1 /*

     2  * Copyright 1997-2007 Sun Microsystems, Inc.  All Rights Reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Sun designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Sun in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,

    22  * CA 95054 USA or visit www.sun.com if you need additional information or

    23  * have any questions.

    24  */

    25 

    26 package sun.security.tools;

    27 

    28 import java.io.*;

    29 import java.util.*;

    30 import java.util.zip.*;

    31 import java.util.jar.*;

    32 import java.math.BigInteger;

    33 import java.net.URI;

    34 import java.net.URISyntaxException;

    35 import java.net.URL;

    36 import java.net.URLClassLoader;

    37 import java.net.SocketTimeoutException;

    38 import java.text.Collator;

    39 import java.text.MessageFormat;

    40 import java.security.cert.Certificate;

    41 import java.security.cert.X509Certificate;

    42 import java.security.cert.CertificateException;

    43 import java.security.cert.CertificateExpiredException;

    44 import java.security.cert.CertificateNotYetValidException;

    45 import java.security.*;

    46 import java.lang.reflect.Constructor;

    47 

    48 import com.sun.jarsigner.ContentSigner;

    49 import com.sun.jarsigner.ContentSignerParameters;

    50 import sun.security.x509.*;

    51 import sun.security.util.*;

    52 import sun.misc.BASE64Encoder;

    53 

    54 /**

    55  * <p>The jarsigner utility.

    56  *

    57  * @author Roland Schemers

    58  * @author Jan Luehe

    59  */

    60 

    61 public class JarSigner {

    62 

    63     // for i18n

    64     private static final java.util.ResourceBundle rb =

    65         java.util.ResourceBundle.getBundle

    66         ("sun.security.tools.JarSignerResources");

    67     private static final Collator collator = Collator.getInstance();

    68     static {

    69         // this is for case insensitive string comparisions

    70         collator.setStrength(Collator.PRIMARY);

    71     }

    72 

    73     private static final String META_INF = "META-INF/";

    74 

    75     // prefix for new signature-related files in META-INF directory

    76     private static final String SIG_PREFIX = META_INF + "SIG-";

    77 

    78     private static final Class[] PARAM_STRING = { String.class };

    79 

    80     private static final String NONE = "NONE";

    81     private static final String P11KEYSTORE = "PKCS11";

    82 

    83     private static final long SIX_MONTHS = 180*24*60*60*1000L; //milliseconds

    84 

    85     // Attention:

    86     // This is the entry that get launched by the security tool jarsigner.

    87     // It's marked as exported private per AppServer Team's request.

    88     // See http://ccc.sfbay/6428446

    89     public static void main(String args[]) throws Exception {

    90         JarSigner js = new JarSigner();

    91         js.run(args);

    92     }

    93 

    94     static final String VERSION = "1.0";

    95 

    96     static final int IN_KEYSTORE = 0x01;

    97     static final int IN_SCOPE = 0x02;

    98 

    99     // signer's certificate chain (when composing)

   100     X509Certificate[] certChain;

   101 

   102     /*

   103      * private key

   104      */

   105     PrivateKey privateKey;

   106     KeyStore store;

   107 

   108     IdentityScope scope;

   109 

   110     String keystore; // key store file

   111     boolean nullStream = false; // null keystore input stream (NONE)

   112     boolean token = false; // token-based keystore

   113     String jarfile;  // jar file to sign

   114     String alias;    // alias to sign jar with

   115     char[] storepass; // keystore password

   116     boolean protectedPath; // protected authentication path

   117     String storetype; // keystore type

   118     String providerName; // provider name

   119     Vector<String> providers = null; // list of providers

   120     HashMap<String,String> providerArgs = new HashMap<String, String>(); // arguments for provider constructors

   121     char[] keypass; // private key password

   122     String sigfile; // name of .SF file

   123     String sigalg; // name of signature algorithm

   124     String digestalg = "SHA1"; // name of digest algorithm

   125     String signedjar; // output filename

   126     String tsaUrl; // location of the Timestamping Authority

   127     String tsaAlias; // alias for the Timestamping Authority's certificate

   128     boolean verify = false; // verify the jar

   129     boolean verbose = false; // verbose output when signing/verifying

   130     boolean showcerts = false; // show certs when verifying

   131     boolean debug = false; // debug

   132     boolean signManifest = true; // "sign" the whole manifest

   133     boolean externalSF = true; // leave the .SF out of the PKCS7 block

   134 

   135     // read zip entry raw bytes

   136     private ByteArrayOutputStream baos = new ByteArrayOutputStream(2048);

   137     private byte[] buffer = new byte[8192];

   138     private ContentSigner signingMechanism = null;

   139     private String altSignerClass = null;

   140     private String altSignerClasspath = null;

   141     private ZipFile zipFile = null;

   142     private boolean hasExpiredCert = false;

   143     private boolean hasExpiringCert = false;

   144     private boolean notYetValidCert = false;

   145 

   146     private boolean badKeyUsage = false;

   147     private boolean badExtendedKeyUsage = false;

   148     private boolean badNetscapeCertType = false;

   149 

   150     public void run(String args[]) {

   151         try {

   152             parseArgs(args);

   153 

   154             // Try to load and install the specified providers

   155             if (providers != null) {

   156                 ClassLoader cl = ClassLoader.getSystemClassLoader();

   157                 Enumeration<String> e = providers.elements();

   158                 while (e.hasMoreElements()) {

   159                     String provName = e.nextElement();

   160                     Class<?> provClass;

   161                     if (cl != null) {

   162                         provClass = cl.loadClass(provName);

