v1.0.12 release

Merge pull request #38 from proconnect-gouv/deps-update
Update dependencies
2026-03-02 19:41:37 +01:00 · 2026-03-02 19:38:16 +01:00 · 2026-02-27 19:08:46 +01:00 · 2026-02-27 19:05:31 +01:00 · 2026-02-27 19:05:30 +01:00 · 2026-02-27 19:05:29 +01:00
14 changed files with 170 additions and 128 deletions
@@ -17,14 +17,14 @@ jobs:
      packages: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
@@ -36,14 +36,14 @@ jobs:
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Login to Github Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ github.token }}

      - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          target: production
@@ -59,7 +59,7 @@ jobs:
    needs:
      - build-and-push
    steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@main
+      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
        id: notify
        with:
          deployment_repo_path: "${{ github.repository }}"
@@ -16,7 +16,7 @@ jobs:
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
            fetch-depth: 0
      - name: show
@@ -39,7 +39,7 @@ jobs:
      github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
            fetch-depth: 0
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -49,7 +49,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -65,11 +65,11 @@ jobs:
        working-directory: src/satosa
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: '3.11'
+          python-version: '3.14'
      - name: Install development dependencies
        run: |
          # Python's xmlsec requirement
@@ -89,11 +89,11 @@ jobs:
        working-directory: src/satosa
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
-          python-version: '3.11'
+          python-version: '3.14'
      - name: Install development dependencies
        run: |
          # Python's xmlsec requirement
@@ -110,7 +110,7 @@ jobs:
      image: ghcr.io/helmfile/helmfile:v1.2.0
    steps:
      -
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
@@ -119,7 +119,7 @@ jobs:
          repositories: secrets
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          submodules: recursive
          token: ${{ steps.app-token.outputs.token }}
@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [1.0.12] - 2026-03-02
+- upgrade dependencies: Python 3.14.3, gunicorn 25.1.0…
+
+## [1.0.11] - 2025-11-24
+- remove setuptools, wheel and pip from production Docker image
+
 ## [1.0.10] - 2025-11-21
 - rename helmfile.yaml for compatibility with helmfile 1.x

@@ -1,13 +1,17 @@
 # ---- base image to inherit from ----
-FROM python:3.11.12-slim-bookworm AS common
+FROM python:3.14.3-slim-trixie AS common

 # Install xmlsec1 dependencies required for xmlsec (for SAML)
 # Needs to be kept before the `pip install`
-RUN apt-get update && \
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
    apt-get -y upgrade && \
    apt-get install -qy --no-install-recommends xmlsec1 && \
    rm -rf /var/lib/apt/lists/*

+# Silence pip warnings about running as root in a container
+ENV PIP_ROOT_USER_ACTION=ignore
+
 # We want the most up-to-date stable pip release
 RUN pip install --upgrade pip

@@ -37,6 +41,10 @@ CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"]
 # ---- Development image ----
 FROM common AS development

+# Install curl (for healthchecks)
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && apt-get install -qy curl
+
 # Playwright browsers
 ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers
 RUN pip install playwright
@@ -68,7 +76,8 @@ COPY ./src/satosa /app/

 WORKDIR /app

-RUN pip install .
+# Uninstall pip, setuptools and wheel after installation to reduce attack surface
+RUN pip install . && pip uninstall -y setuptools wheel pip

 # Switch to unprivileged user
 USER ${DOCKER_USER}
@@ -30,7 +30,7 @@ services:
          }
        }
      SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-      SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
+      SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/idps.xml
      SAML2_ENTITY_ID: https://satosa.traefik.me/Saml2/proxy_saml2_backend.xml
    env_file:
      - env.d/development/common
@@ -40,6 +40,13 @@ services:
      - ./docker/files/usr/local/etc/gunicorn/satosa.py:/usr/local/etc/gunicorn/satosa.py
    depends_on:
      - redis
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "http://localhost:8000/ping"]
+      interval: 60s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+      start_interval: 1s

  oidc-test-client:
    build: docker/oidc-test-client
@@ -1,4 +1,4 @@
-FROM python:3.11
+FROM python:3.14

