsigner"
        args "-verify", pathToJar
        standardOutput = stdout;
    }
    return stdout.toString().contains("jar verified")
}

ext.assertJceSigned = { pathToJar ->
    if (!isJceSigned(pathToJar)) {
        ant.fail("${pathToJar} is not signed")
    } else {
        println "${pathToJar} is signed"
    }
    return pathToJar
}

configurations {
    jacocoAgent
    testDep {
        extendsFrom(jacocoAgent)
        attributes {
            // Make sure gradle knows to resolve the dependency which actually has the code
            attribute(Bundling.BUNDLING_ATTRIBUTE, objects.named(Bundling, 'external'))
        }
    }
    stagingJar
    testRunner {
        attributes {
            // Make sure gradle knows to resolve the dependency which actually has the code
            attribute(Bundling.BUNDLING_ATTRIBUTE, objects.named(Bundling, 'external'))
        }
    }
}

repositories {
    mavenCentral {}
}

dependencies {
    // Separate so we can extract the jar for the agent specifically
    jacocoAgent group: 'org.jacoco', name: 'org.jacoco.agent', version: '0.8.7', classifier: 'runtime'

    // Separate so we can extract the jar for the runner specifically
    testRunner group: 'org.junit.platform', name: 'junit-platform-console-standalone', version: '1.8.2'

    testDep 'org.apiguardian:apiguardian-api:1.1.2'
    testDep 'org.junit.jupiter:junit-jupiter:5.8.2'
    testDep 'org.junit.vintage:junit-vintage-engine:5.8.2'
    testDep 'org.bouncycastle:bcprov-debug-jdk15on:1.69'
    testDep 'org.bouncycastle:bcpkix-jdk15on:1.69'
    testDep 'commons-codec:commons-codec:1.12'
    testDep 'org.hamcrest:hamcrest:2.1'
    testDep 'org.jacoco:org.jacoco.core:0.8.3'
    testDep 'org.jacoco:org.jacoco.report:0.8.3'
}

defaultTasks 'release'

task buildAwsLc {
    def sharedObjectOutDir = "${buildDir}/awslc/bin"
    def cMakeBuildDir = "${buildDir}/awslc/build"
    outputs.dir("${sharedObjectOutDir}")

    doFirst {
        if (file(awslcSrcPath).list().size() == 0) {
            if (System.properties["AWSLC_SRC_DIR"]) {
                throw new GradleException("aws-lc dir empty! specify another directory or populate with aws-lc source files.")
            } else {
                throw new GradleException("aws-lc dir empty! run 'git submodule update --init --recursive' to populate.")
            }
        }

        if (!isLegacyBuild) {
            exec {
                workingDir awslcSrcPath
                commandLine "git", "fetch", "--tags"
            }
            exec {
                workingDir awslcSrcPath
                commandLine "git", "checkout", awsLcGitVersionId
            }
        }
        mkdir "${buildDir}/awslc"
        mkdir sharedObjectOutDir
        mkdir cMakeBuildDir
    }

    doLast {
        // TODO: Remove this when we finally deprecate gcc4.1.2/Cmake 3.9 internally.
        // Behavior of how older versions of Cmake take in the the build and source
        // directory arguments is slightly different.
        // FIPS isn't tested for this dimension. The only thing we care about for the
        // legacy build is non C++11 and CMake 3.9 compatibility.
        if (isLegacyBuild) {
            exec {
                workingDir cMakeBuildDir
                executable cmakeBin
                args "-DBUILD_TESTING=OFF"
                args "-DBUILD_LIBSSL=OFF"
                args "-DCMAKE_BUILD_TYPE=Debug"
                args "-DMY_ASSEMBLER_IS_TOO_OLD_FOR_AVX=ON"
                args "-std=gnu99"
                args "-fgnu89-inline"
                args "-DCMAKE_INSTALL_PREFIX=${sharedObjectOutDir}"
                args "-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON"
                args "-DLEGACY_BUILD=ON"

                args "${awslcSrcPath}"
            }
        }
        else {
            exec {
                workingDir awslcSrcPath
                executable cmakeBin
                args "-B${cMakeBuildDir}"
                args '-DCMAKE_BUILD_TYPE=RelWithDebInfo'
                args "-DCMAKE_INSTALL_PREFIX=${sharedObjectOutDir}"
                args "-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON"