   163                     } else {

   164                         provClass = Class.forName(provName);

   165                     }

   166 

   167                     String provArg = providerArgs.get(provName);

   168                     Object obj;

   169                     if (provArg == null) {

   170                         obj = provClass.newInstance();

   171                     } else {

   172                         Constructor<?> c =

   173                                 provClass.getConstructor(PARAM_STRING);

   174                         obj = c.newInstance(provArg);

   175                     }

   176 

   177                     if (!(obj instanceof Provider)) {

   178                         MessageFormat form = new MessageFormat(rb.getString

   179                             ("provName not a provider"));

   180                         Object[] source = {provName};

   181                         throw new Exception(form.format(source));

   182                     }

   183                     Security.addProvider((Provider)obj);

   184                 }

   185             }

   186 

   187             hasExpiredCert = false;

   188             hasExpiringCert = false;

   189             notYetValidCert = false;

   190 

   191             badKeyUsage = false;

   192             badExtendedKeyUsage = false;

   193             badNetscapeCertType = false;

   194 

   195             if (verify) {

   196                 try {

   197                     loadKeyStore(keystore, false);

   198                     scope = IdentityScope.getSystemScope();

   199                 } catch (Exception e) {

   200                     if ((keystore != null) || (storepass != null)) {

   201                         System.out.println(rb.getString("jarsigner error: ") +

   202                                         e.getMessage());

   203                         System.exit(1);

   204                     }

   205                 }

   206                 /*              if (debug) {

   207                     SignatureFileVerifier.setDebug(true);

   208                     ManifestEntryVerifier.setDebug(true);

   209                 }

   210                 */

   211                 verifyJar(jarfile);

   212             } else {

   213                 loadKeyStore(keystore, true);

   214                 getAliasInfo(alias);

   215 

   216                 // load the alternative signing mechanism

   217                 if (altSignerClass != null) {

   218                     signingMechanism = loadSigningMechanism(altSignerClass,

   219                         altSignerClasspath);

   220                 }

   221                 signJar(jarfile, alias, args);

   222             }

   223         } catch (Exception e) {

   224             System.out.println(rb.getString("jarsigner error: ") + e);

   225             if (debug) {

   226                 e.printStackTrace();

   227             }

   228             System.exit(1);

   229         } finally {

   230             // zero-out private key password

   231             if (keypass != null) {

   232                 Arrays.fill(keypass, ' ');

   233                 keypass = null;

   234             }

   235             // zero-out keystore password

   236             if (storepass != null) {

   237                 Arrays.fill(storepass, ' ');

   238                 storepass = null;

   239             }

   240         }

   241     }

   242 

   243     /*

   244      * Parse command line arguments.

   245      */

   246     void parseArgs(String args[]) {

   247         /* parse flags */

   248         int n = 0;

   249 

   250         for (n=0; (n < args.length) && args[n].startsWith("-"); n++) {

   251 

   252             String flags = args[n];

   253 

   254             if (collator.compare(flags, "-keystore") == 0) {

   255                 if (++n == args.length) usage();

   256                 keystore = args[n];

   257             } else if (collator.compare(flags, "-storepass") ==0) {

   258                 if (++n == args.length) usage();

   259                 storepass = args[n].toCharArray();

   260             } else if (collator.compare(flags, "-storetype") ==0) {

   261                 if (++n == args.length) usage();

   262                 storetype = args[n];

   263             } else if (collator.compare(flags, "-providerName") ==0) {

   264                 if (++n == args.length) usage();

   265                 providerName = args[n];

   266             } else if ((collator.compare(flags, "-provider") == 0) ||

   267                         (collator.compare(flags, "-providerClass") == 0)) {

   268                 if (++n == args.length) usage();

   269                 if (providers == null) {

   270                     providers = new Vector<String>(3);

   271                 }

   272                 providers.add(args[n]);

   273 

   274                 if (args.length > (n+1)) {

   275                     flags = args[n+1];

   276                     if (collator.compare(flags, "-providerArg") == 0) {

   277                         if (args.length == (n+2)) usage();

   278                         providerArgs.put(args[n], args[n+2]);

   279                         n += 2;

   280                     }

   281                 }

   282             } else if (collator.compare(flags, "-protected") ==0) {

   283                 protectedPath = true;

   284             } else if (collator.compare(flags, "-debug") ==0) {

   285                 debug = true;

   286             } else if (collator.compare(flags, "-keypass") ==0) {

   287                 if (++n == args.length) usage();

   288                 keypass = args[n].toCharArray();

   289             } else if (collator.compare(flags, "-sigfile") ==0) {

   290                 if (++n == args.length) usage();

   291                 sigfile = args[n];

   292             } else if (collator.compare(flags, "-signedjar") ==0) {

   293                 if (++n == args.length) usage();

   294                 signedjar = args[n];

   295             } else if (collator.compare(flags, "-tsa") ==0) {

   296                 if (++n == args.length) usage();

   297                 tsaUrl = args[n];

   298             } else if (collator.compare(flags, "-tsacert") ==0) {

   299                 if (++n == args.length) usage();

   300                 tsaAlias = args[n];

   301             } else if (collator.compare(flags, "-altsigner") ==0) {

   302                 if (++n == args.length) usage();

   303                 altSignerClass = args[n];