 COPY . /app

@@ -12,7 +12,7 @@ satosa:
    LOG_LEVEL: debug

    SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/idps.xml
    SAML2_ENTITY_ID:  https://oidc2fer.127.0.0.1.nip.io/Saml2/proxy_saml2_backend.xml

    STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }
@@ -1,7 +1,7 @@
 image:
  repository: ghcr.io/proconnect-gouv/oidc2fer
  pullPolicy: Always
-  tag: "v1.0.10"
+  tag: "v1.0.11"

 satosa:
  replicas: 2
@@ -13,7 +13,7 @@ satosa:
    LOG_LEVELS: '{ "satosa.backends.saml2": "DEBUG" }'

    SAML2_DISCOVERY_URL: https://discovery.renater.fr/agentconnect/
-    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/renater/main/main-idps-renater-metadata.xml
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/fer/idps.xml
    SAML2_ENTITY_ID:  https://renater.agentconnect.gouv.fr/Saml2/proxy_saml2_backend.xml

    STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }
@@ -24,92 +24,110 @@ satosa:

    OIDC_DB_URI: { secretKeyRef: { name: redis.redis.libre.sh, key: url } }

-    # As provided by RENATER on 2025-09-19
+    # As provided by RENATER
    SIRET_MAP: |-
      {
-        "https://shibboleth.grenoble-inp.fr/idp/shibboleth": "19381912500017",
-        "https://identites.ensea.fr/idp/shibboleth": "19951376300011",
-        "https://idp.ent.dauphine.fr/idp/shibboleth": "19754692200018",
-        "https://idp.univ-lyon2.fr/idp/shibboleth": "19691775100014",
-        "https://shibboleth.insa-rouen.fr/idp/shibboleth": "19760165100023",
-        "https://idp1.univ-fcomte.fr/idp/shibboleth": "93810656400017",
-        "https://idp.univ-tours.fr/idp/shibboleth": "19370800500478",
+        "http://idp.univ-poitiers.fr": "19860856400375",
        "https://apps.univ-lr.fr/idp/shibboleth": "19170032700015",
-        "https://shib.mines-albi.fr/idp/shibboleth": "18009202500097",
+        "https://auth.sso.vet-alfort.fr/saml/metadata": "19940608300014",
+        "https://auth.uttop.fr/saml/metadata": "19650048200019",
+        "https://authentification.inrae.fr/saml/metadata/idp": "18007003901803",
+        "https://federation.ens.psl.eu/idp/shibboleth": "19753459700012",
+        "https://federation.umontpellier.fr/idp/shibboleth": "13002979600013",
+        "https://federation.unimes.fr/idp/shibboleth": "93249157400012",
        "https://federation.upf.pf/idp/shibboleth": "19987001500013",
        "https://federation.utbm.fr/idp/shibboleth": "19900356700013",
-        "urn:mace:cru.fr:federation:univ-paris1.fr": "19751717000019",
-        "https://idp.sciencespobordeaux.fr/idp/shibboleth": "19330192600039",
-        "https://vip.espci.fr/saml2/idp/metadata.php": "20000068500012",
-        "urn:mace:cru.fr:federation:univ-nantes.fr": "13002974700016",
-        "https://shibboleth.univ-corse.fr/idp/shibboleth": "19202664900264",
-        "https://srv-fii.insa-toulouse.fr/idp/shibboleth": "19310152400018",
-        "urn:mace:cru.fr:federation:univ-rouen.fr": "19761904200017",
+        "https://federation3.univ-brest.fr/idp/shibboleth": "94129831700012",
+        "https://idauthproxy.insa-lyon.fr/Saml2IDP/metadata": "19690192000013",
        "https://ident-shib.ensc-rennes.fr/idp/shibboleth": "19350077400016",
-        "urn:mace:cru.fr:federation:unilim.fr": "19870669900321",
-        "https://idp.inha.fr/idp/shibboleth": "19754688000018",
-        "https://federation.unimes.fr/idp/shibboleth": "93249157400012",
-        "urn:mace:cru.fr:federation:univ-rennes1.fr": "13003051300019",
