Examples with ManifestDigester sun.security.util.ManifestDigester used on opensource projects

Example 1 with ManifestDigester

use of sun.security.util.ManifestDigester in project otertool by wuntee.

the class JarSigner method signJar.

void signJar(String jarName, String alias, String[] args) throws Exception {
    boolean aliasUsed = false;
    X509Certificate tsaCert = null;
    if (sigfile == null) {
        sigfile = alias;
        aliasUsed = true;
    }
    if (sigfile.length() > 8) {
        sigfile = sigfile.substring(0, 8).toUpperCase();
    } else {
        sigfile = sigfile.toUpperCase();
    }
    StringBuilder tmpSigFile = new StringBuilder(sigfile.length());
    for (int j = 0; j < sigfile.length(); j++) {
        char c = sigfile.charAt(j);
        if (!((c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || (c == '-') || (c == '_'))) {
            if (aliasUsed) {
                // convert illegal characters from the alias to be _'s
                c = '_';
            } else {
                throw new RuntimeException(rb.getString("signature filename must consist of the following characters: A-Z, 0-9, _ or -"));
            }
        }
        tmpSigFile.append(c);
    }
    sigfile = tmpSigFile.toString();
    String tmpJarName;
    if (signedjar == null)
        tmpJarName = jarName + ".sig";
    else
        tmpJarName = signedjar;
    File jarFile = new File(jarName);
    File signedJarFile = new File(tmpJarName);
    // Open the jar (zip) file
    try {
        zipFile = new ZipFile(jarName);
    } catch (IOException ioe) {
        error(rb.getString("unable to open jar file: ") + jarName, ioe);
    }
    FileOutputStream fos = null;
    try {
        fos = new FileOutputStream(signedJarFile);
    } catch (IOException ioe) {
        error(rb.getString("unable to create: ") + tmpJarName, ioe);
    }
    PrintStream ps = new PrintStream(fos);
    ZipOutputStream zos = new ZipOutputStream(ps);
    /* First guess at what they might be - we don't xclude RSA ones. */
    String sfFilename = (META_INF + sigfile + ".SF").toUpperCase();
    String bkFilename = (META_INF + sigfile + ".DSA").toUpperCase();
    Manifest manifest = new Manifest();
    Map<String, Attributes> mfEntries = manifest.getEntries();
    // The Attributes of manifest before updating
    Attributes oldAttr = null;
    boolean mfModified = false;
    boolean mfCreated = false;
    byte[] mfRawBytes = null;
    try {
        MessageDigest[] digests = { MessageDigest.getInstance(digestalg) };
        // Check if manifest exists
        ZipEntry mfFile;
        if ((mfFile = getManifestFile(zipFile)) != null) {
            // Manifest exists. Read its raw bytes.
            mfRawBytes = getBytes(zipFile, mfFile);
            manifest.read(new ByteArrayInputStream(mfRawBytes));
            oldAttr = (Attributes) (manifest.getMainAttributes().clone());
        } else {
            // Create new manifest
            Attributes mattr = manifest.getMainAttributes();
            mattr.putValue(Attributes.Name.MANIFEST_VERSION.toString(), "1.0");
            String javaVendor = System.getProperty("java.vendor");
            String jdkVersion = System.getProperty("java.version");
            mattr.putValue("Created-By", jdkVersion + " (" + javaVendor + ")");
            mfFile = new ZipEntry(JarFile.MANIFEST_NAME);
            mfCreated = true;
        }
        /*
             * For each entry in jar
             * (except for signature-related META-INF entries),
             * do the following:
             *
             * - if entry is not contained in manifest, add it to manifest;
             * - if entry is contained in manifest, calculate its hash and
             *   compare it with the one in the manifest; if they are
             *   different, replace the hash in the manifest with the newly
             *   generated one. (This may invalidate existing signatures!)
             */
        BASE64Encoder encoder = new JarBASE64Encoder();
        Vector<ZipEntry> mfFiles = new Vector<ZipEntry>();
        for (Enumeration<? extends ZipEntry> enum_ = zipFile.entries(); enum_.hasMoreElements(); ) {
            ZipEntry ze = enum_.nextElement();
            if (ze.getName().startsWith(META_INF)) {
                // Store META-INF files in vector, so they can be written
                // out first
                mfFiles.addElement(ze);
                if (signatureRelated(ze.getName())) {
                    // ignore signature-related and manifest files
                    continue;
                }
            }
            if (manifest.getAttributes(ze.getName()) != null) {
                // possibly update its digest attributes
                if (updateDigests(ze, zipFile, digests, encoder, manifest) == true) {
                    mfModified = true;
                }
            } else if (!ze.isDirectory()) {
                // Add entry to manifest
                Attributes attrs = getDigestAttributes(ze, zipFile, digests, encoder);
                mfEntries.put(ze.getName(), attrs);
                mfModified = true;
            }
        }
        // Recalculate the manifest raw bytes if necessary
        if (mfModified) {
            ByteArrayOutputStream baos = new ByteArrayOutputStream();
            manifest.write(baos);
            byte[] newBytes = baos.toByteArray();
            if (mfRawBytes != null && oldAttr.equals(manifest.getMainAttributes())) {
                /*
                     * Note:
                     *
                     * The Attributes object is based on HashMap and can handle
                     * continuation columns. Therefore, even if the contents are 
                     * not changed (in a Map view), the bytes that it write() 
