Merge branch 'main' into vc-mvp-2

.github/workflows/canister-tests.yml

@@ -337,12 +337,6 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      # Required by the ic-test-state-machine
-      - name: Install openssl (macos)
-        if: ${{ matrix.os == 'macos-latest' }}
-        run: |
-          brew install openssl@3
-
       - name: Download nextest
         run: |
           set -euo pipefail

.github/workflows/release-build-check.yml

@@ -17,8 +17,8 @@ jobs:
   latest-release:
     outputs:
       ref: ${{ steps.release.outputs.ref }}
-      prod_sha256: ${{ steps.release.outputs.prod_sha256 }}
-      dev_sha256: ${{ steps.release.outputs.dev_sha256 }}
+      ii_prod_sha256: ${{ steps.release.outputs.ii_prod_sha256 }}
+      archive_sha256: ${{ steps.release.outputs.archive_sha256 }}
     runs-on: ubuntu-latest
     steps:
       - name: Get latest release information
@@ -32,14 +32,18 @@ jobs:
             exit 1
           fi
           curl --silent -SL "https://github.com/dfinity/internet-identity/releases/download/$latest_release_ref/internet_identity_production.wasm.gz" -o internet_identity_production.wasm.gz
-          latest_prod_release_sha256=$(shasum -a 256 ./internet_identity_production.wasm.gz | cut -d ' ' -f1)
+          curl --silent -SL "https://github.com/dfinity/internet-identity/releases/download/$latest_release_ref/archive.wasm.gz" -o archive.wasm.gz
+          latest_release_ii_prod_sha256=$(shasum -a 256 ./internet_identity_production.wasm.gz | cut -d ' ' -f1)
+          latest_release_archive_sha256=$(shasum -a 256 ./archive.wasm.gz | cut -d ' ' -f1)
           echo latest release is "$latest_release_ref"
-          echo latest prod release sha256 is "$latest_prod_release_sha256"
+          echo latest prod release sha256 is "$latest_release_ii_prod_sha256"
+          echo latest archive release sha256 is "$latest_release_archive_sha256"
           echo "ref=$latest_release_ref" >> "$GITHUB_OUTPUT"
-          echo "prod_sha256=$latest_prod_release_sha256" >> "$GITHUB_OUTPUT"
+          echo "ii_prod_sha256=$latest_release_ii_prod_sha256" >> "$GITHUB_OUTPUT"
+          echo "archive_sha256=$latest_release_archive_sha256" >> "$GITHUB_OUTPUT"
         id: release
 
-  # Then perform the build, using the release as checkout
+  # Perform the clean build (non-docker), using the release as checkout
   clean-build:
     runs-on: ${{ matrix.os }}
     needs: latest-release
@@ -54,7 +58,7 @@ jobs:
       - uses: ./.github/actions/check-build
         with:
           # we check that ubuntu builds match the latest release build
-          sha256: ${{ startsWith(matrix.os, 'ubuntu') && needs.latest-release.outputs.prod_sha256 || '' }}
+          sha256: ${{ startsWith(matrix.os, 'ubuntu') && needs.latest-release.outputs.ii_prod_sha256 || '' }}
 
         # Since the release build check is a scheduled job, a failure won't be shown on any
         # PR status. To notify the team, we send a message to our Slack channel on failure.
@@ -64,3 +68,40 @@ jobs:
         with:
           WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
           MESSAGE: "Release build check failed"
+
+  # Verify the hash using the verify-hash script, using the release as checkout.
+  # This runs the build using docker and should work on all platforms.
+  verify-build-dockerized:
+    runs-on: ${{ matrix.os }}
+    needs: latest-release
+    strategy:
+      matrix:
+        os: [ ubuntu-22.04, ubuntu-20.04, macos-11, macos-12 ]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: "refs/tags/${{ needs.latest-release.outputs.ref }}"
+
+      - name: Setup docker (missing on MacOS)
+        if: runner.os == 'macos'
+        run: |
+          brew install docker
+          brew install docker-buildx
+          # The following 2 commands are taken from the post install instructions printed by `brew install docker-buildx` 
+          mkdir -p ~/.docker/cli-plugins
+          ln -sfn /usr/local/opt/docker-buildx/bin/docker-buildx ~/.docker/cli-plugins/docker-buildx
+          colima start
+
+      - name: "Verify Hash"
+        id: dfx-metadata
+        run: |
+          ./scripts/verify-hash --ii-hash ${{ needs.latest-release.outputs.ii_prod_sha256 }} --archive-hash ${{ needs.latest-release.outputs.archive_sha256 }}
+
+        # Since the release build check is a scheduled job, a failure won't be shown on any
+        # PR status. To notify the team, we send a message to our Slack channel on failure.
+      - name: Notify Slack on failure
+        uses: ./.github/actions/slack
+        if: ${{ failure() }}
+        with:
+          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          MESSAGE: "Verify hash check failed"

.github/workflows/update-dapps.yml

@@ -12,15 +12,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+      - uses: ./.github/actions/setup-node
+      - run: npm ci
 
       # Run the update
       - name: Check new dapps file
         id: update
         run: ./scripts/update-dapps
 
+      # Run the formatter so that the dapps.json file is formatted
+      - run: npm run format
+
       # If the dapps changed, create a PR.
+      # This action creates a PR only if there are changes.
       - name: Create Pull Request
-        if: ${{ steps.update.outputs.updated == '1' }}
         uses: peter-evans/create-pull-request@v4
         with:
           token: ${{ secrets.GIX_BOT_PAT }}

.ic-commit

@@ -1,3 +1,3 @@
 # the commit used to pull the state machine executable
 # see rust canister tests for more info
-c74ce7317761e540d722d01fa6c26a046707f372
+4918bb79b1ff24defeec0d596c60796688b5ddec

.node-version

@@ -1 +1 @@
-18.17.1
+18.18.0

demos/using-dev-build/package.json

@@ -16,7 +16,7 @@
     "@wdio/local-runner": "^8.6.9",
     "@wdio/mocha-framework": "^8.6.8",
     "@wdio/spec-reporter": "^8.6.8",
-    "chromedriver": "^115.0.0",
+    "chromedriver": "^117.0.1",
     "prettier": "^2.7.1",
     "prettier-plugin-organize-imports": "^3.2.2",
     "proxy": "git+https://github.com/nmattia/dfx-proxy",

docker-test-env/docker-compose.yml

@@ -28,14 +28,16 @@ services:
   # Selenium container with chromedriver and chrome
   selenium:
     # use the seleniarm image that provides multiple architecture variants including one for M1 chips
-    image: seleniarm/standalone-chromium:104.0
+    image: seleniarm/standalone-chromium:116.0
     ports:
       - "4444:4444" # port for the test runner to connect to chromedriver
       - "7900:7900" # port to access the page to watch what chrome is doing (http://localhost:7900, pw is secret)
     shm_size: '2gb' # allow more memory for chrome to actually render the pages
     environment: # default number of sessions is 1. We need more because of flows involving multiple devices (which we simulate using parallel sessions).
       - SE_NODE_OVERRIDE_MAX_SESSIONS=true
       - SE_NODE_MAX_SESSIONS=5
+      - SCREEN_WIDTH=1920
+      - SCREEN_HEIGHT=1080
     networks:
       - ic
 networks: