Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2026-08-07 01:30:53 +02:00
Code Issues Packages Projects Releases Activity

Use pgpainless for key generation

Browse Source 
The library pgpainless (https://gh.pgpainless.org/) makes it much more easy to create gpg keys for new users. As a benefit, these keys can be verified by GitHub.

Committed-by: Konstantin Schaper <konstantin.schaper@cloudogu.com>
Co-authored-by: René Pfeuffer <rene.pfeuffer@cloudogu.com>
This commit is contained in:
Rene Pfeuffer
2023-05-08 15:28:53 +02:00
committed by Konstantin Schaper
parent 05bc61ab1b
commit 8025e82b1b
9 changed files with 36 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
scm-webapp/src/main/java/sonia/scm/security/gpg/DefaultGPG.java
View File

@@ -27,10 +27,11 @@ package sonia.scm.security.gpg;
import org.apache.shiro.SecurityUtils;
import org.bouncycastle.bcpg.ArmoredInputStream;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPKeyRingGenerator;
import org.bouncycastle.openpgp.PGPObjectFactory;
import org.bouncycastle.openpgp.PGPSecretKeyRing;
import org.bouncycastle.openpgp.PGPSignatureList;
import org.bouncycastle.openpgp.operator.jcajce.JcaKeyFingerprintCalculator;
import org.pgpainless.PGPainless;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import sonia.scm.security.GPG;
@@ -40,8 +41,8 @@ import sonia.scm.security.PublicKey;
import javax.inject.Inject;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.security.InvalidAlgorithmParameterException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.util.Collections;
import java.util.List;
import java.util.Optional;
@@ -99,18 +100,18 @@ public class DefaultGPG implements GPG {
final String userId = SecurityUtils.getSubject().getPrincipal().toString();
final Optional<String> privateRawKey = privateKeyStore.getForUserId(userId);
if (!privateRawKey.isPresent()) {
if (privateRawKey.isEmpty()) {
try {
final PGPKeyRingGenerator keyPair = GPGKeyPairGenerator.generateKeyPair();
PGPSecretKeyRing secretKeys = GPGKeyPairGenerator.generateKeyPair();
final String rawPublicKey = GPGKeyExporter.exportKeyRing(keyPair.generatePublicKeyRing());
final String rawPrivateKey = GPGKeyExporter.exportKeyRing(keyPair.generateSecretKeyRing());
final String rawPublicKey = PGPainless.asciiArmor(PGPainless.extractCertificate(secretKeys));
final String rawPrivateKey = PGPainless.asciiArmor(secretKeys);
privateKeyStore.setForUserId(userId, rawPrivateKey);
publicKeyStore.add("Default SCM-Manager Signing Key", userId, rawPublicKey, true);
return DefaultPrivateKey.parseRaw(rawPrivateKey);
} catch (PGPException | NoSuchAlgorithmException | NoSuchProviderException | IOException e) {
} catch (PGPException | NoSuchAlgorithmException | InvalidAlgorithmParameterException | IOException e) {
throw new GPGException("Private key could not be generated", e);
}
} else {

43
scm-webapp/src/main/java/sonia/scm/security/gpg/GPGKeyExporter.java
View File

@@ -1,43 +0,0 @@
/*
* MIT License
*
* Copyright (c) 2020-present Cloudogu GmbH and Contributors
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
package sonia.scm.security.gpg;
import org.bouncycastle.bcpg.ArmoredOutputStream;
import org.bouncycastle.openpgp.PGPKeyRing;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
class GPGKeyExporter {
private GPGKeyExporter() { }
static String exportKeyRing(PGPKeyRing keyRing) throws IOException {
final ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
final ArmoredOutputStream armoredOutputStream = new ArmoredOutputStream(byteArrayOutputStream);
keyRing.encode(armoredOutputStream);
armoredOutputStream.close();
return new String(byteArrayOutputStream.toByteArray());
}
}

37
scm-webapp/src/main/java/sonia/scm/security/gpg/GPGKeyPairGenerator.java
View File

@@ -25,27 +25,17 @@
package sonia.scm.security.gpg;
import org.apache.shiro.SecurityUtils;
import org.bouncycastle.bcpg.HashAlgorithmTags;
import org.bouncycastle.bcpg.PublicKeyAlgorithmTags;
import org.bouncycastle.bcpg.SymmetricKeyAlgorithmTags;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPKeyPair;
import org.bouncycastle.openpgp.PGPKeyRingGenerator;
import org.bouncycastle.openpgp.PGPSignature;
import org.bouncycastle.openpgp.operator.jcajce.JcaPGPContentSignerBuilder;
import org.bouncycastle.openpgp.operator.jcajce.JcaPGPDigestCalculatorProviderBuilder;
import org.bouncycastle.openpgp.operator.jcajce.JcaPGPKeyPair;
import org.bouncycastle.openpgp.operator.jcajce.JcePBESecretKeyEncryptorBuilder;
import org.bouncycastle.openpgp.PGPSecretKeyRing;
import org.pgpainless.PGPainless;
import org.pgpainless.key.generation.type.rsa.RsaLength;
import sonia.scm.repository.Person;
import sonia.scm.user.User;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.InvalidAlgorithmParameterException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.Security;
import java.util.Date;
final class GPGKeyPairGenerator {
@@ -57,25 +47,10 @@ final class GPGKeyPairGenerator {
private GPGKeyPairGenerator() {}
static PGPKeyRingGenerator generateKeyPair() throws PGPException, NoSuchProviderException, NoSuchAlgorithmException {
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", "BC");
keyPairGenerator.initialize(2048);
KeyPair pair = keyPairGenerator.generateKeyPair();
PGPKeyPair keyPair = new JcaPGPKeyPair(PublicKeyAlgorithmTags.RSA_GENERAL, pair, new Date());
static PGPSecretKeyRing generateKeyPair() throws PGPException, NoSuchAlgorithmException, InvalidAlgorithmParameterException {
final User user = SecurityUtils.getSubject().getPrincipals().oneByType(User.class);
final Person person = new Person(user.getDisplayName(), user.getMail());
return new PGPKeyRingGenerator(
PGPSignature.POSITIVE_CERTIFICATION,
keyPair,
person.toString(),
new JcaPGPDigestCalculatorProviderBuilder().build().get(HashAlgorithmTags.SHA1),
null,
null,
new JcaPGPContentSignerBuilder(PublicKeyAlgorithmTags.RSA_GENERAL, HashAlgorithmTags.SHA1),
new JcePBESecretKeyEncryptorBuilder(SymmetricKeyAlgorithmTags.AES_256).build(new char[]{})
);
return PGPainless.generateKeyRing().simpleRsaKeyRing(person.toString(), RsaLength._4096);
}
}