                     * may be different from the original bytes that it read()
                     * from. Since the signature on the main attributes is based 
                     * on raw bytes, we must retain the exact bytes.
                     */
                int newPos = findHeaderEnd(newBytes);
                int oldPos = findHeaderEnd(mfRawBytes);
                if (newPos == oldPos) {
                    System.arraycopy(mfRawBytes, 0, newBytes, 0, oldPos);
                } else {
                    // cat oldHead newTail > newBytes
                    byte[] lastBytes = new byte[oldPos + newBytes.length - newPos];
                    System.arraycopy(mfRawBytes, 0, lastBytes, 0, oldPos);
                    System.arraycopy(newBytes, newPos, lastBytes, oldPos, newBytes.length - newPos);
                    newBytes = lastBytes;
                }
            }
            mfRawBytes = newBytes;
        }
        // Write out the manifest
        if (mfModified) {
            // manifest file has new length
            mfFile = new ZipEntry(JarFile.MANIFEST_NAME);
        }
        zos.putNextEntry(mfFile);
        zos.write(mfRawBytes);
        // Calculate SignatureFile (".SF") and SignatureBlockFile
        ManifestDigester manDig = new ManifestDigester(mfRawBytes);
        SignatureFile sf = new SignatureFile(digests, manifest, manDig, sigfile, signManifest);
        if (tsaAlias != null) {
            tsaCert = getTsaCert(tsaAlias);
        }
        SignatureFile.Block block = null;
        try {
            block = sf.generateBlock(privateKey, sigalg, certChain, externalSF, tsaUrl, tsaCert, signingMechanism, args, zipFile);
        } catch (SocketTimeoutException e) {
            // Provide a helpful message when TSA is beyond a firewall
            error(rb.getString("unable to sign jar: ") + rb.getString("no response from the Timestamping Authority. ") + rb.getString("When connecting from behind a firewall then an HTTP proxy may need to be specified. ") + rb.getString("Supply the following options to jarsigner: ") + "\n  -J-Dhttp.proxyHost=<hostname> " + "\n  -J-Dhttp.proxyPort=<portnumber> ", e);
        }
        sfFilename = sf.getMetaName();
        bkFilename = block.getMetaName();
        ZipEntry sfFile = new ZipEntry(sfFilename);
        ZipEntry bkFile = new ZipEntry(bkFilename);
        long time = System.currentTimeMillis();
        sfFile.setTime(time);
        bkFile.setTime(time);
        // signature file
        zos.putNextEntry(sfFile);
        sf.write(zos);
        // signature block file
        zos.putNextEntry(bkFile);
        block.write(zos);
        // vector
        for (int i = 0; i < mfFiles.size(); i++) {
            ZipEntry ze = mfFiles.elementAt(i);
            if (!ze.getName().equalsIgnoreCase(JarFile.MANIFEST_NAME) && !ze.getName().equalsIgnoreCase(sfFilename) && !ze.getName().equalsIgnoreCase(bkFilename)) {
                writeEntry(zipFile, zos, ze);
            }
        }
        // Write out all other files
        for (Enumeration<? extends ZipEntry> enum_ = zipFile.entries(); enum_.hasMoreElements(); ) {
            ZipEntry ze = enum_.nextElement();
            if (!ze.getName().startsWith(META_INF)) {
                writeEntry(zipFile, zos, ze);
            }
        }
    } catch (IOException ioe) {
        error(rb.getString("unable to sign jar: ") + ioe, ioe);
    } finally {
        // close the resouces
        if (zipFile != null) {
            zipFile.close();
            zipFile = null;
        }
        if (zos != null) {
            zos.close();
        }
    }
    // try {
    if (signedjar == null) {
        // one, then delete the original.
        if (!signedJarFile.renameTo(jarFile)) {
            File origJar = new File(jarName + ".orig");
            if (jarFile.renameTo(origJar)) {
                if (signedJarFile.renameTo(jarFile)) {
                    origJar.delete();
                } else {
                    MessageFormat form = new MessageFormat(rb.getString("attempt to rename signedJarFile to jarFile failed"));
                    Object[] source = { signedJarFile, jarFile };
                    error(form.format(source));
                }
            } else {
                MessageFormat form = new MessageFormat(rb.getString("attempt to rename jarFile to origJar failed"));
                Object[] source = { jarFile, origJar };
                error(form.format(source));
            }
        }
    }
    if (hasExpiredCert || hasExpiringCert || notYetValidCert || badKeyUsage || badExtendedKeyUsage || badNetscapeCertType) {
        logger.warn(rb.getString("Warning: "));
        if (badKeyUsage) {
            logger.warn(rb.getString("The signer certificate's KeyUsage extension doesn't allow code signing."));
        }
        if (badExtendedKeyUsage) {
            logger.warn(rb.getString("The signer certificate's ExtendedKeyUsage extension doesn't allow code signing."));
        }
        if (badNetscapeCertType) {
            logger.warn(rb.getString("The signer certificate's NetscapeCertType extension doesn't allow code signing."));
        }
        if (hasExpiredCert) {
            logger.warn(rb.getString("The signer certificate has expired."));
        } else if (hasExpiringCert) {
            logger.warn(rb.getString("The signer certificate will expire within six months."));
        } else if (notYetValidCert) {
            logger.warn(rb.getString("The signer certificate is not yet valid."));
        }
    }
// no IOException thrown in the above try clause, so disable
// the catch clause.
// } catch(IOException ioe) {
//     error(rb.getString("unable to sign jar: ")+ioe, ioe);
// }
}