                if (isFips) {
                    args '-DFIPS=1'
                }

                args '.'
            }
        }
        exec {
            workingDir awslcSrcPath
            commandLine 'make', '-j', Runtime.runtime.availableProcessors(), '-C', "${cMakeBuildDir}", 'install'
        }
    }
}

def getStagedArtifact(platformClassifier, destDir) {
    def projectName = isFips ? project.name + "-FIPS" : project.name
    def prebuiltJarFileName = "${projectName}-${version}-${platformClassifier}.jar"

    println "Platform " + platformClassifier
    def stagingProperties = new Properties()
    if (isFips) {
        stagingProperties.load(new java.io.FileInputStream("${System.env.CODEBUILD_SRC_DIR_Stage_FIPS}/fake_maven/staging.properties"));
    } else {
        stagingProperties.load(new java.io.FileInputStream("${System.env.CODEBUILD_SRC_DIR_Stage}/fake_maven/staging.properties"));
    }

    println "Loaded staging id is " + stagingProperties['staging.id']
    def repoBase = "https://aws.oss.sonatype.org/content/repositories/" + stagingProperties['staging.id']
    mkdir "${destDir}"
    exec {
        workingDir "${destDir}"
        commandLine 'wget', "${repoBase}/software/amazon/cryptools/${projectName}/${version}/${prebuiltJarFileName}"
    }

    return assertJceSigned("${destDir}/${prebuiltJarFileName}")
}

task downloadStagedJar() {
    doLast {
        getStagedArtifact(project.property('platform'), project.property('destDir'))
    }
}

task executeCmake(type: Exec) {
    outputs.dir("${buildDir}/cmake")
    inputs.dir("${buildDir}/awslc/bin/")
    inputs.dir("${projectDir}/src")
    inputs.dir("${projectDir}/tst")
    inputs.dir("${projectDir}/csrc")
    inputs.dir("${projectDir}/CMake")
    inputs.dir("${projectDir}/etc")
    inputs.dir("${projectDir}/extra-jar-files")
    inputs.dir("${projectDir}/test-data")
    inputs.dir("${projectDir}/template-src")

    dependsOn buildAwsLc

    workingDir "${buildDir}/cmake"
    def prebuiltJar = null
    def projectName = isFips ? project.name + "-FIPS" : project.name
    def prebuiltJarFileName = "${projectName}-${version}-${osdetector.classifier}.jar"
    if (System.properties['stagingProperties'] != null) {
        prebuiltJar = getStagedArtifact(osdetector.classifier, "${buildDir}/tmp")
    } else if (System.properties['prebuiltJar'] != null) {
        prebuiltJar = "${projectDir}/" + System.properties['prebuiltJar']
    } else if (System.properties['fakeMaven'] != null) {
        def fakeMavenBase
        if (isFips) {
            fakeMavenBase = System.env.CODEBUILD_SRC_DIR_Stage_FIPS
        } else {
            fakeMavenBase = System.env.CODEBUILD_SRC_DIR_Stage
        }
        fakeMavenBase = "${fakeMavenBase}/fake_maven"
        prebuiltJar = "${fakeMavenBase}/${prebuiltJarFileName}"
    } else if (System.properties['downloadedStagedJar'] != null) {
        prebuiltJar = "${System.properties['downloadedStagedJar']}/${prebuiltJarFileName}"
    }

    executable cmakeBin
    args "-DTEST_CLASSPATH=${configurations.testDep.asPath}", "-DJACOCO_AGENT_JAR=${configurations.jacocoAgent.singleFile}"
    args "-DOPENSSL_ROOT_DIR=${buildDir}/awslc/bin", '-DCMAKE_BUILD_TYPE=Release', '-DPROVIDER_VERSION_STRING=' + version
    args "-DTEST_RUNNER_JAR=${configurations.testRunner.singleFile}"
    args "-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON"
    if (isFips) {
        args "-DFIPS=ON"
    }
    if (isExperimentalFips) {
        args '-DEXPERIMENTAL_FIPS=ON'
    }