-        "urn:mace:cru.fr:federation:univ-ubs.fr": "19561718800600",
-        "https://idp.univ-orleans.fr/idp/shibboleth": "19450855200016",
-        "https://shibboleth.univ-savoie.fr/idp/shibboleth": "19730858800015",
-        "https://idp.cirad.fr/idp/shibboleth": "33159627000016",
-        "https://sso.ird.fr/idp/shibboleth": "18000602500159",
-        "https://idp.ensma.fr/idp/shibboleth": "19860073600021",
-        "https://idp.renater.fr/idp/shibboleth": "18008947600055",
-        "https://idp.inp-toulouse.fr/idp/shibboleth": "19311381800127",
-        "https://idp.unistra.fr/idp/shibboleth": "13000545700010",
-        "https://idp1.agroparistech.fr/idp/shibboleth": "13000285000134",
-        "https://janus.cnrs.fr/idp": "18008901303720",
-        "https://federation.umontpellier.fr/idp/shibboleth": "13002979600013",
-        "https://idp.sciencespo-lyon.fr/idp/shibboleth": "19690173000024",
-        "https://shibboleth.univ-grenoble-alpes.fr/idp/shibboleth": "13002608100013",
-        "https://idp.bnu.fr/idp/shibboleth": "18004406700015",
-        "https://ruhnu.univ-tlse2.fr/idp/shibboleth": "19311383400017",
-        "https://idp2.amue.fr/idp/shibboleth": "18004312700091",
-        "https://idpv3.univ-amu.fr/idp/shibboleth": "13001533200013",
-        "https://idp-ng.univ-st-etienne.fr/idp/shibboleth": "93850168100010",
+        "https://identification.univ-toulouse.fr": "13002132200016",
+        "https://identites.ec-lyon.fr/idp/shibboleth": "19690187000010",
+        "https://identites.ensea.fr/idp/shibboleth": "19951376300011",
        "https://identities.univ-jfc.fr/idp/prod": "19811201300018",
-        "https://idp3.univ-lorraine.fr/idp/shibboleth": "13001550600012",
+        "https://idp-genci.renater.fr/idp/shibboleth": "49468697500041",
+        "https://idp-ng.univ-st-etienne.fr/idp/shibboleth": "93850168100010",
+        "https://idp-septa.onisep.fr/idp/shibboleth": "18004302800653",
+        "https://idp-v4.univ-montp3.fr/idp/shibboleth": "93249089900014",
+        "https://idp.bnu.fr/idp/shibboleth": "18004406700015",
+        "https://idp.cirad.fr/idp/shibboleth": "33159627000016",
+        "https://idp.crous-reims.fr/idp/shibboleth": "18510200100327",
+        "https://idp.ec-nantes.fr/idp/shibboleth": "19440100600011",
+        "https://idp.ehesp.fr/idp/shibboleth": "13000362700010",
+        "https://idp.ens-lyon.fr/idp/shibboleth": "13000812100019",
+        "https://idp.ensam.eu/idp/shibboleth": "19753472000010",
+        "https://idp.ensfea.fr/idp/shibboleth": "19310143300012",
+        "https://idp.ensma.fr/idp/shibboleth": "19860073600021",
+        "https://idp.ent.dauphine.fr/idp/shibboleth": "19754692200018",
+        "https://idp.imt-atlantique.fr/idp/shibboleth": "18009202500121",
+        "https://idp.inha.fr/idp/shibboleth": "19754688000018",
+        "https://idp.inp-toulouse.fr/idp/shibboleth": "19311381800127",
+        "https://idp.insa-rennes.fr/idp/shibboleth": "19350097200016",
+        "https://idp.institut-agro.fr/idp": "13002622200013",
+        "https://idp.isae.fr/idp/shibboleth": "13000427800011",
+        "https://idp.lyon.archi.fr/idp/shibboleth": "19690184700018",
+        "https://idp.renater.fr/idp/shibboleth": "18008947600055",
+        "https://idp.rennes.archi.fr/idp/shibboleth": "19350089900029",
+        "https://idp.sciencespo-lyon.fr/idp/shibboleth": "19690173000024",
