1 /*

     2  * Copyright (c) 1997, 2014, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.tools.jarsigner;

    27 

    28 import java.io.*;

    29 import java.util.*;

    30 import java.util.zip.*;

    31 import java.util.jar.*;

    32 import java.math.BigInteger;

    33 import java.net.URI;

    34 import java.net.URISyntaxException;

    35 import java.text.Collator;

    36 import java.text.MessageFormat;

    37 import java.security.cert.Certificate;

    38 import java.security.cert.X509Certificate;

    39 import java.security.cert.CertificateException;

    40 import java.security.*;

    41 import java.lang.reflect.Constructor;

    42 

    43 import com.sun.jarsigner.ContentSigner;

    44 import com.sun.jarsigner.ContentSignerParameters;

    45 import java.net.SocketTimeoutException;

    46 import java.net.URL;

    47 import java.net.URLClassLoader;

    48 import java.security.cert.CertPath;

    49 import java.security.cert.CertPathValidator;

    50 import java.security.cert.CertificateExpiredException;

    51 import java.security.cert.CertificateFactory;

    52 import java.security.cert.CertificateNotYetValidException;

    53 import java.security.cert.PKIXParameters;

    54 import java.security.cert.TrustAnchor;

    55 import java.util.Map.Entry;

    56 import sun.security.tools.KeyStoreUtil;

    57 import sun.security.tools.PathList;

    58 import sun.security.x509.*;

    59 import sun.security.util.*;

    60 import java.util.Base64;

    61 

    62 

    63 /**

    64  * <p>The jarsigner utility.

    65  *

    66  * The exit codes for the main method are:

    67  *

    68  * 0: success

    69  * 1: any error that the jar cannot be signed or verified, including:

    70  *      keystore loading error

    71  *      TSP communication error

    72  *      jarsigner command line error...

    73  * otherwise: error codes from -strict

    74  *

    75  * @author Roland Schemers

    76  * @author Jan Luehe

    77  */

    78 

    79 public class Main {

    80 

    81     // for i18n

    82     private static final java.util.ResourceBundle rb =

    83         java.util.ResourceBundle.getBundle

    84         ("sun.security.tools.jarsigner.Resources");

    85     private static final Collator collator = Collator.getInstance();

    86     static {

    87         // this is for case insensitive string comparisions

    88         collator.setStrength(Collator.PRIMARY);

    89     }

    90 

    91     private static final String META_INF = "META-INF/";

    92 

    93     private static final Class<?>[] PARAM_STRING = { String.class };

    94 

    95     private static final String NONE = "NONE";

    96     private static final String P11KEYSTORE = "PKCS11";

    97 

    98     private static final long SIX_MONTHS = 180*24*60*60*1000L; //milliseconds

    99 

   100     // Attention:

   101     // This is the entry that get launched by the security tool jarsigner.

   102     public static void main(String args[]) throws Exception {

   103         Main js = new Main();

   104         js.run(args);

   105     }

   106 

   107     static final String VERSION = "1.0";

   108 

   109     static final int IN_KEYSTORE = 0x01;        // signer is in keystore

   110     static final int IN_SCOPE = 0x02;

   111     static final int NOT_ALIAS = 0x04;          // alias list is NOT empty and

   112                                                 // signer is not in alias list

   113     static final int SIGNED_BY_ALIAS = 0x08;    // signer is in alias list

   114 

   115     X509Certificate[] certChain;    // signer's cert chain (when composing)

   116     PrivateKey privateKey;          // private key

   117     KeyStore store;                 // the keystore specified by -keystore

   118                                     // or the default keystore, never null

   119 

   120     String keystore; // key store file

   121     boolean nullStream = false; // null keystore input stream (NONE)

   122     boolean token = false; // token-based keystore

   123     String jarfile;  // jar files to sign or verify

   124     String alias;    // alias to sign jar with

   125     List<String> ckaliases = new ArrayList<>(); // aliases in -verify

   126     char[] storepass; // keystore password

   127     boolean protectedPath; // protected authentication path

   128     String storetype; // keystore type

   129     String providerName; // provider name

   130     Vector<String> providers = null; // list of providers

   131     // arguments for provider constructors

   132     HashMap<String,String> providerArgs = new HashMap<>();

   133     char[] keypass; // private key password

   134     String sigfile; // name of .SF file

   135     String sigalg; // name of signature algorithm

   136     String digestalg = "SHA-256"; // name of digest algorithm

   137     String signedjar; // output filename

   138     String tsaUrl; // location of the Timestamping Authority

   139     String tsaAlias; // alias for the Timestamping Authority's certificate

   140     String altCertChain; // file to read alternative cert chain from

   141     String tSAPolicyID;

   142     String tSADigestAlg = "SHA-256";

   143     boolean verify = false; // verify the jar

   144     String verbose = null; // verbose output when signing/verifying

   145     boolean showcerts = false; // show certs when verifying

   146     boolean debug = false; // debug

   147     boolean signManifest = true; // "sign" the whole manifest

   148     boolean externalSF = true; // leave the .SF out of the PKCS7 block

   149     boolean strict = false;  // treat warnings as error

   150 

   151     // read zip entry raw bytes

   152     private ByteArrayOutputStream baos = new ByteArrayOutputStream(2048);

   153     private byte[] buffer = new byte[8192];

   154     private ContentSigner signingMechanism = null;

   155     private String altSignerClass = null;

   156     private String altSignerClasspath = null;

   157     private ZipFile zipFile = null;

