Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2025-11-12 16:35:45 +01:00
Code Issues Packages Projects Releases Activity

refactor

Browse Source
This commit is contained in:
Eduard Heimbuch
2020-07-29 17:16:57 +02:00
parent b22ead23de
commit 3da7710543
20 changed files with 323 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
scm-webapp/src/main/java/sonia/scm/security/gpg/DefaultGPG.java
View File

@@ -69,7 +69,7 @@ public class DefaultGPG implements GPG {
public Optional<PublicKey> findPublicKey(String id) {
Optional<RawGpgKey> key = store.findById(id);
return key.map(rawGpgKey -> new GpgKey(id, rawGpgKey.getOwner(), rawGpgKey.getRaw().getBytes()));
return key.map(rawGpgKey -> new GpgKey(rawGpgKey.getId(), rawGpgKey.getOwner(), rawGpgKey.getRaw(), rawGpgKey.getContacts()));
}
@Override
@@ -79,7 +79,7 @@ public class DefaultGPG implements GPG {
if (!keys.isEmpty()) {
return keys
.stream()
.map(rawGpgKey -> new GpgKey(rawGpgKey.getId(), rawGpgKey.getOwner(), rawGpgKey.getRaw().getBytes()))
.map(rawGpgKey -> new GpgKey(rawGpgKey.getId(), rawGpgKey.getOwner(), rawGpgKey.getRaw(), rawGpgKey.getContacts()))
.collect(Collectors.toSet());
}

57
scm-webapp/src/main/java/sonia/scm/security/gpg/GpgKey.java
View File

@@ -28,10 +28,9 @@ import org.bouncycastle.bcpg.ArmoredInputStream;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPObjectFactory;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.PGPPublicKeyRing;
import org.bouncycastle.openpgp.PGPSignature;
import org.bouncycastle.openpgp.PGPSignatureList;
import org.bouncycastle.openpgp.operator.PGPContentVerifierBuilderProvider;
import org.bouncycastle.openpgp.operator.jcajce.JcaKeyFingerprintCalculator;
import org.bouncycastle.openpgp.operator.jcajce.JcaPGPContentVerifierBuilderProvider;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -43,26 +42,25 @@ import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.nio.charset.StandardCharsets;
import java.util.LinkedHashSet;
import java.util.Optional;
import java.util.Set;
import static sonia.scm.security.gpg.PgpPublicKeyExtractor.getFromRawKey;
public class GpgKey implements PublicKey {
private static final Logger LOG = LoggerFactory.getLogger(GpgKey.class);
private final String id;
private final String owner;
private final Set<String> contacts = new LinkedHashSet<>();
private final String raw;
private final Set<String> contacts;
public GpgKey(String id, String owner, byte[] raw) {
public GpgKey(String id, String owner, String raw, Set<String> contacts) {
this.id = id;
this.owner = owner;
try {
getPgpPublicKey(raw).getUserIDs().forEachRemaining(contacts::add);
} catch (IOException e) {
LOG.error("Could not find contacts in public key", e);
}
this.raw = raw;
this.contacts = contacts;
}
@Override
@@ -78,6 +76,11 @@ public class GpgKey implements PublicKey {
return Optional.of(owner);
}
@Override
public String getRaw() {
return raw;
}
@Override
public Set<String> getContacts() {
return contacts;
@@ -87,32 +90,34 @@ public class GpgKey implements PublicKey {
public boolean verify(InputStream stream, byte[] signature) {
boolean verified = false;
try {
PGPPublicKey publicKey = getPgpPublicKey(signature);
PGPSignature pgpSignature = ((PGPSignature) publicKey.getSignatures().next());
ArmoredInputStream armoredInputStream = new ArmoredInputStream(new ByteArrayInputStream(signature));
PGPObjectFactory pgpObjectFactory = new PGPObjectFactory(armoredInputStream, null);
PGPSignature pgpSignature = ((PGPSignatureList) pgpObjectFactory.nextObject()).get(0);
PGPContentVerifierBuilderProvider provider = new JcaPGPContentVerifierBuilderProvider();
pgpSignature.init(provider, publicKey);
char[] buffer = new char[1024];
int bytesRead = 0;
BufferedReader in = new BufferedReader(new InputStreamReader(stream));
Optional<PGPPublicKey> pgpPublicKey = getFromRawKey(raw);
while (bytesRead != -1) {
bytesRead = in.read(buffer, 0, 1024);
pgpSignature.update(new String(buffer).getBytes(StandardCharsets.UTF_8));
if (pgpPublicKey.isPresent()) {
pgpSignature.init(provider, pgpPublicKey.get());
char[] buffer = new char[1024];
int bytesRead = 0;
BufferedReader in = new BufferedReader(new InputStreamReader(stream));
while (bytesRead != -1) {
bytesRead = in.read(buffer, 0, 1024);
pgpSignature.update(new String(buffer).getBytes(StandardCharsets.UTF_8));
}
verified = pgpSignature.verify();
}
verified = pgpSignature.verify();
} catch (IOException | PGPException e) {
LOG.error("Could not verify GPG key", e);
}
return verified;
}
private PGPPublicKey getPgpPublicKey(byte[] signature) throws IOException {
ArmoredInputStream armoredInputStream = new ArmoredInputStream(new ByteArrayInputStream(signature));
PGPObjectFactory pgpObjectFactory = new PGPObjectFactory(armoredInputStream, new JcaKeyFingerprintCalculator());
return ((PGPPublicKeyRing) pgpObjectFactory.nextObject()).getPublicKey();
return verified;
}
}