+        "https://idp.sciencespobordeaux.fr/idp/shibboleth": "19330192600039",
+        "https://idp.uca.fr/idp/shibboleth": "13002806100013",
+        "https://idp.uha.fr/idp/shibboleth": "19681166500013",
+        "https://idp.unistra.fr/idp/shibboleth": "13000545700010",
+        "https://idp.univ-avignon.fr/idp/shibboleth": "19840685200204",
+        "https://idp.univ-cotedazur.fr/idp/shibboleth": "13002566100013",
+        "https://idp.univ-eiffel.fr/idp/shibboleth": "13002612300013",
        "https://idp.univ-lemans.fr/idp/shibboleth": "19720916600010",
        "https://idp.univ-lille.fr/idp/shibboleth": "13002975400012",
-        "https://idp.univ-tln.fr/idp/shibboleth": "19830766200017",
-        "https://idp.uca.fr/idp/shibboleth": "13002806100013",
-        "https://shibboleth3.utt.fr/idp/shibboleth": "19101060200032",
-        "https://idp3.ut-capitole.fr/idp/shibboleth": "13003061200019",
-        "https://idp.imt-atlantique.fr/idp/shibboleth": "18009202500121",
-        "https://shib.univ-lehavre.fr/idp/shibboleth": "19762762300097",
-        "https://idp2.univ-paris8.fr/idp/shibboleth": "19931827000014",
-        "https://shib2.unc.nc/idp/shibboleth": "13000322100012",
-        "https://upnidp2.parisnanterre.fr/idp/shibboleth": "19921204400010",
-        "https://idp.ensfea.fr/idp/shibboleth": "19310143300012",
-        "https://idp.univ-eiffel.fr/idp/shibboleth": "13002612300013",
-        "https://idp.insa-rennes.fr/idp/shibboleth": "19350097200016",
-        "https://idp.univ-tlse3.fr/idp/shibboleth": "93827139200012",
-        "https://idp.universite-paris-saclay.fr/idp": "13002602400054",
-        "https://shibboleth.ens2m.fr/idp/shibboleth": "19250082500026",
-        "https://sso-ciation-saclay.centralesupelec.fr/idp/shibboleth": "13002076100016",
-        "https://federation.ens.psl.eu/idp/shibboleth": "19753459700012",
-        "https://authentification.inrae.fr/saml/metadata/idp": "18007003901803",
-        "https://idp.ensam.eu/idp/shibboleth": "19753472000010",
-        "https://idp1.ens-paris-saclay.fr/idp/shibboleth": "19940607500036",
-        "https://idp2.emse.fr/idp/shibboleth": "18009202500105",
-        "https://idp-septa.onisep.fr/idp/shibboleth": "18004302800653",
-        "https://papangue.vetagro-sup.fr/idp/shibboleth": "13000858400018",
-        "https://multipass.imt-nord-europe.fr/idp/shibboleth": "18009202500139",
-        "https://idp4.unicaen.fr/idp/shibboleth": "19141408500016",
-        "https://sso.bordeaux-inp.fr/idp/shibboleth": "13000635600013",
-        "https://auth.uttop.fr/saml/metadata": "19650048200019",
-        "https://idp.univ-cotedazur.fr/idp/shibboleth": "13002566100013",
-        "https://idp2.brgm.fr/idp/shibboleth": "58205614900120",
-        "https://idp.crous-reims.fr/idp/shibboleth": "18510200100327",
-        "https://idp.univ-avignon.fr/idp/shibboleth": "19840685200204",
-        "https://idp-genci.renater.fr/idp/shibboleth": "49468697500041",
-        "https://auth.sso.vet-alfort.fr/saml/metadata": "19940608300014",
+        "https://idp.univ-lyon2.fr/idp/shibboleth": "19691775100014",
+        "https://idp.univ-lyon3.fr/idp/shibboleth": "19692437700282",
+        "https://idp.univ-orleans.fr/idp/shibboleth": "19450855200016",
        "https://idp.univ-perp.fr/idp/shibboleth": "19660437500010",
-        "https://idp.institut-agro.fr/idp": "13002622200013",
+        "https://idp.univ-tln.fr/idp/shibboleth": "19830766200017",
