[java-idp-plugin-jetty] 177/186: JJETTY-13 Implement Jetty-base plugin V2

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch dev/foo
in repository java-idp-plugin-jetty.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-jetty.git;a=commit;h=f882b156a60905282dd5b90e0ed0a4fabe391586

commit f882b156a60905282dd5b90e0ed0a4fabe391586
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Jul 14 19:51:58 2025 +0100

    JJETTY-13 Implement Jetty-base plugin V2
    
    https://shibboleth.atlassian.net/browse/JJETTY-13
    
    Signature Checking
---
 jetty-cli/pom.xml                                  |   5 +++
 .../plugin/jetty/cli/impl/JettyDownloadCLI.java    |  37 ++++++++++++++++++++-
 ...ystore.gpg => jetty-base-download-keystore.gpg} | Bin
 3 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/jetty-cli/pom.xml b/jetty-cli/pom.xml
index e6445da..34c0393 100644
--- a/jetty-cli/pom.xml
+++ b/jetty-cli/pom.xml
@@ -63,6 +63,11 @@
             <artifactId>slf4j-api</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcpg-jdk18on</artifactId>
+            <scope>provided</scope>
+        </dependency>
         
         <dependency>
             <groupId>org.testng</groupId>
diff --git a/jetty-cli/src/main/java/net/shibboleth/idp/plugin/jetty/cli/impl/JettyDownloadCLI.java b/jetty-cli/src/main/java/net/shibboleth/idp/plugin/jetty/cli/impl/JettyDownloadCLI.java
index 97a21e3..78eb5fe 100644
--- a/jetty-cli/src/main/java/net/shibboleth/idp/plugin/jetty/cli/impl/JettyDownloadCLI.java
+++ b/jetty-cli/src/main/java/net/shibboleth/idp/plugin/jetty/cli/impl/JettyDownloadCLI.java
@@ -13,14 +13,19 @@
  */
 package net.shibboleth.idp.plugin.jetty.cli.impl;
 
+import java.io.BufferedInputStream;
+import java.io.FileInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.security.Security;
 import java.util.List;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.opensaml.security.httpclient.HttpClientSecurityContextHandler;
 import org.opensaml.security.httpclient.HttpClientSecurityParameters;
 import org.slf4j.Logger;
@@ -30,6 +35,8 @@ import org.springframework.core.io.Resource;
 import net.shibboleth.idp.Version;
 import net.shibboleth.idp.cli.AbstractIdPHomeAwareCommandLine;
 import net.shibboleth.idp.installer.InstallerSupport;
+import net.shibboleth.idp.installer.TrustStore;
+import net.shibboleth.idp.installer.TrustStore.Signature;
 import net.shibboleth.shared.cli.AbstractCommandLine;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -91,6 +98,9 @@ public class JettyDownloadCLI extends AbstractIdPHomeAwareCommandLine<JettyDownl
 
         super.doRun(args);
 
+        if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
+            Security.addProvider(new BouncyCastleProvider());
+        }
 	    
 	    if (args.getBaseURL() == null) {
 	        //
@@ -165,7 +175,7 @@ public class JettyDownloadCLI extends AbstractIdPHomeAwareCommandLine<JettyDownl
 	        
 	        keyStore = idpHome.resolve(args.getKeystore());
 	        
-	        if (Files.exists(keyStore)) {
+	        if (!Files.exists(keyStore)) {
                 log.error("keystore file {} does not exist", keyStore);
                 return RC_IO;
 	        }
@@ -228,6 +238,31 @@ public class JettyDownloadCLI extends AbstractIdPHomeAwareCommandLine<JettyDownl
      * @return an RC result
      */
     private int sigCheck(JettyDownloadArguments args) {
+        if (args.isNoSigCheck()) {
+            log.info("Downloaded file {} not signature checked.  Do this separately", downloadFileName);
+            return RC_OK;
+        }
+        try (final InputStream sigStream = new BufferedInputStream(
+                new FileInputStream(downloadsDir.resolve(downloadFileName + ".asc").toFile()));
+            final InputStream dataStream  = new BufferedInputStream(
+                    new FileInputStream(downloadsDir.resolve(downloadFileName).toFile()));  ) {
+
+            final TrustStore trust = new TrustStore();
+            trust.setTrustStore(keyStore.toAbsolutePath().toString());
+            trust.initialize();
+            final Signature sig = TrustStore.signatureOf(sigStream);
+            if (!trust.contains(sig)) {
+                log.error("TrustStore does not contain signature {}", sig);
+                return RC_IO;
+            }
+            if (!trust.checkSignature(dataStream, sig)) {
+                log.error("Signature checked for {} failed", downloadFileName);
+                return RC_IO;
+            }
+        } catch (final ComponentInitializationException | IOException e) {
+            log.error("Could not signature check", downloadFileName, e);
+            return RC_IO;
+        }
         return RC_OK;
     }
 
diff --git a/jetty-cli/src/test/resources/idphome-test/credentials/jetty-keystore.gpg b/jetty-cli/src/test/resources/idphome-test/credentials/jetty-base-download-keystore.gpg
similarity index 100%
rename from jetty-cli/src/test/resources/idphome-test/credentials/jetty-keystore.gpg
rename to jetty-cli/src/test/resources/idphome-test/credentials/jetty-base-download-keystore.gpg

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.