[java-mvn-enforcer] branch main updated: JMVN-38 Detect missing keyrings - even when artifacts are SNAPSHOT

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-mvn-enforcer.

View the commit online:
http://git.shibboleth.net/view/?p=java-mvn-enforcer.git;a=commit;h=abf7a9aeace83385e5b299e8fa83bcfd28a0fea5

The following commit(s) were added to refs/heads/main by this push:
     new abf7a9a  JMVN-38 Detect missing keyrings - even when artifacts are SNAPSHOT
abf7a9a is described below

commit abf7a9aeace83385e5b299e8fa83bcfd28a0fea5
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Apr 19 13:44:04 2022 +0100

    JMVN-38 Detect missing keyrings - even when artifacts are SNAPSHOT
    
    https://shibboleth.atlassian.net/browse/JMVN-38
    
    Check for keyring before ignoring SNAPSHOTS
---
 .../java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java     | 2 +-
 src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java  | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
index dd97883..0d47d10 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
@@ -192,7 +192,7 @@ public class BaseSigChecker {
      * @param group the group to load
      * @return a keyring or null if there wasn't one.
      */
-    private GPGKeyRing getKeyRing(final String group) {
+    protected GPGKeyRing getKeyRing(final String group) {
         final Optional<GPGKeyRing> opt = keyRings.get(group);
         if (opt != null) {
             if (opt.isEmpty()) {
diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java
index 4ec5538..e7e70ce 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java
@@ -95,6 +95,14 @@ public class M2SigChecker extends BaseSigChecker {
                 return result;
             }
             if (info.getVersion().endsWith("SNAPSHOT")) {
+                final GPGKeyRing keyRing = getKeyRing(info.getGroupId());
+                if (keyRing == null) {
+                    getReport().format("%-30s: %-14s No keyring for group %s\n", info.getArtifactId(),
+                            info.getVersion(), info.getGroupId());
+                    log.error("Artifact: {} Version: {} Group: {} No keyring ",info.getArtifactId(),
+                            info.getVersion(), info.getGroupId());
+                    failCount ++;
+                }
                 return result;
             }
             if (!checkSignature(new BufferedInputStream(new FileInputStream(file.toFile())), info)) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.