Table of Contents

Introduction

The JS7 offers to perform operations on orders, workflows, jobs and related objects by the JS7 - REST Web Service API.
- Note that all operations available with the JOC Cockpit GUI makes use of the REST Web Service API.
- For detailed information see the Technical Documentation of the REST Web Service API.
- For available CLI operations see JS7 - Unix Shell Command Line Interface.
The REST Web Service API can be accessed from Shell utilities such as curl.
In addition, a PowerShell module is available for simplified access to the REST Web Service API. This is described in the JS7 - PowerShell Module article.

The Workflow Deployment Script offered for Unix Shell can be used applied to perform frequently used deployment operations.

Workflow Deployment Script

Operation

Command

Object

Documentation

export / import

Any

JS7 - Inventory Export and Import

sign

import-deploy

Deployable

Controller objects such as

Worfklows

Workflows	JS7 - Secure Deployment of Scheduling Objects
	deploy / revoke

Deployable objects such as Worfklows

	JS7 - Deployment of Scheduling Objects
release / recall

Releaseble

Automation objects such as Schedules
store / remove	Any	Store object to inventory / move objects to trash
restore / delete	Any	Restore removed objects / delete removed objects from trash
revalidate	Any	Revalidate objects from inventory folder
encrypt / decrypt	None	Encrypt / decrypt strings and files

The script is offered for download and can be used as a command line interface for applied for frequently used deployment operations:

The script is available for Linux and MacOS® using bash shell.
The script terminates with exit code 0 to signal successful execution, with exit code 1 for command line argument errors and with exit code 4 for non-recoverable errors. Exit code 3 signals that no matching objects have been found.
The script is intended as a baseline example for customization by JS7 users and by SOS within the scope of professional services. Examples make use of JS7 Release 2.7.2, bash 4.2, curl 7.29.0 and jq 1.6.0.

Prerequisites

The Script requires the curl utility and the jq utility to be available from the operating system.

jq ships with the MIT license, see https://opensource.org/licenses/MIT.

Download

Download: deploy-workflow.sh JS7 - Download (Section: Unix Shell ClI)

Usage

Invoking the script without arguments displays the usage clause:

...

Code Block

title	Usage

Usage: deploy-workflow.sh [Command] [Options] [Switches]

  Commands:
    export            --file [--format] --path --type [--use-short-path] [--start-folder] [--for-signing] 
    ..                --file [--format] --folder [--recursive] [--type] [--use-short-path] [--for-signing]
                          [--use-short-path] [--for-signing]   [--no-draft] [--no-deployed] [--no-released] [--no-invalid]
    import            --file [--format] [--folder] [--overwrite] [--prefix] [--suffix]
    import-deploy     --file [--format] [--folder] [--algorithm]
    deploy            --path --type [--date-from] [--no-draft] [--no-deployed]
    ..                --folder [--recursive] [--date-from] [--no-draft] [--no-deployed]
    revoke            --path --type
    ..                --folder [--recursive]
    release           --path --type [--date-from]
    ..                --folder [--recursive] [--date-from]
    recall            --path --type
    ..                --folder [--recursive] [--type]
    store             --path --type --file
    remove            --path --type [--date-from]
    ..                --folder [--date-from]
    restore           --path --type --new-path [--prefix] [--suffix]
    ..                --folder --new-path [--prefix] [--suffix]
    delete            --path --type
    ..                --folder

  Options:
  revalidate  --url=<url>      --folder [--recursive]
    sign             | required:--file JOC Cockpit URL
   [--keystore |--controller-id=<id>  key --cert] [--key-password] [--hash]
    ..         | required: Controller ID
    --user=<account>     directory [--keystore |--key --cert] [--key-password] [--hash]
    encrypt          | required: JOC Cockpit user account--in [--infile --outfile] --cert [--java-home] [--java-lib]
    --password=<password>decrypt           --in [--infile  | optional: JOC Cockpit password--outfile] --key [--key-password] [--java-home] [--java-lib]

  Options:
    --ca-certurl=<path><url>                   | optional: path to CA Certificate| usedrequired: for JOC Cockpit loginURL
    --clientcontroller-cert=<path>     id=<id[,id]>          | optionalrequired: path to Client Certificate used for loginController ID
    --client-keyuser=<path><account>                | optional: path to| Clientrequired: KeyJOC usedCockpit foruser loginaccount
    --timeoutpassword=<seconds>  <password>              | optional: timeoutJOC for request, default: 60Cockpit password
    --ca-filecert=<path>                      | optional: path to exportCA fileCertificate orused importfor file
JOC Cockpit login
    --client-format=<ZIP|TAR_GZ>cert=<path>               | optional: formatpath ofto exportClient fileCertificate orused importfor filelogin
    --client-folder=<folder[,folder]>key=<path>                | optional: path listto ofClient inventoryKey foldersused holdingfor objectslogin
    --path=<path[,path]>timeout=<seconds>                | optional: listtimeout offor inventoryrequest, paths to objectsdefault: 60
    --type=<type[,type]>file=<path>               | optional: list of object types such as
| optional: path to export file or import file
    --format=<ZIP|TAR_GZ>              | optional: format of export file or import file
    --folder=<folder[,folder]>         | optional: list of inventory folders  WORKFLOW,FILEORDERSOURCE,JOBRESOURCE,NOTICEBOARD,LOCKholding objects
    --start-prefix=<string>   folder=<folder>               | optional: start prefixfolder for duplicateexport objectswith onrelative importpaths
    --suffix=<string>  path=<path[,path]>                | optional: suffixlist forof duplicateinventory objectspaths onto importobjects
    --date-from=<date>  type=<type[,type]>               | optional: updatelist dailyof planobject starttypes datesuch for deploy/release operationas WORKFLOW,SCHEDDULE
    --timenew-zonepath=<tz> <path>                  | optional: timenew zoneobject forpath dates, default: Europe/Berlinon restore
    --prefix=<string>                  | optional: prefix for duplicate objects on import
    --suffix=<string>                  see| https://en.wikipedia.org/wiki/List_of_tz_database_time_zonesoptional: suffix for duplicate objects on import
    --audit-messagealgorithm=<string><identifier>           | optional: audit log message signature algorithm for import, default: SHA512withECDSA
    --auditdate-time-spentfrom=<number><date>        | optional: audit log time spent in minutes
  |  --audit-link=<url>                 | optional: audit log linkoptional: update daily plan start date for deploy/release operation
    --log-dirdirectory=<directory>              | optional: path to directory holdingwith thefiles script'sthat logshould files