    if (prebuiltJar != null) {
       args '-DSIGNED_JAR=' + prebuiltJar
       println "Using SIGNED_JAR=${prebuiltJar}"
    }

    if (System.properties['JAVA_HOME'] != null) {
        args '-DJAVA_HOME=' + System.properties['JAVA_HOME']
    }

    if (System.properties['TEST_JAVA_HOME'] != null) {
        args '-DTEST_JAVA_HOME=' + System.properties['TEST_JAVA_HOME']
    }
    if (System.properties['TEST_JAVA_MAJOR_VERSION'] != null) {
        args '-DTEST_JAVA_MAJOR_VERSION=' + System.properties['TEST_JAVA_MAJOR_VERSION']
    }
    if (System.properties['SINGLE_TEST'] != null) {
        args '-DSINGLE_TEST=' + System.properties['SINGLE_TEST']

    }
    if (System.properties['USE_CLANG_TIDY'] != null) {
        args '-DUSE_CLANG_TIDY=' + System.properties['USE_CLANG_TIDY']

    }
    args projectDir
}

task build_objects {
    dependsOn executeCmake
    inputs.file("${buildDir}/cmake/Makefile")
    outputs.file("${buildDir}/cmake/AmazonCorrettoCryptoProvider.jar")

    doLast {
      exec {
        workingDir "${buildDir}/cmake"

        commandLine 'make', '-j', Runtime.runtime.availableProcessors(), 'accp-jar'
      }
    }
}

task build(overwrite:true) {
    dependsOn build_objects
    outputs.file("${buildDir}/lib/AmazonCorrettoCryptoProvider.jar")
    doLast {
        mkdir "${buildDir}/lib"
        if (project.hasProperty('jcecertAlias')) {
            ant.signjar(
                alias: jcecertAlias,
                jar: "${buildDir}/cmake/AmazonCorrettoCryptoProvider.jar",
                destDir: "${buildDir}/lib",
                storepass: "${System.env.KEYSTORE_PASSWORD}" ,
                keystore: "${project.gradle.gradleUserHomeDir}/${jcecertJks}",
                tsaurl: "http://timestamp.digicert.com"
            )
        } else {
            copy {
                from("${buildDir}/cmake") {
                    include 'AmazonCorrettoCryptoProvider.jar'
                }
                into "${buildDir}/lib"
            }
        }
    }
}

task emptyJar(type: Jar) {
    archiveFileName = 'empty.jar'
    archiveClassifier = null
    destinationDirectory = file("${buildDir}/lib")
}

task accp_javadoc(type: Jar) {
    dependsOn executeCmake
    doFirst {
        mkdir "${buildDir}/lib"
        exec {
            workingDir "${buildDir}/cmake"
            commandLine 'make', 'javadoc'
        }
    }
    archiveFileName = 'AmazonCorrettoCryptoProvider-javadoc.jar'
    archiveClassifier = 'javadoc'
    destinationDirectory = file("${buildDir}/lib")
    from "${buildDir}/cmake/javadoc/AmazonCorrettoCryptoProvider/"
}
javadoc.dependsOn accp_javadoc

task src_jar {
    dependsOn executeCmake
    outputs.file("${buildDir}/lib/AmazonCorrettoCryptoProvider-sources.jar")
    doLast {
        mkdir "${buildDir}/lib"
        exec {
            workingDir "${buildDir}/cmake"
            commandLine 'make', 'accp-jar-source'
        }
        copy {
            from("${buildDir}/cmake") {
                include 'AmazonCorrettoCryptoProvider-sources.jar'
            }
            into "${buildDir}/lib"
        }
    }
}

task test_extra_checks_exec(type: Exec) {
    dependsOn executeCmake
    workingDir "${buildDir}/cmake"
    commandLine 'make', 'check-junit-extra-checks'