   158 

   159     // Informational warnings

   160     private boolean hasExpiringCert = false;

   161     private boolean noTimestamp = false;

   162     private Date expireDate = new Date(0L);     // used in noTimestamp warning

   163 

   164     // Severe warnings

   165     private boolean hasExpiredCert = false;

   166     private boolean notYetValidCert = false;

   167     private boolean chainNotValidated = false;

   168     private boolean notSignedByAlias = false;

   169     private boolean aliasNotInStore = false;

   170     private boolean hasUnsignedEntry = false;

   171     private boolean badKeyUsage = false;

   172     private boolean badExtendedKeyUsage = false;

   173     private boolean badNetscapeCertType = false;

   174 

   175     CertificateFactory certificateFactory;

   176     CertPathValidator validator;

   177     PKIXParameters pkixParameters;

   178 

   179     public void run(String args[]) {

   180         try {

   181             args = parseArgs(args);

   182 

   183             // Try to load and install the specified providers

   184             if (providers != null) {

   185                 ClassLoader cl = ClassLoader.getSystemClassLoader();

   186                 Enumeration<String> e = providers.elements();

   187                 while (e.hasMoreElements()) {

   188                     String provName = e.nextElement();

   189                     Class<?> provClass;

   190                     if (cl != null) {

   191                         provClass = cl.loadClass(provName);

   192                     } else {

   193                         provClass = Class.forName(provName);

   194                     }

   195 

   196                     String provArg = providerArgs.get(provName);

   197                     Object obj;

   198                     if (provArg == null) {

   199                         obj = provClass.newInstance();

   200                     } else {

   201                         Constructor<?> c =

   202                                 provClass.getConstructor(PARAM_STRING);

   203                         obj = c.newInstance(provArg);

   204                     }

   205 

   206                     if (!(obj instanceof Provider)) {

   207                         MessageFormat form = new MessageFormat(rb.getString

   208                             ("provName.not.a.provider"));

   209                         Object[] source = {provName};

   210                         throw new Exception(form.format(source));

   211                     }

   212                     Security.addProvider((Provider)obj);

   213                 }

   214             }

   215 

   216             if (verify) {

   217                 try {

   218                     loadKeyStore(keystore, false);

   219                 } catch (Exception e) {

   220                     if ((keystore != null) || (storepass != null)) {

   221                         System.out.println(rb.getString("jarsigner.error.") +

   222                                         e.getMessage());

   223                         System.exit(1);

   224                     }

   225                 }

   226                 /*              if (debug) {

   227                     SignatureFileVerifier.setDebug(true);

   228                     ManifestEntryVerifier.setDebug(true);

   229                 }

   230                 */

   231                 verifyJar(jarfile);

   232             } else {

   233                 loadKeyStore(keystore, true);

   234                 getAliasInfo(alias);

   235 

   236                 // load the alternative signing mechanism

   237                 if (altSignerClass != null) {

   238                     signingMechanism = loadSigningMechanism(altSignerClass,

   239                         altSignerClasspath);

   240                 }

   241                 signJar(jarfile, alias, args);

   242             }

   243         } catch (Exception e) {

   244             System.out.println(rb.getString("jarsigner.error.") + e);

   245             if (debug) {

   246                 e.printStackTrace();

   247             }

   248             System.exit(1);

   249         } finally {

   250             // zero-out private key password

   251             if (keypass != null) {

   252                 Arrays.fill(keypass, ' ');

   253                 keypass = null;

   254             }

   255             // zero-out keystore password

   256             if (storepass != null) {

   257                 Arrays.fill(storepass, ' ');

   258                 storepass = null;

   259             }

   260         }

   261 

   262         if (strict) {

   263             int exitCode = 0;

   264             if (chainNotValidated || hasExpiredCert || notYetValidCert) {

   265                 exitCode |= 4;

   266             }

   267             if (badKeyUsage || badExtendedKeyUsage || badNetscapeCertType) {

   268                 exitCode |= 8;

   269             }

   270             if (hasUnsignedEntry) {

   271                 exitCode |= 16;

   272             }

   273             if (notSignedByAlias || aliasNotInStore) {

   274                 exitCode |= 32;

   275             }

   276             if (exitCode != 0) {

   277                 System.exit(exitCode);

   278             }

   279         }

   280     }

   281 

   282     /*

   283      * Parse command line arguments.

   284      */

   285     String[] parseArgs(String args[]) throws Exception {

   286         /* parse flags */

   287         int n = 0;

   288 

   289         if (args.length == 0) fullusage();

   290 

   291         String confFile = null;

   292         String command = "-sign";

   293         for (n=0; n < args.length; n++) {

   294             if (collator.compare(args[n], "-verify") == 0) {

   295                 command = "-verify";

   296             } else if (collator.compare(args[n], "-conf") == 0) {

   297                 if (n == args.length - 1) {

   298                     usageNoArg();

   299                 }

   300                 confFile = args[++n];

   301             }

   302         }

   303 

   304         if (confFile != null) {

   305             args = KeyStoreUtil.expandArgs(

   306                     "jarsigner", confFile, command, null, args);

   307         }

   308 

   309         debug = Arrays.stream(args).anyMatch(

   310                 x -> collator.compare(x, "-debug") == 0);

   311 

   312         if (debug) {

   313             // No need to localize debug output

   314             System.out.println("Command line args: " +

   315                     Arrays.toString(args));

   316         }

   317 

   318         for (n=0; n < args.length; n++) {

   319 

   320             String flags = args[n];

   321             String modifier = null;

   322 

   323             if (flags.startsWith("-")) {

   324                 int pos = flags.indexOf(':');