   304             } else if (collator.compare(flags, "-altsignerpath") ==0) {

   305                 if (++n == args.length) usage();

   306                 altSignerClasspath = args[n];

   307             } else if (collator.compare(flags, "-sectionsonly") ==0) {

   308                 signManifest = false;

   309             } else if (collator.compare(flags, "-internalsf") ==0) {

   310                 externalSF = false;

   311             } else if (collator.compare(flags, "-verify") ==0) {

   312                 verify = true;

   313             } else if (collator.compare(flags, "-verbose") ==0) {

   314                 verbose = true;

   315             } else if (collator.compare(flags, "-sigalg") ==0) {

   316                 if (++n == args.length) usage();

   317                 sigalg = args[n];

   318             } else if (collator.compare(flags, "-digestalg") ==0) {

   319                 if (++n == args.length) usage();

   320                 digestalg = args[n];

   321             } else if (collator.compare(flags, "-certs") ==0) {

   322                 showcerts = true;

   323             } else if (collator.compare(flags, "-h") == 0 ||

   324                         collator.compare(flags, "-help") == 0) {

   325                 usage();

   326             } else {

   327                 System.err.println(rb.getString("Illegal option: ") + flags);

   328                 usage();

   329             }

   330         }

   331 

   332         if (n == args.length) usage();

   333         jarfile = args[n++];

   334 

   335         if (!verify) {

   336             if (n == args.length) usage();

   337             alias = args[n++];

   338         }

   339 

   340         if (storetype == null) {

   341             storetype = KeyStore.getDefaultType();

   342         }

   343         storetype = KeyStoreUtil.niceStoreTypeName(storetype);

   344 

   345         if (P11KEYSTORE.equalsIgnoreCase(storetype) ||

   346                 KeyStoreUtil.isWindowsKeyStore(storetype)) {

   347             token = true;

   348             if (keystore == null) {

   349                 keystore = NONE;

   350             }

   351         }

   352 

   353         if (NONE.equals(keystore)) {

   354             nullStream = true;

   355         }

   356 

   357         if (token && !nullStream) {

   358             System.err.println(MessageFormat.format(rb.getString

   359                 ("-keystore must be NONE if -storetype is {0}"), storetype));

   360             System.err.println();

   361             usage();

   362         }

   363 

   364         if (token && keypass != null) {

   365             System.err.println(MessageFormat.format(rb.getString

   366                 ("-keypass can not be specified " +

   367                 "if -storetype is {0}"), storetype));

   368             System.err.println();

   369             usage();

   370         }

   371 

   372         if (protectedPath) {

   373             if (storepass != null || keypass != null) {

   374                 System.err.println(rb.getString

   375                         ("If -protected is specified, " +

   376                         "then -storepass and -keypass must not be specified"));

   377                 System.err.println();

   378                 usage();

   379             }

   380         }

   381         if (KeyStoreUtil.isWindowsKeyStore(storetype)) {

   382             if (storepass != null || keypass != null) {

   383                 System.err.println(rb.getString

   384                         ("If keystore is not password protected, " +

   385                         "then -storepass and -keypass must not be specified"));

   386                 System.err.println();

   387                 usage();

   388             }

   389         }

   390     }

   391 

   392     void usage() {

   393         System.out.println(rb.getString

   394                 ("Usage: jarsigner [options] jar-file alias"));

   395         System.out.println(rb.getString

   396                 ("       jarsigner -verify [options] jar-file"));

   397         System.out.println();

   398         System.out.println(rb.getString

   399                 ("[-keystore <url>]           keystore location"));

   400         System.out.println();

   401         System.out.println(rb.getString

   402                 ("[-storepass <password>]     password for keystore integrity"));

   403         System.out.println();

   404         System.out.println(rb.getString

   405                 ("[-storetype <type>]         keystore type"));

   406         System.out.println();

   407         System.out.println(rb.getString

   408                 ("[-keypass <password>]       password for private key (if different)"));

   409         System.out.println();

   410         System.out.println(rb.getString

   411                 ("[-sigfile <file>]           name of .SF/.DSA file"));

   412         System.out.println();

   413         System.out.println(rb.getString

   414                 ("[-signedjar <file>]         name of signed JAR file"));

   415         System.out.println();

   416         System.out.println(rb.getString

   417                 ("[-digestalg <algorithm>]    name of digest algorithm"));

   418         System.out.println();

   419         System.out.println(rb.getString

   420                 ("[-sigalg <algorithm>]       name of signature algorithm"));

   421         System.out.println();

   422         System.out.println(rb.getString

   423                 ("[-verify]                   verify a signed JAR file"));

   424         System.out.println();

   425         System.out.println(rb.getString

   426                 ("[-verbose]                  verbose output when signing/verifying"));

   427         System.out.println();

   428         System.out.println(rb.getString

   429                 ("[-certs]                    display certificates when verbose and verifying"));

   430         System.out.println();

   431         System.out.println(rb.getString

   432                 ("[-tsa <url>]                location of the Timestamping Authority"));

   433         System.out.println();

   434         System.out.println(rb.getString

   435                 ("[-tsacert <alias>]          public key certificate for Timestamping Authority"));

   436         System.out.println();

   437         System.out.println(rb.getString

   438                 ("[-altsigner <class>]        class name of an alternative signing mechanism"));

   439         System.out.println();

   440         System.out.println(rb.getString

   441                 ("[-altsignerpath <pathlist>] location of an alternative signing mechanism"));