}

task test_extra_checks(type: Copy) {
    doFirst {
        mkdir "${buildDir}/reports/unit-tests"
    }
    dependsOn test_extra_checks_exec
    from "${buildDir}/cmake/unit-tests/"
    into "${buildDir}/reports/unit-tests"
}

task test_exec(type: Exec) {
    dependsOn executeCmake
    workingDir "${buildDir}/cmake"
    commandLine 'make', 'check'
}

task unit_tests(type: Copy) {
    doFirst {
        mkdir "${buildDir}/reports/unit-tests"
    }
    dependsOn test_exec
    from "${buildDir}/cmake/unit-tests/"
    into "${buildDir}/reports/unit-tests"
}
test.dependsOn unit_tests

task single_test(type: Exec) {
    dependsOn executeCmake
    workingDir "${buildDir}/cmake"
    commandLine 'make', 'check-junit-single'
}

task test_integration_exec(type: Exec) {
    dependsOn executeCmake
    workingDir "${buildDir}/cmake"
    commandLine 'make', 'check-integration'
}

task test_integration(type: Copy) {
    doFirst {
        mkdir "${buildDir}/reports/integration-tests"
    }
    dependsOn test_integration_exec
    from "${buildDir}/cmake/integration-tests/"
    into "${buildDir}/reports/integration-tests"
}

task test_integration_extra_checks(type: Exec) {
    dependsOn executeCmake
    workingDir "${buildDir}/cmake"
    commandLine 'make', 'check-integration-extra-checks'
}

task coverage_clean(type: Delete) {
    delete fileTree("${buildDir}/cmake-coverage") {
        include '**/*.gcda'
    }
    delete "${buildDir}/reports/cpp"
}

task coverage_cmake(type: Exec) {
    dependsOn coverage_clean, buildAwsLc
    doFirst {
        if (System.properties['prebuiltJar'] != null) {
            ant.fail("Cannot run coverage with a prebuilt jar")
        }
        mkdir "${buildDir}/cmake-coverage"
    }
    workingDir "${buildDir}/cmake-coverage"
    executable cmakeBin
    args "-DTEST_CLASSPATH=${configurations.testDep.asPath}"
    args "-DJACOCO_AGENT_JAR=${configurations.jacocoAgent.singleFile}"
    args "-DOPENSSL_ROOT_DIR=${buildDir}/awslc/bin"
    args '-DCMAKE_BUILD_TYPE=Coverage', '-DCOVERAGE=ON', '-DENABLE_NATIVE_TEST_HOOKS=ON'
    args '-DPROVIDER_VERSION_STRING=' + version, projectDir
    args "-DTEST_RUNNER_JAR=${configurations.testRunner.singleFile}"
    args "-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON"
    if (isLegacyBuild) {
        args "-DLEGACY_BUILD=ON"
    }
    if (isFips) {
        args "-DFIPS=ON"
    }
    if (isExperimentalFips) {
        args '-DEXPERIMENTAL_FIPS=ON'
    }

    if (System.properties['JAVA_HOME'] != null) {
        args '-DJAVA_HOME=' + System.properties['JAVA_HOME']
    }

    if (System.properties['SINGLE_TEST'] != null) {
        args '-DSINGLE_TEST=' + System.properties['SINGLE_TEST']

    }
}

task coverage_exec(type: Exec) {
    dependsOn coverage_cmake, coverage_clean
    doFirst {
        if (System.properties['prebuiltJar'] != null) {
            ant.fail("Cannot run coverage with a prebuilt jar")
        }
    }
    workingDir "${buildDir}/cmake-coverage"
    commandLine 'make', 'coverage'
}

task coverage_java_report(type: Copy) {
    doFirst {
        mkdir "${buildDir}/reports/java"
    }
    dependsOn coverage_exec

    from "${buildDir}/cmake-coverage/coverage/results/html/"
    into "${buildDir}/reports/java"
}

