# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

#

# This code is free software; you can redistribute it and/or modify it

# under the terms of the GNU General Public License version 2 only, as

# published by the Free Software Foundation.

#

# This code is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

# version 2 for more details (a copy is included in the LICENSE file that

# accompanied this code).

#

# You should have received a copy of the GNU General Public License version

# 2 along with this work; if not, write to the Free Software Foundation,

# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

#

# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

# or visit www.oracle.com if you need additional information or have any

# questions.

##### Summary #####

This test is used to verify the compatibility on jarsigner cross different JDK

releases. It also can be used to check jar signing (w/ and w/o TSA) and verifying

on some specific key algorithms and digest algorithms.

##### Output #####

The test will generate a report, at JTwork/scratch/report.html, to display the

key parameters for signing and the status of signing and verifying. And it will

generate another report, at JTwork/scratch/failedReport.html, to collect all of

failed cases.

Please note that, the test may output a great deal of logs if the jdk list and

TSA list are big, and that would lead to jtreg output overflow. So, it redirects

stdout and stderr to file JTwork/scratch/details.out.

##### Report Columns #####

Certificate

    Certificate identifier. The identifier consists of specific attributes of

    the certificate. Generally, the naming convention is:

    KeyAlgorithm_DigestAlgorithm_[KeySize][_Expired]

Signer JDK

    The JDK version that signs jar.

Signature Algorithm

TSA

    TSA URL index. All of TSA URLs and their indices can be found at the top

    of this report.

Signing Status

    Signing process result status. The status are the followings:

    [1]NONE, no action.

    [2]NORMAL, no any error and warning.

    [3]WARNING, no any error but some warnings raise.

    [4]ERROR, some errors raise.

Verifier JDK

    The JDK version that verifies signed jars.

Verifying Status

    Verifying process result status. The status are the same as those for

    "Status of Signing".

Delay Verifying Status

    Delay verifying process result status. The status are the same as those

    for "Status of Signing".

Failed

    It highlights which case fails. The failed cases (rows) are marked with

    letter X.

##### Usages #####

jtreg [-options] \

    -jdk:<path/to/testing/JDK>

    [-DproxyHost=<host> \

     -DproxyPort=<port> \

     -DtsaListFile=</url/to/tsaListFile> \

     -DjdkListFile=</path/to/jdkListFile> \

     -DjdkList=</path/to/jdk1#/path/to/jdk2#/path/to/jdk3#...> \

     -DjavaSecurityFile=</path/to/java/security/properties/file> \

     -DdelayVerify=<true|false> \

     -DcertValidity=<[1, 1440]>] \

Besides the common jtreg options, like -jdk, this test introduces a set of

properties for receiving users' inputs and making the test more flexible. These

proxyHost=<host>

    This property indicates proxy host.

proxyPort=<port>

    This property indicates proxy port. The default value is 80.

tsaListFile=</path/to/tsaListFile>

    This property indicates a local file, which contains a set of TSA URLs and

    the supported digest algorithms (by optional parameter digests). The format

    of the file content looks like the below,

    http://path/to/tsa1

    http://path/to/tsa2;digests=SHA-1,SHA-256

    https://path/to/tsa3

    ...

    If a TSA line does not list the supported digest algorithms, that means

    the TSA supports SHA-1, SHA-256 and SHA-512. Because the test only focus

    on SHA-1, SHA-256 and SHA-512. So, if other digest algorithms, like SHA-224

    and SHA-384, are listed, they just be ignored.

    This property directly lists a set of TSAs in command. "#" is the delimiter.

    Note that, if both of tsaListFile and tsaList are specified, only property

jdkListFile=</path/to/jdkListFile>

    This property indicates a local file, which contains a set of local JDK

    paths. The style of the file content looks like the below,

    /path/to/jdk1

    /path/to/jdk2

    /path/to/jdk3

    ...

jdkList=</path/to/jdk1#/path/to/jdk2#/path/to/jdk3#...>

    This property directly lists a set of local JDK paths in command. "#" is

    the delimiter.

