diff --git a/core/src/main/java/org/wildfly/channel/spi/SignatureValidator.java b/core/src/main/java/org/wildfly/channel/spi/SignatureValidator.java index 4a1da13f..e4dec0df 100644 --- a/core/src/main/java/org/wildfly/channel/spi/SignatureValidator.java +++ b/core/src/main/java/org/wildfly/channel/spi/SignatureValidator.java @@ -48,6 +48,13 @@ SignatureResult validateSignature(ArtifactIdentifier artifactId, InputStream art */ class SignatureException extends RuntimeException { private final SignatureResult signatureResult; + private String missingSignature; + + public SignatureException(String message, Throwable cause, SignatureResult signatureResult, String missingSignature) { + super(message, cause); + this.signatureResult = signatureResult; + this.missingSignature = missingSignature; + } public SignatureException(String message, Throwable cause, SignatureResult signatureResult) { super(message, cause); @@ -62,5 +69,9 @@ public SignatureException(String message, SignatureResult signatureResult) { public SignatureResult getSignatureResult() { return signatureResult; } + + public String getMissingSignature() { + return missingSignature; + } } } diff --git a/gpg-validator/src/main/java/org/wildfly/channel/gpg/GpgSignatureValidator.java b/gpg-validator/src/main/java/org/wildfly/channel/gpg/GpgSignatureValidator.java index 889c7dfa..659ad312 100644 --- a/gpg-validator/src/main/java/org/wildfly/channel/gpg/GpgSignatureValidator.java +++ b/gpg-validator/src/main/java/org/wildfly/channel/gpg/GpgSignatureValidator.java @@ -134,7 +134,7 @@ public SignatureResult validateSignature(ArtifactIdentifier artifactId, InputStr } } catch (PGPException | IOException e) { throw new SignatureException("Unable to parse the certificate downloaded from keyserver", e, - SignatureResult.noSignature(artifactId)); + SignatureResult.noSignature(artifactId), keyID); } if (key == null) { @@ -146,7 +146,7 @@ public SignatureResult validateSignature(ArtifactIdentifier artifactId, InputStr pgpPublicKeys = downloadPublicKey(gpgUrl); } catch (IOException e) { throw new SignatureException("Unable to parse the certificate downloaded from " + gpgUrl, e, - SignatureResult.noSignature(artifactId)); + SignatureResult.noSignature(artifactId), Long.toHexString(pgpSignature.getKeyID()).toUpperCase(Locale.ROOT)); } if (pgpPublicKeys.stream().anyMatch(k -> k.getKeyID() == pgpSignature.getKeyID())) { key = pgpPublicKeys.stream().filter(k -> k.getKeyID() == pgpSignature.getKeyID()).findFirst().get(); @@ -193,7 +193,7 @@ public SignatureResult validateSignature(ArtifactIdentifier artifactId, InputStr pgpSignature.init(new BcPGPContentVerifierBuilderProvider(), publicKey); } catch (PGPException e) { throw new SignatureException("Unable to verify the signature using key " + keyID, e, - SignatureResult.invalid(artifactId)); + SignatureResult.invalid(artifactId), keyID); } final SignatureResult result = verifyFile(artifactId, artifactStream, pgpSignature); @@ -291,7 +291,7 @@ private static SignatureResult verifyFile(ArtifactIdentifier artifactSource, Inp } } catch (PGPException e) { throw new SignatureException("Unable to verify the file signature", e, - SignatureResult.invalid(artifactSource)); + SignatureResult.invalid(artifactSource), Long.toHexString(pgpSignature.getKeyID()).toUpperCase(Locale.ROOT)); } }