task coverage_cpp_report {
    dependsOn coverage_exec
    doFirst {
        mkdir "${buildDir}/reports/cpp"
    }
    doLast {
        exec {
            workingDir "${buildDir}/cmake-coverage"
            commandLine 'lcov', '--capture', '--directory', "${buildDir}/cmake-coverage/CMakeFiles/amazonCorrettoCryptoProvider.dir/csrc", '--output-file', "${buildDir}/cmake-coverage/coverage.info", '--rc', 'lcov_branch_coverage=1', '--ignore-errors', lcovIgnore
        }
        // Convert absolute to relative paths
        exec {
            workingDir "${buildDir}/cmake-coverage"
            commandLine 'perl', '-i', '-pe', "s[^SF:${projectDir}/*][SF:]", "${buildDir}/cmake-coverage/coverage.info"
        }
        // lcov captures coverage data for inline functions in system headers; strip this out to avoid
        // polluting our metrics with unused STL code.
        exec {
            workingDir "${buildDir}/cmake-coverage"
            commandLine 'lcov', '-e', "${buildDir}/cmake-coverage/coverage.info", 'csrc/*', '--rc', 'lcov_branch_coverage=1', '--ignore-errors', lcovIgnore
            standardOutput = new FileOutputStream("${buildDir}/reports/cpp/coverage.info")
        }
        exec {
            workingDir "${buildDir}/cmake-coverage"
            commandLine 'gcovr', '-r', "${projectDir}", '--xml'
            standardOutput = new FileOutputStream("${buildDir}/reports/cpp/cobertura.xml")
        }
        exec {
             workingDir projectDir
             commandLine 'genhtml', '-o', "${buildDir}/reports/cpp", '--rc', 'genhtml_branch_coverage=1', "${buildDir}/reports/cpp/coverage.info", '--ignore-errors', lcovIgnore
        }
    }
}

task coverage {
    dependsOn coverage_java_report
}

task release {
    if (isLegacyBuild) {
        dependsOn build, test, javadoc, src_jar
    } else {
        dependsOn build, test, coverage, javadoc, src_jar
    }
}

task overkill {
    dependsOn test, test_extra_checks, test_integration, test_integration_extra_checks
}

task fakePublish {
     dependsOn emptyJar
     outputs.dir("${buildDir}/fake_maven")

    def x64Base = "${System.env.CODEBUILD_SRC_DIR_Linux_x64_Artifacts}/lib"
    def aarch64Base = "${System.env.CODEBUILD_SRC_DIR_Linux_aarch64_Artifacts}/lib"
    def osxX64Base = "${System.env.CODEBUILD_SRC_DIR_Osx_x64_Artifacts}/lib"
    def osxAarch64Base = "${System.env.CODEBUILD_SRC_DIR_Osx_aarch64_Artifacts}/lib"
    def newPrefix = "AmazonCorrettoCryptoProvider-${version}"
    if (isFips) {
        newPrefix = "AmazonCorrettoCryptoProvider-FIPS-${version}"
        x64Base = "${System.env.CODEBUILD_SRC_DIR_Linux_x64_Artifacts_FIPS}/lib"
        aarch64Base = "${System.env.CODEBUILD_SRC_DIR_Linux_aarch64_Artifacts_FIPS}/lib"
        osxX64Base = null
        osxAarch64Base = null
    }
    def x86Jar = "${x64Base}/AmazonCorrettoCryptoProvider.jar"
    def aarch64Jar = "${aarch64Base}/AmazonCorrettoCryptoProvider.jar"
    def osxX64Jar = "${osxX64Base}/AmazonCorrettoCryptoProvider.jar"
    def osxAarch64Jar = "${osxAarch64Base}/AmazonCorrettoCryptoProvider.jar"
    def sourceJar = "${x64Base}/AmazonCorrettoCryptoProvider-sources.jar"
    def javadocJar = "${x64Base}/AmazonCorrettoCryptoProvider-javadoc.jar"

    doLast {
        println "Running on " + osdetector.classifier
        if (!isFips) {
            println osxX64Jar
            println file(osxX64Jar).file
            println osxAarch64Jar
            println file(osxAarch64Jar).file
        }
        println aarch64Jar
        println file(aarch64Jar).file
        println x86Jar
        println file(x86Jar).file
        println sourceJar
        println file(sourceJar).file
        println javadocJar
        println file(javadocJar).file

