bundles/org.eclipse.equinox.p2.artifact.repository/src/org/eclipse/equinox/internal/p2/artifact/processors/pgp/PGPSignatureVerifier.java - equinox/rt.equinox.p2 - Git at Google

 /*******************************************************************************
  * Copyright (c) 2021 Red Hat Inc. and others.
  *
  * This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License 2.0
  * which accompanies this distribution, and is available at
  * https://www.eclipse.org/legal/epl-2.0/
  *
  * SPDX-License-Identifier: EPL-2.0
  *******************************************************************************/
 package org.eclipse.equinox.internal.p2.artifact.processors.pgp;

 import java.io.*;
 import java.nio.charset.StandardCharsets;
 import java.util.*;
 import java.util.Map.Entry;
 import org.bouncycastle.bcpg.ArmoredInputStream;
 import org.bouncycastle.openpgp.*;
 import org.bouncycastle.openpgp.bc.BcPGPObjectFactory;
 import org.bouncycastle.openpgp.operator.PGPContentVerifier;
 import org.bouncycastle.openpgp.operator.PGPContentVerifierBuilder;
 import org.bouncycastle.openpgp.operator.bc.BcPGPContentVerifierBuilderProvider;
 import org.eclipse.core.runtime.*;
 import org.eclipse.equinox.internal.p2.artifact.repository.Activator;
 import org.eclipse.equinox.internal.p2.core.helpers.LogHelper;
 import org.eclipse.equinox.internal.provisional.p2.artifact.repository.processing.ProcessingStep;
 import org.eclipse.equinox.p2.core.IProvisioningAgent;
 import org.eclipse.equinox.p2.repository.artifact.*;
 import org.eclipse.equinox.p2.repository.artifact.spi.ArtifactDescriptor;
 import org.eclipse.equinox.p2.repository.spi.PGPPublicKeyService;
 import org.eclipse.osgi.util.NLS;

 /**
  * This processing step verifies PGP signatures are correct (i.e., the artifact
  * was not tampered during fetch). Note that is does <b>not</b> deal with trust.
  * Dealing with trusted signers is done as part of CheckTrust and touchpoint
  * phase.
  */
 public final class PGPSignatureVerifier extends ProcessingStep {

 	/**
 	 * ID of the registering
 	 * <code>org.eclipse.equinox.p2.artifact.repository.processingSteps</tt>
 	 * extension.
 	 */
 	public static final String ID = "org.eclipse.equinox.p2.processing.PGPSignatureCheck"; //$NON-NLS-1$

 	public static final String PGP_SIGNER_KEYS_PROPERTY_NAME = "pgp.publicKeys"; //$NON-NLS-1$

 	public static final String PGP_SIGNATURES_PROPERTY_NAME = "pgp.signatures"; //$NON-NLS-1$

 	private PGPPublicKeyService keyService;

 	private IArtifactDescriptor sourceDescriptor;

 	private Map<PGPSignature, List<PGPContentVerifier>> signaturesToVerify = new LinkedHashMap<>();

 	private Map<PGPContentVerifier, PGPPublicKey> verifierKeys = new LinkedHashMap<>();

 	private List<OutputStream> signatureVerifiers = new ArrayList<>();

 	public PGPSignatureVerifier() {
 		super();
 		link(nullOutputStream(), new NullProgressMonitor()); // this is convenience for tests
 	}

 	public static Collection<PGPSignature> getSignatures(IArtifactDescriptor artifact)
 			throws IOException, PGPException {
 		String signatureText = unnormalizedPGPProperty(artifact.getProperty(PGP_SIGNATURES_PROPERTY_NAME));
 		if (signatureText == null) {
 			return Collections.emptyList();
 		}
 		List<PGPSignature> res = new ArrayList<>();
 		try (InputStream in = new ArmoredInputStream(
 				new ByteArrayInputStream(signatureText.getBytes(StandardCharsets.US_ASCII)))) {
 			PGPObjectFactory pgpFactory = new BcPGPObjectFactory(in);
 			Object o = pgpFactory.nextObject();
 			PGPSignatureList signatureList = new PGPSignatureList(new PGPSignature[0]);
 			if (o instanceof PGPCompressedData) {
 				PGPCompressedData pgpCompressData = (PGPCompressedData) o;
 				pgpFactory = new BcPGPObjectFactory(pgpCompressData.getDataStream());
 				signatureList = (PGPSignatureList) pgpFactory.nextObject();
 			} else if (o instanceof PGPSignatureList) {
 				signatureList = (PGPSignatureList) o;
 			}
 			signatureList.iterator().forEachRemaining(res::add);
 		}
 		return res;
 	}

