[xmlsectool] 02/02: XSTJ-67 - Replace --key with --keyFile and --keyAlias
Ian Young
ian at iay.org.uk
Mon Nov 16 16:19:37 UTC 2020
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository xmlsectool.
View the commit online:
http://git.shibboleth.net/view/?p=xmlsectool.git;a=commit;h=7c873c5317768814521347aee50312b95a7c54d7
commit 7c873c5317768814521347aee50312b95a7c54d7
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Mon Nov 16 16:19:31 2020 +0000
XSTJ-67 - Replace --key with --keyFile and --keyAlias
https://issues.shibboleth.net/jira/browse/XSTJ-67
---
.../tool/xmlsectool/CommandLineArguments.java | 57 ++++++++++++++++++----
.../net/shibboleth/tool/xmlsectool/XMLSecTool.java | 11 +++--
.../net/shibboleth/tool/xmlsectool/XSTJ59Test.java | 2 +-
.../net/shibboleth/tool/xmlsectool/XSTJ69Test.java | 2 +-
.../net/shibboleth/tool/xmlsectool/XSTJ82Test.java | 4 +-
.../net/shibboleth/tool/xmlsectool/XSTJ83Test.java | 6 +--
6 files changed, 61 insertions(+), 21 deletions(-)
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/CommandLineArguments.java b/src/main/java/net/shibboleth/tool/xmlsectool/CommandLineArguments.java
index a8f0d81..7a4a1e8 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/CommandLineArguments.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/CommandLineArguments.java
@@ -61,7 +61,10 @@ public class CommandLineArguments {
private static final String KI_KEY_NAME_ARG = "keyInfoKeyName";
private static final String KI_CRL_ARG = "keyInfoCRL";
private static final String CERT_ARG = "certificate";
+ @Deprecated(since="3.0.0", forRemoval=true)
private static final String KEY_ARG = "key";
+ private static final String KEY_FILE_ARG = "keyFile";
+ private static final String KEY_ALIAS_ARG = "keyAlias";
private static final String KEY_PASSWORD_ARG = "keyPassword";
private static final String KEYSTORE_ARG = "keystore";
private static final String KEYSTORE_PASSWORD_ARG = "keystorePassword";
@@ -189,8 +192,15 @@ public class CommandLineArguments {
private String cert;
@Parameter(names = OPT + KEY_ARG)
+ @Deprecated(since="3.0.0", forRemoval=true)
private String key;
+ @Parameter(names = OPT + KEY_FILE_ARG)
+ private String keyFile;
+
+ @Parameter(names = OPT + KEY_ALIAS_ARG)
+ private String keyAlias;
+
@Parameter(names = OPT + KEY_PASSWORD_ARG)
private String keyPassword;
@@ -341,6 +351,17 @@ public class CommandLineArguments {
DeprecationSupport.warn(ObjectType.CLI_OPTION, OPT + WHITELIST_DIGEST_ARG,
null, OPT + ALLOW_DIGEST_ARG);
}
+
+ // --key deprecated, what to use instead depends on context
+ if (key != null) {
+ if (cert != null) {
+ DeprecationSupport.warn(ObjectType.CLI_OPTION, OPT + KEY_ARG,
+ null, OPT + KEY_FILE_ARG);
+ } else {
+ DeprecationSupport.warn(ObjectType.CLI_OPTION, OPT + KEY_ARG,
+ null, OPT + KEY_ALIAS_ARG);
+ }
+ }
}
/**
@@ -527,7 +548,19 @@ public class CommandLineArguments {
return cert;
}
- public String getKey() {
+ public String getKeyFile() {
+ if (keyFile != null) {
+ return keyFile;
+ }
+ // fall back to legacy option
+ return key;
+ }
+
+ public String getKeyAlias() {
+ if (keyAlias != null) {
+ return keyAlias;
+ }
+ // fall back to legacy option
return key;
}
@@ -645,8 +678,14 @@ public class CommandLineArguments {
}
if (doSign()) {
- if (getKey() == null) {
- errorAndExit(KEY_ARG + " option is required");
+ if (getCertificate() != null) {
+ if (getKeyFile() == null) {
+ errorAndExit(KEY_FILE_ARG + " option is required");
+ }
+ } else {
+ if (getKeyAlias() == null) {
+ errorAndExit(KEY_ALIAS_ARG + " option is required");
+ }
}
if ((getKeystore() != null || getPkcs11Config() != null) && getKeyPassword() == null) {
