(".certchain.file.name.of.alternative.certchain.file")); System.out.println(); System.out.println(rb.getString (".sigfile.file.name.of.SF.DSA.file")); System.out.println(); System.out.println(rb.getString (".signedjar.file.name.of.signed.JAR.file")); System.out.println(); System.out.println(rb.getString (".digestalg.algorithm.name.of.digest.algorithm")); System.out.println(); System.out.println(rb.getString (".sigalg.algorithm.name.of.signature.algorithm")); System.out.println(); System.out.println(rb.getString (".verify.verify.a.signed.JAR.file")); System.out.println(); System.out.println(rb.getString (".verbose.suboptions.verbose.output.when.signing.verifying.")); System.out.println(rb.getString (".suboptions.can.be.all.grouped.or.summary")); System.out.println(); System.out.println(rb.getString (".certs.display.certificates.when.verbose.and.verifying")); System.out.println(); System.out.println(rb.getString (".tsa.url.location.of.the.Timestamping.Authority")); System.out.println(); System.out.println(rb.getString (".tsacert.alias.public.key.certificate.for.Timestamping.Authority")); System.out.println(); System.out.println(rb.getString (".altsigner.class.class.name.of.an.alternative.signing.mechanism")); System.out.println(); System.out.println(rb.getString (".altsignerpath.pathlist.location.of.an.alternative.signing.mechanism")); System.out.println(); System.out.println(rb.getString (".internalsf.include.the.SF.file.inside.the.signature.block")); System.out.println(); System.out.println(rb.getString (".sectionsonly.don.t.compute.hash.of.entire.manifest")); System.out.println(); System.out.println(rb.getString (".protected.keystore.has.protected.authentication.path")); System.out.println(); System.out.println(rb.getString (".providerName.name.provider.name")); System.out.println(); System.out.println(rb.getString (".providerClass.class.name.of.cryptographic.service.provider.s")); System.out.println(rb.getString (".providerArg.arg.master.class.file.and.constructor.argument")); System.out.println(); System.out.println(rb.getString (".strict.treat.warnings.as.errors")); System.out.println(); System.exit(0); } void verifyJar(String jarName) throws Exception { boolean anySigned = false; // if there exists entry inside jar signed JarFile jf = null; try { jf = new JarFile(jarName, true); Vector<JarEntry> entriesVec = new Vector<>(); byte[] buffer = new byte[8192]; Enumeration<JarEntry> entries = jf.entries(); while (entries.hasMoreElements()) { JarEntry je = entries.nextElement(); entriesVec.addElement(je); InputStream is = null; try { is = jf.getInputStream(je); int n; while ((n = is.read(buffer, 0, buffer.length)) != -1) { // we just read. this will throw a SecurityException // if a signature/digest check fails. } } finally { if (is != null) { is.close(); } } } Manifest man = jf.getManifest(); // The map to record display info, only used when -verbose provided // key: signer info string // value: the list of files with common key Map<String,List<String>> output = new LinkedHashMap<>(); if (man != null) { if (verbose != null) System.out.println(); Enumeration<JarEntry> e = entriesVec.elements(); long now = System.currentTimeMillis(); String tab = rb.getString("6SPACE"); while (e.hasMoreElements()) { JarEntry je = e.nextElement(); String name = je.getName(); CodeSigner[] signers = je.getCodeSigners(); boolean isSigned = (signers != null); anySigned |= isSigned; hasUnsignedEntry |= !je.isDirectory() && !isSigned && !signatureRelated(name); int inStoreOrScope = inKeyStore(signers); boolean inStore = (inStoreOrScope & IN_KEYSTORE) != 0; boolean inScope = (inStoreOrScope & IN_SCOPE) != 0; notSignedByAlias |= (inStoreOrScope & NOT_ALIAS) != 0; if (keystore != null) { aliasNotInStore |= isSigned && (!inStore && !inScope); } // Only used when -verbose provided StringBuffer sb = null; if (verbose != null) { sb = new StringBuffer(); boolean inManifest = ((man.getAttributes(name) != null) || (man.getAttributes("./"+name) != null) || (man.getAttributes("/"+name) != null)); sb.append( (isSigned ? rb.getString("s") : rb.getString("SPACE")) + (inManifest ? rb.getString("m") : rb.getString("SPACE")) + (inStore ? rb.getString("k") : rb.getString("SPACE")) + (inScope ? rb.getString("i") : rb.getString("SPACE")) + ((inStoreOrScope & NOT_ALIAS) != 0 ?"X":" ") + rb.getString("SPACE")); sb.append("|"); } // When -certs provided, display info has extra empty // lines at the beginning and end. if (isSigned) { if (showcerts) sb.append('\n'); for (CodeSigner signer: signers) { // signerInfo() must be called even if -verbose // not provided. The method updates various // warning flags. String si = signerInfo(signer, tab, now); if (showcerts) { sb.append(si); sb.append('\n'); } } } else if (showcerts && !verbose.equals("all")) { // Print no info for unsigned entries when -verbose:all, // to be consistent with old behavior. if (signatureRelated(name)) { sb.append("\n" + tab + rb.getString( ".Signature.related.entries.") + "\n\n"); } else { sb.append("\n" + tab + rb.getString( ".Unsigned.entries.") + "\n\n"); } } if (verbose != null) { String label = sb.toString(); if (signatureRelated(name)) { // Entries inside META-INF and other unsigned // entries are grouped separately. label = "-" + label; } // The label finally contains 2 parts separated by '|': // The legend displayed before the entry names, and // the cert info (if -certs specfied). if (!output.containsKey(label)) { output.put(label, new ArrayList<String>()); } StringBuffer fb = new StringBuffer(); String s = Long.toString(je.getSize()); for (int i = 6 - s.length(); i > 0; --i) { fb.append(' '); } fb.append(s).append(' '). append(new Date(je.getTime()).toString()); fb.append(' ').append(name); output.get(label).add(fb.toString()); } } } if (verbose != null) { for (Entry<String,List<String>> s: output.entrySet()) { List<String> files = s.getValue(); String key = s.getKey(); if (key.charAt(0) == '-') { // the signature-related group key = key.substring(1); } int pipe = key.indexOf('|'); if (verbose.equals("all")) { for (String f: files) { System.out.println(key.substring(0, pipe) + f); System.out.printf(key.substring(pipe+1)); } } else { if (verbose.equals("grouped")) { for (String f: files) { System.out.println(key.substring(0, pipe) + f); } } else if (verbose.equals("summary")) { System.out.print(key.substring(0, pipe)); if (files.size() > 1) { System.out.println(files.get(0) + " " + String.format(rb.getString( ".and.d.more."), files.size()-1)); } else { System.out.println(files.get(0)); } } System.out.printf(key.substring(pipe+1)); } } System.out.println(); System.out.println(rb.getString( ".s.signature.was.verified.")); System.out.println(rb.getString( ".m.entry.is.listed.in.manifest")); System.out.println(rb.getString( ".k.at.least.one.certificate.was.found.in.keystore")); System.out.println(rb.getString( ".i.at.least.one.certificate.was.found.in.identity.scope")); if (ckaliases.size() > 0) { System.out.println(rb.getString( ".X.not.signed.by.specified.alias.es.")); } System.out.println(); } if (man == null) System.out.println(rb.getString("no.manifest.")); if (!anySigned) { System.out.println(rb.getString( "jar.is.unsigned.signatures.missing.or.not.parsable.")); } else { System.out.println(rb.getString("jar.verified.")); if (hasUnsignedEntry || hasExpiredCert || hasExpiringCert || badKeyUsage || badExtendedKeyUsage || badNetscapeCertType || notYetValidCert || chainNotValidated || aliasNotInStore || notSignedByAlias) { System.out.println(); System.out.println(rb.getString("Warning.")); if (badKeyUsage) { System.out.println( rb.getString("This.jar.contains.entries.whose.signer.certificate.s.KeyUsage.extension.doesn.t.allow.code.signing.")); } if (badExtendedKeyUsage) { System.out.println( rb.getString("This.jar.contains.entries.whose.signer.certificate.s.ExtendedKeyUsage.extension.doesn.t.allow.code.signing.")); } if (badNetscapeCertType) { System.out.println( rb.getString("This.jar.contains.entries.whose.signer.certificate.s.NetscapeCertType.extension.doesn.t.allow.code.signing.")); } if (hasUnsignedEntry) { System.out.println(rb.getString( "This.jar.contains.unsigned.entries.which.have.not.been.integrity.checked.")); } if (hasExpiredCert) { System.out.println(rb.getString( "This.jar.contains.entries.whose.signer.certificate.has.expired.")); } if (hasExpiringCert) { System.out.println(rb.getString( "This.jar.contains.entries.whose.signer.certificate.will.expire.within.six.months.")); } if (notYetValidCert) { System.out.println(rb.getString( "This.jar.contains.entries.whose.signer.certificate.is.not.yet.valid.")); } if (chainNotValidated) { System.out.println( rb.getString("This.jar.contains.entries.whose.certificate.chain.is.not.validated.")); } if (notSignedByAlias) { System.out.println( rb.getString("This.jar.contains.signed.entries.which.is.not.signed.by.the.specified.alias.es.")); } if (aliasNotInStore) { System.out.println(rb.getString("This.jar.contains.signed.entries.that.s.not.signed.by.alias.in.this.keystore.")); } if (! (verbose != null && showcerts)) { System.out.println(); System.out.println(rb.getString( "Re.run.with.the.verbose.and.certs.options.for.more.details.")); } } } return; } catch (Exception e) { System.out.println(rb.getString("jarsigner.") + e); if (debug) { e.printStackTrace(); } } finally { // close the resource if (jf != null) { jf.close(); } } System.exit(1); } private static MessageFormat validityTimeForm = null; private static MessageFormat notYetTimeForm = null; private static MessageFormat expiredTimeForm = null; private static MessageFormat expiringTimeForm = null; /* * Display some details about a certificate: * * [<tab>] <cert-type> [", " <subject-DN>] [" (" <keystore-entry-alias> ")"] * [<validity-period> | <expiry-warning>] * * Note: no newline character at the end */ String printCert(String tab, Certificate c, boolean checkValidityPeriod, long now, boolean checkUsage) { StringBuilder certStr = new StringBuilder(); String space = rb.getString("SPACE"); X509Certificate x509Cert = null; if (c instanceof X509Certificate) { x509Cert = (X509Certificate) c; certStr.append(tab).append(x509Cert.getType()) .append(rb.getString("COMMA")) .append(x509Cert.getSubjectDN().getName()); } else { certStr.append(tab).append(c.getType()); } String alias = storeHash.get(c); if (alias != null) { certStr.append(space).append(alias); } if (checkValidityPeriod && x509Cert != null) { certStr.append("\n").append(tab).append("["); Date notAfter = x509Cert.getNotAfter(); try { x509Cert.checkValidity(); // test if cert will expire within six months if (now == 0) { now = System.currentTimeMillis(); } if (notAfter.getTime() < now + SIX_MONTHS) { hasExpiringCert = true; if (expiringTimeForm == null) { expiringTimeForm = new MessageFormat( rb.getString("certificate.will.expire.on")); } Object[] source = { notAfter }; certStr.append(expiringTimeForm.format(source)); } else { if (validityTimeForm == null) { validityTimeForm = new MessageFormat( rb.getString("certificate.is.valid.from")); } Object[] source = { x509Cert.getNotBefore(), notAfter }; certStr.append(validityTimeForm.format(source)); } } catch (CertificateExpiredException cee) { hasExpiredCert = true; if (expiredTimeForm == null) { expiredTimeForm = new MessageFormat( rb.getString("certificate.expired.on")); } Object[] source = { notAfter }; certStr.append(expiredTimeForm.format(source)); } catch (CertificateNotYetValidException cnyve) { notYetValidCert = true; if (notYetTimeForm == null) { notYetTimeForm = new MessageFormat( rb.getString("certificate.is.not.valid.until")); } Object[] source = { x509Cert.getNotBefore() }; certStr.append(notYetTimeForm.format(source)); } certStr.append("]"); if (checkUsage) { boolean[] bad = new boolean[3]; checkCertUsage(x509Cert, bad); if (bad[0] || bad[1] || bad[2]) { String x = ""; if (bad[0]) { x ="KeyUsage"; } if (bad[1]) { if (x.length() > 0) x = x + ", "; x = x + "ExtendedKeyUsage"; } if (bad[2]) { if (x.length() > 0) x = x + ", "; x = x + "NetscapeCertType"; } certStr.append("\n").append(tab) .append(MessageFormat.format(rb.getString( ".