  Switches:be signed
    -h | --help-keystore=<path>                  | optional: path to keystore file |in displaysPKCS12 usageformat
    -v-key=<path> | --verbose                     | displaysoptional: verbosepath output,to repeat to increase verbosityprivate key file in PEM format
    -p | -key-password=<password>          | optional: password for keystore/private      | asks for passwordkey file
    --rcert=<path>  | --recursive                   | specifiesoptional: folderspath to certificate befile lookedin upPEM recursivelyformat
    -o | --overwrite-hash=<sha256|sha512>             | optional: hash algorithm for signing such |as overwritessha256, objectssha512, ondefault: importsha256
    -s | --for-signing-in=<string>                      | optional: exportsinput objectsstring for digital signingencryption/decryption
    --uinfile=<path> | --use-short-path              | exports relative paths
 | optional: input --no-draftfile for encryption/decryption
    --outfile=<path>                   | doesoptional: notoutput processfile draftfor objectsencryption/decryption
    --nojava-deployedhome=<directory>            | optional: Java Home directory for     | does not process deployed objectsencryption/decryption, default: $JAVA_HOME
    --nojava-releasedlib=<directory>             | optional: Java library directory for encryption/decryption, default: ./lib
 | does not process released objects
 --audit-message=<string>      --no-invalid     | optional: audit log message
    --audit-time-spent=<number>        | optional: |audit doeslog nottime processspent invalidin objectsminutes
    --removeaudit-link=<url>                 | optional: audit log link
    --log-dir=<directory>  | removes deployed/released objects
    --show-logs       | optional: path to directory holding the script's log files

  Switches:
    -h | |--help shows log output if --log-dir is used
    --make-dirs             | displays usage
    -v | --verbose   | creates directories if they do not exist

Commands

            | displays verbose output, repeat to increase verbosity
    -p | --password                    | asks for password
    -k | --key-password                | asks for keystore/key password
    -r | --recursive                   | specifies folders to be looked up recursively
    -o | --overwrite                   | overwrites objects on import
    -s | --for-signing                 | exports objects for digital signing
    -u | --use-short-path              | exports relative paths
    --no-draft                         | excludes draft objects
    --no-deployed                      | excludes deployed objects
    --no-released                      | excludes released objects
    --no-invalid                       | excludes invalid objects
    --show-logs                        | shows log output if --log-dir is used
    --make-dirs                        | creates directories if they do not exist

Anchor
commands
commands
Commands

export
- Allows to export objects such as workflows to an archive file in .zip or .tar.gz format. The command comes in two flavors:
  - export
export
- Allows to export scheduling objects such as workflows to an archive file in .zip or .tar.gz format. The command comes in two flavors:
  - export individual objects specified by the --path and --type options.
  - export objects from folders using the --folder option and --recursive switch.
    - Optionally the object type is specified and otherwise all objects will be exported.
- The archive file is specified from the --file and --format options.
import
- Imports an archive file to the inventory.
- Users can specify if existing objects will be overwritten or if duplicate objects from the import file will be assigned a prefix or suffix or will be ignored.
import-deploy
- Imports an archive file to the inventory and deploys the included objects. The operation is applicable if JOC Cockpit is operated for the high security level.
  - As a prerequisite the archive file must have been exported using the --for-signing switch.
  - Workflows and Job Resources from the archive file have been digitally signed by the user. Signature files have been added to the archive file.
- On import the objects in the archive file are deployed to related Controllers as specified during export.
deploy
- Allows to deploy objects such as workflows. The command can be used in two flavors:
  - deploy individual objects specified by the --path and --type options.
  - deploy objects from folders using the --folder option and --recursive switch.
- Deletion of objects from a Controller is considered similar a deplyoment operation.
revoke
- Allows to undeploy objects such as workflows. The command can be used in two flavors:
  - revoke individual objects specified by the --path and --type options.
  - revoke objects from folders using the --folder option and --recursive switch.
- Revoking objects deletes them from the Controller and Agents, objects remain in draft status in the inventory.
release
- Allows to release objects such as schedules. The command can be used in two flavors:
  - release individual objects specified by the --path and --type options.
  - release objects from folders using the --folder option and --recursive switch.
- Revocation of objects is considered similar to a release operation.

recall

Allows to unrelease objects such as schedules. The command can be used in two flavors:
- revoke individual objects specified by the --path and --type options.
  Recalling
  - export objects
  deactivates them from further use, objects remain in draft status in the inventory.
store
- Allows to store an object such as a workflow from a file to the inventory.
  - The --file option specifies the file that holds the JSON representation of an object.
  - The --type option specifies the object type.
  - The --path option specifies the folders and object name of the objects inventory location.
- Objects are stored to the inventory in draft status and can deployed or released using the related commands.
remove
- Allows to remove an object such as a workflow from the inventory. The command can be used in two flavors:
  - remove individual objects specified by the --path and --type options.
  - remove objects from folders recursively using the --folder option.
- Removing objects moves them to the trash from which they can be deleted or restored.