 	public static PGPPublicKeyStore getKeys(IArtifactDescriptor artifact) {
 		PGPPublicKeyStore keyStore = new PGPPublicKeyStore();
 		String keyText = artifact.getProperty(PGPSignatureVerifier.PGP_SIGNER_KEYS_PROPERTY_NAME);
 		PGPPublicKeyStore.readPublicKeys(keyText).stream().forEach(keyStore::addKey);
 		return keyStore;
 	}

 	@Override
 	public void initialize(IProvisioningAgent agent, IProcessingStepDescriptor descriptor,
 			IArtifactDescriptor context) {
 		super.initialize(agent, descriptor, context);

 		sourceDescriptor = context;
 		keyService = agent.getService(PGPPublicKeyService.class);

 //		1. verify declared public keys have signature from a trusted key, if so, add to KeyStore
 //		2. verify artifact signature matches signature of given keys, and at least 1 of this key is trusted
 		String signatureText = unnormalizedPGPProperty(context.getProperty(PGP_SIGNATURES_PROPERTY_NAME));
 		if (signatureText == null) {
 			setStatus(Status.OK_STATUS);
 			return;
 		}

 		Collection<PGPSignature> signatures;
 		try {
 			signatures = getSignatures(context);
 		} catch (Exception ex) {
 			setStatus(new Status(IStatus.ERROR, Activator.ID, Messages.Error_CouldNotLoadSignature, ex));
 			return;
 		}

 		if (signatures.isEmpty()) {
 			setStatus(Status.OK_STATUS);
 			return;
 		}

 		IArtifactRepository repository = context.getRepository();

 		PGPPublicKeyStore.readPublicKeys(context.getProperty(PGP_SIGNER_KEYS_PROPERTY_NAME))
 				.forEach(keyService::addKey);
 		if (repository != null) {
 			PGPPublicKeyStore.readPublicKeys(repository.getProperty(PGP_SIGNER_KEYS_PROPERTY_NAME))
 					.forEach(keyService::addKey);
 		}

 		for (PGPSignature signature : signatures) {
 			long keyID = signature.getKeyID();
 			Collection<PGPPublicKey> keys = keyService.getKeys(keyID);
 			if (keys.isEmpty()) {
 				LogHelper.log(new Status(IStatus.WARNING, Activator.ID,
 						NLS.bind(Messages.Warning_publicKeyNotFound, PGPPublicKeyService.toHex(keyID),
 								context.getArtifactKey().getId())));
 			} else {
 				try {
 					PGPContentVerifierBuilder verifierBuilder = new BcPGPContentVerifierBuilderProvider()
 							.get(signature.getKeyAlgorithm(), signature.getHashAlgorithm());
 					List<PGPContentVerifier> verifiers = new ArrayList<>();
 					signaturesToVerify.put(signature, verifiers);
 					for (PGPPublicKey key : keys) {
 						PGPContentVerifier verifier = verifierBuilder.build(key);
 						verifierKeys.put(verifier, key);
 						verifiers.add(verifier);
 						signatureVerifiers.add(verifier.getOutputStream());
 					}
 				} catch (PGPException ex) {
 					setStatus(new Status(IStatus.ERROR, Activator.ID, ex.getMessage(), ex));
 					return;
 				}
 			}
 		}
 	}