   325                 if (pos > 0) {

   326                     modifier = flags.substring(pos+1);

   327                     flags = flags.substring(0, pos);

   328                 }

   329             }

   330 

   331             if (!flags.startsWith("-")) {

   332                 if (jarfile == null) {

   333                     jarfile = flags;

   334                 } else {

   335                     alias = flags;

   336                     ckaliases.add(alias);

   337                 }

   338             } else if (collator.compare(flags, "-conf") == 0) {

   339                 if (++n == args.length) usageNoArg();

   340             } else if (collator.compare(flags, "-keystore") == 0) {

   341                 if (++n == args.length) usageNoArg();

   342                 keystore = args[n];

   343             } else if (collator.compare(flags, "-storepass") ==0) {

   344                 if (++n == args.length) usageNoArg();

   345                 storepass = getPass(modifier, args[n]);

   346             } else if (collator.compare(flags, "-storetype") ==0) {

   347                 if (++n == args.length) usageNoArg();

   348                 storetype = args[n];

   349             } else if (collator.compare(flags, "-providerName") ==0) {

   350                 if (++n == args.length) usageNoArg();

   351                 providerName = args[n];

   352             } else if ((collator.compare(flags, "-provider") == 0) ||

   353                         (collator.compare(flags, "-providerClass") == 0)) {

   354                 if (++n == args.length) usageNoArg();

   355                 if (providers == null) {

   356                     providers = new Vector<String>(3);

   357                 }

   358                 providers.add(args[n]);

   359 

   360                 if (args.length > (n+1)) {

   361                     flags = args[n+1];

   362                     if (collator.compare(flags, "-providerArg") == 0) {

   363                         if (args.length == (n+2)) usageNoArg();

   364                         providerArgs.put(args[n], args[n+2]);

   365                         n += 2;

   366                     }

   367                 }

   368             } else if (collator.compare(flags, "-protected") ==0) {

   369                 protectedPath = true;

   370             } else if (collator.compare(flags, "-certchain") ==0) {

   371                 if (++n == args.length) usageNoArg();

   372                 altCertChain = args[n];

   373             } else if (collator.compare(flags, "-tsapolicyid") ==0) {

   374                 if (++n == args.length) usageNoArg();

   375                 tSAPolicyID = args[n];

   376             } else if (collator.compare(flags, "-tsadigestalg") ==0) {

   377                 if (++n == args.length) usageNoArg();

   378                 tSADigestAlg = args[n];

   379             } else if (collator.compare(flags, "-debug") ==0) {

   380                 // Already processed

   381             } else if (collator.compare(flags, "-keypass") ==0) {

   382                 if (++n == args.length) usageNoArg();

   383                 keypass = getPass(modifier, args[n]);

   384             } else if (collator.compare(flags, "-sigfile") ==0) {

   385                 if (++n == args.length) usageNoArg();

   386                 sigfile = args[n];

   387             } else if (collator.compare(flags, "-signedjar") ==0) {

   388                 if (++n == args.length) usageNoArg();

   389                 signedjar = args[n];

   390             } else if (collator.compare(flags, "-tsa") ==0) {

   391                 if (++n == args.length) usageNoArg();

   392                 tsaUrl = args[n];

   393             } else if (collator.compare(flags, "-tsacert") ==0) {

   394                 if (++n == args.length) usageNoArg();

   395                 tsaAlias = args[n];

   396             } else if (collator.compare(flags, "-altsigner") ==0) {

   397                 if (++n == args.length) usageNoArg();

   398                 altSignerClass = args[n];

   399             } else if (collator.compare(flags, "-altsignerpath") ==0) {

   400                 if (++n == args.length) usageNoArg();

   401                 altSignerClasspath = args[n];

   402             } else if (collator.compare(flags, "-sectionsonly") ==0) {

   403                 signManifest = false;

   404             } else if (collator.compare(flags, "-internalsf") ==0) {

   405                 externalSF = false;

   406             } else if (collator.compare(flags, "-verify") ==0) {

   407                 verify = true;

   408             } else if (collator.compare(flags, "-verbose") ==0) {

   409                 verbose = (modifier != null) ? modifier : "all";

   410             } else if (collator.compare(flags, "-sigalg") ==0) {

   411                 if (++n == args.length) usageNoArg();

   412                 sigalg = args[n];

   413             } else if (collator.compare(flags, "-digestalg") ==0) {

   414                 if (++n == args.length) usageNoArg();

   415                 digestalg = args[n];

   416             } else if (collator.compare(flags, "-certs") ==0) {

   417                 showcerts = true;

   418             } else if (collator.compare(flags, "-strict") ==0) {

   419                 strict = true;

   420             } else if (collator.compare(flags, "-h") == 0 ||

   421                         collator.compare(flags, "-help") == 0) {

   422                 fullusage();

   423             } else {

   424                 System.err.println(

   425                         rb.getString("Illegal.option.") + flags);

   426                 usage();

   427             }

   428         }

   429 

   430         // -certs must always be specified with -verbose

   431         if (verbose == null) showcerts = false;

   432 

   433         if (jarfile == null) {

   434             System.err.println(rb.getString("Please.specify.jarfile.name"));

   435             usage();

   436         }

   437         if (!verify && alias == null) {

   438             System.err.println(rb.getString("Please.specify.alias.name"));

   439             usage();

   440         }

   441         if (!verify && ckaliases.size() > 1) {

   442             System.err.println(rb.getString("Only.one.alias.can.be.specified"));

   443             usage();

   444         }

   445 

   446         if (storetype == null) {

   447             storetype = KeyStore.getDefaultType();

   448         }

   449         storetype = KeyStoreUtil.niceStoreTypeName(storetype);

   450 

   451         try {

   452             if (signedjar != null && new File(signedjar).getCanonicalPath().equals(

   453                     new File(jarfile).getCanonicalPath())) {

   454                 signedjar = null;

   455             }

   456         } catch (IOException ioe) {

   457             // File system error?

