[java-mvn-enforcer] 02/02: JMVN-1 Exbed Keyrings from tested repository

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-mvn-enforcer.

View the commit online:
http://git.shibboleth.net/view/?p=java-mvn-enforcer.git;a=commit;h=ebae166f8420cb25e00375ee091923f3800597ff

commit ebae166f8420cb25e00375ee091923f3800597ff
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sun Dec 5 16:17:57 2021 +0000

    JMVN-1 Exbed Keyrings from tested repository
    
    https://shibboleth.atlassian.net/browse/JMVN-1
    
    Add a test to allow the GPGdata artifact to be a SNAPSHOT (and hence
    unsigned) iff the parent artefact is also SNAPSHOT
---
 .../shibboleth/mvn/enforcer/impl/JarEnforcer.java  | 54 ++++++++++++++--------
 1 file changed, 34 insertions(+), 20 deletions(-)

diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
index 2bebc3a..2b62462 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
@@ -197,24 +197,26 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
             log.error("Could not locate data artifact {}:{}:{}", dataGroupId, dataArtifactId, dataVersion);
             throw new FileNotFoundException("Could not locate data artifact");
         }
-        final File asc = downloadArtifact(dataGroupId, dataArtifactId, dataVersion, "jar.asc");
-        if (jar == null || !jar.exists()) {
-            log.error("Could not locate data artifact signature for {}:{}:{}", dataGroupId, dataArtifactId, dataVersion);
-            throw new FileNotFoundException("Could not locate data artifact signature");
-        }
-        final File keyRingFile = new File (dataKeyRing);
-        if (!keyRingFile.exists()) {
-            log.error("KeyRing {} not found", keyRingFile);
-            throw new FileNotFoundException(dataKeyRing);
-        }
-        final GPGKeyRing keyRing = new GPGKeyRing(keyRingFile);
-        try (final InputStream ascStream = new BufferedInputStream(new FileInputStream(asc));
-             final InputStream jarStream = new BufferedInputStream(new FileInputStream(jar))) {
-
-            final Signature sig = new Signature(ascStream);
-            if (!keyRing.checkSignature(jarStream, sig)) {
-                log.error("Signature check on data artifact {}:{}:{}:{} failed", dataGroupId, dataArtifactId, dataVersion);
-                throw new EnforcerRuleException("Signature check on data artifact failed");
+        if (!isGPGDataASnapshot()) {
+            final File asc = downloadArtifact(dataGroupId, dataArtifactId, dataVersion, "jar.asc");
+            if (jar == null || !jar.exists()) {
+                log.error("Could not locate data artifact signature for {}:{}:{}", dataGroupId, dataArtifactId, dataVersion);
+                throw new FileNotFoundException("Could not locate data artifact signature");
+            }
+            final File keyRingFile = new File (dataKeyRing);
+            if (!keyRingFile.exists()) {
+                log.error("KeyRing {} not found", keyRingFile);
+                throw new FileNotFoundException(dataKeyRing);
+            }
+            final GPGKeyRing keyRing = new GPGKeyRing(keyRingFile);
+            try (final InputStream ascStream = new BufferedInputStream(new FileInputStream(asc));
+                 final InputStream jarStream = new BufferedInputStream(new FileInputStream(jar))) {
+
+                final Signature sig = new Signature(ascStream);
+                if (!keyRing.checkSignature(jarStream, sig)) {
+                    log.error("Signature check on data artifact {}:{}:{}:{} failed", dataGroupId, dataArtifactId, dataVersion);
+                    throw new EnforcerRuleException("Signature check on data artifact failed");
+                }
             }
         }
         final URL url[] = {jar.toURI().toURL()};
@@ -263,11 +265,15 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
      * @param jarPaths the jars to look at.
      * @return if this worked (or was suppressed)
      * @throws FileNotFoundException if a file was not found
+     * @throws EnforcerRuleException if we were doing an invaluid SNAPSHOT/nonSNAPSHOT test
      */
-    private boolean performSignatureCheck(final ProjectPomContext pomContext, final Path target, final List<Path> jarPaths) throws FileNotFoundException {
+    private boolean performSignatureCheck(final ProjectPomContext pomContext, final Path target, final List<Path> jarPaths) throws FileNotFoundException, EnforcerRuleException {
         boolean signatureResult = true;
         if (checkSignatures) {
-             final File out = target.resolve("signatureReport.txt").toFile();
+            if (isGPGDataASnapshot() && !pomContext.isSnapShot()) {
+                throw new EnforcerRuleException("Running a signature check of a non SNAPSHOT build against a SNAPSHOT of GPGData");
+            }
+            final File out = target.resolve("signatureReport.txt").toFile();
             try (final PrintWriter report =
                     new PrintWriter(new BufferedOutputStream(new FileOutputStream(out)))) {
                 report.format("Signature Testing started at %s\n\n", Instant.now().toString());
@@ -308,6 +314,14 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
         return depdendencyResult;
     }
 
+    /**
+     * Is the keystore a snapshot?
+     * @return of the version ends in -SNAPSHOT
+     */
+    private boolean isGPGDataASnapshot()  {
+        return dataVersion == null || dataVersion.endsWith("-SNAPSHOT");
+    }
+
     @Override
     public String getCacheId() {
         return null;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.