Options

--url
- Specifies the URL by which JOC Cockpit is accessible using <http|https>://<host>:<port>.
- Example: http://centostest-primary.sos:4446
- Example: https://centostest-primary.sos:4443
--user
- Specifies the user account for login to JOC Cockpit. If JS7 - Identity Services are available for Client authentication certificates that are specified with the --client-cert and --client-key options then their common name (CN) attribute has to match the user account.
- If a user account is specified then a password can be specified using the --password option or interactive keyboard input can be prompted using the -p switch.
--password
- Specifies the password used for the account specified with the --user option for login to JOC Cockpit.
- Consider use of the -p switch offering a secure option for interactive keyboard input.
--controller-id
- Specifies the identification of the Controller that holds related orders.
- More than one Controller ID can be specified, separated by comma, for the export operation when using the --for-signing switch.
--ca-cert
- Specifies the path to a file in PEM format that holds the Root CA Certificate and optionally Intermediate CA Certificates to verify HTTPS connections to JOC Cockpit.
--client-cert
- Specifies the path to a file in PEM format that holds the Client Certificate if HTTPS mutual authentication is used..
--client-key
- Specifies the path to a file in PEM format that holds the Client Private Key if HTTPS mutual authentication is used..
--timeout
- Specifies the maximum duration for requests to the JS7 REST Web Service. Default: 60 seconds.
--file
- Specifies the location of an archive file that is used with export, import and import-deploy operations.
- On export an existing archive file will be overwritten.
--format
- Specifies the format of the archive file indicated with the --file option.
- The format can be one of ZIP or TAR_GZ. Default: ZIP. The JS7 can process archive files in .zip format on Unix.
--folder
- Specifies the inventory folder used for the related operation.
  - Folder specification starts from a / followed by a hierarchy of sub-folders.
  - More than one folder can be specified using comma as in --folder=/ProductDemo/AgentCluster,/ProductDemo/ScheduledExecution.
- When used with the import and import-deploy operations, a single folder can be specified that is prepended the folders included with the archive file.
--path
- Specifies the path of an object such as a workflow, job resource, schedule. A path starts from a /, optionally followed by a hierarchy of sub-folders, and the object name.
- Objects are identified from thier path and object type.
--type
- Specifies the object type such as a workflow that is indicated together with the --path option to identify an object.
  - Deployable object types include: WORKFLOW, FILEORDERSOURCE, JOBRESOURCE, NOTICEBOARD, LOCK
  - Releasable object types include: INCLUDESCRIPT, SCHEDULE, WORKINGDAYSCALENDAR, NONWORKINGDAYSCALENDAR, JOBTEMPLATE, REPORT
- When used with the export operation for folders then more than one type can be specified separated by comma, for example --type=WORKFLOW,JOBRESOURCE
--prefix
- When used with the import operation, a prefix can be specified that is prepended all objects that are imported.
- If an object with the same name and prefix exists, then the object will not be imported.
--suffix
- When used with the import operation, a suffix can be specified that is appended all objects that are imported.
- If an object with the same name and suffix exists, then the object will not be imported.
--date-from
- Specifies the date starting from which the Daily Plan will be updated:
  - The --date-from=now value specifies that the Daily Plan will be updated for orders starting from now.
  - The Daily Plan date in ISO date format can be specified, for example --date-from=2023-10-23.
  - If omitted then the Daily Plan will not be updated.
- Orders in the Daily Plan can be updated if the underlying workflow or schedule is changed.
--audit-message
- Specifies a message that is made available for the Audit Log.
- Specification of Audit Log messages can be enforced on a per user basis and for a JS7 environment.
--audit-time-spent
- Specifies the time spent to perform an operation which is added to the Audit Log.
- The option can be specified if the --audit-message option is used.
--audit-link
- Specifies a link (URL) which is added to the Audit Log.
- The option can be specified if the --audit-message option is used.
--log-dir
- If a log directory is specified then the script will log information about processing steps to a log file in this directory.
- File names are created according to the pattern: deploy-workflow.<yyyy>-<MM>-<dd>T<hh>-<mm>-<ss>.log
- For example: deploy-workflow.2022-03-19T20-50-45.log

Switches

-h | --help
- Displays usage.
-v | --verbose
- Displays verbose log output that includes requests and responses with the JS7 REST Web Service.
- When used twice as with -v -v then curl verbose output will be displayed.
-p | --password
- Asks the user for interactive keyboard input of the password used for the account specified with the --user option..
- The switch is used for secure interactive input as an alternative to use of the option --password=<password>.
-r | --recursive
- Specifies that folders will be looked up recursively if the --folder option is used.
-d | --delete
- Specifies that objects should be deleted from the inventory.
- Deployable objects will be revoked from the Controller. Releasable objects will be recalled.
-o | --overwrite
- Specifies that objects with the same name and type will be overwritten when used with the import operation.
-s | --for-signing
- Specifies that objects are exported for digital signing when used with the export operation. For JS7 environments operated for the high security level digitally signed objects can be imported using the import-deploy operation.
-u | --use-short-path
- Specifies that relative object paths will be applied to the archive file when used with the export operation.
- An object path /a/b/c/workflow will be added as /c/workflow to the archive file. A folder /a/b/c will be added as /c to the archive file.
--no-draft
- Specifies that no draft objects will be processed when used with the export and deploy operations.
--no-deployed
- Specifies that no objects in deployed status will be processed when used with the export and deploy operations.
--no-released
- Specifies that no objects in released status will be processed when used with the export operation.
--no-invalid
- Specifies that only valid objects will be processed when used with the export operation.
--show-logs
- Displays the log output created by the script if the --log-dir option is used.
--make-dirs
- If directories are missing that are indicated with the --log-dir option then they will be created.

Exit Codes

0: operation successful
1: argument errors
3: no objects found
4: JS7 REST Web Service is not reachable or reports errors

Examples

The following examples illustrate typical use cases.

...