        def destinationDir = "${buildDir}/fake_maven"
        if (!isFips) {
            copy {
                from osxX64Jar
                rename 'AmazonCorrettoCryptoProvider.jar', "${newPrefix}-osx-x86_64.jar"
                into "${destinationDir}"
            }
            copy {
                from osxAarch64Jar
                rename 'AmazonCorrettoCryptoProvider.jar', "${newPrefix}-osx-aarch_64.jar"
                into "${destinationDir}"
            }
        }
        copy {
            from aarch64Jar
            rename 'AmazonCorrettoCryptoProvider.jar', "${newPrefix}-linux-aarch_64.jar"
            into "${destinationDir}"
        }
        copy {
            from x64Base
            rename { String filename ->
                if (filename.equals("AmazonCorrettoCryptoProvider.jar")) {
                    return "${newPrefix}-linux-x86_64.jar"
                } else {
                    return filename.replace("AmazonCorrettoCryptoProvider-", "${newPrefix}-")
                }
            }
            into "${destinationDir}"
        }
        if (project.hasProperty('jcecertAlias')) {
            if (!isFips) {
                ant.signjar(
                    alias: jcecertAlias,
                    jar: "${destinationDir}/${newPrefix}-osx-x86_64.jar",
                    storepass: "${System.env.KEYSTORE_PASSWORD}",
                    keystore: "${project.gradle.gradleUserHomeDir}/${jcecertJks}",
                    tsaurl: "http://timestamp.digicert.com"
                )
                ant.signjar(
                    alias: jcecertAlias,
                    jar: "${destinationDir}/${newPrefix}-osx-aarch_64.jar",
                    storepass: "${System.env.KEYSTORE_PASSWORD}",
                    keystore: "${project.gradle.gradleUserHomeDir}/${jcecertJks}",
                    tsaurl: "http://timestamp.digicert.com"
                )

            }
            ant.signjar(
                alias: jcecertAlias,
                jar: "${destinationDir}/${newPrefix}-linux-aarch_64.jar",
                storepass: "${System.env.KEYSTORE_PASSWORD}" ,
                keystore: "${project.gradle.gradleUserHomeDir}/${jcecertJks}",
                tsaurl: "http://timestamp.digicert.com"
            )
            ant.signjar(
                alias: jcecertAlias,
                jar: "${destinationDir}/${newPrefix}-linux-x86_64.jar",
                storepass: "${System.env.KEYSTORE_PASSWORD}",
                keystore: "${project.gradle.gradleUserHomeDir}/${jcecertJks}",
                tsaurl: "http://timestamp.digicert.com"
            )
        }
        // Fake publish doesn't bother with the empty jar
    }

}

if (project.hasProperty('jcecertAlias')) {
    publishing {
        publications {
            mavenJava(MavenPublication) {
                def pomName = "Amazon Corretto Crypto Provider"
                if (isFips) {
                    artifactId = project.name + "-FIPS"
                    pomName = pomName + " (FIPS)"
                } else {
                    artifactId = project.name
                }
                def fakeMavenBase = "${buildDir}/fake_maven/${artifactId}-${version}-"
                def x86Jar = "${fakeMavenBase}linux-x86_64.jar"
                def aarch64Jar = "${fakeMavenBase}linux-aarch_64.jar"
                def osxX64Jar = "${fakeMavenBase}osx-x86_64.jar"
                def osxAarch64Jar = "${fakeMavenBase}osx-aarch_64.jar"
                def sourceJar = "${fakeMavenBase}sources.jar"
                def javadocJar = "${fakeMavenBase}javadoc.jar"
                artifact source: file(x86Jar),classifier:"linux-x86_64",extension:"jar"
                artifact source: file(aarch64Jar),classifier:"linux-aarch_64",extension:"jar"
                if (!isFips) {
                    artifact source: file(osxX64Jar),classifier:"osx-x86_64",extension:"jar"
                    artifact source: file(osxAarch64Jar),classifier:"osx-aarch_64",extension:"jar"
                }
                artifact emptyJar
                artifact source: file(javadocJar),classifier:"javadoc",extension:"jar"
                artifact source: file(sourceJar),classifier:"sources",extension:"jar"

                pom {
                    name = pomName
                    description = getDescriptionForPom(isFips)
                    url = 'https://github.com/corretto/amazon-corretto-crypto-provider'
                    licenses {
                        license {
                            name = 'The Apache License, Version 2.0'
                            url = 'http://www.apache.org/licenses/LICENSE-2.0.txt'
                        }
                    }
                    scm {
                        url = 'https://github.com/corretto/amazon-corretto-crypto-provider.git'
                        connection = 'scm:git:git@github.com:corretto/amazon-corretto-crypto-provider.git'
                        developerConnection = 'scm:git:git@github.com:corretto/amazon-corretto-crypto-provider.git'
                    }
                    developers {
                        developer {
                            id = 'amazonwebservices'
                            organization = 'Amazon Web Services'
                            organizationUrl = 'https://aws.amazon.com'
                        }
                    }
                }
            }
        }
    }