Example 2 with ManifestDigester

use of sun.security.util.ManifestDigester in project jdk8u_jdk by JetBrains.

the class JarVerifier method processEntry.

/**
     * called when we reach the end of entry in one of the read() methods.
     */
private void processEntry(ManifestEntryVerifier mev) throws IOException {
    if (!parsingBlockOrSF) {
        JarEntry je = mev.getEntry();
        if ((je != null) && (je.signers == null)) {
            je.signers = mev.verify(verifiedSigners, sigFileSigners);
            je.certs = mapSignersToCertArray(je.signers);
        }
    } else {
        try {
            parsingBlockOrSF = false;
            if (debug != null) {
                debug.println("processEntry: processing block");
            }
            String uname = mev.getEntry().getName().toUpperCase(Locale.ENGLISH);
            if (uname.endsWith(".SF")) {
                String key = uname.substring(0, uname.length() - 3);
                byte[] bytes = baos.toByteArray();
                // add to sigFileData in case future blocks need it
                sigFileData.put(key, bytes);
                // check pending blocks, we can now process
                // anyone waiting for this .SF file
                Iterator<SignatureFileVerifier> it = pendingBlocks.iterator();
                while (it.hasNext()) {
                    SignatureFileVerifier sfv = it.next();
                    if (sfv.needSignatureFile(key)) {
                        if (debug != null) {
                            debug.println("processEntry: processing pending block");
                        }
                        sfv.setSignatureFile(bytes);
                        sfv.process(sigFileSigners, manifestDigests);
                    }
                }
                return;
            }
            // now we are parsing a signature block file
            String key = uname.substring(0, uname.lastIndexOf("."));
            if (signerCache == null)
                signerCache = new ArrayList<>();
            if (manDig == null) {
                synchronized (manifestRawBytes) {
                    if (manDig == null) {
                        manDig = new ManifestDigester(manifestRawBytes);
                        manifestRawBytes = null;
                    }
                }
            }
            SignatureFileVerifier sfv = new SignatureFileVerifier(signerCache, manDig, uname, baos.toByteArray());
            if (sfv.needSignatureFileBytes()) {
                // see if we have already parsed an external .SF file
                byte[] bytes = sigFileData.get(key);
                if (bytes == null) {
                    // (uname, block);
                    if (debug != null) {
                        debug.println("adding pending block");
                    }
                    pendingBlocks.add(sfv);
                    return;
                } else {
                    sfv.setSignatureFile(bytes);
                }
            }
            sfv.process(sigFileSigners, manifestDigests);
        } catch (IOException ioe) {
            // e.g. sun.security.pkcs.ParsingException
            if (debug != null)
                debug.println("processEntry caught: " + ioe);
        // ignore and treat as unsigned
        } catch (SignatureException se) {
            if (debug != null)
                debug.println("processEntry caught: " + se);
        // ignore and treat as unsigned
        } catch (NoSuchAlgorithmException nsae) {
            if (debug != null)
                debug.println("processEntry caught: " + nsae);
        // ignore and treat as unsigned
        } catch (CertificateException ce) {
            if (debug != null)
                debug.println("processEntry caught: " + ce);
        // ignore and treat as unsigned
        }
    }
}