   458             // Just ignore it.

   459         }

   460 

   461         if (P11KEYSTORE.equalsIgnoreCase(storetype) ||

   462                 KeyStoreUtil.isWindowsKeyStore(storetype)) {

   463             token = true;

   464             if (keystore == null) {

   465                 keystore = NONE;

   466             }

   467         }

   468 

   469         if (NONE.equals(keystore)) {

   470             nullStream = true;

   471         }

   472 

   473         if (token && !nullStream) {

   474             System.err.println(MessageFormat.format(rb.getString

   475                 (".keystore.must.be.NONE.if.storetype.is.{0}"), storetype));

   476             usage();

   477         }

   478 

   479         if (token && keypass != null) {

   480             System.err.println(MessageFormat.format(rb.getString

   481                 (".keypass.can.not.be.specified.if.storetype.is.{0}"), storetype));

   482             usage();

   483         }

   484 

   485         if (protectedPath) {

   486             if (storepass != null || keypass != null) {

   487                 System.err.println(rb.getString

   488                         ("If.protected.is.specified.then.storepass.and.keypass.must.not.be.specified"));

   489                 usage();

   490             }

   491         }

   492         if (KeyStoreUtil.isWindowsKeyStore(storetype)) {

   493             if (storepass != null || keypass != null) {

   494                 System.err.println(rb.getString

   495                         ("If.keystore.is.not.password.protected.then.storepass.and.keypass.must.not.be.specified"));

   496                 usage();

   497             }

   498         }

   499         return args;

   500     }

   501 

   502     static char[] getPass(String modifier, String arg) {

   503         char[] output = KeyStoreUtil.getPassWithModifier(modifier, arg, rb);

   504         if (output != null) return output;

   505         usage();

   506         return null;    // Useless, usage() already exit

   507     }

   508 

   509     static void usageNoArg() {

   510         System.out.println(rb.getString("Option.lacks.argument"));

   511         usage();

   512     }

   513 

   514     static void usage() {

   515         System.out.println();

   516         System.out.println(rb.getString("Please.type.jarsigner.help.for.usage"));

   517         System.exit(1);

   518     }

   519 

   520     static void fullusage() {

   521         System.out.println(rb.getString

   522                 ("Usage.jarsigner.options.jar.file.alias"));

   523         System.out.println(rb.getString

   524                 (".jarsigner.verify.options.jar.file.alias."));

   525         System.out.println();

   526         System.out.println(rb.getString

   527                 (".keystore.url.keystore.location"));

   528         System.out.println();

   529         System.out.println(rb.getString

   530                 (".storepass.password.password.for.keystore.integrity"));

   531         System.out.println();

   532         System.out.println(rb.getString

   533                 (".storetype.type.keystore.type"));

   534         System.out.println();

   535         System.out.println(rb.getString

   536                 (".keypass.password.password.for.private.key.if.different."));

   537         System.out.println();

   538         System.out.println(rb.getString

   539                 (".certchain.file.name.of.alternative.certchain.file"));

   540         System.out.println();

   541         System.out.println(rb.getString

   542                 (".sigfile.file.name.of.SF.DSA.file"));

   543         System.out.println();

   544         System.out.println(rb.getString

   545                 (".signedjar.file.name.of.signed.JAR.file"));

   546         System.out.println();

   547         System.out.println(rb.getString

   548                 (".digestalg.algorithm.name.of.digest.algorithm"));

   549         System.out.println();

   550         System.out.println(rb.getString

   551                 (".sigalg.algorithm.name.of.signature.algorithm"));

   552         System.out.println();

   553         System.out.println(rb.getString

   554                 (".verify.verify.a.signed.JAR.file"));

   555         System.out.println();

   556         System.out.println(rb.getString

   557                 (".verbose.suboptions.verbose.output.when.signing.verifying."));

   558         System.out.println(rb.getString

   559                 (".suboptions.can.be.all.grouped.or.summary"));

   560         System.out.println();

   561         System.out.println(rb.getString

   562                 (".certs.display.certificates.when.verbose.and.verifying"));

   563         System.out.println();

   564         System.out.println(rb.getString

   565                 (".tsa.url.location.of.the.Timestamping.Authority"));

   566         System.out.println();

   567         System.out.println(rb.getString

   568                 (".tsacert.alias.public.key.certificate.for.Timestamping.Authority"));

   569         System.out.println();

   570         System.out.println(rb.getString

   571                 (".tsapolicyid.tsapolicyid.for.Timestamping.Authority"));

   572         System.out.println();

   573         System.out.println(rb.getString

   574                 (".tsadigestalg.algorithm.of.digest.data.in.timestamping.request"));

   575         System.out.println();

   576         System.out.println(rb.getString

   577                 (".altsigner.class.class.name.of.an.alternative.signing.mechanism"));

   578         System.out.println();

   579         System.out.println(rb.getString

   580                 (".altsignerpath.pathlist.location.of.an.alternative.signing.mechanism"));