+        "https://idp.univ-tlse3.fr/idp/shibboleth": "93827139200012",
+        "https://idp.univ-tours.fr/idp/shibboleth": "19370800500478",
+        "https://idp.universite-paris-saclay.fr/idp": "13002602400054",
+        "https://idp1.agroparistech.fr/idp/shibboleth": "13000285000134",
+        "https://idp1.ens-paris-saclay.fr/idp/shibboleth": "19940607500036",
+        "https://idp1.univ-fcomte.fr/idp/shibboleth": "93810656400017",
+        "https://idp2.amue.fr/idp/shibboleth": "18004312700091",
+        "https://idp2.brgm.fr/idp/shibboleth": "58205614900120",
+        "https://idp2.emse.fr/idp/shibboleth": "18009202500105",
+        "https://idp2.univ-paris8.fr/idp/shibboleth": "19931827000014",
+        "https://idp3.univ-lorraine.fr/idp/shibboleth": "13001550600012",
+        "https://idp3.ut-capitole.fr/idp/shibboleth": "13003061200019",
+        "https://idp4.unicaen.fr/idp/shibboleth": "19141408500016",
+        "https://idpv3.univ-amu.fr/idp/shibboleth": "13001533200013",
+        "https://janus.cnrs.fr/idp": "18008901303720",
+        "https://multipass.imt-nord-europe.fr/idp/shibboleth": "18009202500139",
+        "https://papangue.vetagro-sup.fr/idp/shibboleth": "13000858400018",
        "https://prod-idp.inria.fr": "18008904700013",
-        "https://idp.ec-nantes.fr/idp/shibboleth": "19440100600011"
+        "https://ruhnu.univ-tlse2.fr/idp/shibboleth": "19311383400017",
+        "https://shib.mines-albi.fr/idp/shibboleth": "18009202500097",
+        "https://shib.univ-lehavre.fr/idp/shibboleth": "19762762300097",
+        "https://identite.univ-reims.fr/idp/shibboleth": "19511296600799",
+        "https://shib2.unc.nc/idp/shibboleth": "13000322100012",
+        "https://shibboleth.ens2m.fr/idp/shibboleth": "19250082500026",
+        "https://shibboleth.grenoble-inp.fr/idp/shibboleth": "19381912500017",
+        "https://shibboleth.insa-rouen.fr/idp/shibboleth": "19760165100023",
+        "https://shibboleth.ube.fr/idp/shibboleth": "93823061200013",
+        "https://shibboleth.univ-corse.fr/idp/shibboleth": "19202664900264",
+        "https://shibboleth.univ-evry.fr/idp/shibboleth": "19911975100014",
+        "https://shibboleth.univ-grenoble-alpes.fr/idp/shibboleth": "13002608100013",
+        "https://shibboleth.univ-savoie.fr/idp/shibboleth": "19730858800015",
+        "https://shibboleth03.chartes.psl.eu/idp/shibboleth": "19753478700043",
+        "https://shibboleth3.utt.fr/idp/shibboleth": "19101060200032",
+        "https://srv-fii.insa-toulouse.fr/idp/shibboleth": "19310152400018",
+        "https://sso-ciation-saclay.centralesupelec.fr/idp/shibboleth": "13002076100016",
+        "https://sso.bordeaux-inp.fr/idp/shibboleth": "13000635600013",
+        "https://sso.ird.fr/idp/shibboleth": "18000602500159",
+        "https://upnidp2.parisnanterre.fr/idp/shibboleth": "19921204400010",
+        "https://vip.espci.fr/saml2/idp/metadata.php": "20000068500012",
+        "urn:mace:cru.fr:federation:uhb.fr": "19350937900015",
+        "urn:mace:cru.fr:federation:unilim.fr": "19870669900321",
+        "urn:mace:cru.fr:federation:univ-nantes.fr": "13002974700016",
+        "urn:mace:cru.fr:federation:univ-paris1.fr": "19751717000019",
+        "urn:mace:cru.fr:federation:univ-rennes1.fr": "13003051300019",
+        "urn:mace:cru.fr:federation:univ-rouen.fr": "19761904200017",
+        "urn:mace:cru.fr:federation:univ-ubs.fr": "19561718800600"
      }

