1 /*
2  * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4  *
5  * This code is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 only, as
7  * published by the Free Software Foundation.
8  *
9  * This code is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * version 2 for more details (a copy is included in the LICENSE file that
13  * accompanied this code).
14  *
15  * You should have received a copy of the GNU General Public License version
16  * 2 along with this work; if not, write to the Free Software Foundation,
17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20  * or visit www.oracle.com if you need additional information or have any
21  * questions.
22  */
23 
24 import java.util.List;
25 import java.util.regex.Matcher;
26 import java.util.regex.Pattern;
27 import java.util.stream.Collectors;
28 
29 import jdk.jpackage.test.TKit;
30 import jdk.jpackage.test.Executor;
31 
32 import jdk.incubator.jpackage.internal.MacCertificate;
33 
34 public class SigningCheck {
35 
checkCertificates()36     public static void checkCertificates() {
37         List<String> result = findCertificate(SigningBase.APP_CERT, SigningBase.KEYCHAIN);
38         String key = findKey(SigningBase.APP_CERT, result);
39         validateCertificate(key);
40         validateCertificateTrust(SigningBase.APP_CERT);
41 
42         result = findCertificate(SigningBase.INSTALLER_CERT, SigningBase.KEYCHAIN);
43         key = findKey(SigningBase.INSTALLER_CERT, result);
44         validateCertificate(key);
45         validateCertificateTrust(SigningBase.INSTALLER_CERT);
46     }
47 
findCertificate(String name, String keyChain)48     private static List<String> findCertificate(String name, String keyChain) {
49         List<String> result = new Executor()
50                 .setExecutable("security")
51                 .addArguments("find-certificate", "-c", name, "-a", keyChain)
52                 .executeAndGetOutput();
53 
54         return result;
55     }
56 
findKey(String name, List<String> result)57     private static String findKey(String name, List<String> result) {
58         Pattern p = Pattern.compile("\"alis\"<blob>=\"([^\"]+)\"");
59         Matcher m = p.matcher(result.stream().collect(Collectors.joining()));
60         if (!m.find()) {
61             TKit.trace("Did not found a key for '" + name + "'");
62             return null;
63         }
64         String matchedKey = m.group(1);
65         if (m.find()) {
66             TKit.trace("Found more than one key for '" + name + "'");
67             return null;
68         }
69         TKit.trace("Using key '" + matchedKey);
70         return matchedKey;
71     }
72 
validateCertificate(String key)73     private static void validateCertificate(String key) {
74         if (key != null) {
75             MacCertificate certificate = new MacCertificate(key);
76             if (!certificate.isValid()) {
77                 TKit.throwSkippedException("Certifcate expired: " + key);
78             } else {
79                 return;
80             }
81         }
82 
83         TKit.throwSkippedException("Cannot find required certifciates: " + key);
84     }
85 
validateCertificateTrust(String name)86     private static void validateCertificateTrust(String name) {
87         List<String> result = new Executor()
88                 .setExecutable("security")
89                 .addArguments("dump-trust-settings")
90                 .executeAndGetOutput();
91         result.stream().forEachOrdered(TKit::trace);
92         TKit.assertTextStream(name)
93                 .predicate((line, what) -> line.trim().endsWith(what))
94                 .orElseThrow(() -> TKit.throwSkippedException(
95                         "Certifcate not trusted by current user: " + name))
96                 .apply(result.stream());
97     }
98 
99 }
100