[java-mvn-enforcer] 04/05: JPAR-190 Investigate an enforcer to check all jars and poms ~/.m2/.... towards the end of a build
Rod Widdowson
rdw at steadingsoftware.com
Sun Oct 10 13:34:38 UTC 2021
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-mvn-enforcer.
View the commit online:
http://git.shibboleth.net/view/?p=java-mvn-enforcer.git;a=commit;h=22d792699fc36a244d28e59c3931839980c37a95
commit 22d792699fc36a244d28e59c3931839980c37a95
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sat Oct 9 16:40:33 2021 +0100
JPAR-190 Investigate an enforcer to check all jars and poms ~/.m2/.... towards the end of a build
https://shibboleth.atlassian.net/browse/JPAR-190
Wire m2 enforcement checking in to the top level enforcer.
---
.../shibboleth/mvn/enforcer/impl/JarEnforcer.java | 143 ++++++++++++++-------
1 file changed, 100 insertions(+), 43 deletions(-)
diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
index 5ab80df..4a30f30 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
@@ -18,6 +18,7 @@ package net.shibboleth.mvn.enforcer.impl;
import java.io.BufferedOutputStream;
import java.io.File;
+import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.PrintWriter;
import java.nio.file.Files;
@@ -61,10 +62,10 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
/** Where to get the mapping of artifact to group. */
private String artifactMap = "";
- /** Will we check that all jars have signatures? */
+ /** Will we check that all jars we distribute jars have valid signatures? */
private boolean checkSignatures = true;
- /** Will we check that the jars are versions we expected? */
+ /** Will we check that the jars we distribute are versions we expected? */
private boolean checkDependencies = true;
/** Do we want to find out which jar files were included on behalf of which
@@ -74,6 +75,9 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
*/
private boolean listJarSources;
+ /** Will we check that all jars in ~/.m2/... jars have valid signatures? */
+ private boolean checkM2;
+
/** Our artifact factory. This is deprecated but there seems no easy way to create one.
* (No replacement is suggested and the best code out there creates a pom file and parses it.
* Really?
@@ -92,7 +96,6 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
/** Our Maven log. */
private Log log;
- // Checkstyle: CyclomaticComplexity|MethodLength OFF
@Override
public void execute(final EnforcerRuleHelper helper) throws EnforcerRuleException {
log = helper.getLog();
@@ -138,52 +141,22 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
pomContext.initialize(pom);
- final File out2 = target.resolve("m2SignatureReport.txt").toFile();
- try (final PrintWriter report2 =
- new PrintWriter(new BufferedOutputStream(new FileOutputStream(out2)))) {
- report2.format("M2 Signature Testing started at %s\n\n", Instant.now().toString());
- final M2SigChecker chk = new M2SigChecker(pomContext, report2);
- chk.testSignatures(Path.of("c:/users/rdw/.m2/repository"));
- }
-
- boolean depdendencyResult = true;
- if (checkDependencies) {
- final File out = target.resolve("dependencyReport.txt").toFile();
- try (final PrintWriter report = new PrintWriter(
- new BufferedOutputStream(new FileOutputStream(out)))) {
- report.format("POM based Dependency Testing started at %s\n\n", Instant.now().toString());
-
- final DependencyChecker checker = new DependencyChecker(pomContext, report);
- depdendencyResult = checker.checkDependencies(jarPaths, listJarSources);
- report.format("Completed at %s\n\n", Instant.now().toString());
- if (!depdendencyResult) {
- log.error( "Dependency check failed, check the file ./target/dependencyReport.txt");
- }
- }
- }
-
- boolean signatureResult = true;
- if (checkSignatures) {
- final File out = target.resolve("signatureReport.txt").toFile();
- try (final PrintWriter report =
- new PrintWriter(new BufferedOutputStream(new FileOutputStream(out)))) {
- report.format("Signature Testing started at %s\n\n", Instant.now().toString());
- final SigChecker sigChecker = new SigChecker(pomContext, report);
- signatureResult = sigChecker.testSignatures(jarPaths);
- report.format("Completed at %s\n\n", Instant.now().toString());
- if (!signatureResult) {
- log.error("Signature check failed, check the file ./target/signatureReport.txt");
- }
- }
- }
+ final boolean m2Result = performM2Check(pomContext, target);
+ final boolean depdendencyResult = performDependencyCheck(pomContext, target, jarPaths);
+ final boolean signatureResult = performSignatureCheck(pomContext, target, jarPaths);
if (!depdendencyResult) {
throw new EnforcerRuleException(