 ingress:
@@ -13,7 +13,7 @@ satosa:
    LOG_LEVELS: '{ "satosa.backends.saml2": "DEBUG" }'

    SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/idps.xml
    SAML2_ENTITY_ID:  https://oidc2fer-staging.beta.numerique.gouv.fr/Saml2/proxy_saml2_backend.xml-test

    STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }
@@ -30,6 +30,8 @@ releases:
      - auth:
          password: pass
        architecture: standalone
+        image:
+          repository: bitnamilegacy/redis

  - name: extra
    installed: {{ ne .Environment.Name "dev" | toYaml }}
@@ -11,23 +11,24 @@ version = "0.1.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
-    "Intended Audience :: Developers",
+    "Intended Audience :: End Users/Desktop",
+    "Intended Audience :: System Administrators",
    "License :: OSI Approved :: MIT License",
    "Natural Language :: English",
    "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.14",
 ]
-description = "An application to handle contacts and teams."
+description = "A gateway from RENATER's FER to ProConnect's OIDC provider, built on top of SATOSA."
 keywords = ["OIDC", "SAML", "Shibboleth", "FER", "RENATER"]
 license = { file = "LICENSE" }
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.14"
 dependencies = [
    "SATOSA==8.5.1",
-    "gunicorn==23.0.0",
-    "redis==5.0.4",
-    "JSON-log-formatter==1.0",
-    "WhiteNoise==6.7.0",
+    "gunicorn==25.1.0",
+    "redis==7.2.1",
+    "JSON-log-formatter==1.1.1",
+    "WhiteNoise==6.12.0",
 ]

 [project.urls]
@@ -40,18 +41,15 @@ dependencies = [
 dev = [
    "pylint==3.1.0",
    "pytest-cov==4.1.0",
-    "pytest==8.0.2",
-    "ruff==0.2.2",
-    "pytest-playwright==0.4.4",
+    "pytest==9.0.2",
+    "ruff==0.15.4",
+    "pytest-playwright==0.7.2",
 ]

 [tool.setuptools]
 packages = { find = { where = ["."], exclude = ["tests"] } }
 zip-safe = true

-[tool.distutils.bdist_wheel]
-universal = true
-
 [tool.ruff]
 exclude = [
    ".git",
@@ -1,7 +0,0 @@
-#!/usr/bin/env python
-"""Setup file for the oidc2fer module. All configuration stands in the setup.cfg file."""
-# coding: utf-8
-
-from setuptools import setup
-
-setup()
@@ -26,7 +26,8 @@ fi
 # https://github.com/kubernetes-sigs/kind/issues/2875
 # https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
 # See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
-cat <<EOF | kind create cluster --config=-
+kind --name=oidc2fer delete cluster || true
+cat <<EOF | kind --name=oidc2fer create cluster --config=-
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 containerdConfigPatches:
@@ -35,7 +36,6 @@ containerdConfigPatches:
    config_path = "/etc/containerd/certs.d"
 nodes:
 - role: control-plane
-  image: kindest/node:v1.27.3
  kubeadmConfigPatches:
  - |
    kind: InitConfiguration
@@ -50,9 +50,7 @@ nodes:
    hostPort: 443
    protocol: TCP
 - role: worker
-  image: kindest/node:v1.27.3
 - role: worker
-  image: kindest/node:v1.27.3
 EOF