 	/**
 	 * See // https://www.w3.org/TR/1998/REC-xml-19980210#AVNormalize, newlines
 	 * replaced by spaces by parser, needs to be restored
 	 *
 	 * @param armoredPGPBlock the PGP block, in armored form
 	 * @return fixed PGP armored blocks
 	 */
 	static String unnormalizedPGPProperty(String armoredPGPBlock) {
 		if (armoredPGPBlock == null) {
 			return null;
 		}
 		if (armoredPGPBlock.contains("\n") || armoredPGPBlock.contains("\r")) { //$NON-NLS-1$ //$NON-NLS-2$
 			return armoredPGPBlock;
 		}
 		return armoredPGPBlock.replace(' ', '\n')
 				.replace("-----BEGIN\nPGP\nSIGNATURE-----", "-----BEGIN PGP SIGNATURE-----") //$NON-NLS-1$ //$NON-NLS-2$
 				.replace("-----END\nPGP\nSIGNATURE-----", "-----END PGP SIGNATURE-----") //$NON-NLS-1$ //$NON-NLS-2$
 				.replace("-----BEGIN\nPGP\nPUBLIC\nKEY\nBLOCK-----", "-----BEGIN PGP PUBLIC KEY BLOCK-----") //$NON-NLS-1$ //$NON-NLS-2$
 				.replace("-----END\nPGP\nPUBLIC\nKEY\nBLOCK-----", "-----END PGP PUBLIC KEY BLOCK-----"); //$NON-NLS-1$ //$NON-NLS-2$
 	}

 	@Override
 	public void write(int b) throws IOException {
 		getDestination().write(b);
 		for (OutputStream verifier : signatureVerifiers) {
 			verifier.write(b);
 		}
 	}

 	@Override
 	public void write(byte[] b, int off, int len) throws IOException {
 		getDestination().write(b, off, len);
 		for (OutputStream verifier : signatureVerifiers) {
 			verifier.write(b, off, len);
 		}
 	}

 	@Override
 	public void close() throws IOException {
 		try {
 			if (!getStatus().isOK()) {
 				return;
 			}

 			if (signaturesToVerify.isEmpty()) {
 				return;
 			}

 			PGPPublicKeyStore keyStore = new PGPPublicKeyStore();
 			for (Entry<PGPSignature, List<PGPContentVerifier>> entry : signaturesToVerify.entrySet()) {
 				PGPSignature signature = entry.getKey();
 				List<PGPContentVerifier> verifiers = entry.getValue();
 				boolean verified = false;
 				for (PGPContentVerifier verifier : verifiers) {
 					try {
 						verifier.getOutputStream().write(signature.getSignatureTrailer());
 						if (verifier.verify(signature.getSignature())) {
 							PGPPublicKey verifyingKey = verifierKeys.get(verifier);
 							if (!Boolean.FALSE.toString()
 									.equalsIgnoreCase(System.getProperty("p2.pgp.verifyExpiration"))) { //$NON-NLS-1$
 								if (PGPPublicKeyService.compareSignatureTimeToKeyValidityTime(signature,
 										verifyingKey) != 0) {
 									LogHelper.log(new Status(IStatus.WARNING, Activator.ID,
 											NLS.bind(Messages.Error_SignatureAfterKeyExpiration, PGPPublicKeyService
 													.toHexFingerprint(verifyingKey))));
 								}
 							}

 							if (!Boolean.FALSE.toString()
 									.equalsIgnoreCase(System.getProperty("p2.pgp.verifyRevocation"))) { //$NON-NLS-1$
 								if (!keyService.isCreatedBeforeRevocation(signature, verifyingKey)) {
 									setStatus(new Status(IStatus.ERROR, Activator.ID,
 											NLS.bind(Messages.Error_SignatureAfterKeyRevocation, PGPPublicKeyService
 													.toHexFingerprint(verifyingKey))));
 									return;
 								}
 							}

 							keyStore.addKey(verifyingKey);
 							verified = true;
 							break;
 						}
 					} catch (PGPException ex) {
 						LogHelper.log(new Status(IStatus.ERROR, Activator.ID, ex.getMessage(), ex));
 					}
 				}

 				if (!verified) {
 					setStatus(new Status(IStatus.ERROR, Activator.ID, Messages.Error_SignatureAndFileDontMatch));
 					return;
 				}
 			}