   581         System.out.println();

   582         System.out.println(rb.getString

   583                 (".internalsf.include.the.SF.file.inside.the.signature.block"));

   584         System.out.println();

   585         System.out.println(rb.getString

   586                 (".sectionsonly.don.t.compute.hash.of.entire.manifest"));

   587         System.out.println();

   588         System.out.println(rb.getString

   589                 (".protected.keystore.has.protected.authentication.path"));

   590         System.out.println();

   591         System.out.println(rb.getString

   592                 (".providerName.name.provider.name"));

   593         System.out.println();

   594         System.out.println(rb.getString

   595                 (".providerClass.class.name.of.cryptographic.service.provider.s"));

   596         System.out.println(rb.getString

   597                 (".providerArg.arg.master.class.file.and.constructor.argument"));

   598         System.out.println();

   599         System.out.println(rb.getString

   600                 (".strict.treat.warnings.as.errors"));

   601         System.out.println();

   602         System.out.println(rb.getString

   603                 (".conf.url.specify.a.pre.configured.options.file"));

   604         System.out.println();

   605 

   606         System.exit(0);

   607     }

   608 

   609     void verifyJar(String jarName)

   610         throws Exception

   611     {

   612         boolean anySigned = false;  // if there exists entry inside jar signed

   613         JarFile jf = null;

   614 

   615         try {

   616             jf = new JarFile(jarName, true);

   617             Vector<JarEntry> entriesVec = new Vector<>();

   618             byte[] buffer = new byte[8192];

   619 

   620             Enumeration<JarEntry> entries = jf.entries();

   621             while (entries.hasMoreElements()) {

   622                 JarEntry je = entries.nextElement();

   623                 entriesVec.addElement(je);

   624                 InputStream is = null;

   625                 try {

   626                     is = jf.getInputStream(je);

   627                     int n;

   628                     while ((n = is.read(buffer, 0, buffer.length)) != -1) {

   629                         // we just read. this will throw a SecurityException

   630                         // if  a signature/digest check fails.

   631                     }

   632                 } finally {

   633                     if (is != null) {

   634                         is.close();

   635                     }

   636                 }

   637             }

   638 

   639             Manifest man = jf.getManifest();

   640 

   641             // The map to record display info, only used when -verbose provided

   642             //      key: signer info string

   643             //      value: the list of files with common key

   644             Map<String,List<String>> output = new LinkedHashMap<>();

   645 

   646             if (man != null) {

   647                 if (verbose != null) System.out.println();

   648                 Enumeration<JarEntry> e = entriesVec.elements();

   649 

   650                 String tab = rb.getString("6SPACE");

   651 

   652                 while (e.hasMoreElements()) {

   653                     JarEntry je = e.nextElement();

   654                     String name = je.getName();

   655                     CodeSigner[] signers = je.getCodeSigners();

   656                     boolean isSigned = (signers != null);

   657                     anySigned |= isSigned;

   658                     hasUnsignedEntry |= !je.isDirectory() && !isSigned

   659                                         && !signatureRelated(name);

   660 

   661                     int inStoreOrScope = inKeyStore(signers);

   662 

   663                     boolean inStore = (inStoreOrScope & IN_KEYSTORE) != 0;

   664                     boolean inScope = (inStoreOrScope & IN_SCOPE) != 0;

   665 

   666                     notSignedByAlias |= (inStoreOrScope & NOT_ALIAS) != 0;

   667                     if (keystore != null) {

   668                         aliasNotInStore |= isSigned && (!inStore && !inScope);

   669                     }

   670 

   671                     // Only used when -verbose provided

   672                     StringBuffer sb = null;

   673                     if (verbose != null) {

   674                         sb = new StringBuffer();

   675                         boolean inManifest =

   676                             ((man.getAttributes(name) != null) ||

   677                              (man.getAttributes("./"+name) != null) ||

   678                              (man.getAttributes("/"+name) != null));

   679                         sb.append(isSigned ? rb.getString("s") : rb.getString("SPACE"))

   680                                 .append(inManifest ? rb.getString("m") : rb.getString("SPACE"))

   681                                 .append(inStore ? rb.getString("k") : rb.getString("SPACE"))

   682                                 .append(inScope ? rb.getString("i") : rb.getString("SPACE"))

   683                                 .append((inStoreOrScope & NOT_ALIAS) != 0 ? 'X' : ' ')

   684                                 .append(rb.getString("SPACE"));

   685                         sb.append('|');

   686                     }

   687 

   688                     // When -certs provided, display info has extra empty

   689                     // lines at the beginning and end.

   690                     if (isSigned) {

   691                         if (showcerts) sb.append('\n');

   692                         for (CodeSigner signer: signers) {

   693                             // signerInfo() must be called even if -verbose

   694                             // not provided. The method updates various

   695                             // warning flags.

   696                             String si = signerInfo(signer, tab);

   697                             if (showcerts) {

   698                                 sb.append(si);

   699                                 sb.append('\n');

   700                             }

   701                         }

   702                     } else if (showcerts && !verbose.equals("all")) {

   703                         // Print no info for unsigned entries when -verbose:all,

   704                         // to be consistent with old behavior.

   705                         if (signatureRelated(name)) {

   706                             sb.append('\n')

   707                                     .append(tab)

   708                                     .append(rb

   709                                             .getString(".Signature.related.entries."))

   710                                     .append("\n\n");

   711                         } else {

   712                             sb.append('\n').append(tab)

   713                                     .append(rb.getString(".Unsigned.entries."))

