3210N/A#
3210N/A# Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
3210N/A# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
3210N/A#
3210N/A# This code is free software; you can redistribute it and/or modify it
3210N/A# under the terms of the GNU General Public License version 2 only, as
3210N/A# published by the Free Software Foundation.
3210N/A#
3210N/A# This code is distributed in the hope that it will be useful, but WITHOUT
3210N/A# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
3210N/A# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
3210N/A# version 2 for more details (a copy is included in the LICENSE file that
3210N/A# accompanied this code).
3210N/A#
3210N/A# You should have received a copy of the GNU General Public License version
3210N/A# 2 along with this work; if not, write to the Free Software Foundation,
3210N/A# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
3210N/A#
3210N/A# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
3210N/A# or visit www.oracle.com if you need additional information or have any
3210N/A# questions.
3210N/A#
3210N/A
3210N/A# @test
3210N/A# @bug 7004168
3210N/A# @summary jarsigner -verify checks for KeyUsage codesigning ext on all certs
3210N/A# instead of just signing cert
3210N/A#
3210N/A# @run shell checkusage.sh
3210N/A#
3210N/A
3210N/Aif [ "${TESTJAVA}" = "" ] ; then
3210N/A JAVAC_CMD=`which javac`
3210N/A TESTJAVA=`dirname $JAVAC_CMD`/..
3210N/Afi
3210N/A
3210N/A# set platform-dependent variables
3210N/AOS=`uname -s`
3210N/Acase "$OS" in
3210N/A Windows_* )
3210N/A FS="\\"
3210N/A ;;
3210N/A * )
3210N/A FS="/"
3210N/A ;;
3210N/Aesac
3210N/A
3210N/AKT="$TESTJAVA${FS}bin${FS}keytool -storepass changeit -keypass changeit"
3210N/AJAR=$TESTJAVA${FS}bin${FS}jar
3210N/AJARSIGNER="$TESTJAVA${FS}bin${FS}jarsigner"
3210N/A
3210N/Arm js.jks trust.jks unrelated.jks 2> /dev/null
3210N/A
3210N/Aecho x > x
3210N/A$JAR cvf a.jar x
3210N/A
3210N/A################### 3 Keystores #######################
3210N/A
3210N/A# Keystore js.jks: including CA and Publisher
3210N/A# CA contains a non-empty KeyUsage
3210N/A$KT -keystore js.jks -genkeypair -alias ca -dname CN=CA -ext KU=kCS -ext bc -validity 365
3210N/A$KT -keystore js.jks -genkeypair -alias pub -dname CN=Publisher
3210N/A
3210N/A# Publisher contains the correct KeyUsage
3210N/A$KT -keystore js.jks -certreq -alias pub | \
3210N/A $KT -keystore js.jks -gencert -alias ca -ext KU=dig -validity 365 | \
3210N/A $KT -keystore js.jks -importcert -alias pub
3210N/A
3210N/A# Keystore trust.jks: including CA only
3210N/A$KT -keystore js.jks -exportcert -alias ca | \
3210N/A $KT -keystore trust.jks -importcert -alias ca -noprompt
3210N/A
3210N/A# Keystore unrelated.jks: unrelated
3210N/A$KT -keystore unrelated.jks -genkeypair -alias nothing -dname CN=Nothing -validity 365
3210N/A
3210N/A
3210N/A################### 4 Tests #######################
3210N/A
3210N/A# Test 1: Sign should be OK
3210N/A
3210N/A$JARSIGNER -keystore js.jks -storepass changeit a.jar pub
3210N/ARESULT=$?
3210N/Aecho $RESULT
3210N/A#[ $RESULT = 0 ] || exit 1
3210N/A
3210N/A# Test 2: Verify should be OK
3210N/A
3210N/A$JARSIGNER -keystore trust.jks -strict -verify a.jar
3210N/ARESULT=$?
3210N/Aecho $RESULT
3210N/A#[ $RESULT = 0 ] || exit 2
3210N/A
3210N/A# Test 3: When no keystore is specified, the error is only
3210N/A# "chain not validated"
3210N/A
3210N/A$JARSIGNER -strict -verify a.jar
3210N/ARESULT=$?
3210N/Aecho $RESULT
3210N/A#[ $RESULT = 4 ] || exit 3
3210N/A
3210N/A# Test 4: When unrelated keystore is specified, the error is
3210N/A# "chain not validated" and "not alias in keystore"
3210N/A
3210N/A$JARSIGNER -keystore unrelated.jks -strict -verify a.jar
3210N/ARESULT=$?
3210N/Aecho $RESULT
3210N/A#[ $RESULT = 36 ] || exit 4
3210N/A
3210N/Aexit 0