 			// Update the destination artifact descriptor with the signatures that have been
 			// verified and the keys used for that verification.
 			OutputStream destination = getDestination();
 			if (destination instanceof IAdaptable) {
 				ArtifactDescriptor destinationDescriptor = ((IAdaptable) destination)
 						.getAdapter(ArtifactDescriptor.class);
 				destinationDescriptor.setProperty(PGP_SIGNATURES_PROPERTY_NAME,
 						sourceDescriptor.getProperty(PGP_SIGNATURES_PROPERTY_NAME));
 				destinationDescriptor.setProperty(PGP_SIGNER_KEYS_PROPERTY_NAME, keyStore.toArmoredString());
 			}

 			setStatus(Status.OK_STATUS);
 		} finally

 		{
 			super.close();
 		}
 	}

 }
	/*******************************************************************************
	* Copyright (c) 2021 Red Hat Inc. and others.
	*
	* This program and the accompanying materials
	* are made available under the terms of the Eclipse Public License 2.0
	* which accompanies this distribution, and is available at
	* https://www.eclipse.org/legal/epl-2.0/
	*
	* SPDX-License-Identifier: EPL-2.0
	*******************************************************************************/
	package org.eclipse.equinox.internal.p2.artifact.processors.pgp;

	import java.io.*;
	import java.nio.charset.StandardCharsets;
	import java.util.*;
	import java.util.Map.Entry;
	import org.bouncycastle.bcpg.ArmoredInputStream;
	import org.bouncycastle.openpgp.*;
	import org.bouncycastle.openpgp.bc.BcPGPObjectFactory;
	import org.bouncycastle.openpgp.operator.PGPContentVerifier;
	import org.bouncycastle.openpgp.operator.PGPContentVerifierBuilder;
	import org.bouncycastle.openpgp.operator.bc.BcPGPContentVerifierBuilderProvider;
	import org.eclipse.core.runtime.*;
	import org.eclipse.equinox.internal.p2.artifact.repository.Activator;
	import org.eclipse.equinox.internal.p2.core.helpers.LogHelper;
	import org.eclipse.equinox.internal.provisional.p2.artifact.repository.processing.ProcessingStep;
	import org.eclipse.equinox.p2.core.IProvisioningAgent;
	import org.eclipse.equinox.p2.repository.artifact.*;
	import org.eclipse.equinox.p2.repository.artifact.spi.ArtifactDescriptor;
	import org.eclipse.equinox.p2.repository.spi.PGPPublicKeyService;
	import org.eclipse.osgi.util.NLS;

	/**
	* This processing step verifies PGP signatures are correct (i.e., the artifact
	* was not tampered during fetch). Note that is does <b>not</b> deal with trust.
	* Dealing with trusted signers is done as part of CheckTrust and touchpoint
	* phase.
	*/
	public final class PGPSignatureVerifier extends ProcessingStep {

	/**
	* ID of the registering
	* <code>org.eclipse.equinox.p2.artifact.repository.processingSteps</tt>
	* extension.
	*/
	public static final String ID = "org.eclipse.equinox.p2.processing.PGPSignatureCheck"; //$NON-NLS-1$

	public static final String PGP_SIGNER_KEYS_PROPERTY_NAME = "pgp.publicKeys"; //$NON-NLS-1$

	public static final String PGP_SIGNATURES_PROPERTY_NAME = "pgp.signatures"; //$NON-NLS-1$

	private PGPPublicKeyService keyService;

	private IArtifactDescriptor sourceDescriptor;

	private Map<PGPSignature, List<PGPContentVerifier>> signaturesToVerify = new LinkedHashMap<>();

	private Map<PGPContentVerifier, PGPPublicKey> verifierKeys = new LinkedHashMap<>();

	private List<OutputStream> signatureVerifiers = new ArrayList<>();

	public PGPSignatureVerifier() {
	super();
	link(nullOutputStream(), new NullProgressMonitor()); // this is convenience for tests
	}

	public static Collection<PGPSignature> getSignatures(IArtifactDescriptor artifact)
	throws IOException, PGPException {
	String signatureText = unnormalizedPGPProperty(artifact.getProperty(PGP_SIGNATURES_PROPERTY_NAME));
	if (signatureText == null) {
	return Collections.emptyList();
	}
	List<PGPSignature> res = new ArrayList<>();
	try (InputStream in = new ArmoredInputStream(
	new ByteArrayInputStream(signatureText.getBytes(StandardCharsets.US_ASCII)))) {
	PGPObjectFactory pgpFactory = new BcPGPObjectFactory(in);
	Object o = pgpFactory.nextObject();
	PGPSignatureList signatureList = new PGPSignatureList(new PGPSignature[0]);
	if (o instanceof PGPCompressedData) {
	PGPCompressedData pgpCompressData = (PGPCompressedData) o;
	pgpFactory = new BcPGPObjectFactory(pgpCompressData.getDataStream());
	signatureList = (PGPSignatureList) pgpFactory.nextObject();
	} else if (o instanceof PGPSignatureList) {
	signatureList = (PGPSignatureList) o;
	}
	signatureList.iterator().forEachRemaining(res::add);
	}
	return res;
	}

