set since tag for gpg stuff to 2.4.0, rename Signature.key to Signature.keyId and added DummyGPG for testing

scm-core/src/main/java/sonia/scm/repository/Changeset.java

@@ -355,7 +355,7 @@ public class Changeset extends BasicPropertiesAware implements ModelObject {
   /**
    * Sets a collection of signatures which belong to this changeset.
    * @param signatures collection of signatures
-   * @since 2.3.0
+   * @since 2.4.0
    */
   public void setSignatures(Collection<Signature> signatures) {
     this.signatures = new ArrayList<>(signatures);
@@ -364,7 +364,7 @@ public class Changeset extends BasicPropertiesAware implements ModelObject {
   /**
    * Returns a immutable list of signatures.
    * @return signatures
-   * @since 2.3.0
+   * @since 2.4.0
    */
   public List<Signature> getSignatures() {
     return Collections.unmodifiableList(signatures);
@@ -373,7 +373,7 @@ public class Changeset extends BasicPropertiesAware implements ModelObject {
   /**
    * Adds a signature to the list of signatures.
    * @param signature
-   * @since 2.3.0
+   * @since 2.4.0
    */
   public void addSignature(Signature signature) {
     signatures.add(signature);

scm-core/src/main/java/sonia/scm/repository/Signature.java

@@ -31,14 +31,14 @@ import java.util.Optional;
 
 /**
  * Signature is the output of a signature verification.
- * @since 2.3.0
+ * @since 2.4.0
  */
 @Value
 public class Signature implements Serializable {
 
   private static final long serialVersionUID = 1L;
 
-  private final String key;
+  private final String keyId;
   private final String type;
   private final boolean verified;
   private final String owner;

scm-core/src/main/java/sonia/scm/security/GPG.java

@@ -29,7 +29,7 @@ import java.util.Optional;
 /**
  * Allows signing and verification using gpg.
  *
- * @since 2.3.0
+ * @since 2.4.0
  */
 public interface GPG {
 

scm-core/src/main/java/sonia/scm/security/PrivateKey.java

@@ -29,7 +29,7 @@ import java.io.InputStream;
 
 /**
  * Can be used to create signatures of data.
- * @since 2.3.0
+ * @since 2.4.0
  */
 public interface PrivateKey {
 

scm-core/src/main/java/sonia/scm/security/PublicKey.java

@@ -31,7 +31,7 @@ import java.util.Optional;
 /**
  * The public key can be used to verify signatures.
  *
- * @since 2.3.0
+ * @since 2.4.0
  */
 public interface PublicKey {
 

scm-webapp/src/main/java/sonia/scm/security/gpg/DummyGPG.java

@@ -0,0 +1,58 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.security.gpg;
+
+import sonia.scm.security.GPG;
+import sonia.scm.security.PrivateKey;
+import sonia.scm.security.PublicKey;
+
+import java.util.Collections;
+import java.util.Optional;
+
+/**
+ * Dummy implementation of {@link GPG} should be replaced soon.
+ */
+public class DummyGPG implements GPG {
+
+  @Override
+  public String findPublicKeyId(byte[] signature) {
+    return "unknown";
+  }
+
+  @Override
+  public Optional<PublicKey> findPublicKey(String id) {
+    return Optional.empty();
+  }
+
+  @Override
+  public Iterable<PublicKey> findPublicKeysByUsername(String username) {
+    return Collections.emptySet();
+  }
+
+  @Override
+  public PrivateKey getPrivateKey() {
+    throw new UnsupportedOperationException("getPrivateKey is not yet implemented");
+  }
+}

scm-webapp/src/main/java/sonia/scm/security/gpg/GPGModule.java

@@ -0,0 +1,37 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.security.gpg;
+
+import com.google.inject.AbstractModule;
+import sonia.scm.plugin.Extension;
+import sonia.scm.security.GPG;
+
+@Extension
+public class GPGModule extends AbstractModule {
+  @Override
+  protected void configure() {
+    bind(GPG.class).to(DummyGPG.class);
+  }
+}

scm-webapp/src/main/java/sonia/scm/security/gpg/Keys.java

@@ -24,18 +24,13 @@
 
 package sonia.scm.security.gpg;
 
-import org.bouncycastle.bcpg.ArmoredInputStream;
-import org.bouncycastle.gpg.keybox.PublicKeyRingBlob;
 import org.bouncycastle.openpgp.PGPException;
-import org.bouncycastle.openpgp.PGPObjectFactory;
 import org.bouncycastle.openpgp.PGPPublicKey;
 import org.bouncycastle.openpgp.PGPPublicKeyRing;
 import org.bouncycastle.openpgp.PGPPublicKeyRingCollection;
 import org.bouncycastle.openpgp.PGPUtil;
-import org.bouncycastle.openpgp.jcajce.JcaPGPPublicKeyRing;
 import org.bouncycastle.openpgp.operator.KeyFingerPrintCalculator;
 import org.bouncycastle.openpgp.operator.jcajce.JcaKeyFingerprintCalculator;
-import sonia.scm.security.PublicKey;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;

scm-webapp/src/main/java/sonia/scm/security/gpg/PublicKeyStore.java

@@ -27,20 +27,13 @@ package sonia.scm.security.gpg;
 import com.google.common.annotations.VisibleForTesting;
 import org.apache.shiro.SecurityUtils;
 import org.bouncycastle.openpgp.PGPException;
-import sonia.scm.security.PublicKey;
 import sonia.scm.store.DataStore;
 import sonia.scm.store.DataStoreFactory;
 
 import javax.inject.Inject;
 import javax.inject.Singleton;
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
 import java.io.IOException;
 import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
 import java.util.Optional;
 import java.util.function.Supplier;