   442         System.out.println();

   443         System.out.println(rb.getString

   444                 ("[-internalsf]               include the .SF file inside the signature block"));

   445         System.out.println();

   446         System.out.println(rb.getString

   447                 ("[-sectionsonly]             don't compute hash of entire manifest"));

   448         System.out.println();

   449         System.out.println(rb.getString

   450                 ("[-protected]                keystore has protected authentication path"));

   451         System.out.println();

   452         System.out.println(rb.getString

   453                 ("[-providerName <name>]      provider name"));

   454         System.out.println();

   455         System.out.println(rb.getString

   456                 ("[-providerClass <class>     name of cryptographic service provider's"));

   457         System.out.println(rb.getString

   458                 ("  [-providerArg <arg>]] ... master class file and constructor argument"));

   459         System.out.println();

   460 

   461         System.exit(1);

   462     }

   463 

   464     void verifyJar(String jarName)

   465         throws Exception

   466     {

   467         boolean anySigned = false;

   468         boolean hasUnsignedEntry = false;

   469         JarFile jf = null;

   470 

   471         try {

   472             jf = new JarFile(jarName, true);

   473             Vector<JarEntry> entriesVec = new Vector<JarEntry>();

   474             byte[] buffer = new byte[8192];

   475 

   476             Enumeration<JarEntry> entries = jf.entries();

   477             while (entries.hasMoreElements()) {

   478                 JarEntry je = entries.nextElement();

   479                 entriesVec.addElement(je);

   480                 InputStream is = null;

   481                 try {

   482                     is = jf.getInputStream(je);

   483                     int n;

   484                     while ((n = is.read(buffer, 0, buffer.length)) != -1) {

   485                         // we just read. this will throw a SecurityException

   486                         // if  a signature/digest check fails.

   487                     }

   488                 } finally {

   489                     if (is != null) {

   490                         is.close();

   491                     }

   492                 }

   493             }

   494 

   495             Manifest man = jf.getManifest();

   496 

   497             if (man != null) {

   498                 if (verbose) System.out.println();

   499                 Enumeration<JarEntry> e = entriesVec.elements();

   500 

   501                 long now = System.currentTimeMillis();

   502 

   503                 while (e.hasMoreElements()) {

   504                     JarEntry je = e.nextElement();

   505                     String name = je.getName();

   506                     CodeSigner[] signers = je.getCodeSigners();

   507                     boolean isSigned = (signers != null);

   508                     anySigned |= isSigned;

   509                     hasUnsignedEntry |= !je.isDirectory() && !isSigned

   510                                         && !signatureRelated(name);

   511 

   512                     if (verbose) {

   513                         int inStoreOrScope = inKeyStore(signers);

   514                         boolean inStore = (inStoreOrScope & IN_KEYSTORE) != 0;

   515                         boolean inScope = (inStoreOrScope & IN_SCOPE) != 0;

   516                         boolean inManifest =

   517                             ((man.getAttributes(name) != null) ||

   518                              (man.getAttributes("./"+name) != null) ||

   519                              (man.getAttributes("/"+name) != null));

   520                         System.out.print(

   521                           (isSigned ? rb.getString("s") : rb.getString(" ")) +

   522                           (inManifest ? rb.getString("m") : rb.getString(" ")) +

   523                           (inStore ? rb.getString("k") : rb.getString(" ")) +

   524                           (inScope ? rb.getString("i") : rb.getString(" ")) +

   525                           rb.getString("  "));

   526                         StringBuffer sb = new StringBuffer();

   527                         String s = Long.toString(je.getSize());

   528                         for (int i = 6 - s.length(); i > 0; --i) {

   529                             sb.append(' ');

   530                         }

   531                         sb.append(s).append(' ').

   532                                     append(new Date(je.getTime()).toString());

   533                         sb.append(' ').append(je.getName());

   534                         System.out.println(sb.toString());

   535 

   536                         if (signers != null && showcerts) {

   537                             String tab = rb.getString("      ");

   538                             for (int i = 0; i < signers.length; i++) {

   539                                 System.out.println();

   540                                 List<? extends Certificate> certs =

   541                                     signers[i].getSignerCertPath()

   542                                         .getCertificates();

   543                                 // display the signature timestamp, if present

   544                                 Timestamp timestamp = signers[i].getTimestamp();

   545                                 if (timestamp != null) {

   546                                     System.out.println(

   547                                         printTimestamp(tab, timestamp));

   548                                 }

   549                                 // display the certificate(s)

   550                                 for (Certificate c : certs) {

   551                                     System.out.println(

   552                                         printCert(tab, c, true, now));

   553                                 }

   554                             }

   555                             System.out.println();

   556                         }

   557 

   558                     }

   559                     if (isSigned) {

   560                         for (int i = 0; i < signers.length; i++) {

   561                             Certificate cert =

   562                                 signers[i].getSignerCertPath()

   563                                     .getCertificates().get(0);

   564                             if (cert instanceof X509Certificate) {

   565                                 checkCertUsage((X509Certificate)cert, null);

   566                                 if (!showcerts) {

   567                                     long notAfter = ((X509Certificate)cert)

   568                                         .getNotAfter().getTime();

   569 

   570                                     if (notAfter < now) {

   571                                         hasExpiredCert = true;

   572                                     } else if (notAfter < now + SIX_MONTHS) {

   573                                         hasExpiringCert = true;