	public static PGPPublicKeyStore getKeys(IArtifactDescriptor artifact) {
	PGPPublicKeyStore keyStore = new PGPPublicKeyStore();
	String keyText = artifact.getProperty(PGPSignatureVerifier.PGP_SIGNER_KEYS_PROPERTY_NAME);
	PGPPublicKeyStore.readPublicKeys(keyText).stream().forEach(keyStore::addKey);
	return keyStore;
	}

	@Override
	public void initialize(IProvisioningAgent agent, IProcessingStepDescriptor descriptor,
	IArtifactDescriptor context) {
	super.initialize(agent, descriptor, context);

	sourceDescriptor = context;
	keyService = agent.getService(PGPPublicKeyService.class);

	// 1. verify declared public keys have signature from a trusted key, if so, add to KeyStore
	// 2. verify artifact signature matches signature of given keys, and at least 1 of this key is trusted
	String signatureText = unnormalizedPGPProperty(context.getProperty(PGP_SIGNATURES_PROPERTY_NAME));
	if (signatureText == null) {
	setStatus(Status.OK_STATUS);
	return;
	}

	Collection<PGPSignature> signatures;
	try {
	signatures = getSignatures(context);
	} catch (Exception ex) {
	setStatus(new Status(IStatus.ERROR, Activator.ID, Messages.Error_CouldNotLoadSignature, ex));
	return;
	}

	if (signatures.isEmpty()) {
	setStatus(Status.OK_STATUS);
	return;
	}

	IArtifactRepository repository = context.getRepository();

	PGPPublicKeyStore.readPublicKeys(context.getProperty(PGP_SIGNER_KEYS_PROPERTY_NAME))
	.forEach(keyService::addKey);
	if (repository != null) {
	PGPPublicKeyStore.readPublicKeys(repository.getProperty(PGP_SIGNER_KEYS_PROPERTY_NAME))
	.forEach(keyService::addKey);
	}

	for (PGPSignature signature : signatures) {
	long keyID = signature.getKeyID();
	Collection<PGPPublicKey> keys = keyService.getKeys(keyID);
	if (keys.isEmpty()) {
	LogHelper.log(new Status(IStatus.WARNING, Activator.ID,
	NLS.bind(Messages.Warning_publicKeyNotFound, PGPPublicKeyService.toHex(keyID),
	context.getArtifactKey().getId())));
	} else {
	try {
	PGPContentVerifierBuilder verifierBuilder = new BcPGPContentVerifierBuilderProvider()
	.get(signature.getKeyAlgorithm(), signature.getHashAlgorithm());
	List<PGPContentVerifier> verifiers = new ArrayList<>();
	signaturesToVerify.put(signature, verifiers);
	for (PGPPublicKey key : keys) {
	PGPContentVerifier verifier = verifierBuilder.build(key);
	verifierKeys.put(verifier, key);
	verifiers.add(verifier);
	signatureVerifiers.add(verifier.getOutputStream());
	}
	} catch (PGPException ex) {
	setStatus(new Status(IStatus.ERROR, Activator.ID, ex.getMessage(), ex));
	return;
	}
	}
	}
	}