    Note that, if both of jdkListFile and jdkList are specified, only property

    jdkListFile is selected. If neither of jdkListFile nor jdkList is specified,

    the only one JDK in the JDK list.

javaSecurityFile=</path/to/java/security/properties/file>

    This property indicates an alternative java security properties file. The

    default file is the path of file java.scurity that is distributed with

    this test.

delayVerify=<true|false>

    This property indicates if doing an additional verifying after all of valid

    certificates expire. The default value is false.

certValidity=<[1, 1440]>

    This property indicates the remaining validity period in minutes for valid

    certificates. The value range is [1, 1440]. The default value is 1440.

    Note that, if delayVerify is false, this property doesn't take effect.

##### Examples #####

$ cat /path/to/jdkList

/path/to/jdk6u171-b05

/path/to/jdk7u161-b05

/path/to/jdk8u144-b01

/path/to/jdk9-179 

$ cat /path/to/tsaList

http://timestamp.comodoca.com/rfc3161

http://sha256timestamp.ws.symantec.com/sha256/timestamp

http://tsa.starfieldtech.com

http://timestamp.entrust.net/TSS/RFC3161sha1TS;digests=SHA-1,SHA-256

http://timestamp.entrust.net/TSS/RFC3161sha2TS;digests=SHA-1,SHA-256

http://rfc3161timestamp.globalsign.com/advanced;digests=SHA-256,SHA-512

http://rfc3161timestamp.globalsign.com/standard

http://timestamp.globalsign.com/scripts/timstamp.dll

http://timestamp.globalsign.com/?signature=sha2;digests=SHA-256,SHA-512

http://timestamp.digicert.com

http://time.certum.pl

http://tsa.swisssign.net

http://zeitstempel.dfn.de

https://tsp.iaik.tugraz.at/tsp/TspRequest

    -jdk:/path/to/latest/jdk \

    -DproxyHost=<proxy> -DproxyPort=<port> \

    -DjdkListFile=/path/to/jdkList \

    -DtsaListFile=/path/to/tsaList \

    -DdelayVerify=true -DcertValidity=60 \

The above is a comprehensive usage example. File "jdkList" lists the paths of

testing JDK builds, and file "tsaList" lists the URLs of TSA services. Some TSAs,

like http://timestamp.entrust.net/TSS/RFC3161sha1TS, specify the supported digest

algorithms. Other TSAs, which don't specify parameter digests, are regarded to

support SHA-1, SHA-256 and SHA-512. The test uses a proxy to access TSA services.

And it enables delay verifying and set the certificate validity period to 60

minutes. So, after the first verification is done, the test will wait for all

of valid certificates expire and then does verification again.

If don't want to provide such JDK list and TSA list files, the test allows to

specify JDKs and TSAs (via properties jdkList and tsaList respectively) in the

command directly, like the below style,

    -jdk:/path/to/latest/jdk \

    -DproxyHost=<proxy> -DproxyPort=<port> \

    -DjdkList=/path/to/jdk6u171-b05#/path/to/jdk7u161-b05#/path/to/jdk8u144-b01#/path/to/jdk9-179 \

    -DtsaList=http://timestamp.comodoca.com/rfc3161#http://timestamp.entrust.net/TSS/RFC3161sha1TS;digests=SHA-1,SHA-256 \

    -DdelayVerify=true -DcertValidity=60 \

Furthermore, here introduces one of the simplest usages. It doesn't specify any

JDK list, so the testing JDK, which is specified by jtreg option "-jdk", will

be tested. And it doesn't apply delay verifying, and no proxy is used, and use

only one TSA. Now, the command is pretty simple and looks like the followings,

    -jdk:/path/to/latest/jdk \

    -DtsaList=http://timestamp.comodoca.com/rfc3161 \