[java-oidc-common] 02/02: JPAR-182 Add signature checking.

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=58a5ab7afa6a8a1dc15ce8b33553c441fcbdad56

commit 58a5ab7afa6a8a1dc15ce8b33553c441fcbdad56
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sat Sep 25 13:35:05 2021 +0100

    JPAR-182 Add signature checking.
    
    https://shibboleth.atlassian.net/browse/JPAR-182
---
 oidc-common-dist/pom.xml                           |  34 +++++++++++++++++++--
 .../src/main/enforcer/keyRings/com.nimbusds.gpg    | Bin 0 -> 1237 bytes
 .../src/main/enforcer/keyRings/net.minidev.gpg     | Bin 0 -> 1237 bytes
 3 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/oidc-common-dist/pom.xml b/oidc-common-dist/pom.xml
index fc6e085..00e89a3 100644
--- a/oidc-common-dist/pom.xml
+++ b/oidc-common-dist/pom.xml
@@ -65,9 +65,39 @@
                     <tarLongFileMode>gnu</tarLongFileMode>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <dependencies>
+                    <dependency>
+                        <groupId>net.shibboleth.maven.enforcer.rules</groupId>
+                        <artifactId>maven-dist-enforcer</artifactId>
+                        <version>2.0.0</version>
+                    </dependency>
+                </dependencies>
+                <executions>
+                    <execution>
+                        <id>oidc-rp-enforce</id>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <jarEnforcer implementation="net.shibboleth.mvn.enforcer.impl.JarEnforcer">
+                                    <enforcerData>${basedir}/src/main/enforcer</enforcerData>
+                                    <parentPomDir>${basedir}/..</parentPomDir>
+                                    <jarDirs>${basedir}/../oidc-common-attribute-api/target/dependency {basedir}/../oidc-common-attribute-impl/target/dependency ${basedir}/../oidc-common-crypto-api/target/dependency ${basedir}/../oidc-common-crypto-impl/target/dependency ${basedir}/../oidc-common-metadata-api/target/dependency ${basedir}/../oidc-common-metadata-impl/target/dependency  ${basedir}/../oidc-common-saml-api/target/dependency  ${basedir}/../oidc-common-saml/target/dependency</ [...]
+                                    <checkSignatures>true</checkSignatures>
+                                    <checkDependencies>false</checkDependencies>
+                                    <listJarSources>false</listJarSources>
+                                </jarEnforcer>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
-
     </build>
 
-
 </project>
diff --git a/oidc-common-dist/src/main/enforcer/keyRings/com.nimbusds.gpg b/oidc-common-dist/src/main/enforcer/keyRings/com.nimbusds.gpg
new file mode 100644
index 0000000..130d917
Binary files /dev/null and b/oidc-common-dist/src/main/enforcer/keyRings/com.nimbusds.gpg differ
diff --git a/oidc-common-dist/src/main/enforcer/keyRings/net.minidev.gpg b/oidc-common-dist/src/main/enforcer/keyRings/net.minidev.gpg
new file mode 100644
index 0000000..f070f6b
Binary files /dev/null and b/oidc-common-dist/src/main/enforcer/keyRings/net.minidev.gpg differ

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.