Build and Test
Proof of concept. Not for production use. The service does not authenticate callers yet, so run it only on an isolated network. All attestations and certificates it creates are for testing only.
Requirements
- JDK 25
- Maven 3.6.3 or newer
Build
mvn clean verify
HSM tests run only when SoftHSM2 is installed; CI installs it and fails instead of skipping (softhsm-test.yml, see SoftHSM2 Development Setup). The test profile uses an in-memory H2 database in tests, so tests need no database.
Dependency Vulnerability Check
An opt-in OWASP Dependency-Check scan fails the build on any dependency with CVSS 7 or higher. It is not part of the default build:
mvn -Pcve-check verify
The scan needs network access (NVD data download). An API key is recommended: set the NVD_API_KEY environment variable and pass -DnvdApiKeyEnvironmentVariable=NVD_API_KEY.
Run Locally
Prepare the configuration, start PostgreSQL, apply the migrations and the SoftHSM2 setup, then:
mvn spring-boot:run -Dspring-boot.run.profiles=dev
An IntelliJ run configuration for the dev profile is in .run/; it reads environment variables from the git-ignored local.env.
Contributing
Pull requests target develop. Commits must be signed.