@@ -762,11 +801,11 @@ public class CommandLineArguments {
out.println("PEM/DER Encoded Certificate/Key Options - "
+ "these options are mutually exclusive with the Keystore and PKCS#11 options. "
+ "The '" + CERT_ARG + "' option is required for signature verification. "
- + "The '" + CERT_ARG + "' and '" + KEY_ARG
+ + "The '" + CERT_ARG + "' and '" + KEY_FILE_ARG
+ "' options are required for signing.");
out.println(String.format(" --%-20s %s", CERT_ARG,
"Specifies the file from which the signing, or validation, certificate is read."));
- out.println(String.format(" --%-20s %s", KEY_ARG,
+ out.println(String.format(" --%-20s %s", KEY_FILE_ARG,
"Specifies the file from which the signing key is read."));
out.println(String.format(" --%-20s %s", KEY_PASSWORD_ARG,
"Specifies the password for the signing key."));
@@ -777,7 +816,7 @@ public class CommandLineArguments {
+ " Options '"
+ KEYSTORE_ARG
+ "', '"
- + KEY_ARG
+ + KEY_ALIAS_ARG
+ "', and '"
+ KEY_PASSWORD_ARG + "' are required.");
out.println(String.format(" --%-20s %s", KEYSTORE_ARG, "Specifies the keystore file."));
@@ -786,7 +825,7 @@ public class CommandLineArguments {
out.println(String.format(" --%-20s %s", KEYSTORE_TYPE_ARG, "Specifies the type of the keystore."));
out.println(String.format(" --%-20s %s", KEYSTORE_PROVIDER_ARG,
"Specifies the keystore provider class to use instead of the default one for the JVM."));
- out.println(String.format(" --%-20s %s", KEY_ARG,
+ out.println(String.format(" --%-20s %s", KEY_ALIAS_ARG,
"Specifies the key alias for the signing key is read."));
out.println(String.format(" --%-20s %s", KEY_PASSWORD_ARG,
"Specifies the password for the signing key. Keystore password used if none is given."));
@@ -797,12 +836,12 @@ public class CommandLineArguments {
+ " Options '"
+ PKCS11_CONFIG_ARG
+ "' and '"
- + KEY_ARG
+ + KEY_ALIAS_ARG
+ "' are required. Option '"
+ KEY_PASSWORD_ARG
+ "' required when signing and, with some PKCS#11 devices, during signature verification.");
out.println(String.format(" --%-20s %s", PKCS11_CONFIG_ARG, "The PKCS#11 token configuration file."));
- out.println(String.format(" --%-20s %s", KEY_ARG,
+ out.println(String.format(" --%-20s %s", KEY_ALIAS_ARG,
"Specifies the key alias for the signing key is read."));
out.println(String.format(" --%-20s %s", KEY_PASSWORD_ARG, "Specifies the pin for the signing key."));
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java b/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
index 09e36b8..a341328 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XMLSecTool.java
@@ -889,20 +889,20 @@ public final class XMLSecTool {
if (cli.getCertificate() != null) {
try {
credential =
- CredentialHelper.getFileBasedCredentials(cli.getKey(), cli.getKeyPassword(),
+ CredentialHelper.getFileBasedCredentials(cli.getKeyFile(), cli.getKeyPassword(),
cli.getCertificate());
} catch (final KeyException e) {
- log.error("Unable to read key file " + cli.getKey(), e);
+ log.error("Unable to read key file " + cli.getKeyFile(), e);
throw new Terminator(ReturnCode.RC_IO);
} catch (final CertificateException e) {
- log.error("Unable to read certificate file " + cli.getKey(), e);
+ log.error("Unable to read certificate file " + cli.getKeyFile(), e);
throw new Terminator(ReturnCode.RC_IO);
}
} else if (cli.getPkcs11Config() != null) {
try {
credential =
CredentialHelper.getPKCS11Credential(cli.getPkcs11Config(),
- cli.getKey(), cli.getKeyPassword());
+ cli.getKeyAlias(), cli.getKeyPassword());
} catch (final IOException e) {
log.error("Error accessing PKCS11 store", e);
throw new Terminator(ReturnCode.RC_IO);
@@ -914,7 +914,8 @@ public final class XMLSecTool {
try {