- - from folders using the --folder option and --recursive switch.
    - Optionally one or more object types can be specified and otherwise all objects will be exported, see --type option.
    - Should relative paths be used in the archive file then the --use-short-path switch can be applied.
    - Export of objects can further be limited by use of the --no-* switches, see section Switches.
- The archive file is specified from the --file and --format options.
- If JOC Cockpit is operated for the High Security Level then the --for-signing switch can be used to export Controller Objects that should be digitally signed. Objects and signatures can be imported using the import-deploy command.
import
- Imports an archive file to the inventory. The operation applies to use of JOC Cockpit with the Low and Medium Security Level.
- Users can specify if existing objects will be overwritten or if duplicate objects from the import file will be assigned a prefix or suffix or will be ignored.
sign
- Digitally signs workflows and job resources from an export archive file. The operation applies to use of JOC Cockpit with the High Security Level.
- Signing includes to specify the Private Key and Certificate from files in PEM format or from a keystore. Optionally the hash algorithm sha256 or sha512 is specified.
- The sequence of operations includes to export, to sign and to import-deploy signed objects.
- The sign command works without access to the JS7 REST Web Service and does not require to specify options for connecting to JOC Cockpit.
import-deploy
- Imports an archive file to the inventory and deploys the included objects. The operation is applicable if JOC Cockpit is operated for the High Security Level.
  - As a prerequisite the archive file must be exported using the --for-signing switch.
  - Workflows and Job Resources from the archive file are digitally signed by the user. Signature files are added to the archive file.
- On import the objects in the archive file are deployed to related Controllers as specified during export.
deploy
- Allows to deploy Controller Objects such as workflows. The command can be used in two flavors:
  - deploy individual objects specified by the --path and --type options.
  - deploy objects from folders using the --folder option and --recursive switch.
- Deploying objects forwards them to Controllers and Agents.
  - More than one Controller ID can be specified like this: --controller-id=controller-uat-1,controller-uat-2
revoke
- Allows to undeploy Controller Objects such as workflows. The command can be used in two flavors:
  - revoke individual objects specified by the --path and --type options.
  - revoke objects from folders using the --folder option and --recursive switch.
- Revoking Controller objects deletes them from the Controller and Agents, objects remain in draft status in the inventory.
  - More than one Controller ID can be specified like this: --controller-id=controller-uat-1,controller-uat-2
release
- Allows to release Automation Objects such as schedules. The command can be used in two flavors:
  - release individual objects specified by the --path and --type options.
  - release objects from folders using the --folder option and --recursive switch.
- Releasing objects activates them for example for use by the Daily Plan.
recall
- Allows to unrelease Automation Objects such as schedules. The command can be used in two flavors:
  - recall individual objects specified by the --path and --type options.
  - recall objects from folders using the --folder option. The --type option and --recursive switch can optionally be specified.
- Recalling objects deactivates them from further use, objects remain in draft status in the inventory.
store
- Allows to store an object such as a workflow or schedule from a file to the inventory.
  - The --file option specifies the file that holds the JSON representation of an object.
  - The --type option specifies the object type.
  - The --path option specifies the folders and object name of the objects inventory location.
- Objects are stored to the inventory in draft status and can be deployed or released using the related commands.
remove
- Allows to remove objects such as workflows or schedules from the inventory. The command can be used in two flavors:
  - remove individual objects specified by the --path and --type options.
  - remove objects from folders recursively using the --folder option.
- Controller objects such as workflows are removed from the Controller and from the inventory. Automation objects such as schedules are removed from the inventory.
- Removing objects moves them to the trash from which they can be restored or deleted
restore
- Allows to restore objects such as workflows or schedules from the trash. The command can be used in two flavors:
  - restore individual objects specified by the --path and --type options.
  - restore objects from folders recursively using the --folder option.
- Restoring objects moves them from the trash to the inventory from which they can be deployed or released.
delete
- Allows to delete objects such as workflows or schedules from the trash. The command can be used in two flavors:
  - delete individual objects specified by the --path and --type options.
  - delete objects from folders recursively using the --folder option.
- Deleting objects will permanently wipe them from the trash.
revalidate
- Allows to revalildate objects such as workflows or schedules from the inventory, for example after import. The command can be used for inventory folders.
encrypt
- Allows to encrypt a value using the --in option. If used to encrypt a file then --infile and --outfile options must be specified.
- The --cert option specifies the path to a file holding the Certificate used for encryption.
- Encryption is performed by Java libraries that are looked up in the ./lib sub-directory of the JS7 Unix Shell CLI. For details see JS7 - Encryption and Decryption.
decrypt
- Allows to decrypt a value using the --in option. If used to decrypt a file then --infile and --outfile options must be specified.
- The --key option specifies the path to the Private Key used for decryption. If the Private Key is protected by a password, then the --key-password option or switch must be specified.
- Decryption is performed by Java libraries that are looked up in the ./lib sub-directory of the JS7 Unix Shell CLI.