   574                                     }

   575                                 }

   576                             }

   577                         }

   578                     }

   579 

   580                 }

   581             }

   582             if (verbose) {

   583                 System.out.println();

   584                 System.out.println(rb.getString(

   585                     "  s = signature was verified "));

   586                 System.out.println(rb.getString(

   587                     "  m = entry is listed in manifest"));

   588                 System.out.println(rb.getString(

   589                     "  k = at least one certificate was found in keystore"));

   590                 System.out.println(rb.getString(

   591                     "  i = at least one certificate was found in identity scope"));

   592                 System.out.println();

   593             }

   594 

   595             if (man == null)

   596                 System.out.println(rb.getString("no manifest."));

   597 

   598             if (!anySigned) {

   599                 System.out.println(rb.getString(

   600                       "jar is unsigned. (signatures missing or not parsable)"));

   601             } else {

   602                 System.out.println(rb.getString("jar verified."));

   603                 if (hasUnsignedEntry || hasExpiredCert || hasExpiringCert ||

   604                     badKeyUsage || badExtendedKeyUsage || badNetscapeCertType ||

   605                     notYetValidCert) {

   606 

   607                     System.out.println();

   608                     System.out.println(rb.getString("Warning: "));

   609                     if (badKeyUsage) {

   610                         System.out.println(

   611                             rb.getString("This jar contains entries whose signer certificate's KeyUsage extension doesn't allow code signing."));

   612                     }

   613 

   614                     if (badExtendedKeyUsage) {

   615                         System.out.println(

   616                             rb.getString("This jar contains entries whose signer certificate's ExtendedKeyUsage extension doesn't allow code signing."));

   617                     }

   618 

   619                     if (badNetscapeCertType) {

   620                         System.out.println(

   621                             rb.getString("This jar contains entries whose signer certificate's NetscapeCertType extension doesn't allow code signing."));

   622                     }

   623 

   624                     if (hasUnsignedEntry) {

   625                         System.out.println(rb.getString(

   626                             "This jar contains unsigned entries which have not been integrity-checked. "));

   627                     }

   628                     if (hasExpiredCert) {

   629                         System.out.println(rb.getString(

   630                             "This jar contains entries whose signer certificate has expired. "));

   631                     }

   632                     if (hasExpiringCert) {

   633                         System.out.println(rb.getString(

   634                             "This jar contains entries whose signer certificate will expire within six months. "));

   635                     }

   636                     if (notYetValidCert) {

   637                         System.out.println(rb.getString(

   638                             "This jar contains entries whose signer certificate is not yet valid. "));

   639                     }

   640 

   641                     if (! (verbose && showcerts)) {

   642                         System.out.println();

   643                         System.out.println(rb.getString(

   644                             "Re-run with the -verbose and -certs options for more details."));

   645                     }

   646                 }

   647             }

   648             System.exit(0);

   649         } catch (Exception e) {

   650             System.out.println(rb.getString("jarsigner: ") + e);

   651             if (debug) {

   652                 e.printStackTrace();

   653             }

   654         } finally { // close the resource

   655             if (jf != null) {

   656                 jf.close();

   657             }

   658         }

   659 

   660         System.exit(1);

   661     }

   662 

   663     /*

   664      * Display some details about a certificate:

   665      *

   666      * <cert-type> [", " <subject-DN>] [" (" <keystore-entry-alias> ")"]

   667      */

   668     String printCert(Certificate c) {

   669         return printCert("", c, false, 0);

   670     }

   671 

   672     private static MessageFormat validityTimeForm = null;

   673     private static MessageFormat notYetTimeForm = null;

   674     private static MessageFormat expiredTimeForm = null;

   675     private static MessageFormat expiringTimeForm = null;

   676 

   677     /*

   678      * Display some details about a certificate:

   679      *

   680      * [<tab>] <cert-type> [", " <subject-DN>] [" (" <keystore-entry-alias> ")"]

   681      * [<validity-period> | <expiry-warning>]

   682      */

   683     String printCert(String tab, Certificate c, boolean checkValidityPeriod,

   684         long now) {

   685 

   686         StringBuilder certStr = new StringBuilder();

   687         String space = rb.getString(" ");

   688         X509Certificate x509Cert = null;

   689 

   690         if (c instanceof X509Certificate) {

   691             x509Cert = (X509Certificate) c;

   692             certStr.append(tab).append(x509Cert.getType())

   693                 .append(rb.getString(", "))

   694                 .append(x509Cert.getSubjectDN().getName());

   695         } else {

   696             certStr.append(tab).append(c.getType());

   697         }

   698 

   699         String alias = storeHash.get(c);

   700         if (alias != null) {

   701             certStr.append(space).append(alias);

   702         }

   703 

   704         if (checkValidityPeriod && x509Cert != null) {

   705 

   706             certStr.append("\n").append(tab).append("[");

   707             Date notAfter = x509Cert.getNotAfter();

   708             try {

   709                 x509Cert.checkValidity();

   710                 // test if cert will expire within six months

   711                 if (now == 0) {

   712                     now = System.currentTimeMillis();

   713                 }

   714                 if (notAfter.getTime() < now + SIX_MONTHS) {

   715                     hasExpiringCert = true;

   716 

   717                     if (expiringTimeForm == null) {

   718                         expiringTimeForm = new MessageFormat(

   719                             rb.getString("certificate will expire on"));

   720                     }

   721                     Object[] source = { notAfter };

   722                     certStr.append(expiringTimeForm.format(source));