credential =
CredentialHelper.getKeystoreCredential(cli.getKeystore(), cli.getKeystorePassword(),
- cli.getKeystoreProvider(), cli.getKeystoreType(), cli.getKey(), cli.getKeyPassword());
+ cli.getKeystoreProvider(), cli.getKeystoreType(), cli.getKeyAlias(),
+ cli.getKeyPassword());
} catch (final IOException e) {
log.error("Unable to read keystore " + cli.getKeystore(), e);
throw new Terminator(ReturnCode.RC_IO);
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java
index 0a66deb..fd74706 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java
@@ -49,7 +49,7 @@ public class XSTJ59Test extends BaseTest {
"--inFile", "in.xml",
"--outFile", "out.xml",
"--certificate", "sign.crt",
- "--key", "sign.key",
+ "--keyFile", "sign.key",
"--digest", "SHA-1",
"--allowDigest", "SHA-1"
};
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ69Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ69Test.java
index eec885c..c4b76cc 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ69Test.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ69Test.java
@@ -129,7 +129,7 @@ public class XSTJ69Test extends BaseTest {
"--inFile", "in.xml",
"--outFile", "out.xml",
"--certificate", "sign.crt",
- "--key", "sign.key"
+ "--keyFile", "sign.key"
};
final var cli = new CommandLineArguments();
cli.parseCommandLineArguments(args);
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ82Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ82Test.java
index 02dac8a..a7b3268 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ82Test.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ82Test.java
@@ -47,7 +47,7 @@ public class XSTJ82Test extends BaseTest {
"--outFile", "out.xml",
"--pkcs11Config", configFile.getAbsolutePath(),
"--keyPassword", "1234",
- "--key", "key2048",
+ "--keyAlias", "key2048",
};
final CommandLineArguments cli = new CommandLineArguments();
cli.parseCommandLineArguments(args);
@@ -55,7 +55,7 @@ public class XSTJ82Test extends BaseTest {
// Deep unit test on the CredentialHelper's credential acquisition method
var cred = CredentialHelper.getPKCS11Credential(cli.getPkcs11Config(),
- cli.getKey(), cli.getKeyPassword());
+ cli.getKeyAlias(), cli.getKeyPassword());
Assert.assertNotNull(cred);
var pubKey = cred.getPublicKey();
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ83Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ83Test.java
index 49d3389..0fbf22a 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ83Test.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ83Test.java
@@ -50,14 +50,14 @@ public class XSTJ83Test extends BaseTest {
"--sign",
"--inFile", testResource,
"--outFile", "out.xml",
- "--key", keyFile.getAbsolutePath(),
+ "--keyFile", keyFile.getAbsolutePath(),
"--certificate", certFile.getAbsolutePath(),
};
final CommandLineArguments cli = new CommandLineArguments();
cli.parseCommandLineArguments(args);
XMLSecTool.initLogging(cli);
- final var signingCredential = CredentialHelper.getFileBasedCredentials(cli.getKey(), "",
+ final var signingCredential = CredentialHelper.getFileBasedCredentials(cli.getKeyFile(), "",
certFile.getAbsolutePath());
Assert.assertNotNull(signingCredential);
final var verifyCredential = CredentialHelper.getFileBasedCredentials(null, "",
@@ -66,7 +66,7 @@ public class XSTJ83Test extends BaseTest {
var pubKey = signingCredential.getPublicKey();
Assert.assertNotNull(pubKey);
- System.out.println(pubKey.getClass());
+ // System.out.println(pubKey.getClass());
Assert.assertEquals(pubKey.getAlgorithm(), "EC");
Assert.assertTrue(pubKey instanceof ECPublicKey);
var ecPubKey = (ECPublicKey) pubKey;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list