   714                                     .append("\n\n");

   715                         }

   716                     }

   717 

   718                     if (verbose != null) {

   719                         String label = sb.toString();

   720                         if (signatureRelated(name)) {

   721                             // Entries inside META-INF and other unsigned

   722                             // entries are grouped separately.

   723                             label = "-" + label;

   724                         }

   725 

   726                         // The label finally contains 2 parts separated by '|':

   727                         // The legend displayed before the entry names, and

   728                         // the cert info (if -certs specified).

   729 

   730                         if (!output.containsKey(label)) {

   731                             output.put(label, new ArrayList<String>());

   732                         }

   733 

   734                         StringBuilder fb = new StringBuilder();

   735                         String s = Long.toString(je.getSize());

   736                         for (int i = 6 - s.length(); i > 0; --i) {

   737                             fb.append(' ');

   738                         }

   739                         fb.append(s).append(' ').

   740                                 append(new Date(je.getTime()).toString());

   741                         fb.append(' ').append(name);

   742 

   743                         output.get(label).add(fb.toString());

   744                     }

   745                 }

   746             }

   747             if (verbose != null) {

   748                 for (Entry<String,List<String>> s: output.entrySet()) {

   749                     List<String> files = s.getValue();

   750                     String key = s.getKey();

   751                     if (key.charAt(0) == '-') { // the signature-related group

   752                         key = key.substring(1);

   753                     }

   754                     int pipe = key.indexOf('|');

   755                     if (verbose.equals("all")) {

   756                         for (String f: files) {

   757                             System.out.println(key.substring(0, pipe) + f);

   758                             System.out.printf(key.substring(pipe+1));

   759                         }

   760                     } else {

   761                         if (verbose.equals("grouped")) {

   762                             for (String f: files) {

   763                                 System.out.println(key.substring(0, pipe) + f);

   764                             }

   765                         } else if (verbose.equals("summary")) {

   766                             System.out.print(key.substring(0, pipe));

   767                             if (files.size() > 1) {

   768                                 System.out.println(files.get(0) + " " +

   769                                         String.format(rb.getString(

   770                                         ".and.d.more."), files.size()-1));

   771                             } else {

   772                                 System.out.println(files.get(0));

   773                             }

   774                         }

   775                         System.out.printf(key.substring(pipe+1));

   776                     }

   777                 }

   778                 System.out.println();

   779                 System.out.println(rb.getString(

   780                     ".s.signature.was.verified."));

   781                 System.out.println(rb.getString(

   782                     ".m.entry.is.listed.in.manifest"));

   783                 System.out.println(rb.getString(

   784                     ".k.at.least.one.certificate.was.found.in.keystore"));

   785                 System.out.println(rb.getString(

   786                     ".i.at.least.one.certificate.was.found.in.identity.scope"));

   787                 if (ckaliases.size() > 0) {

   788                     System.out.println(rb.getString(

   789                         ".X.not.signed.by.specified.alias.es."));

   790                 }

   791                 System.out.println();

   792             }

   793             if (man == null)

   794                 System.out.println(rb.getString("no.manifest."));

   795 

   796             if (!anySigned) {

   797                 System.out.println(rb.getString(

   798                       "jar.is.unsigned.signatures.missing.or.not.parsable."));

   799             } else {

   800                 boolean warningAppeared = false;

   801                 boolean errorAppeared = false;

   802                 if (badKeyUsage || badExtendedKeyUsage || badNetscapeCertType ||

   803                         notYetValidCert || chainNotValidated || hasExpiredCert ||

   804                         hasUnsignedEntry ||

   805                         aliasNotInStore || notSignedByAlias) {

   806 

   807                     if (strict) {

   808                         System.out.println(rb.getString("jar.verified.with.signer.errors."));

   809                         System.out.println();

   810                         System.out.println(rb.getString("Error."));

   811                         errorAppeared = true;

   812                     } else {

   813                         System.out.println(rb.getString("jar.verified."));

   814                         System.out.println();

   815                         System.out.println(rb.getString("Warning."));

   816                         warningAppeared = true;

   817                     }

   818 

   819                     if (badKeyUsage) {

   820                         System.out.println(

   821                             rb.getString("This.jar.contains.entries.whose.signer.certificate.s.KeyUsage.extension.doesn.t.allow.code.signing."));

   822                     }

   823 

   824                     if (badExtendedKeyUsage) {

   825                         System.out.println(

   826                             rb.getString("This.jar.contains.entries.whose.signer.certificate.s.ExtendedKeyUsage.extension.doesn.t.allow.code.signing."));

   827                     }

   828 

   829                     if (badNetscapeCertType) {

   830                         System.out.println(

   831                             rb.getString("This.jar.contains.entries.whose.signer.certificate.s.NetscapeCertType.extension.doesn.t.allow.code.signing."));

   832                     }

   833 

   834                     if (hasUnsignedEntry) {

   835                         System.out.println(rb.getString(

   836                             "This.jar.contains.unsigned.entries.which.have.not.been.integrity.checked."));

   837                     }

   838                     if (hasExpiredCert) {

   839                         System.out.println(rb.getString(

   840                             "This.jar.contains.entries.whose.signer.certificate.has.expired."));

   841                     }

   842                     if (notYetValidCert) {

   843                         System.out.println(rb.getString(

   844                             "This.jar.contains.entries.whose.signer.certificate.is.not.yet.valid."));

   845                     }

   846 

   847                     if (chainNotValidated) {

   848                         System.out.println(

   849                                 rb.getString("This.jar.contains.entries.whose.certificate.chain.is.not.validated."));