Anchor
options
options
Options

--url
- Specifies the URL by which JOC Cockpit is accessible using <http|https>://<host>:<port>.
- Example: http://centostest-primary.sos:4446
- Example: https://centostest-primary.sos:4443
--user
- Specifies the user account for login to JOC Cockpit. If JS7 - Identity Services are available for Client authentication certificates that are specified with the --client-cert and --client-key options then their common name (CN) attribute has to match the user account.
- If a user account is specified then a password can be specified using the --password option or interactive keyboard input can be prompted using the -p switch.
--password
- Specifies the password used for the account specified with the --user option for login to JOC Cockpit.
- Password input from the command line is considered insecure.
  - Consider use of the -p switch offering a secure option for interactive keyboard input.
  - Consider use of the encrypt command to encrypt a password: ./deploy-workflow.sh encrypt --in=root --cert=encrypt.crt.
    - The encryption result will include the prefix enc: followed by the encrypted symmetric key, initialization vector and encrypted secret separated by space.
    - If an encrypted password is specified, then it will be decrypted using the Private Key file: ./deploy-workflow.sh <command> --password="enc:BF8J8KP7TPlxy..." --key=encrypt.key.
--controller-id
- Specifies the identification of the Controller that holds related orders.
- More than one Controller ID can be specified, separated by comma, for the export operation when using the --for-signing switch.
--ca-cert
- Specifies the path to a file in PEM format that holds the Root CA Certificate and optionally Intermediate CA Certificates to verify HTTPS connections to JOC Cockpit.
--client-cert
- Specifies the path to a file in PEM format that holds the Client Certificate if HTTPS mutual authentication is used..
--client-key
- Specifies the path to a file in PEM format that holds the Client Private Key if HTTPS mutual authentication is used..
--timeout
- Specifies the maximum duration for requests to the JS7 REST Web Service. Default: 60 seconds.
--file
- Specifies the location of an archive file that is used with export, import and import-deploy commands.
- On export an existing archive file will be overwritten.
--format
- Specifies the format of the archive file indicated with the --file option.
- The format can be one of ZIP or TAR_GZ. Default: ZIP. The JS7 can process archive files in .zip format on Unix.
--folder
- Specifies the inventory folder used for the related operation.
  - Folder specification starts from a / followed by one or more sub-folders.
  - More than one folder can be specified using comma as in --folder=/ProductDemo/AgentCluster,/ProductDemo/ScheduledExecution.
- When used with the import and import-deploy commands, a single folder can be specified that is prepended the folders included with the archive file.
--start-folder
- Specifies the inventory folder used for relative paths in archive files when using the export command with the --path option, see --use-short-path switch.
--path
- Specifies the path of an object such as a workflow, job resource, schedule. A path starts from a /, optionally followed by a hierarchy of sub-folders, and the object name.
- Objects are identified from thier path and object type.
--type
- Specifies the object type such as a workflow or schedule that is indicated together with the --path option to identify an object.
  - Controller Object types include: WORKFLOW,FILEORDERSOURCE,JOBRESOURCE,NOTICEBOARD,LOCK
  - Automation Object types include: SCHEDULE,WORKINGDAYSCALENDAR,NONWORKINGDAYSCALENDAR,JOBTEMPLATE,INCLUDESCRIPT,REPORT
- When used with the export command for folders then more than one object type can be specified separated by comma, for example --type=WORKFLOW,JOBRESOURCE
--new-path
- When used with the restore command, the new path is specified to which the object will be restored in the inventory.
--prefix
- When used with the import command, a prefix can be specified that is prepended all objects that are imported.
- If an object with the same name and prefix exists, then the object will not be imported.
--suffix
- When used with the import command, a suffix can be specified that is appended all objects that are imported.
- If an object with the same name and suffix exists, then the object will not be imported.
--algorithm
- When used with the import-deploy command, the signature algorithm is specified that was used to digitally sign objects. Default: SHA512withECDSA.
- The algorithm name is made up of the hash algorithm name such as SHA256, SHA512 and the encryption type of the Private Key such as ECDSA or RSA.
- This offers to specify the following algorithm names: SHA256withECDSA, SHA256withRSA, SHA512withECDSA, SHA512withRSA.
--date-from
- Specifies the date starting from which the Daily Plan will be updated:
  - The --date-from=now option value specifies that the Daily Plan will be updated for orders starting from now.
  - The Daily Plan date in ISO date format can be specified, for example --date-from=2023-10-23.
  - If omitted then the Daily Plan will not be updated.
- Orders in the Daily Plan can be updated for example if the underlying workflow or schedule is changed.
--directory
- When used with the sign command, specifies the directory in which workflow files with the extension *.workflow.json and job resources holding the extension .jobresource.json are looked up for signing. Sub-directories are looked up recursively.
- All files found will be digitally signed by creating a signature file with the extension *.json.sig that holds the signature of the related object.
--keystore
- When used with the sign command, specifies the path to a keystore file in PKCS12 format. The keystore is expected to hold the Private Key and Certificate.
- Only one of the options --keystore and --key can be specified.
--key
- When used with the sign and decrypt commands, specifies the path to a file that holds the Private Key in PEM format used for signing/decrypting.
- Only one of the options --keystore and --key can be specified.
--cert
- When used with the sign and encrypt commands, specifies the path to a file that holds the CA-signed or self-signed X.509 Certificate. Alternatively, the path to a file holding the Public Key can be specified. The Certificate/Public Key is expected in PEM format.
- For signing the argument is required if the --key option is used. The argument is optional If the --keystore option is used. The --cert option has precedence if used with the --keystore option.
- For encryption the Certificate/Public Key must match the Private Key used for later decryption specified with the --key option.
--key-password
- When used with the sign and decrypt commands, specifies the password for access to the keystore using the --keystore option or key file using the --key option.
- Password input from the command line is considered insecure.
  - Consider use of the -k switch or more elaborate mechanisms, for example by temporarily populating the system keystore form a security key such as a YubiKey® or similar.
  - Consider use of encrypted passwords as explained with the --password option.
--hash
- When used with the sign command, specifies the hash algorithm used to create a hash from a file that should be signed.
- Possible values include sha256 and sha512. Default: sha256
--in
- When used with the encrypt and decrypt commands, specifies the input value that should be encrypted or decrypted.,
- One of the options --in or --infile can be specified.
--infile
- When used with the encrypt and decrypt commands, specifies the path to the input file that should be encrypted/decrypted.
- One of the options --in or --infile can be specified. This option requires use of the --outfile option.
--outfile
- When used with the encrypt command, specifies the path to the output file that will be created holding the encrypted content of the input file.
- When used with the decrypt command, specifies the path to the output file that will be created holding the decrypted content of the input file.
- The option is required if the --infile option is specified
--java-home
- When used with the encrypt and decrypt commands or with encrypted passwords, specifies the Java home directory. By default the JAVA_HOME environment variable is used to determine the location of Java.
- The Java home directory is the top-level directory of a Java installation. The directory includes the bin sub-directory and java executable.
--java-lib
- When used with the encrypt and decrypt commands or with encrypted passwords, a number of Java libraries are required to perform encryption/decryption.
- The Java libraries are expected in the lib sub-directory of the JS7 Unix Shell CLI. Default: ./lib.
--audit-message
- Specifies a message that is made available to the Audit Log.
- Specification of Audit Log messages can be enforced on a per user basis and for a JS7 environment.
--audit-time-spent
- Specifies the time spent to perform an operation which is added to the Audit Log.
- The option can be specified if the --audit-message option is used.
--audit-link
- Specifies a link (URL) which is added to the Audit Log.
- The option can be specified if the --audit-message option is used.
--log-dir
- If a log directory is specified then the script will log information about processing steps to a log file in this directory.
- File names are created according to the pattern: deploy-workflow.<yyyy>-<MM>-<dd>T<hh>-<mm>-<ss>.log
- For example: deploy-workflow.2022-03-19T20-50-45.log