{0}.extension.does.not.support.code.signing."), x)); } } } return certStr.toString(); } private static MessageFormat signTimeForm = null; private String printTimestamp(String tab, Timestamp timestamp) { if (signTimeForm == null) { signTimeForm = new MessageFormat(rb.getString("entry.was.signed.on")); } Object[] source = { timestamp.getTimestamp() }; return new StringBuilder().append(tab).append("[") .append(signTimeForm.format(source)).append("]").toString(); } private Map<CodeSigner,Integer> cacheForInKS = new IdentityHashMap<>(); private int inKeyStoreForOneSigner(CodeSigner signer) { if (cacheForInKS.containsKey(signer)) { return cacheForInKS.get(signer); } boolean found = false; int result = 0; List<? extends Certificate> certs = signer.getSignerCertPath().getCertificates(); for (Certificate c : certs) { String alias = storeHash.get(c); if (alias != null) { if (alias.startsWith("(")) { result |= IN_KEYSTORE; } else if (alias.startsWith("[")) { result |= IN_SCOPE; } if (ckaliases.contains(alias.substring(1, alias.length() - 1))) { result |= SIGNED_BY_ALIAS; } } else { if (store != null) { try { alias = store.getCertificateAlias(c); } catch (KeyStoreException kse) { // never happens, because keystore has been loaded } if (alias != null) { storeHash.put(c, "(" + alias + ")"); found = true; result |= IN_KEYSTORE; } } if (ckaliases.contains(alias)) { result |= SIGNED_BY_ALIAS; } } } cacheForInKS.put(signer, result); return result; } Hashtable<Certificate, String> storeHash = new Hashtable<>(); int inKeyStore(CodeSigner[] signers) { if (signers == null) return 0; int output = 0; Lines 501–1000 of 2445. Previous lines Load more
(".certchain.file.name.of.alternative.certchain.file")); System.out.println(); System.out.println(rb.getString (".sigfile.file.name.of.SF.DSA.file")); System.out.println(); System.out.println(rb.getString (".signedjar.file.name.of.signed.JAR.file")); System.out.println(); System.out.println(rb.getString (".digestalg.algorithm.name.of.digest.algorithm")); System.out.println(); System.out.println(rb.getString (".sigalg.algorithm.name.of.signature.algorithm")); System.out.println(); System.out.println(rb.getString (".verify.verify.a.signed.JAR.file")); System.out.println(); System.out.println(rb.getString (".verbose.suboptions.verbose.output.when.signing.verifying.")); System.out.println(rb.getString (".suboptions.can.be.all.grouped.or.summary")); System.out.println(); System.out.println(rb.getString (".certs.display.certificates.when.verbose.and.verifying")); System.out.println(); System.out.println(rb.getString (".tsa.url.location.of.the.Timestamping.Authority")); System.out.println(); System.out.println(rb.getString (".tsacert.alias.public.key.certificate.for.Timestamping.Authority")); System.out.println(); System.out.println(rb.getString (".altsigner.class.class.name.of.an.alternative.signing.mechanism")); System.out.println(); System.out.println(rb.getString (".altsignerpath.pathlist.location.of.an.alternative.signing.mechanism")); System.out.println(); System.out.println(rb.getString (".internalsf.include.the.SF.file.inside.the.signature.block")); System.out.println(); System.out.println(rb.getString (".sectionsonly.don.t.compute.hash.of.entire.manifest")); System.out.println(); System.out.println(rb.getString (".protected.keystore.has.protected.authentication.path")); System.out.println(); System.out.println(rb.getString (".providerName.name.provider.name")); System.out.println(); System.out.println(rb.getString (".providerClass.class.name.of.cryptographic.service.provider.s")); System.out.println(rb.getString (".providerArg.arg.master.class.file.and.constructor.argument")); System.out.println(); System.out.println(rb.getString (".strict.treat.warnings.as.errors")); System.out.println(); System.exit(0); } void verifyJar(String jarName) throws Exception { boolean anySigned = false; // if there exists entry inside jar signed JarFile jf = null; try { jf = new JarFile(jarName, true); Vector<JarEntry> entriesVec = new Vector<>(); byte[] buffer = new byte[8192]; Enumeration<JarEntry> entries = jf.entries(); while (entries.hasMoreElements()) { JarEntry je = entries.nextElement(); entriesVec.addElement(je); InputStream is = null; try { is = jf.getInputStream(je); int n; while ((n = is.read(buffer, 0, buffer.length)) != -1) { // we just read. this will throw a SecurityException // if a signature/digest check fails. } } finally { if (is != null) { is.close(); } } } Manifest man = jf.getManifest(); // The map to record display info, only used when -verbose provided // key: signer info string // value: the list of files with common key Map<String,List<String>> output = new LinkedHashMap<>(); if (man != null) { if (verbose != null) System.out.println(); Enumeration<JarEntry> e = entriesVec.elements(); long now = System.currentTimeMillis(); String tab = rb.getString("6SPACE"); while (e.hasMoreElements()) { JarEntry je = e.nextElement(); String name = je.getName(); CodeSigner[] signers = je.getCodeSigners(); boolean isSigned = (signers != null); anySigned |= isSigned; hasUnsignedEntry |= !je.isDirectory() && !isSigned && !signatureRelated(name); int inStoreOrScope = inKeyStore(signers); boolean inStore = (inStoreOrScope & IN_KEYSTORE) != 0; boolean inScope = (inStoreOrScope & IN_SCOPE) != 0; notSignedByAlias |= (inStoreOrScope & NOT_ALIAS) != 0; if (keystore != null) { aliasNotInStore |= isSigned && (!inStore && !inScope); } // Only used when -verbose provided StringBuffer sb = null; if (verbose != null) { sb = new StringBuffer(); boolean inManifest = ((man.getAttributes(name) != null) || (man.getAttributes("./"+name) != null) || (man.getAttributes("/"+name) != null)); sb.append( (isSigned ? rb.getString("s") : rb.getString("SPACE")) + (inManifest ? rb.getString("m") : rb.getString("SPACE")) + (inStore ? rb.getString("k") : rb.getString("SPACE")) + (inScope ? rb.getString("i") : rb.getString("SPACE")) + ((inStoreOrScope & NOT_ALIAS) != 0 ?"X":" ") + rb.getString("SPACE")); sb.append("|"); } // When -certs provided, display info has extra empty // lines at the beginning and end. if (isSigned) { if (showcerts) sb.append('\n'); for (CodeSigner signer: signers) { // signerInfo() must be called even if -verbose // not provided. The method updates various // warning flags. String si = signerInfo(signer, tab, now); if (showcerts) { sb.append(si); sb.append('\n'); } } } else if (showcerts && !verbose.equals("all")) { // Print no info for unsigned entries when -verbose:all, // to be consistent with old behavior. if (signatureRelated(name)) { sb.append("\n" + tab + rb.getString( ".Signature.related.entries.") + "\n\n"); } else { sb.append("\n" + tab + rb.getString( ".Unsigned.entries.") + "\n\n"); } } if (verbose != null) { String label = sb.toString(); if (signatureRelated(name)) { // Entries inside META-INF and other unsigned // entries are grouped separately. label = "-" + label; } // The label finally contains 2 parts separated by '|': // The legend displayed before the entry names, and // the cert info (if -certs specfied). if (!output.containsKey(label)) { output.put(label, new ArrayList<String>()); } StringBuffer fb = new StringBuffer(); String s = Long.toString(je.getSize()); for (int i = 6 - s.length(); i > 0; --i) { fb.append(' '); } fb.append(s).append(' '). append(new Date(je.getTime()).toString()); fb.append(' ').append(name); output.get(label).add(fb.toString()); } } } if (verbose != null) { for (Entry<String,List<String>> s: output.entrySet()) { List<String> files = s.getValue(); String key = s.getKey(); if (key.charAt(0) == '-') { // the signature-related group key = key.substring(1); } int pipe = key.indexOf('|'); if (verbose.equals("all")) { for (String f: files) { System.out.println(key.substring(0, pipe) + f); System.out.printf(key.substring(pipe+1)); } } else { if (verbose.equals("grouped")) { for (String f: files) { System.out.println(key.substring(0, pipe) + f); } } else if (verbose.equals("summary")) { System.out.print(key.substring(0, pipe)); if (files.size() > 1) { System.out.println(files.get(0) + " " + String.format(rb.getString( ".and.d.more."), files.size()-1)); } else { System.out.println(files.get(0)); } } System.out.printf(key.substring(pipe+1)); } } System.out.println(); System.out.println(rb.getString( ".s.signature.was.verified.")); System.out.println(rb.getString( ".m.entry.is.listed.in.manifest")); System.out.println(rb.getString( ".k.at.least.one.certificate.was.found.in.keystore")); System.out.println(rb.getString( ".i.at.least.one.certificate.was.found.in.identity.scope")); if (ckaliases.size() > 0) { System.out.println(rb.getString( ".X.not.signed.by.specified.alias.es.")); } System.out.println(); } if (man == null) System.out.println(rb.getString("no.manifest.")); if (!anySigned) { System.out.println(rb.getString( "jar.is.unsigned.signatures.missing.or.not.parsable.")); } else { System.out.println(rb.getString("jar.verified.")); if (hasUnsignedEntry || hasExpiredCert || hasExpiringCert || badKeyUsage || badExtendedKeyUsage || badNetscapeCertType || notYetValidCert || chainNotValidated || aliasNotInStore || notSignedByAlias) { System.out.println(); System.out.println(rb.getString("Warning.")); if (badKeyUsage) { System.out.println( rb.getString("This.jar.contains.entries.whose.signer.certificate.s.KeyUsage.extension.doesn.t.allow.code.signing.")); } if (badExtendedKeyUsage) { System.out.println( rb.getString("This.jar.contains.entries.whose.signer.certificate.s.ExtendedKeyUsage.extension.doesn.t.allow.code.signing.")); } if (badNetscapeCertType) { System.out.println( rb.getString("This.jar.contains.entries.whose.signer.certificate.s.NetscapeCertType.extension.doesn.t.allow.code.signing.")); } if (hasUnsignedEntry) { System.out.println(rb.getString( "This.jar.contains.unsigned.entries.which.have.not.been.integrity.checked.")); } if (hasExpiredCert) { System.out.println(rb.getString( "This.jar.contains.entries.whose.signer.certificate.has.expired.")); } if (hasExpiringCert) { System.out.println(rb.getString( "This.jar.contains.entries.whose.signer.certificate.will.expire.within.six.months.")); } if (notYetValidCert) { System.out.println(rb.getString( "This.jar.contains.entries.whose.signer.certificate.is.not.yet.valid.")); } if (chainNotValidated) { System.out.println( rb.getString("This.jar.contains.entries.whose.certificate.chain.is.not.validated.")); } if (notSignedByAlias) { System.out.println( rb.getString("This.jar.contains.signed.entries.which.is.not.signed.by.the.specified.alias.es.")); } if (aliasNotInStore) { System.out.println(rb.getString("This.jar.contains.signed.entries.that.s.not.signed.by.alias.in.this.keystore.")); } if (! (verbose != null && showcerts)) { System.out.println(); System.out.println(rb.getString( "Re.run.with.the.verbose.and.certs.options.for.more.details.")); } } } return; } catch (Exception e) { System.out.println(rb.getString("jarsigner.") + e); if (debug) { e.printStackTrace(); } } finally { // close the resource if (jf != null) { jf.close(); } } System.exit(1); } private static MessageFormat validityTimeForm = null; private static MessageFormat notYetTimeForm = null; private static MessageFormat expiredTimeForm = null; private static MessageFormat expiringTimeForm = null; /* * Display some details about a certificate: * * [<tab>] <cert-type> [", " <subject-DN>] [" (" <keystore-entry-alias> ")"] * [<validity-period> | <expiry-warning>] * * Note: no newline character at the end */ String printCert(String tab, Certificate c, boolean checkValidityPeriod, long now, boolean checkUsage) { StringBuilder certStr = new StringBuilder(); String space = rb.getString("SPACE"); X509Certificate x509Cert = null; if (c instanceof X509Certificate) { x509Cert = (X509Certificate) c; certStr.append(tab).append(x509Cert.getType()) .append(rb.getString("COMMA")) .append(x509Cert.getSubjectDN().getName()); } else { certStr.append(tab).append(c.getType()); } String alias = storeHash.get(c); if (alias != null) { certStr.append(space).append(alias); } if (checkValidityPeriod && x509Cert != null) { certStr.append("\n").append(tab).append("["); Date notAfter = x509Cert.getNotAfter(); try { x509Cert.checkValidity(); // test if cert will expire within six months if (now == 0) { now = System.currentTimeMillis(); } if (notAfter.getTime() < now + SIX_MONTHS) { hasExpiringCert = true; if (expiringTimeForm == null) { expiringTimeForm = new MessageFormat( rb.getString("certificate.will.expire.on")); } Object[] source = { notAfter }; certStr.append(expiringTimeForm.format(source)); } else { if (validityTimeForm == null) { validityTimeForm = new MessageFormat( rb.getString("certificate.is.valid.from")); } Object[] source = { x509Cert.getNotBefore(), notAfter }; certStr.append(validityTimeForm.format(source)); } } catch (CertificateExpiredException cee) { hasExpiredCert = true; if (expiredTimeForm == null) { expiredTimeForm = new MessageFormat( rb.getString("certificate.expired.on")); } Object[] source = { notAfter }; certStr.append(expiredTimeForm.format(source)); } catch (CertificateNotYetValidException cnyve) { notYetValidCert = true; if (notYetTimeForm == null) { notYetTimeForm = new MessageFormat( rb.getString("certificate.is.not.valid.until")); } Object[] source = { x509Cert.getNotBefore() }; certStr.append(notYetTimeForm.format(source)); } certStr.append("]"); if (checkUsage) { boolean[] bad = new boolean[3]; checkCertUsage(x509Cert, bad); if (bad[0] || bad[1] || bad[2]) { String x = ""; if (bad[0]) { x ="KeyUsage"; } if (bad[1]) { if (x.length() > 0) x = x + ", "; x = x + "ExtendedKeyUsage"; } if (bad[2]) { if (x.length() > 0) x = x + ", "; x = x + "NetscapeCertType"; } certStr.append("\n").append(tab) .append(MessageFormat.format(rb.getString( ".{0}.extension.does.not.support.code.signing."), x)); } } } return certStr.toString(); } private static MessageFormat signTimeForm = null; private String printTimestamp(String tab, Timestamp timestamp) { if (signTimeForm == null) { signTimeForm = new MessageFormat(rb.getString("entry.was.signed.on")); } Object[] source = { timestamp.getTimestamp() }; return new StringBuilder().append(tab).append("[") .append(signTimeForm.format(source)).append("]").toString(); } private Map<CodeSigner,Integer> cacheForInKS = new IdentityHashMap<>(); private int inKeyStoreForOneSigner(CodeSigner signer) { if (cacheForInKS.containsKey(signer)) { return cacheForInKS.get(signer); } boolean found = false; int result = 0; List<? extends Certificate> certs = signer.getSignerCertPath().getCertificates(); for (Certificate c : certs) { String alias = storeHash.get(c); if (alias != null) { if (alias.startsWith("(")) { result |= IN_KEYSTORE; } else if (alias.startsWith("[")) { result |= IN_SCOPE; } if (ckaliases.contains(alias.substring(1, alias.length() - 1))) { result |= SIGNED_BY_ALIAS; } } else { if (store != null) { try { alias = store.getCertificateAlias(c); } catch (KeyStoreException kse) { // never happens, because keystore has been loaded } if (alias != null) { storeHash.put(c, "(" + alias + ")"); found = true; result |= IN_KEYSTORE; } } if (ckaliases.contains(alias)) { result |= SIGNED_BY_ALIAS; } } } cacheForInKS.put(signer, result); return result; } Hashtable<Certificate, String> storeHash = new Hashtable<>(); int inKeyStore(CodeSigner[] signers) { if (signers == null) return 0; int output = 0;