1 /*
2 * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 */
23
24 /*
25 * @test
26 * @bug 8047305 8075618
27 * @summary Tests jarsigner tool and JarSigner API work with multi-release JAR files.
28 * @library /test/lib
29 * @library /lib/testlibrary
30 * @run main MVJarSigningTest
31 */
32
33 import jdk.security.jarsigner.JarSigner;
34
35 import java.io.BufferedReader;
36 import java.io.File;
37 import java.io.FileInputStream;
38 import java.io.FileOutputStream;
39 import java.io.IOException;
40 import java.io.InputStreamReader;
41 import java.nio.file.Files;
42 import java.nio.file.Path;
43 import java.nio.file.Paths;
44 import java.security.KeyStore;
45 import java.security.PrivateKey;
46 import java.security.cert.Certificate;
47 import java.security.cert.CertificateFactory;
48 import java.util.ArrayList;
49 import java.util.Arrays;
50 import java.util.Collections;
51 import java.util.List;
52 import java.util.concurrent.TimeUnit;
53 import java.util.jar.JarFile;
54 import java.util.stream.Stream;
55 import java.util.zip.ZipEntry;
56 import java.util.zip.ZipFile;
57 import java.util.zip.ZipOutputStream;
58
59 import jdk.test.lib.JDKToolFinder;
60 import jdk.test.lib.JDKToolLauncher;
61 import jdk.test.lib.Utils;
62 import jdk.test.lib.process.OutputAnalyzer;
63 import jdk.test.lib.process.ProcessTools;
64
65
66 public class MVJarSigningTest {
67
68 private static final String TEST_SRC = System.getProperty("test.src", ".");
69 private static final String USR_DIR = System.getProperty("user.dir", ".");
70 private static final String JAR_NAME = "MV.jar";
71 private static final String KEYSTORE = "keystore.jks";
72 private static final String ALIAS = "JavaTest";
73 private static final String STOREPASS = "changeit";
74 private static final String KEYPASS = "changeit";
75 private static final String SIGNED_JAR = "Signed.jar";
76 private static final String POLICY_FILE = "SignedJar.policy";
77 private static final String VERSION = "" + Runtime.version().major();
78 private static final String VERSION_MESSAGE = "I am running on version " + VERSION;
79
80 public static void main(String[] args) throws Throwable {
81 // compile java files in jarContent directory
82 compile("jarContent");
83
84 // create multi-release jar
85 Path classes = Paths.get("classes");
86 jar("cf", JAR_NAME, "-C", classes.resolve("base").toString(), ".",
87 "--release", "9", "-C", classes.resolve("v9").toString(), ".",
88 "--release", "10", "-C", classes.resolve("v10").toString(), ".")
89 .shouldHaveExitValue(0);
90
91 genKey();
92 signJar(JAR_NAME)
93 .shouldHaveExitValue(0)
94 .shouldMatch("signing.*META-INF/versions/9/version/Version.class")
95 .shouldMatch("signing.*META-INF/versions/10/version/Version.class")
96 .shouldMatch("signing.*version/Main.class")
97 .shouldMatch("signing.*version/Version.class");
98 verify(SIGNED_JAR);
99
100 // test with JarSigner API
101 Files.deleteIfExists(Paths.get(SIGNED_JAR));
102 signWithJarSignerAPI(JAR_NAME);
103 verify(SIGNED_JAR);
104
105 // test Permission granted
106 File keypass = new File("keypass");
107 try (FileOutputStream fos = new FileOutputStream(keypass)) {
108 fos.write(KEYPASS.getBytes());
109 }
110 String[] cmd = {
111 "-classpath", SIGNED_JAR,
112 "-Djava.security.manager",
113 "-Djava.security.policy=" +
114 TEST_SRC + File.separator + POLICY_FILE,
115 "version.Main"};
116 ProcessTools.executeTestJvm(cmd)
117 .shouldHaveExitValue(0)
118 .shouldContain(VERSION_MESSAGE);
119 }
120
121 private static void compile (String jarContent_path) throws Throwable {