   723 

   724                 } else {

   725                     if (validityTimeForm == null) {

   726                         validityTimeForm = new MessageFormat(

   727                             rb.getString("certificate is valid from"));

   728                     }

   729                     Object[] source = { x509Cert.getNotBefore(), notAfter };

   730                     certStr.append(validityTimeForm.format(source));

   731                 }

   732             } catch (CertificateExpiredException cee) {

   733                 hasExpiredCert = true;

   734 

   735                 if (expiredTimeForm == null) {

   736                     expiredTimeForm = new MessageFormat(

   737                         rb.getString("certificate expired on"));

   738                 }

   739                 Object[] source = { notAfter };

   740                 certStr.append(expiredTimeForm.format(source));

   741 

   742             } catch (CertificateNotYetValidException cnyve) {

   743                 notYetValidCert = true;

   744 

   745                 if (notYetTimeForm == null) {

   746                     notYetTimeForm = new MessageFormat(

   747                         rb.getString("certificate is not valid until"));

   748                 }

   749                 Object[] source = { x509Cert.getNotBefore() };

   750                 certStr.append(notYetTimeForm.format(source));

   751             }

   752             certStr.append("]");

   753 

   754             boolean[] bad = new boolean[3];

   755             checkCertUsage(x509Cert, bad);

   756             if (bad[0] || bad[1] || bad[2]) {

   757                 String x = "";

   758                 if (bad[0]) {

   759                     x ="KeyUsage";

   760                 }

   761                 if (bad[1]) {

   762                     if (x.length() > 0) x = x + ", ";

   763                     x = x + "ExtendedKeyUsage";

   764                 }

   765                 if (bad[2]) {

   766                     if (x.length() > 0) x = x + ", ";

   767                     x = x + "NetscapeCertType";

   768                 }

   769                 certStr.append("\n").append(tab)

   770                         .append(MessageFormat.format(rb.getString(

   771                         "[{0} extension does not support code signing]"), x));

   772             }

   773         }

   774         return certStr.toString();

   775     }

   776 

   777     private static MessageFormat signTimeForm = null;

   778 

   779     private String printTimestamp(String tab, Timestamp timestamp) {

   780 

   781         if (signTimeForm == null) {

   782             signTimeForm =

   783                 new MessageFormat(rb.getString("entry was signed on"));

   784         }

   785         Object[] source = { timestamp.getTimestamp() };

   786 

   787         return new StringBuilder().append(tab).append("[")

   788             .append(signTimeForm.format(source)).append("]").toString();

   789     }

   790 

   791     Hashtable<Certificate, String> storeHash =

   792                                 new Hashtable<Certificate, String>();

   793 

   794     int inKeyStore(CodeSigner[] signers) {

   795         int result = 0;

   796 

   797         if (signers == null)

   798             return 0;

   799 

   800         boolean found = false;

   801 

   802         for (int i = 0; i < signers.length; i++) {

   803             found = false;

   804             List<? extends Certificate> certs =

   805                 signers[i].getSignerCertPath().getCertificates();

   806 

   807             for (Certificate c : certs) {

   808                 String alias = storeHash.get(c);

   809 

   810                 if (alias != null) {

   811                     if (alias.startsWith("("))

   812                             result |= IN_KEYSTORE;

   813                     else if (alias.startsWith("["))

   814                             result |= IN_SCOPE;

   815                 } else {

   816                     if (store != null) {

   817                         try {

   818                             alias = store.getCertificateAlias(c);

   819                         } catch (KeyStoreException kse) {

   820                             // never happens, because keystore has been loaded

   821                         }

   822                         if (alias != null) {

   823                             storeHash.put(c, "("+alias+")");

   824                             found = true;

   825                             result |= IN_KEYSTORE;

   826                         }

   827                     }

   828                     if (!found && (scope != null)) {

   829                         Identity id = scope.getIdentity(c.getPublicKey());

   830                         if (id != null) {

   831                             result |= IN_SCOPE;

   832                             storeHash.put(c, "["+id.getName()+"]");

   833                         }

   834                     }

   835                 }

   836             }

   837         }

   838         return result;

   839     }

   840 

   841     void signJar(String jarName, String alias, String[] args)

   842         throws Exception {

   843         boolean aliasUsed = false;

   844         X509Certificate tsaCert = null;

   845 

   846         if (sigfile == null) {

   847             sigfile = alias;

   848             aliasUsed = true;

   849         }

   850 

   851         if (sigfile.length() > 8) {

   852             sigfile = sigfile.substring(0, 8).toUpperCase();

   853         } else {

   854             sigfile = sigfile.toUpperCase();

   855         }

   856 

   857         StringBuilder tmpSigFile = new StringBuilder(sigfile.length());

   858         for (int j = 0; j < sigfile.length(); j++) {

   859             char c = sigfile.charAt(j);

   860             if (!