Anchor
switches
switches
Switches

-h | --help
- Displays usage.
-v | --verbose
- Displays verbose log output that includes requests and responses with the JS7 REST Web Service.
- When used twice as with -v -v then curl verbose output will be displayed.
-p | --password
- Asks the user for interactive keyboard input of the password used for the account specified with the --user option..
- The switch is used for secure interactive input as an alternative to use of the option --password=<password>.
-k | --key-password
- Asks the user for interactive keyboard input of the password used for access to a keystore or key file specified with the --keystore or --key options.
- The switch is used for secure interactive input as an alternative to use of the --key-password=<password> option.
-r | --recursive
- Specifies that folders will be looked up recursively if the --folder option is used.
-o | --overwrite
- Specifies that objects with the same name and type will be overwritten when used with the import command.
-s | --for-signing
- Specifies that objects are exported for digital signing when used with the export command. For JS7 environments operated for the High Security Level digitally signed objects can be imported using the import-deploy command.
-u | --use-short-path
- Specifies that relative object paths will be applied to archive files when used with the export command.
- An object path /a/b/c/workflow will be added as /c/workflow to the archive file. A folder /a/b/c will be added as /c to the archive file.
--no-draft
- Specifies that draft objects will be excluded when used with the export and deploy command.
--no-deployed
- Specifies that deployed objects will be excluded when used with the export and deploy command.
--no-released
- Specifies that released objects will be excluded when used with the export command.
--no-invalid
- Specifies that invalid objects will be excluded when used with the export command.
--show-logs
- Displays the log output created by the script if the --log-dir option is used.
--make-dirs
- If directories are missing that are indicated with the --log-dir option then they will be created.

Anchor
exit_codes
exit_codes
Exit Codes

0: operation successful
1: argument errors
3: no objects found
4: JS7 REST Web Service is not reachable or reports errors

Examples

The following examples illustrate typical use cases.

Exporting Objects

Objects can be exported to an archive file in .zip or .tar.gz format.
Users can export individual objects from their path and object type. Alternatively, objects can be exported by folders, optionally limited to specific object types.

Code Block

language	bash
title	Examples for Exporting Objects
linenumbers	true

# common options for connection to the JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# export workflows
./deploy-workflow.sh export "${request_options[@]}" \
    --file=export.zip --path=/ap/ap3jobs,/ap/Agent/apRunAsUser --type=WORKFLOW

# export draft schedules
./deploy-workflow.sh export "${request_options[@]}" \
    --file=export.zip --path=/ap/Agent/apAgentSchedule01,/ap/Agent/apAgentSchedule02 --type=SCHEDULE --no-released

# export objects from folder
./deploy-workflow.sh export "${request_options[@]}" \
    --file=export.zip --folder=/ap --recursive

# export objects from folder using relative path
./deploy-workflow.sh export "${request_options[@]}" \
    --file=export.zip --folder=/ap/Agent --recursive --use-short-path

# export objects from folder, limiting object types and validity, feeding audit log
./deploy-workflow.sh export "${request_options[@]}" \
    --file=export.zip --folder=/ap --recursive --type=WORKFLOW,JOBRESOURCE --no-invalid --audit-message="export to production"

Importing Objects

Previously exported objects can be imported, for example from a non-production environment to a production environment.
For import users can specify that existing objects with the same name and type should be overwritten. In addition, users can specify a prefix or suffix to be added to the name of imported objects.
On export users can specify to apply the absolute or relative path of objects when creating the archive file.
On import users can accept the path of imported objects as given with the archive file. Alternatively, users can specify a top-level folder hierarchy to which paths from objects in the archive file will be added.

Code Block

language	bash
title	Examples for Importing Objects
linenumbers	true

# common options for connection to the JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# import objects
./deploy-workflow.sh import "${request_options[@]}" \
    --file=export.zip --overwrite

# import objects to a new top-level folder and apply suffix
./deploy-workflow.sh import "${request_options[@]}" \
    --file=export.zip --folder=/Version22 --suffix=v22

# revalidate objects from folder
./deploy-workflow.sh revalidate "${request_options[@]}" \
    --folder=/Version22 --recursive

Exporting, Signing and Importing/Deploying for High Security Level

For deployment of Controller Objects the JS7 High Security Level requires digital signing outside of JOC Cockpit in order to securely apply the user's Private Key. To this purpose the import-deploy command is used. For deployment in Low or Medium Security Level the deploy command is used.
- Digital signing includes that based on the user's Private Key and Certificate signature files are created that have to be added to the archive file for later import & deployment.
- The steps to import and to deploy are available from a single operation to prevent tampering of objects after import.
There are a number of ways how to perform signing. The recommended solution is use of the js7_sign_workflow.sh script as explained from the JS7 - Signing Workflows with X.509 Certificates using Unix Shell Script article. The below example explains the steps to export, to sign and to import/deploy objects.