"Dependency check failed, check the file ./target/dependencyReport.txt");
}
if (!signatureResult) {
throw new EnforcerRuleException(
- "Signature check failed, check the file ./target/signatureReport.txt");
+ "Signature check over distribution failed, check the file ./target/signatureReport.txt");
}
+ if (!m2Result) {
+ throw new EnforcerRuleException(
+ "Signature check ove ~m2 failed, check the file ./target/m2Report.txt");
+ }
+
}
} catch (final EnforcerRuleException e) {
throw e;
@@ -191,8 +164,92 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
throw new EnforcerRuleException(e.toString() + " "+ e.getMessage(), e);
}
}
- // Checkstyle: CyclomaticComplexity|MethodLength ON
+ /** Do the m2 signature checks
+ * @param pomContext Context for the work
+ * @param target Target Directory of this project
+ * @return if this worked (or was suppressed)
+ * @throws Exception is resolution fails
+ */
+ private boolean performM2Check(final ProjectPomContext pomContext, final Path target) throws Exception {
+ boolean m2Result = true;
+ if (checkM2) {
+ // cannot use our artifacts because sometimes we get the in source one
+ final PomArtifact artifact = pomContext.getParentPom().new
+ PomArtifact("org.opensaml", "opensaml-parent", "4.1.0");
+ final Path resolvedPom = downloadArtifact(artifact, "pom");
+ // Resolved pm path is <pathTpM2Repo>/group1/group2/..../artifact/version/pomfilename
+ log.debug("Resolved Pom = " + resolvedPom.toString());
+ Path root = resolvedPom.getParent().getParent().getParent(); // strip version, artifact
+ int index = artifact.getGroupId().indexOf('.');
+ while (index > 0) {
+ root = root.getParent();
+ index = artifact.getGroupId().indexOf('.', index+1);
+ }
+ root = root.getParent();
+ log.info("Inferred M2 Root at " + root.toString());
+ final File out2 = target.resolve("m2SignatureReport.txt").toFile();
+ try (final PrintWriter report =
+ new PrintWriter(new BufferedOutputStream(new FileOutputStream(out2)))) {
+ report.format("M2 Signature Testing started at %s\n\n", Instant.now().toString());
+ final M2SigChecker chk = new M2SigChecker(pomContext, report);
+ m2Result = chk.testSignatures(root);
+ report.format("Completed at %s\n\n", Instant.now().toString());
+ }
+ }
+ return m2Result;
+ }
+
+ /** Do the signature check
+ * @param pomContext Context for the work
+ * @param target Target Directory of this project
+ * @param jarPaths the jars to look at.
+ * @return if this worked (or was suppressed)
+ * @throws FileNotFoundException if a file was not found
+ */
+ private boolean performSignatureCheck(final ProjectPomContext pomContext, final Path target, final List<Path> jarPaths) throws FileNotFoundException {
+ boolean signatureResult = true;
+ if (checkSignatures) {
+ final File out = target.resolve("signatureReport.txt").toFile();
+ try (final PrintWriter report =
+ new PrintWriter(new BufferedOutputStream(new FileOutputStream(out)))) {
+ report.format("Signature Testing started at %s\n\n", Instant.now().toString());
+ final SigChecker sigChecker = new SigChecker(pomContext, report);
+ signatureResult = sigChecker.testSignatures(jarPaths);
+ report.format("Completed at %s\n\n", Instant.now().toString());
+ if (!signatureResult) {
+ log.error("Signature check failed, check the file ./target/signatureReport.txt");
+ }
+ }
+ }
+ return signatureResult;
+ }
+
+ /** Do the dependency check
+ * @param pomContext Context for the work
+ * @param target Target Directory of this project
+ * @param jarPaths the jars to look at.
+ * @return if this worked (or was suppressed)
+ * @throws FileNotFoundException if a file was not found
+ */
+ private boolean performDependencyCheck(final ProjectPomContext pomContext, final Path target, final List<Path> jarPaths) throws FileNotFoundException {
+ boolean depdendencyResult = true;
+ if (checkDependencies) {
+ final File out = target.resolve("dependencyReport.txt").toFile();
+ try (final PrintWriter report = new PrintWriter(
+ new BufferedOutputStream(new FileOutputStream(out)))) {
+ report.format("POM based Dependency Testing started at %s\n\n", Instant.now().toString());
+
+ final DependencyChecker checker = new DependencyChecker(pomContext, report);
+ depdendencyResult = checker.checkDependencies(jarPaths, listJarSources);
+ report.format("Completed at %s\n\n", Instant.now().toString());
+ if (!depdendencyResult) {
+ log.error( "Dependency check failed, check the file ./target/dependencyReport.txt");
+ }
+ }
+ }
+ return depdendencyResult;
+ }
@Override
public String getCacheId() {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list