   861                 ((c>= 'A' && c<= 'Z') ||

   862                 (c>= '0' && c<= '9') ||

   863                 (c == '-') ||

   864                 (c == '_'))) {

   865                 if (aliasUsed) {

   866                     // convert illegal characters from the alias to be _'s

   867                     c = '_';

   868                 } else {

   869                  throw new

   870                    RuntimeException(rb.getString

   871                         ("signature filename must consist of the following characters: A-Z, 0-9, _ or -"));

   872                 }

   873             }

   874             tmpSigFile.append(c);

   875         }

   876 

   877         sigfile = tmpSigFile.toString();

   878 

   879         String tmpJarName;

   880         if (signedjar == null) tmpJarName = jarName+".sig";

   881         else tmpJarName = signedjar;

   882 

   883         File jarFile = new File(jarName);

   884         File signedJarFile = new File(tmpJarName);

   885 

   886         // Open the jar (zip) file

   887         try {

   888             zipFile = new ZipFile(jarName);

   889         } catch (IOException ioe) {

   890             error(rb.getString("unable to open jar file: ")+jarName, ioe);

   891         }

   892 

   893         FileOutputStream fos = null;

   894         try {

   895             fos = new FileOutputStream(signedJarFile);

   896         } catch (IOException ioe) {

   897             error(rb.getString("unable to create: ")+tmpJarName, ioe);

   898         }

   899 

   900         PrintStream ps = new PrintStream(fos);

   901         ZipOutputStream zos = new ZipOutputStream(ps);

   902 

   903         /* First guess at what they might be - we don't xclude RSA ones. */

   904         String sfFilename = (META_INF + sigfile + ".SF").toUpperCase();

   905         String bkFilename = (META_INF + sigfile + ".DSA").toUpperCase();

   906 

   907         Manifest manifest = new Manifest();

   908         Map<String,Attributes> mfEntries = manifest.getEntries();

   909 

   910         // The Attributes of manifest before updating

   911         Attributes oldAttr = null;

   912 

   913         boolean mfModified = false;

   914         boolean mfCreated = false;

   915         byte[] mfRawBytes = null;

   916 

   917         try {

   918             MessageDigest digests[] = { MessageDigest.getInstance(digestalg) };

   919 

   920             // Check if manifest exists

   921             ZipEntry mfFile;

   922             if ((mfFile = getManifestFile(zipFile)) != null) {

   923                 // Manifest exists. Read its raw bytes.

   924                 mfRawBytes = getBytes(zipFile, mfFile);

   925                 manifest.read(new ByteArrayInputStream(mfRawBytes));

   926                 oldAttr = (Attributes)(manifest.getMainAttributes().clone());

   927             } else {

   928                 // Create new manifest

   929                 Attributes mattr = manifest.getMainAttributes();

   930                 mattr.putValue(Attributes.Name.MANIFEST_VERSION.toString(),

   931                                "1.0");

   932                 String javaVendor = System.getProperty("java.vendor");

   933                 String jdkVersion = System.getProperty("java.version");

   934                 mattr.putValue("Created-By", jdkVersion + " (" +javaVendor

   935                                + ")");

   936                 mfFile = new ZipEntry(JarFile.MANIFEST_NAME);

   937                 mfCreated = true;

   938             }

   939 

   940             /*

   941              * For each entry in jar

   942              * (except for signature-related META-INF entries),

   943              * do the following:

   944              *

   945              * - if entry is not contained in manifest, add it to manifest;

   946              * - if entry is contained in manifest, calculate its hash and

   947              *   compare it with the one in the manifest; if they are

   948              *   different, replace the hash in the manifest with the newly

   949              *   generated one. (This may invalidate existing signatures!)

   950              */

   951             BASE64Encoder encoder = new JarBASE64Encoder();

   952             Vector<ZipEntry> mfFiles = new Vector<ZipEntry>();

   953 

   954             for (Enumeration<? extends ZipEntry> enum_=zipFile.entries();

   955                         enum_.hasMoreElements();) {

   956                 ZipEntry ze = enum_.nextElement();

   957 

   958                 if (ze.getName().startsWith(META_INF)) {

   959                     // Store META-INF files in vector, so they can be written

   960                     // out first

   961                     mfFiles.addElement(ze);

   962 

   963                     if (signatureRelated(ze.getName())) {

   964                         // ignore signature-related and manifest files

   965                         continue;

   966                     }

   967                 }

   968 

   969                 if (manifest.getAttributes(ze.getName()) != null) {

   970                     // jar entry is contained in manifest, check and

   971                     // possibly update its digest attributes

   972                     if (updateDigests(ze, zipFile, digests, encoder,

   973                                       manifest) == true) {

   974                         mfModified = true;

   975                     }

   976                 } else if (!ze.isDirectory()) {

   977                     // Add entry to manifest

   978                     Attributes attrs = getDigestAttributes(ze, zipFile,

   979                                                            digests,

   980                                                            encoder);

   981                     mfEntries.put(ze.getName(), attrs);

   982                     mfModified = true;

   983                 }

   984             }

   985 

   986             // Recalculate the manifest raw bytes if necessary

   987             if (mfModified) {

   988                 ByteArrayOutputStream baos = new ByteArrayOutputStream();

   989                 manifest.write(baos);

   990                 byte[] newBytes = baos.toByteArray();

   991                 if (mfRawBytes != null

   992                         && oldAttr.equals(manifest.getMainAttributes())) {

   993 

   994                     /*

   995                      * Note:

   996                      *

   997                      * The Attributes object is based on HashMap and can handle

   998                      * continuation columns. Therefore, even if the contents are

   999                      * not changed (in a Map view), the bytes that it write()

  1000                      * may be different from the original bytes that it read()

  1001                      * from. Since the signature on the main attributes is based

  1002                      * on raw bytes, we must retain the exact bytes.