 # 3. Add the registry config to the nodes
@@ -64,7 +62,7 @@ EOF
 # We want a consistent name that works from both ends, so we tell containerd to
 # alias localhost:${reg_port} to the registry container when pulling images
 REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
-for node in $(kind get nodes); do
+for node in $(kind --name=oidc2fer get nodes); do
 	docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
 	cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
 [host."http://${reg_name}:5000"]
@@ -91,6 +89,17 @@ data:
    help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
 EOF

+# Patch the CoreDNS configmap to rewrite requests for *.127.0.0.1.nip.io to the Ingress Controller service
+kubectl -n kube-system get configmap coredns -o yaml |
+  yq '.data.Corefile |= (
+        trim
+        | split("\n")
+        | .[-1] = "    rewrite name regex .*\\.127\\.0\\.0\\.1\\.nip\\.io ingress-nginx-controller.ingress-nginx.svc.cluster.local answer auto\n"
+          + .[-1]
+        | join("\n")
+      )' |
+  kubectl replace -f -
+
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
 kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
 kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'
Author	SHA1	Message	Date
Jonathan Perret	1ef50896ec	v1.0.12 release	2026-03-02 19:41:37 +01:00
Jonathan Perret	f8661c76d5	Merge pull request #38 from proconnect-gouv/deps-update Update dependencies	2026-03-02 19:38:16 +01:00
Jonathan Perret	ecfa38f11e	⬆️ (actions) upgrade and pin GitHub actions To latest stable versions.	2026-02-27 19:08:46 +01:00
Jonathan Perret	159d992783	🔧(config) add healthcheck to docker-compose This makes docker-compose up --wait work.	2026-02-27 19:05:31 +01:00
Jonathan Perret	2efaaa8281	🔨(kind) improve local cluster start script Taking some cues from what's done in other projects.	2026-02-27 19:05:30 +01:00
Jonathan Perret	f0b1c4cbc3	⬆️ (python) upgrade Python dependencies To latest stable versions.	2026-02-27 19:05:29 +01:00
Jonathan Perret	2e9dd01907	🔨(redis) fix bitnami image reference Bitnami images have moved.	2026-02-27 19:05:28 +01:00
Jonathan Perret	5f7b7ab8a8	🔥(pyproject) remove setup.py This file is not needed with a modern project structure, and since `setuptools` is no longer included in recent Python versions it causes a `pylint` failure.	2026-02-27 19:05:19 +01:00
Jonathan Perret	9994eb84b0	⬆️ (python) upgrade to Python 3.14.3 Bumping base image to avoid reported vulnerabilities.	2026-02-27 19:04:37 +01:00
Jonathan Perret	f9efafd574	🔧 (metadata) update Renater metadata URL The old URLs were decommissionned on feb. 26.	2026-02-27 14:45:11 +01:00
Jonathan Perret	208c4467df	🔐(secrets) update secrets to current main	2026-02-11 10:35:53 +01:00
Jonathan Perret	0e82e8b771	🔧(siret) fix stray space in SIRET map This was preventing EHESP users from connecting since their IdP's entity ID was not matched.	2025-12-03 23:14:01 +01:00
Jonathan Perret	798afdf2a9	Deploy release v1.0.11 to production	2025-11-24 18:06:22 +01:00
Jonathan Perret	7cf9fda7d8	v1.0.11 release	2025-11-24 18:05:40 +01:00
Jonathan Perret	1816d2a8de	Merge pull request #36 from proconnect-gouv/update-setuptools ⬆️(setuptools) remove setuptools from production Docker image	2025-11-24 18:04:18 +01:00
Jonathan Perret	c89b9b7ada	⬆️(setuptools) remove setuptools from production Docker image To fix a CVE reported by Cyberwatch. These tools are not required at runtime so there's no need to keep them around.	2025-11-24 17:51:02 +01:00
Jonathan Perret	c0d252f390	🔧(siret) fix entity ID for two entities As provided by RENATER.	2025-11-24 11:47:36 +01:00
Jonathan Perret	fa39964a64	🔧(siret) add new entities to SIRET map As provided by RENATER.	2025-11-24 09:42:00 +01:00