57
scm-webapp/src/main/java/sonia/scm/security/gpg/PgpPublicKeyExtractor.java Normal file
View File

@@ -0,0 +1,57 @@
/*
* MIT License
*
* Copyright (c) 2020-present Cloudogu GmbH and Contributors
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
package sonia.scm.security.gpg;
import org.bouncycastle.bcpg.ArmoredInputStream;
import org.bouncycastle.openpgp.PGPObjectFactory;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.PGPPublicKeyRing;
import org.bouncycastle.openpgp.operator.jcajce.JcaKeyFingerprintCalculator;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.util.Optional;
public class PgpPublicKeyExtractor {
private PgpPublicKeyExtractor() {}
private static final Logger LOG = LoggerFactory.getLogger(PgpPublicKeyExtractor.class);
static Optional<PGPPublicKey> getFromRawKey(String rawKey) {
try {
ArmoredInputStream armoredInputStream = new ArmoredInputStream(new ByteArrayInputStream(rawKey.getBytes()));
PGPObjectFactory pgpObjectFactory = new PGPObjectFactory(armoredInputStream, new JcaKeyFingerprintCalculator());
PGPPublicKey publicKey = ((PGPPublicKeyRing) pgpObjectFactory.nextObject()).getPublicKey();
return Optional.of(publicKey);
} catch (IOException e) {
LOG.error("Invalid PGP key");
}
return Optional.empty();
}
}

18
scm-webapp/src/main/java/sonia/scm/security/gpg/PublicKeyStore.java
View File

@@ -24,6 +24,9 @@
package sonia.scm.security.gpg;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import sonia.scm.ContextEntry;
import sonia.scm.event.ScmEventBus;
import sonia.scm.security.NotPublicKeyException;
@@ -35,13 +38,19 @@ import sonia.scm.user.UserPermissions;
import javax.inject.Inject;
import javax.inject.Singleton;
import java.time.Instant;
import java.util.HashSet;
import java.util.List;
import java.util.Optional;
import java.util.Set;
import java.util.stream.Collectors;
import static sonia.scm.security.gpg.PgpPublicKeyExtractor.getFromRawKey;
@Singleton
public class PublicKeyStore {
private static final Logger LOG = LoggerFactory.getLogger(PublicKeyStore.class);
private static final String STORE_NAME = "gpg_public_keys";
private static final String SUBKEY_STORE_NAME = "gpg_public_sub_keys";
@@ -70,7 +79,7 @@ public class PublicKeyStore {
subKeyStore.put(subKey, new MasterKeyReference(master));
}
RawGpgKey key = new RawGpgKey(master, displayName, username, rawKey, Instant.now());
RawGpgKey key = new RawGpgKey(master, displayName, username, rawKey, getContactsFromPublicKey(rawKey), Instant.now());
store.put(master, key);
@@ -78,6 +87,13 @@ public class PublicKeyStore {
}
private Set<String> getContactsFromPublicKey(String rawKey) {
Set<String> contacts = new HashSet<>();
Optional<PGPPublicKey> publicKeyFromRawKey = getFromRawKey(rawKey);
publicKeyFromRawKey.ifPresent(pgpPublicKey -> pgpPublicKey.getUserIDs().forEachRemaining(contacts::add));
return contacts;
}
public void delete(String id) {
RawGpgKey rawGpgKey = store.get(id);
if (rawGpgKey != null) {

2
scm-webapp/src/main/java/sonia/scm/security/gpg/RawGpgKey.java
View File

@@ -36,6 +36,7 @@ import javax.xml.bind.annotation.XmlRootElement;
import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
import java.time.Instant;
import java.util.Objects;
import java.util.Set;
@Getter
@NoArgsConstructor
@@ -48,6 +49,7 @@ public class RawGpgKey {
private String displayName;
private String owner;
private String raw;
private Set<String> contacts;
@XmlJavaTypeAdapter(XmlInstantAdapter.class)
private Instant created;