  1003                      */

  1004 

  1005                     int newPos = findHeaderEnd(newBytes);

  1006                     int oldPos = findHeaderEnd(mfRawBytes);

  1007 

  1008                     if (newPos == oldPos) {

  1009                         System.arraycopy(mfRawBytes, 0, newBytes, 0, oldPos);

  1010                     } else {

  1011                         // cat oldHead newTail > newBytes

  1012                         byte[] lastBytes = new byte[oldPos +

  1013                                 newBytes.length - newPos];

  1014                         System.arraycopy(mfRawBytes, 0, lastBytes, 0, oldPos);

  1015                         System.arraycopy(newBytes, newPos, lastBytes, oldPos,

  1016                                 newBytes.length - newPos);

  1017                         newBytes = lastBytes;

  1018                     }

  1019                 }

  1020                 mfRawBytes = newBytes;

  1021             }

  1022 

  1023             // Write out the manifest

  1024             if (mfModified) {

  1025                 // manifest file has new length

  1026                 mfFile = new ZipEntry(JarFile.MANIFEST_NAME);

  1027             }

  1028             if (verbose) {

  1029                 if (mfCreated) {

  1030                     System.out.println(rb.getString("   adding: ") +

  1031                                         mfFile.getName());

  1032                 } else if (mfModified) {

  1033                     System.out.println(rb.getString(" updating: ") +

  1034                                         mfFile.getName());

  1035                 }

  1036             }

  1037             zos.putNextEntry(mfFile);

  1038             zos.write(mfRawBytes);

  1039 

  1040             // Calculate SignatureFile (".SF") and SignatureBlockFile

  1041             ManifestDigester manDig = new ManifestDigester(mfRawBytes);

  1042             SignatureFile sf = new SignatureFile(digests, manifest, manDig,

  1043                                                  sigfile, signManifest);

  1044 

  1045             if (tsaAlias != null) {

  1046                 tsaCert = getTsaCert(tsaAlias);

  1047             }

  1048 

  1049             SignatureFile.Block block = null;

  1050 

  1051             try {

  1052                 block =

  1053                     sf.generateBlock(privateKey, sigalg, certChain,

  1054                         externalSF, tsaUrl, tsaCert, signingMechanism, args,

  1055                         zipFile);

  1056             } catch (SocketTimeoutException e) {

  1057                 // Provide a helpful message when TSA is beyond a firewall

  1058                 error(rb.getString("unable to sign jar: ") +

  1059                 rb.getString("no response from the Timestamping Authority. ") +

  1060                 rb.getString("When connecting from behind a firewall then an HTTP proxy may need to be specified. ") +

  1061                 rb.getString("Supply the following options to jarsigner: ") +

  1062                 "\n  -J-Dhttp.proxyHost=<hostname> " +

  1063                 "\n  -J-Dhttp.proxyPort=<portnumber> ", e);

  1064             }

  1065 

  1066             sfFilename = sf.getMetaName();

  1067             bkFilename = block.getMetaName();

  1068 

  1069             ZipEntry sfFile = new ZipEntry(sfFilename);

  1070             ZipEntry bkFile = new ZipEntry(bkFilename);

  1071 

  1072             long time = System.currentTimeMillis();

  1073             sfFile.setTime(time);

  1074             bkFile.setTime(time);

  1075 

  1076             // signature file

  1077             zos.putNextEntry(sfFile);

  1078             sf.write(zos);

  1079             if (verbose) {

  1080                 if (zipFile.getEntry(sfFilename) != null) {

  1081                     System.out.println(rb.getString(" updating: ") +

  1082                                 sfFilename);

  1083                 } else {

  1084                     System.out.println(rb.getString("   adding: ") +

  1085                                 sfFilename);

  1086                 }

  1087             }

  1088 

  1089             if (verbose) {

  1090                 if (tsaUrl != null || tsaCert != null) {

  1091                     System.out.println(

  1092                         rb.getString("requesting a signature timestamp"));

  1093                 }

  1094                 if (tsaUrl != null) {

  1095                     System.out.println(rb.getString("TSA location: ") + tsaUrl);

  1096                 }

  1097                 if (tsaCert != null) {

  1098                     String certUrl =

  1099                         TimestampedSigner.getTimestampingUrl(tsaCert);

  1100                     if (certUrl != null) {

  1101                         System.out.println(rb.getString("TSA location: ") +

  1102                             certUrl);

  1103                     }

  1104                     System.out.println(

  1105                         rb.getString("TSA certificate: ") + printCert(tsaCert));

  1106                 }

  1107                 if (signingMechanism != null) {

  1108                     System.out.println(

  1109                         rb.getString("using an alternative signing mechanism"));

  1110                 }

  1111             }

  1112 

  1113             // signature block file

  1114             zos.putNextEntry(bkFile);

  1115             block.write(zos);

  1116             if (verbose) {

  1117                 if (zipFile.getEntry(bkFilename) != null) {

  1118                     System.out.println(rb.getString(" updating: ") +

  1119                         bkFilename);

  1120                 } else {

  1121                     System.out.println(rb.getString("   adding: ") +

  1122                         bkFilename);

  1123                 }

  1124             }

  1125 

  1126             // Write out all other META-INF files that we stored in the

  1127             // vector

  1128             for (int i=0; i<mfFiles.size(); i++) {

  1129                 ZipEntry ze = mfFiles.elementAt(i);

  1130                 if (!ze.getName().equalsIgnoreCase(JarFile.MANIFEST_NAME)

  1131                     && !ze.getName().equalsIgnoreCase(sfFilename)

  1132                     && !ze.getName().equalsIgnoreCase(bkFilename)) {

  1133                     writeEntry(zipFile, zos, ze);

  1134                 }

  1135             }