Code Block

language	bash
title	Example for Exporting, Signing and Importing/Deploying for High Security Level
linenumbers	true

# common options for connection to the JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# export objects from folder for signing
./deploy-workflow.sh export "${request_options[@]}" \
    --file=export.zip --folder=/myFolder --recursive --for-signing

# digitally sign objects
mkdir -p ./temp
rm -fr ./temp/*
unzip -d ./temp ./export.zip

./deploy-workflow.sh sign \
    --directory=./temp --key=ecdsa.key --cert=ecdsa.crt --hash=sha512

rm -f ./import-from-signing.zip
cd ./temp
zip -r ../import-from-signing.zip *
cd -

# import/deploy objects
./deploy-workflow.sh import-deploy "${request_options[@]}" \
    --file=import-from-signing.zip

Deploying and Revoking Objects

Controller Objects are visible in the inventory from the Controller system folder, for example workflows, job resources etc.
Such objects are in draft status after modification by the user. Deploying such objects makes them available to Controllers & Agents and sets them to the deployed status.
Deployed objects can be revoked which withdraws the objects from Controller & Agents and sets them to the draft status.

Code Block

language	bash
title	Examples for Deploying and Revoking Objects
linenumbers	true

# common options for connection to the JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# deploy workflows and update daily plan
./deploy-workflow.sh deploy "${request_options[@]}" \
    --path=/ap/ap3jobs,/ap/apEnv --type=WORKFLOW --date-from=now

# deploy objects from folder recursively and update daily plan
./deploy-workflow.sh deploy "${request_options[@]}" \
    --folder=/ap/Agent --recursive --date-from=now

# revoke workflows
./deploy-workflow.sh revoke "${request_options[@]}" \
    --path=/ap/ap3jobs,/ap/apEnv --type=WORKFLOW

# revoke objects from folder
./deploy-workflow.sh revoke "${request_options[@]}" \
    --folder=/ap/Agent --recursive

Releasing and Recalling Objects

Automation Objects are visible in the inventory from the Automation system folder, for example calendars, schedules etc.
Such objects are in draft status after modification by the user. Releasing such objects activates them and sets them to the released status.
Released objects can be recalled which deactivates the objects and sets them to the draft status.

Code Block

language	bash
title	Examples for Releasing and Recalling Objects
linenumbers	true

# common options for connection to the JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

 # release schedules and update daily plan
./deploy-workflow.sh release "${request_options[@]}" \
    --path=/ap/Agent/apAgentSchedule01,/ap/Agent/apAgentSchedule02 --type=SCHEDULE --date-from=now
 
# release objects from folder and update daily plan
./deploy-workflow.sh release "${request_options[@]}" \
    --folder=/ap/Agent --recursive --date-from=now

# recall schedules
./deploy-workflow.sh recall "${request_options[@]}" \
    --path=/ap/Agent/apAgentSchedule01,/ap/Agent/apAgentSchedule02 --type=SCHEDULE

# recall objects from folder
./deploy-workflow.sh recall "${request_options[@]}" \
    --folder=/ap/Agent --recursive

Storing and Removing Objects

Objects can be added to the inventory from files in JSON format related to the object type such as a workflow, schedule. Newly added objects are set to draft status.
Objects can be removed from the inventory which will move them to the trash from which they can be restored or deleted.

Code Block

language	bash
title	Examples for Exporting Storing and Removing Objects
linenumbers	true

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# export workflows
./deploy-workflow.sh export ${request_options[@]} \
    --file=export.zip --path=/ap/ap3jobs,/ap/Agent/apRunAsUser --type=WORKFLOW

# export schedules
./deploy-workflow.sh export ${request_options[@]} \
    --file=export.zip --path=/ap/Agent/apAgentSchedule01,/ap/Agent/apAgentSchedule02 --type=SCHEDULE

# export objects from folder the JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# store object
./deploy-workflow.sh exportstore "${request_options[@]}" \
    --file=export.zippath=/ap/NewFolder01/NewWorkflow01 --foldertype=/apWORKFLOW --recursivefile=NewWorkflow01.workflow.json

# exportremove objectsobject, fromupdate folder using relative pathdaily plan
./deploy-workflow.sh exportremove "${request_options[@]}" \
    --file=export.zip --folderpath=/ap/AgentNewFolder01/NewWorkflow01 --recursivetype=WORKFLOW --use-short-pathdate-from=now

# exportremove objects from folder, limiting object types, feedingupdate auditdaily logplan
./deploy-workflow.sh exportremove "${request_options[@]}" \
    --file=export.zip --folder=/ap/NewFolder01 --recursive date-type=WORKFLOW,JOBRESOURCE --audit-message="export to production"

...

from=now

Restoring and Deleting Objects

Objects that have previously been removed reside in the trash.
Objects can be restored or can be permanently deleted from the trash.
- To restore objects from the trash the path, object type and new path in the inventory must be specified. Optionally a prefix or suffix can be added to restored object names. Restored objects are set to draft status.
- To permanently delete objects from the trash they can be specified from their path & object type or from a folder.

