Skip to content

Commit 6f50819

Browse files
cstamascstamas
authored
[MGPG-106] Introduce new signer: BC (#72)
This introduces new pure Java signer BC backed one. Currently two signers supported: "gpg" (uses external executable, as before), and "bc" (uses pure Java Bouncy Castle backed signer). All the ITs (invoker and surefire) are _reused_ and now run twice, once with "gpg" and once with "bc". One IT needed adjustment, as BC does not emit error about "pinentry". --- https://issues.apache.org/jira/browse/MGPG-106
1 parent ea35e2c commit 6f50819

16 files changed

+825
-87
lines changed

‎pgp-keys-map.list

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,13 @@
1515
# specific language governing permissions and limitations
1616
# under the License.
1717

18+
com.kohlschutter.junixsocket:junixsocket-common = 0xB5C082F1158B8C92AE3E5E1C29B8FEA02804261C
19+
com.kohlschutter.junixsocket:junixsocket-core = 0xB5C082F1158B8C92AE3E5E1C29B8FEA02804261C
20+
com.kohlschutter.junixsocket:junixsocket-native-common = 0xB5C082F1158B8C92AE3E5E1C29B8FEA02804261C
1821
commons-io:commons-io = 0x2DB4F1EF0FA761ECC4EA935C86FDC7E2A11262CB
1922
org.apiguardian:apiguardian-api = 0xFF6E2C001948C5F2F38B0CC385911F425EC61B51
23+
org.bouncycastle:bcpg-jdk18on = 0x7B121B76A7ED6CE6E60AD51784E913A8E3A748C0
24+
org.bouncycastle:bcprov-jdk18on = 0x7B121B76A7ED6CE6E60AD51784E913A8E3A748C0
2025
org.junit.jupiter:junit-jupiter-api = 0xFF6E2C001948C5F2F38B0CC385911F425EC61B51
2126
org.junit.jupiter:junit-jupiter-params = 0xFF6E2C001948C5F2F38B0CC385911F425EC61B51
2227
org.junit.platform:junit-platform-commons = 0xFF6E2C001948C5F2F38B0CC385911F425EC61B51

‎pom.xml

Lines changed: 81 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,10 @@ under the License.
6060
</distributionManagement>
6161

6262
<properties>
63+
<javaVersion>8</javaVersion>
6364
<mavenVersion>3.9.6</mavenVersion>
6465
<resolverVersion>1.9.18</resolverVersion>
65-
<javaVersion>8</javaVersion>
66+
<bouncycastleVersion>1.77</bouncycastleVersion>
6667
<project.build.outputTimestamp>2023-05-03T01:33:44Z</project.build.outputTimestamp>
6768
<resource.delimiter>@</resource.delimiter>
6869
</properties>
@@ -120,6 +121,22 @@ under the License.
120121
<artifactId>plexus-utils</artifactId>
121122
<version>3.5.1</version>
122123
</dependency>
124+
<dependency>
125+
<groupId>org.bouncycastle</groupId>
126+
<artifactId>bcpg-jdk18on</artifactId>
127+
<version>${bouncycastleVersion}</version>
128+
</dependency>
129+
<dependency>
130+
<groupId>org.bouncycastle</groupId>
131+
<artifactId>bcprov-jdk18on</artifactId>
132+
<version>${bouncycastleVersion}</version>
133+
</dependency>
134+
<dependency>
135+
<groupId>com.kohlschutter.junixsocket</groupId>
136+
<artifactId>junixsocket-core</artifactId>
137+
<version>2.9.0</version>
138+
<type>pom</type>
139+
</dependency>
123140

