[JIRA] (JMVN-50) Allow local signature from data JAR to be used before resolving

[Ian Young (Jira)]

Ian Young ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ae127cb03-43ed-473d-b6ba-592949cb4be8 ) *created* an issue

Maven Enforcer ( https://shibboleth.atlassian.net/browse/JMVN?atlOrigin=eyJpIjoiYmExZGU0NTlhMTE0NDE5ZDg5N2YzYTdjZjE4MmI2ZDUiLCJwIjoiaiJ9 ) / New Feature ( https://shibboleth.atlassian.net/browse/JMVN-50?atlOrigin=eyJpIjoiYmExZGU0NTlhMTE0NDE5ZDg5N2YzYTdjZjE4MmI2ZDUiLCJwIjoiaiJ9 ) JMVN-50 ( https://shibboleth.atlassian.net/browse/JMVN-50?atlOrigin=eyJpIjoiYmExZGU0NTlhMTE0NDE5ZDg5N2YzYTdjZjE4MmI2ZDUiLCJwIjoiaiJ9 ) Allow local signature from data JAR to be used before resolving ( https://shibboleth.atlassian.net/browse/JMVN-50?atlOrigin=eyJpIjoiYmExZGU0NTlhMTE0NDE5ZDg5N2YzYTdjZjE4MmI2ZDUiLCJwIjoiaiJ9 )

Issue Type: New Feature Assignee: Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) Created: 11/Apr/23 12:43 PM Priority: Trivial Reporter: Ian Young ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ae127cb03-43ed-473d-b6ba-592949cb4be8 )

If we’re checking an artifact, there are situations in which it would be useful for a local signature resource defined in the data JAR’s localSignatures collection to be located and used before (and therefore overriding) any signature file in the local .m2 repository or fetched from another repository.

This would provide a more targeted alternative for us to work around supply chain issues where the artifact HAS a signature but from a GPG key we can’t authenticate. Rather than accepting the questionable key into the keyring for the artifact’s group (and therefore allowing it to sign any artifact in that group, forever) we’d make a signature overriding the existing one, signed by one of our own keys and add THAT to the group’s keyring.

At present, as I understand it, the localSignatures collection is only examined as a fallback when no signature can be resolved; the proposal here is to reverse that ordering.

( https://shibboleth.atlassian.net/browse/JMVN-50#add-comment?atlOrigin=eyJpIjoiYmExZGU0NTlhMTE0NDE5ZDg5N2YzYTdjZjE4MmI2ZDUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JMVN-50#add-comment?atlOrigin=eyJpIjoiYmExZGU0NTlhMTE0NDE5ZDg5N2YzYTdjZjE4MmI2ZDUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100221- sha1:9ff53d8 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230411/aa6c3839/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-24042121-a13c-4977-8c54-ea1c16aca709
Type: image/png
Size: 302 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230411/aa6c3839/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-ee77e726-0bcd-41f7-ae7b-a17bfd81bb34
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230411/aa6c3839/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-d3ed8d74-6ced-4cf6-bc22-b8a3f866d810
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230411/aa6c3839/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-06f53760-04e2-4dac-8b34-b9d09c2265bb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230411/aa6c3839/attachment-0007.png>