122 Path classes = Paths.get(USR_DIR, "classes", "base");
123 Path source = Paths.get(TEST_SRC, jarContent_path, "base", "version");
124 CompilerUtils.compile(source, classes);
125
126 classes = Paths.get(USR_DIR, "classes", "v9");
127 source = Paths.get(TEST_SRC, jarContent_path , "v9", "version");
128 CompilerUtils.compile(source, classes);
129
130 classes = Paths.get(USR_DIR, "classes", "v10");
131 source = Paths.get(TEST_SRC, jarContent_path, "v10", "version");
132 CompilerUtils.compile(source, classes);
133 }
134
135 private static OutputAnalyzer jar(String...args) throws Throwable {
136 JDKToolLauncher launcher = JDKToolLauncher.createUsingTestJDK("jar");
137 Stream.of(args).forEach(launcher::addToolArg);
138 return ProcessTools.executeCommand(launcher.getCommand());
139 }
140
141 private static void genKey() throws Throwable {
142 String keytool = JDKToolFinder.getJDKTool("keytool");
143 Files.deleteIfExists(Paths.get(KEYSTORE));
144 ProcessTools.executeCommand(keytool,
145 "-J-Duser.language=en",
146 "-J-Duser.country=US",
147 "-genkey",
148 "-alias", ALIAS,
149 "-keystore", KEYSTORE,
150 "-keypass", KEYPASS,
151 "-dname", "cn=sample",
152 "-storepass", STOREPASS
153 ).shouldHaveExitValue(0);
154 }
155
156 private static OutputAnalyzer signJar(String jarName) throws Throwable {
157 List<String> args = new ArrayList<>();
158 args.add("-verbose");
159 args.add("-signedjar");
160 args.add(SIGNED_JAR);
161 args.add(jarName);
162 args.add(ALIAS);
163
164 return jarsigner(args);
165 }
166
167 private static void verify(String signedJarName) throws Throwable {
168 verifyJar(signedJarName)
169 .shouldHaveExitValue(0)
170 .shouldContain("jar verified")
171 .shouldMatch("smk.*META-INF/versions/9/version/Version.class")
172 .shouldMatch("smk.*META-INF/versions/10/version/Version.class")
173 .shouldMatch("smk.*version/Main.class")
174 .shouldMatch("smk.*version/Version.class");
175 }
176
177 private static OutputAnalyzer verifyJar(String signedJarName) throws Throwable {
178 List<String> args = new ArrayList<>();
179 args.add("-verbose");
180 args.add("-verify");
181 args.add(signedJarName);
182
183 return jarsigner(args);
184 }
185
186 private static OutputAnalyzer jarsigner(List<String> extra)
187 throws Throwable {
188 JDKToolLauncher launcher = JDKToolLauncher.createUsingTestJDK("jarsigner")
189 .addVMArg("-Duser.language=en")
190 .addVMArg("-Duser.country=US")
191 .addToolArg("-keystore")
192 .addToolArg(KEYSTORE)
193 .addToolArg("-storepass")
194 .addToolArg(STOREPASS)
195 .addToolArg("-keypass")
196 .addToolArg(KEYPASS);
197 for (String s : extra) {
198 if (s.startsWith("-J")) {
199 launcher.addVMArg(s.substring(2));
200 } else {
201 launcher.addToolArg(s);
202 }
203 }
204 return ProcessTools.executeCommand(launcher.getCommand());
205 }
206
207 private static void signWithJarSignerAPI(String jarName)
208 throws Throwable {
209 // Get JarSigner
210 try (FileInputStream fis = new FileInputStream(KEYSTORE)) {
211 KeyStore ks = KeyStore.getInstance("JKS");
212 ks.load(fis, STOREPASS.toCharArray());
213 PrivateKey pk = (PrivateKey)ks.getKey(ALIAS, KEYPASS.toCharArray());
214 Certificate cert = ks.getCertificate(ALIAS);
215 JarSigner signer = new JarSigner.Builder(pk,
216 CertificateFactory.getInstance("X.509").generateCertPath(
217 Collections.singletonList(cert)))
218 .build();
219 // Sign jar
220 try (ZipFile src = new JarFile(jarName);
221 FileOutputStream out = new FileOutputStream(SIGNED_JAR)) {
222 signer.sign(src,out);
223 }
224 }
225 }
226
227 }
228
229