124141
<dependency>
125142
<groupId>org.junit.jupiter</groupId>
@@ -179,8 +196,8 @@ under the License.
179196
<artifactId>apache-rat-plugin</artifactId>
180197
<configuration>
181198
<excludes combine.children="append">
182-
<!-- rat check errors seen on ASF Jenkins instance, but not on local machine... -->
183-
<exclude>src/test/resources/gnupg/**</exclude>
199+
<!-- rat is too cheeky, ignore these resources -->
200+
<exclude>src/test/resources/**</exclude>
184201
</excludes>
185202
</configuration>
186203
</plugin>
@@ -220,6 +237,67 @@ under the License.
220237
<build>
221238
<plugins>
222239
<plugin>
240+
<groupId>org.apache.maven.plugins</groupId>
241+
<artifactId>maven-invoker-plugin</artifactId>
242+
<configuration>
243+
<settingsFile>src/it/settings.xml</settingsFile>
244+
<pomIncludes>
245+
<pomInclude>*</pomInclude>
246+
</pomIncludes>
247+
<pomExcludes>
248+
<!-- not supported with gpg 2.1+ -->
249+
<pomExclude>alternative-secret-keyring</pomExclude>
250+
</pomExcludes>
251+
<goals>
252+
<goal>clean</goal>
253+
<goal>install</goal>
254+
</goals>
255+
<properties>
256+
<gpg.homedir>${project.build.testOutputDirectory}/gnupg</gpg.homedir>
257+
</properties>
258+
</configuration>
259+
<executions>
260+
<execution>
261+
<id>integration-test</id>
262+
<phase>none</phase>
263+
</execution>
264+
<execution>
265+
<id>integration-test-install</id>
266+
<goals>
267+
<goal>install</goal>
268+
</goals>
269+
<phase>integration-test</phase>
270+
</execution>
271+
<execution>
272+
<id>gpg-integration-tests</id>
273+
<goals>
274+
<goal>run</goal>
275+
</goals>
276+
<phase>integration-test</phase>
277+
<configuration>
278+
<properties>
279+
<gpg.signer>gpg</gpg.signer>
280+
</properties>
281+
</configuration>
282+
</execution>
283+
<execution>
284+
<id>bc-integration-tests</id>
285+
<goals>
286+
<goal>run</goal>
287+
</goals>
288+
<phase>integration-test</phase>
289+
<configuration>
290+
<properties>
291+
<gpg.signer>bc</gpg.signer>
292+
<!-- must be absolute -->
293+
<gpg.keyFilePath>${project.basedir}/src/test/resources/signing-key.asc</gpg.keyFilePath>
294+
</properties>
295+
</configuration>
296+
</execution>
297+
</executions>
298+
</plugin>
299+
<plugin>
300+
<!-- this failsafe invocation depends on invoker:install above -->
223301
<groupId>org.apache.maven.plugins</groupId>
224302
<artifactId>maven-failsafe-plugin</artifactId>
225303
<configuration>
@@ -243,27 +321,6 @@ under the License.
243321
</execution>
244322
</executions>
245323
</plugin>
246-
<plugin>
247-
<groupId>org.apache.maven.plugins</groupId>
248-
<artifactId>maven-invoker-plugin</artifactId>
249-
<configuration>
250-
<settingsFile>src/it/settings.xml</settingsFile>
251-
<pomIncludes>
252-
<pomInclude>*</pomInclude>
253-
</pomIncludes>
254-
<pomExcludes>
255-
<!-- not supported with gpg 2.1+ -->
256-
<pomExclude>alternative-secret-keyring</pomExclude>
257-
</pomExcludes>
258-
<goals>
259-
<goal>clean</goal>
260-
<goal>install</goal>
261-
</goals>
262-
<properties>
263-
<gpg.homedir>${project.build.testOutputDirectory}/gnupg</gpg.homedir>
264-
</properties>
265-
</configuration>
266-
</plugin>
267324
</plugins>
268325
</build>
269326
</profile>

‎src/it/sign-release-without-passphrase/verify.groovy

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ if (!logContent.contains("Total time: ") || !logContent.contains("Finished at: "
2828
throw new Exception("Maven build did not fail, but timed out")
2929
}
3030

31-
// assert that the Maven build failed, because pinentry is not allowed in non-interactive mode
32-
if (!logContent.contains("[GNUPG:] FAILURE sign 67108949")) {
31+
// gpg: assert that the Maven build failed, because pinentry is not allowed in non-interactive mode
32+
// bc: assert that the Maven build failed, because key to sign is encrypted by no passphrase provided
33+
if (!logContent.contains("[GNUPG:] FAILURE sign 67108949") && !logContent.contains("Secret key is encrypted but no passphrase provided")) {
3334
throw new Exception("Maven build did not fail in consequence of pinentry not being available to GPG")
3435
}
35-

0 commit comments

Comments
 (0)