    nexusPublishing {
        repositories {
            sonatype {
                nexusUrl = uri('https://aws.oss.sonatype.org/service/local/')
                username = "${System.env.ORG_GRADLE_PROJECT_sonatypeUsername}"
                password = "${System.env.ORG_GRADLE_PROJECT_sonatypePassword}"
            }
        }
    }

    signing {
        sign publishing.publications.mavenJava
    }

    closeSonatypeStagingRepository {
        doLast {
            def idAsString = stagingRepositoryId.get()
            def fw = new java.io.FileWriter("${buildDir}/fake_maven/staging.properties")
            fw.write("staging.id=${idAsString}\n");
            fw.flush()
            fw.close()
            println "StagingId: ${idAsString}"
        }
    }

    releaseSonatypeStagingRepository {
        if (System.properties['stagingProperties']) {
            def stagingProperties = new Properties()
            if (isFips) {
                stagingProperties.load(
                    new java.io.FileInputStream("${System.env.CODEBUILD_SRC_DIR_Stage_FIPS}/fake_maven/staging.properties"));
            } else {
                stagingProperties.load(
                    new java.io.FileInputStream("${System.env.CODEBUILD_SRC_DIR_Stage}/fake_maven/staging.properties"));
            }
            println "Loaded staging id is " + stagingProperties['staging.id']
            stagingRepositoryId = stagingProperties['staging.id']
        }
    }
} else {
    task publish(overwrite: true) {
        doFirst {
            ant.fail('Insufficient configuration for publishing')
        }
    }

    task sign {
        doFirst {
            ant.fail('Insufficient configuration for signing')
        }
    }
}

task clean(overwrite: true, type: Delete) {
   delete "${buildDir}/cmake"
   delete "${buildDir}/cmake-coverage"
   delete "${buildDir}/lib"
   delete "${buildDir}/reports"
   delete "${buildDir}/publications"
}

task deep_clean(type: Delete) {
   delete buildDir
}

task cmake_clean(type: Delete) {
    delete "${buildDir}/cmake"
    delete "${buildDir}/cmake-coverage"
}

task minimal_clean(type: Delete) {
    dependsOn cmake_clean
    delete "${buildDir}/awslc/bin/lib/libcrypto.*"
    delete "${buildDir}/awslc/build/crypto/libcrypto.*"
    delete "${buildDir}/lib/*"
}

task generateEclipseClasspath {
    doLast {
        file(".classpath").withWriter { writer ->
            // Create MarkupBuilder with 4 space indent
            def xml = new MarkupBuilder(new IndentPrinter(writer, "    ", true))

            xml.doubleQuotes = true
            xml.mkp.xmlDeclaration(version: '1.0', encoding: 'utf-8')
            xml.classpath {
                classpathentry('kind': 'con', 'path': 'org.eclipse.jdt.launching.JRE_CONTAINER') {
                    attributes {
                        attribute('name': 'module', 'value': 'true')
                    }
                }
                classpathentry('kind': 'src', 'output': 'build/eclipse/src', 'path': 'src')
                classpathentry('kind': 'src', 'output': 'build/eclipse/template-src', 'path': 'template-src')
                classpathentry('kind': 'src', 'output': 'build/eclipse/tst', 'path': 'tst') {
                    attributes {
                        attribute('name': 'test', 'value': 'true')
                    }
                }
                classpathentry('kind': 'src', 'output': 'build/eclipse/src', 'path': 'build/cmake/generated-java') {
                    attributes {
                        attribute('name': 'optional', 'value': 'true')
                    }
                }
                classpathentry('kind': 'src', 'output': 'build/eclipse/src', 'path': 'build/coverage-cmake/generated-java') {
                    attributes {
                        attribute('name': 'optional', 'value': 'true')
                    }
                }

                configurations.testDep.files.each{f ->
                    classpathentry('kind': 'lib', 'path': f) {
                        attribute('name': 'test', 'value': 'true')
                    }
                }
            } // xml.classpath
        } // file.withWriter
    } // doLast
} // generateEclipseClasspath