/*

 * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

/*

 * @test

 * @bug 8215922

 * @summary jar spec is not precise when describing jar file re-signing

 * @library /test/lib

 */

import jdk.test.lib.Asserts;

import jdk.test.lib.util.JarUtils;

import java.io.InputStream;

import java.security.MessageDigest;

import java.util.Base64;

import java.util.jar.JarEntry;

import java.util.jar.JarFile;

import java.util.jar.Manifest;

import static jdk.test.lib.SecurityTools.*;

public class SignedAgain {

    public static void main(String[] args) throws Exception {

        String opt = "-storepass changeit -keystore ks";

        keytool(opt + " -genkeypair -alias a -dname CN=A -keyalg RSA");

        keytool(opt + " -genkeypair -alias b -dname CN=B -keyalg RSA");

        JarUtils.createJar("a.jar", "f1");

        // as.jar: signed by a

        jarsigner(opt + " -signedjar as.jar a.jar a");

        JarUtils.updateJar("as.jar", "b.jar", "f2");

        // bs.jar: signed again by b

        jarsigner(opt + " -signedjar bs.jar b.jar b");

        // verified

        jarsigner(opt + " -verify -strict -verbose -certs bs.jar")

                .shouldHaveExitValue(0);

        try (JarFile ja = new JarFile("as.jar");

             JarFile jb = new JarFile("bs.jar");

             InputStream ma = ja.getInputStream(

                     new JarEntry("META-INF/MANIFEST.MF"));

             InputStream sa = jb.getInputStream(new JarEntry("META-INF/A.SF"));

             InputStream mb = jb.getInputStream(

                     new JarEntry("META-INF/MANIFEST.MF"));

             InputStream sb = jb.getInputStream(new JarEntry("META-INF/B.SF"))) {

            // Hash of manifest for 2 signed JAR files

            String da = Base64.getEncoder().encodeToString(MessageDigest

                    .getInstance("SHA-256").digest(ma.readAllBytes()));

            String db = Base64.getEncoder().encodeToString(MessageDigest

                    .getInstance("SHA-256").digest(mb.readAllBytes()));

            // They are not the same

            Asserts.assertNotEquals(da, db);

            // Digest-Manifest in A.SF matches da

            Asserts.assertEQ(new Manifest(sa).getMainAttributes()

                    .getValue("SHA-256-Digest-Manifest"), da);

            // Digest-Manifest in B.SF matches db

            Asserts.assertEQ(new Manifest(sb).getMainAttributes()

                    .getValue("SHA-256-Digest-Manifest"), db);

        }

    }

}