	/**
	* See // https://www.w3.org/TR/1998/REC-xml-19980210#AVNormalize, newlines
	* replaced by spaces by parser, needs to be restored
	*
	* @param armoredPGPBlock the PGP block, in armored form
	* @return fixed PGP armored blocks
	*/
	static String unnormalizedPGPProperty(String armoredPGPBlock) {
	if (armoredPGPBlock == null) {
	return null;
	}
	if (armoredPGPBlock.contains("\n") \|\| armoredPGPBlock.contains("\r")) { //$NON-NLS-1$ //$NON-NLS-2$
	return armoredPGPBlock;
	}
	return armoredPGPBlock.replace(' ', '\n')
	.replace("-----BEGIN\nPGP\nSIGNATURE-----", "-----BEGIN PGP SIGNATURE-----") //$NON-NLS-1$ //$NON-NLS-2$
	.replace("-----END\nPGP\nSIGNATURE-----", "-----END PGP SIGNATURE-----") //$NON-NLS-1$ //$NON-NLS-2$
	.replace("-----BEGIN\nPGP\nPUBLIC\nKEY\nBLOCK-----", "-----BEGIN PGP PUBLIC KEY BLOCK-----") //$NON-NLS-1$ //$NON-NLS-2$
	.replace("-----END\nPGP\nPUBLIC\nKEY\nBLOCK-----", "-----END PGP PUBLIC KEY BLOCK-----"); //$NON-NLS-1$ //$NON-NLS-2$
	}

	@Override
	public void write(int b) throws IOException {
	getDestination().write(b);
	for (OutputStream verifier : signatureVerifiers) {
	verifier.write(b);
	}
	}

	@Override
	public void write(byte[] b, int off, int len) throws IOException {
	getDestination().write(b, off, len);
	for (OutputStream verifier : signatureVerifiers) {
	verifier.write(b, off, len);
	}
	}

	@Override
	public void close() throws IOException {
	try {
	if (!getStatus().isOK()) {
	return;
	}

	if (signaturesToVerify.isEmpty()) {
	return;
	}

	PGPPublicKeyStore keyStore = new PGPPublicKeyStore();
	for (Entry<PGPSignature, List<PGPContentVerifier>> entry : signaturesToVerify.entrySet()) {
	PGPSignature signature = entry.getKey();
	List<PGPContentVerifier> verifiers = entry.getValue();
	boolean verified = false;
	for (PGPContentVerifier verifier : verifiers) {
	try {
	verifier.getOutputStream().write(signature.getSignatureTrailer());
	if (verifier.verify(signature.getSignature())) {
	PGPPublicKey verifyingKey = verifierKeys.get(verifier);
	if (!Boolean.FALSE.toString()
	.equalsIgnoreCase(System.getProperty("p2.pgp.verifyExpiration"))) { //$NON-NLS-1$
	if (PGPPublicKeyService.compareSignatureTimeToKeyValidityTime(signature,
	verifyingKey) != 0) {
	LogHelper.log(new Status(IStatus.WARNING, Activator.ID,
	NLS.bind(Messages.Error_SignatureAfterKeyExpiration, PGPPublicKeyService
	.toHexFingerprint(verifyingKey))));
	}
	}

	if (!Boolean.FALSE.toString()
	.equalsIgnoreCase(System.getProperty("p2.pgp.verifyRevocation"))) { //$NON-NLS-1$
	if (!keyService.isCreatedBeforeRevocation(signature, verifyingKey)) {
	setStatus(new Status(IStatus.ERROR, Activator.ID,
	NLS.bind(Messages.Error_SignatureAfterKeyRevocation, PGPPublicKeyService
	.toHexFingerprint(verifyingKey))));
	return;
	}
	}

	keyStore.addKey(verifyingKey);
	verified = true;
	break;
	}
	} catch (PGPException ex) {
	LogHelper.log(new Status(IStatus.ERROR, Activator.ID, ex.getMessage(), ex));
	}
	}

	if (!verified) {
	setStatus(new Status(IStatus.ERROR, Activator.ID, Messages.Error_SignatureAndFileDontMatch));
	return;
	}
	}

	// Update the destination artifact descriptor with the signatures that have been
	// verified and the keys used for that verification.
	OutputStream destination = getDestination();
	if (destination instanceof IAdaptable) {
	ArtifactDescriptor destinationDescriptor = ((IAdaptable) destination)
	.getAdapter(ArtifactDescriptor.class);
	destinationDescriptor.setProperty(PGP_SIGNATURES_PROPERTY_NAME,
	sourceDescriptor.getProperty(PGP_SIGNATURES_PROPERTY_NAME));
	destinationDescriptor.setProperty(PGP_SIGNER_KEYS_PROPERTY_NAME, keyStore.toArmoredString());
	}

	setStatus(Status.OK_STATUS);
	} finally

	{
	super.close();
	}
	}

	}