[java-mvn-enforcer] 02/03: JMVN-61 Teach the m2 enforcer to sig check zip files
Rod Widdowson
rdw at steadingsoftware.com
Sun Nov 5 14:49:59 UTC 2023
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-mvn-enforcer.
View the commit online:
http://git.shibboleth.net/view/?p=java-mvn-enforcer.git;a=commit;h=db8c3e648e4233aef08a5180993cf22af6e287c1
commit db8c3e648e4233aef08a5180993cf22af6e287c1
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sun Nov 5 14:47:06 2023 +0000
JMVN-61 Teach the m2 enforcer to sig check zip files
https://shibboleth.atlassian.net/browse/JMVN-61
---
.../mvn/enforcer/impl/BaseSigChecker.java | 24 +++++++++++++---------
.../shibboleth/mvn/enforcer/impl/JarEnforcer.java | 6 ++++--
.../shibboleth/mvn/enforcer/impl/M2SigChecker.java | 21 +++++++++++++++----
.../shibboleth/mvn/enforcer/impl/SigChecker.java | 2 +-
4 files changed, 36 insertions(+), 17 deletions(-)
diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
index 5a466f8..40bdcf1 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/BaseSigChecker.java
@@ -90,12 +90,13 @@ public class BaseSigChecker {
}
- /** Given the Path and the parent dir check the signature.
+ /** Given the jar, the arteifact and the type check the signature.
* @param jarFile the file to check
* @param artifact the {@link DependencyPomArtifact} for the jar file.
+ * @param type jar or zip
* @return true if the signature passed (or some other "usual conditions)
*/
- protected boolean checkSignature(final InputStream jarFile, final PomArtifact artifact) {
+ protected boolean checkSignature(final InputStream jarFile, final PomArtifact artifact, @Nonnull final String type) {
final String group = artifact.getGroupId();
final String id = artifact.getArtifactId();
final String version;
@@ -120,7 +121,7 @@ public class BaseSigChecker {
log.error("Artifact: {} Version: {} Group: {} No keyring ", id, version, group);
return false;
}
- final Signature sig = getSignature(artifact);
+ final Signature sig = getSignature(artifact, type);
if (sig == null) {
report.format("%-30s: %-14s Could not find signature (group : %s)\n", id, version, group);
log.error("{} {} could not find signature (group={})", id, version, group);
@@ -153,11 +154,12 @@ public class BaseSigChecker {
/** Locate and load the signature for this from our local signatures.
* @param artifact what to load
+ * @param type jar or zip
* @return the Signature or null if we couldn't locate it.
*/
- @Nullable private Signature getSignatureLocal(final PomArtifact artifact) {
+ @Nullable private Signature getSignatureLocal(final PomArtifact artifact, @Nonnull final String type) {
log.debug("Trying classpath store for {}.", artifact);
- final String name = ProjectPomContext.CLASSPATH_ROOT + "localSignatures/" + artifact.toString() + ".jar.asc";
+ final String name = ProjectPomContext.CLASSPATH_ROOT + "localSignatures/" + artifact.toString() + "." + type + ".asc";
try (final InputStream stream = getProjectContext().getEnforcerLoader().getResourceAsStream(name)) {
if (stream == null) {
log.debug("Signature for {} not found in classpath store", artifact);
@@ -176,12 +178,13 @@ public class BaseSigChecker {
/** Locate and load the signature for this artifact from maven.
* @param artifact what to load
+ * @param type jar or zip
* @return the Signature or null if we couldn't locate it.
*/
- private Signature getSignatureMaven(final PomArtifact artifact) {
+ private Signature getSignatureMaven(final PomArtifact artifact, @Nonnull final String type) {
Path path;
try {
- path = getMavenLoader().downloadArtifact(artifact, "jar.asc");
+ path = getMavenLoader().downloadArtifact(artifact, type + ".asc");
} catch (final Exception e) {
log.error("Could not load {} from maven loader or from classpath", artifact, e);
path = null;
@@ -199,14 +202,15 @@ public class BaseSigChecker {
/** Locate and load the signature for this artifact.
* @param artifact what to load
+ * @param type jar or zip
* @return the Signature or null if we couldn't locate it.
