[java-mvn-enforcer] branch main updated: JMVN-50 Allow local signature from data JAR to be used before resolving

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-mvn-enforcer.

View the commit online:
http://git.shibboleth.net/view/?p=java-mvn-enforcer.git;a=commit;h=2befb11839a96a97c046011bc9b2fccb14e90f9c

The following commit(s) were added to refs/heads/main by this push:
     new 2befb11  JMVN-50 Allow local signature from data JAR to be used before resolving
2befb11 is described below

commit 2befb11839a96a97c046011bc9b2fccb14e90f9c
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Apr 13 16:53:02 2023 +0100

    JMVN-50 Allow local signature from data JAR to be used before resolving
    
    https://shibboleth.atlassian.net/browse/JMVN-50
---
 .../mvn/enforcer/impl/BaseSigChecker.java          | 61 +++++++++++++++-------
 1 file changed, 41 insertions(+), 20 deletions(-)

diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
index b995eb0..5a466f8 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
@@ -30,6 +30,7 @@ import java.util.Map;
 import java.util.Optional;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.slf4j.Logger;
@@ -149,36 +150,44 @@ public class BaseSigChecker {
                 id, version, group, keyRing.getKeyInfo(sig));
         return true;
     }
- 
-    /** Locate and load the signature for this artifact.
+
+    /** Locate and load the signature for this from our local signatures.
      * @param artifact what to load
      * @return the Signature or null if we couldn't locate it.
      */
-    private Signature getSignature(final PomArtifact artifact) {
+    @Nullable private Signature getSignatureLocal(final PomArtifact artifact) {
+        log.debug("Trying classpath store for {}.", artifact);
+        final String name = ProjectPomContext.CLASSPATH_ROOT +  "localSignatures/" + artifact.toString() + ".jar.asc";
+        try (final InputStream stream = getProjectContext().getEnforcerLoader().getResourceAsStream(name)) {
+            if (stream == null) {
+                log.debug("Signature for {} not found in classpath store", artifact);
+                return null;
+            }
+            final Signature sig =  GPGKeyRing.signatureOf(stream);
+            report.format("%-30s: %-14s Signature loaded from classpath store\n",
+                    artifact.getArtifactId(), artifact.getVersion());
+            log.info("Signature for {} found in classpath store.", artifact);
+            return sig;
+        } catch (final Throwable e) {
+            log.error("Could not load signature from classpath store:", e);
+            return null;
+        }
+    }
+
+    /** Locate and load the signature for this artifact from maven.
+     * @param artifact what to load
+     * @return the Signature or null if we couldn't locate it.
+     */
+    private Signature getSignatureMaven(final PomArtifact artifact) {
         Path path;
         try {
             path = getMavenLoader().downloadArtifact(artifact, "jar.asc");
         } catch (final Exception e) {
-            log.debug("Error loading {} from maven loader", artifact, e);
+            log.error("Could not load {} from maven loader or from classpath", artifact, e);
             path = null;
         }
         if (path == null || !Files.exists(path)) {
-            log.info("Could not find signature for {}, trying classpath store.", artifact);
-            final String name = ProjectPomContext.CLASSPATH_ROOT +  "localSignatures/" + artifact.toString() + ".jar.asc";
-            try (final InputStream stream = getProjectContext().getEnforcerLoader().getResourceAsStream(name)) {
-                if (stream == null) {
-                    log.error("Signature for {} not found in classpath store", artifact);
-                    return null;
-                }
-                final Signature sig =  GPGKeyRing.signatureOf(stream);
-                report.format("%-30s: %-14s Signature not available.  Loaded from classpath store\n",
-                        artifact.getArtifactId(), artifact.getVersion());
-                log.info("Signature for {} found in classpath store.", artifact);
-                return sig;
-            } catch (final Throwable e) {
-                log.error("Could not load signature from classpath store:", e);
-                return null;
-            }
+            return null;
         }
         try (final InputStream stream = new BufferedInputStream(new FileInputStream(path.toFile()))) {
             return GPGKeyRing.signatureOf(stream);
@@ -188,6 +197,18 @@ public class BaseSigChecker {
         }
     }
 
+    /** Locate and load the signature for this artifact.
+     * @param artifact what to load
+     * @return the Signature or null if we couldn't locate it.
+     */
+    private Signature getSignature(final PomArtifact artifact) {
+        final Signature localSig = getSignatureLocal(artifact);
+        if (localSig != null) {
+            return localSig;
+        }
+        return getSignatureMaven(artifact);
+    }
+
     /** Locate the keyring in the cache or load & cache it (or a negative lookup).
      * @param group the group to load
      * @return a keyring or null if there wasn't one.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.