   850                     }

   851 

   852                     if (notSignedByAlias) {

   853                         System.out.println(

   854                                 rb.getString("This.jar.contains.signed.entries.which.is.not.signed.by.the.specified.alias.es."));

   855                     }

   856 

   857                     if (aliasNotInStore) {

   858                         System.out.println(rb.getString("This.jar.contains.signed.entries.that.s.not.signed.by.alias.in.this.keystore."));

   859                     }

   860                 } else {

   861                     System.out.println(rb.getString("jar.verified."));

   862                 }

   863                 if (hasExpiringCert || noTimestamp) {

   864                     if (!warningAppeared) {

   865                         System.out.println();

   866                         System.out.println(rb.getString("Warning."));

   867                         warningAppeared = true;

   868                     }

   869                     if (hasExpiringCert) {

   870                         System.out.println(rb.getString(

   871                                 "This.jar.contains.entries.whose.signer.certificate.will.expire.within.six.months."));

   872                     }

   873                     if (noTimestamp) {

   874                         System.out.println(

   875                                 String.format(rb.getString("no.timestamp.verifying"), expireDate));

   876                     }

   877                 }

   878                 if (warningAppeared || errorAppeared) {

   879                     if (! (verbose != null && showcerts)) {

   880                         System.out.println();

   881                         System.out.println(rb.getString(

   882                                 "Re.run.with.the.verbose.and.certs.options.for.more.details."));

   883                     }

   884                 }

   885             }

   886             return;

   887         } catch (Exception e) {

   888             System.out.println(rb.getString("jarsigner.") + e);

   889             if (debug) {

   890                 e.printStackTrace();

   891             }

   892         } finally { // close the resource

   893             if (jf != null) {

   894                 jf.close();

   895             }

   896         }

   897 

   898         System.exit(1);

   899     }

   900 

   901     private static MessageFormat validityTimeForm = null;

   902     private static MessageFormat notYetTimeForm = null;

   903     private static MessageFormat expiredTimeForm = null;

   904     private static MessageFormat expiringTimeForm = null;

   905 

   906     /*

   907      * Display some details about a certificate:

   908      *

   909      * [<tab>] <cert-type> [", " <subject-DN>] [" (" <keystore-entry-alias> ")"]

   910      * [<validity-period> | <expiry-warning>]

   911      *

   912      * Note: no newline character at the end

   913      */

   914     String printCert(String tab, Certificate c, boolean checkValidityPeriod,

   915         Date timestamp, boolean checkUsage) {

   916 

   917         StringBuilder certStr = new StringBuilder();

   918         String space = rb.getString("SPACE");

   919         X509Certificate x509Cert = null;

   920 

   921         if (c instanceof X509Certificate) {

   922             x509Cert = (X509Certificate) c;

   923             certStr.append(tab).append(x509Cert.getType())

   924                 .append(rb.getString("COMMA"))

   925                 .append(x509Cert.getSubjectDN().getName());

   926         } else {

   927             certStr.append(tab).append(c.getType());

   928         }

   929 

   930         String alias = storeHash.get(c);

   931         if (alias != null) {

   932             certStr.append(space).append(alias);

   933         }

   934 

   935         if (checkValidityPeriod && x509Cert != null) {

   936 

   937             certStr.append("\n").append(tab).append("[");

   938             Date notAfter = x509Cert.getNotAfter();

   939             try {

   940                 boolean printValidity = true;

   941                 if (timestamp == null) {

   942                     if (expireDate.getTime() == 0 || expireDate.after(notAfter)) {

   943                         expireDate = notAfter;

   944                     }

   945                     x509Cert.checkValidity();

   946                     // test if cert will expire within six months

   947                     if (notAfter.getTime() < System.currentTimeMillis() + SIX_MONTHS) {

   948                         hasExpiringCert = true;

   949                         if (expiringTimeForm == null) {

   950                             expiringTimeForm = new MessageFormat(

   951                                 rb.getString("certificate.will.expire.on"));

   952                         }

   953                         Object[] source = { notAfter };

   954                         certStr.append(expiringTimeForm.format(source));

   955                         printValidity = false;

   956                     }

   957                 } else {

   958                     x509Cert.checkValidity(timestamp);

   959                 }

   960                 if (printValidity) {

   961                     if (validityTimeForm == null) {

   962                         validityTimeForm = new MessageFormat(

   963                             rb.getString("certificate.is.valid.from"));

   964                     }

   965                     Object[] source = { x509Cert.getNotBefore(), notAfter };

   966                     certStr.append(validityTimeForm.format(source));

   967                 }

   968             } catch (CertificateExpiredException cee) {

   969                 hasExpiredCert = true;

   970 

   971                 if (expiredTimeForm == null) {

   972                     expiredTimeForm = new MessageFormat(

   973                         rb.getString("certificate.expired.on"));

   974                 }

   975                 Object[] source = { notAfter };

   976                 certStr.append(expiredTimeForm.format(source));

   977 

   978             } catch (CertificateNotYetValidException cnyve) {

   979                 notYetValidCert = true;

   980 

   981                 if (notYetTimeForm == null) {

   982                     notYetTimeForm = new MessageFormat(

   983                         rb.getString("certificate.is.not.valid.until"));

   984                 }

   985                 Object[] source = { x509Cert.getNotBefore() };

   986                 certStr.append(notYetTimeForm.format(source));

   987             }

   988             certStr.append("]");

   989 

   990             if (checkUsage) {

   991                 boolean[] bad = new boolean[3];