*/
- private Signature getSignature(final PomArtifact artifact) {
- final Signature localSig = getSignatureLocal(artifact);
+ private Signature getSignature(final PomArtifact artifact, @Nonnull final String type) {
+ final Signature localSig = getSignatureLocal(artifact, type);
if (localSig != null) {
return localSig;
}
- return getSignatureMaven(artifact);
+ return getSignatureMaven(artifact, type);
}
/** Locate the keyring in the cache or load & cache it (or a negative lookup).
diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
index 3a77802..af4fc63 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
@@ -97,8 +97,10 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
* Requires that {@link #checkDependencies} be true.
*/
private boolean listJarSources;
- /** Will we check that all jars in ~/.m2/... jars have valid signatures? */
+ /** Will we check that all jars (optionally zips) in ~/.m2/... jars have valid signatures? */
private boolean checkM2;
+ /** When checking M2, do we care about zip files ?*/
+ private boolean zipsInM2Check;
/** Fully Qualified Path of M2 Report.*/
private String m2ReportPath;
/** Fully Qualified Path of Signature Report.*/
@@ -338,7 +340,7 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
try (final PrintWriter report =
new PrintWriter(new BufferedOutputStream(new FileOutputStream(getM2ReportPath().toFile())))) {
report.format("M2 Signature Testing started at %s\n\n", Instant.now().toString());
- final M2SigChecker chk = new M2SigChecker(pomContext, report);
+ final M2SigChecker chk = new M2SigChecker(pomContext, report, zipsInM2Check);
m2Result = chk.testSignatures(root);
report.format("Completed at %s\n\n", Instant.now().toString());
}
diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java
index ad41c21..f159f9f 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/M2SigChecker.java
@@ -42,14 +42,20 @@ public class M2SigChecker extends BaseSigChecker {
/** Our log. */
private final Logger log = EnforcerLogger.getLogger(M2SigChecker.class);
+ /** How many things have failed? */
private int failCount;
+ /** Do we care about zip files? */
+ private final boolean checkZips;
+
/** Constructor.
* @param project The project
* @param writer Where to write our report
+ * @param considerZips Do we want to sig check zip files?
*/
- public M2SigChecker(@Nonnull final ProjectPomContext project, @Nonnull final PrintWriter writer) {
+ public M2SigChecker(@Nonnull final ProjectPomContext project, @Nonnull final PrintWriter writer, boolean considerZips) {
super(project, writer);
+ checkZips = considerZips;
}
/** The Body of the signature test. Are all the files what we expected?
@@ -83,7 +89,14 @@ public class M2SigChecker extends BaseSigChecker {
final FileVisitResult result = super.visitFile(file, attrs);
final Path relativePath = root.relativize(file);
final String fileName = file.getFileName().toString();
- if (!fileName.endsWith(".jar") ||
+ String fileType = "jar";
+ if (fileName.endsWith(".zip")) {
+ if (!checkZips) {
+ return result;
+ }
+ fileType = "zip";
+ }
+ else if (!fileName.endsWith(".jar") ||
fileName.endsWith("-tests.jar") ||
fileName.endsWith("-sources.jar") ||
fileName.endsWith("-javadoc.jar") ) {
@@ -91,7 +104,7 @@ public class M2SigChecker extends BaseSigChecker {
}
final PomArtifact info = artifactFromPath(relativePath);
if (info == null || info.getVersion() == null) {
- log.error("Badly located jar file {}", file);
+ log.error("Badly located file {}", file);
return result;
}
if (info.getVersion().endsWith("SNAPSHOT")) {
@@ -105,7 +118,7 @@ public class M2SigChecker extends BaseSigChecker {
}
return result;
}
- if (!checkSignature(new BufferedInputStream(new FileInputStream(file.toFile())), info)) {
+ if (!checkSignature(new BufferedInputStream(new FileInputStream(file.toFile())), info, fileType)) {
failCount ++;
}
return result;
diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/SigChecker.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/SigChecker.java
index a85102f..297015a 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/SigChecker.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/SigChecker.java
@@ -81,7 +81,7 @@ public class SigChecker extends BaseSigChecker {
private int checkSignature(final String jarPath, final InputStream input) {
final String jarName = Path.of(jarPath).getFileName().toString();
final PomArtifact jarAsArtifact = getProjectContext().splitFileName(jarName);
- if (checkSignature(input, jarAsArtifact)) {
+ if (checkSignature(input, jarAsArtifact, "jar")) {
return 0;
}
return 1;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list