Code Block

language	bash
title	Examples for Importing Restoring and Deleting Objects
linenumbers	true

# common options for connection to the JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# import objects
./deploy-workflow.sh import ${request_options[@]} \
    --file=export.zip --overwrite

# importrestore objectsobject tofrom atrash, newusing top-levelsuffix folderfor andrestored apply suffixobjectd
./deploy-workflow.sh importrestore "${request_options[@]}" \
    --file=export.zip --folder=/Version22 --suffix=v22

Exporting and Importing/Deploying for High Security Level

Code Block

language	bash
title	Example for Exporting and Importing/Deploying for High Security Level
linenumbers	true

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# export --path=/ap/NewFolder01/NewWorkflow01 --type=WORKFLOW --new-path=/ap/NewFolder01/NewWorkflow01 --suffix=restored

# delete object from trash
./deploy-workflow.sh delete "${request_options[@]}" \
    --path=/ap/NewFolder01/NewWorkflow01 --type=WORKFLOW

# delete objects from foldertrash forby signingfolder
./deploy-workflow.sh exportdelete "${request_options[@]}" \
    --file=export.zip --folder=/myFolder --recursive --for-signing

# digitally sign objects
rm -fr ./temp/*
unzip -d ./temp ./export.zip
./js7_sign_workflow.sh --dir=./temp --key=./ecdsa.key --cert=./ecdsa.crt --hash=sha512
rm -f ./import-from-signing.zip
cd ./temp
zip -r ../import-from-signing.zip *
cd -

# import/deploy objects
./deploy-workflow.sh import-deploy ${request_options[@]} \
    --file=import-from-signing.zip

Deploying Objects

folder=/ap/NewFolder01

Encrypting and Decrypting

Secrets can be encrypted and decrypted as explaind with JS7 - Encryption and Decryption.
Encryption/decryption require related Java libraries that are available from the ./lib sub-directory.
For creation of a Private Key and Certificate see JS7 - How to create X.509 Encryption Keys.

Code Block

language	bash
title	Example for Encrypting and Decrypting
linenumbers	true

# create Private Key
openssl ecparam -name secp384r1 -genkey -noout -out encrypt.key

# create Certificate Signing Request
openssl req -new -sha512 -nodes -key encrypt.key -out encrypt.csr -subj "/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=Encrypt"

# create Certificate
openssl x509 -req -sha512 -days 1825 -signkey encrypt.key -in encrypt.csr -out encrypt.crt -extfile <(printf "keyUsage=critical,keyEncipherment,keyAgreement\n")


# encrypt a secret such as a password using the Certificate, the encryption result will be returned and will look like: enc:BEXbHYa...

Code Block

language	bash
title	Examples for Deploying Objects
linenumbers	true

# common options for connection to JS7 REST API
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# deploy objects from folder recursively and update daily plan
./deploy-workflow.sh deploy ${request_options[@]} \
    --folder=/ap/Agent --recursive --date-from=now

# deploy workflows and update daily plan
./deploy-workflow.sh deploy ${request_options[@]} \
   encrypt --path=/ap/ap3jobs,/ap/apEnvin="root" --type=WORKFLOW --date-from=now

Releasing Objects

Code Block

language	bash
title	Examples for Releasing Objects
linenumbers	true

# commoncert=encrypt.crt

# options for connection to the JS7 REST API can specify the encryption result as password and the Private Key for decryption
request_options=(--url=http://localhost:4446 --user=root --password=root --controller-id=controller)

# release objects from folder and update daily plan
./deploy-workflow.sh release ${request_options[@]} \
    --folder=/ap/Agentpassword="enc:BEXbHYa..." --recursivekey=encrypt.key --datecontroller-fromid=nowcontroller)

# release schedules and update daily plan for example, when exporting workflows the Private Key is used to decrypt the password for access to the REST API on-the-fly
./deploy-workflow.sh releaseexport "${request_options[@]} \
    " --file=export.zip --path=/ap/Agent/apAgentSchedule01ap3jobs,/ap/Agent/apAgentSchedule02apRunAsUser --type=SCHEDULE --date-from=nowWORKFLOW

# decrypt an encrypted secret using the Private Key
./deploy-workflow.sh decrypt --in="enc:BEXbHYa..." --key=encrypt.key

Resources

API
- JS7 - REST Web Service API
- JS7 - PowerShell Module
Controller Deployment Operations
- JS7 - Deployment of Scheduling Objects
- JS7 - Secure Deployment of Scheduling Objects
- Unix Shell CLI for Controller Deployment
Controller Status Operations
- JS7 - Unix Shell CLI for Controller Status Operations
Workflow Status Operations
- JS7 - Unix Shell CLI for Workflow Status Operations
JOC Cockpit Status Operations
- JS7 - Unix Shell CLI for JOC Cockpit Status Operations

Space shortcuts

Page tree

Versions Compared

Old Version 12

New Version 45

Key

Introduction

Workflow Deployment Script

Prerequisites

Download

Usage

Commands

Anchor
commands
commands
Commands

Options

Switches

Exit Codes

Examples

Anchor
options
options
Options

Anchor
switches
switches
Switches

Anchor
exit_codes
exit_codes
Exit Codes

Examples

Exporting Objects

Importing Objects

Exporting, Signing and Importing/Deploying for High Security Level

Deploying and Revoking Objects

Releasing and Recalling Objects

Storing and Removing Objects

Restoring and Deleting Objects

Exporting and Importing/Deploying for High Security Level

Deploying Objects

Encrypting and Decrypting

Releasing Objects

Resources

Space shortcuts

Page tree

Page History

Versions Compared

Old Version 12

New Version 45

Key

Introduction

Workflow Deployment Script

Prerequisites

Download

Usage

Commands

AnchorcommandscommandsCommands

Options

Switches

Exit Codes

Examples

AnchoroptionsoptionsOptions

AnchorswitchesswitchesSwitches

Anchorexit_codesexit_codesExit Codes

Examples

Exporting Objects

Importing Objects

Exporting, Signing and Importing/Deploying for High Security Level

Deploying and Revoking Objects

Releasing and Recalling Objects

Storing and Removing Objects

Restoring and Deleting Objects

Exporting and Importing/Deploying for High Security Level

Deploying Objects

Encrypting and Decrypting

Releasing Objects

Resources

Anchor
commands
commands
Commands

Anchor
options
options
Options

Anchor
switches
switches
Switches

Anchor
exit_codes
exit_codes
Exit Codes