   992                 checkCertUsage(x509Cert, bad);

   993                 if (bad[0] || bad[1] || bad[2]) {

   994                     String x = "";

   995                     if (bad[0]) {

   996                         x ="KeyUsage";

   997                     }

   998                     if (bad[1]) {

   999                         if (x.length() > 0) x = x + ", ";

  1000                         x = x + "ExtendedKeyUsage";

  1001                     }

  1002                     if (bad[2]) {

  1003                         if (x.length() > 0) x = x + ", ";

  1004                         x = x + "NetscapeCertType";

  1005                     }

  1006                     certStr.append("\n").append(tab)

  1007                         .append(MessageFormat.format(rb.getString(

  1008                         ".{0}.extension.does.not.support.code.signing."), x));

  1009                 }

  1010             }

  1011         }

  1012         return certStr.toString();

  1013     }

  1014 

  1015     private static MessageFormat signTimeForm = null;

  1016 

  1017     private String printTimestamp(String tab, Timestamp timestamp) {

  1018 

  1019         if (signTimeForm == null) {

  1020             signTimeForm =

  1021                 new MessageFormat(rb.getString("entry.was.signed.on"));

  1022         }

  1023         Object[] source = { timestamp.getTimestamp() };

  1024 

  1025         return new StringBuilder().append(tab).append("[")

  1026             .append(signTimeForm.format(source)).append("]").toString();

  1027     }

  1028 

  1029     private Map<CodeSigner,Integer> cacheForInKS = new IdentityHashMap<>();

  1030 

  1031     private int inKeyStoreForOneSigner(CodeSigner signer) {

  1032         if (cacheForInKS.containsKey(signer)) {

  1033             return cacheForInKS.get(signer);

  1034         }

  1035 

  1036         boolean found = false;

  1037         int result = 0;

  1038         List<? extends Certificate> certs = signer.getSignerCertPath().getCertificates();

  1039         for (Certificate c : certs) {

  1040             String alias = storeHash.get(c);

  1041             if (alias != null) {

  1042                 if (alias.startsWith("(")) {

  1043                     result |= IN_KEYSTORE;

  1044                 } else if (alias.startsWith("[")) {

  1045                     result |= IN_SCOPE;

  1046                 }

  1047                 if (ckaliases.contains(alias.substring(1, alias.length() - 1))) {

  1048                     result |= SIGNED_BY_ALIAS;

  1049                 }

  1050             } else {

  1051                 if (store != null) {

  1052                     try {

  1053                         alias = store.getCertificateAlias(c);

  1054                     } catch (KeyStoreException kse) {

  1055                         // never happens, because keystore has been loaded

  1056                     }

  1057                     if (alias != null) {

  1058                         storeHash.put(c, "(" + alias + ")");

  1059                         found = true;

  1060                         result |= IN_KEYSTORE;

  1061                     }

  1062                 }

  1063                 if (ckaliases.contains(alias)) {

  1064                     result |= SIGNED_BY_ALIAS;

  1065                 }

  1066             }

  1067         }

  1068         cacheForInKS.put(signer, result);

  1069         return result;

  1070     }

  1071 

  1072     Hashtable<Certificate, String> storeHash = new Hashtable<>();

  1073 

  1074     int inKeyStore(CodeSigner[] signers) {

  1075 

  1076         if (signers == null)

  1077             return 0;

  1078 

  1079         int output = 0;

  1080 

  1081         for (CodeSigner signer: signers) {

  1082             int result = inKeyStoreForOneSigner(signer);

  1083             output |= result;

  1084         }

  1085         if (ckaliases.size() > 0 && (output & SIGNED_BY_ALIAS) == 0) {

  1086             output |= NOT_ALIAS;

  1087         }

  1088         return output;

  1089     }

  1090 

  1091     void signJar(String jarName, String alias, String[] args)

  1092         throws Exception {

  1093         boolean aliasUsed = false;

  1094         X509Certificate tsaCert = null;

  1095 

  1096         if (sigfile == null) {

  1097             sigfile = alias;

  1098             aliasUsed = true;

  1099         }

  1100 

  1101         if (sigfile.length() > 8) {

  1102             sigfile = sigfile.substring(0, 8).toUpperCase(Locale.ENGLISH);

  1103         } else {

  1104             sigfile = sigfile.toUpperCase(Locale.ENGLISH);

  1105         }

  1106 

  1107         StringBuilder tmpSigFile = new StringBuilder(sigfile.length());

  1108         for (int j = 0; j < sigfile.length(); j++) {

  1109             char c = sigfile.charAt(j);

  1110             if (!

  1111                 ((c>= 'A' && c<= 'Z') ||

  1112                 (c>= '0' && c<= '9') ||

  1113                 (c == '-') ||

  1114                 (c == '_'))) {

  1115                 if (aliasUsed) {

  1116                     // convert illegal characters from the alias to be _'s

  1117                     c = '_';

  1118                 } else {

  1119                  throw new

  1120                    RuntimeException(rb.getString

  1121                         ("signature.filename.must.consist.of.the.following.characters.A.Z.0.9.or."));

  1122                 }

  1123             }

  1124             tmpSigFile.append(c);

  1125         }

  1126 

  1127         sigfile = tmpSigFile.toString();

  1128 

  1129         String tmpJarName;

  1130         if (signedjar == null) tmpJarName = jarName+".sig";

  1131         else tmpJarName = signedjar;

  1132 

  1133         File jarFile = new File(jarName);

  1134         File signedJarFile = new File(tmpJarName);