You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "cstamas (via GitHub)" <gi...@apache.org> on 2024/03/27 12:07:15 UTC
[PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
cstamas opened a new pull request, #448:
URL: https://github.com/apache/maven-resolver/pull/448
Align with latest changes. Also, trivial fix to align doco generator, now "java.lang." prefix is stripped off to align all the doco.
---
https://issues.apache.org/jira/browse/MRESOLVER-516
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "michael-o (via GitHub)" <gi...@apache.org>.
michael-o commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1543606216
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -66,13 +66,14 @@ public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOExce
GnupgConfigurationKeys.DEFAULT_KEY_FILE_PATH,
GnupgConfigurationKeys.CONFIG_PROP_KEY_FILE_PATH));
if (!keyPath.isAbsolute()) {
- keyPath = session.getLocalRepository().getBasePath().resolve(keyPath);
+ keyPath =
+ Paths.get(System.getProperty("user.home")).resolve(keyPath).toAbsolutePath();
}
if (Files.isRegularFile(keyPath)) {
if (Files.size(keyPath) < MAX_SIZE) {
return Files.readAllBytes(keyPath);
} else {
- logger.warn("Refusing to load key {}; is larger than 5KB", keyPath);
+ logger.warn("Refusing to load file {}; is larger than 64KiB", keyPath);
Review Comment:
The space missing as provided before
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1541035094
##########
maven-resolver-tools/src/main/java/org/eclipse/aether/tools/CollectConfiguration.java:
##########
@@ -208,6 +208,9 @@ private static String getConfigurationType(JavaDocCapable<?> javaDocCapable) {
if (type.startsWith("{@link ") && type.endsWith("}")) {
type = type.substring(7, type.length() - 1);
}
+ if (type.startsWith("java.lang.")) {
+ type = type.substring(10);
Review Comment:
`"java.lang.".length()` is less error-prone during refactoring...
Same for the line above..
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1541070087
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -52,12 +52,7 @@ public final class GpgConfLoader implements GnupgSignatureArtifactGeneratorFacto
/**
* Maximum key size, see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>.
*/
- private static final long MAX_SIZE = 5 * 1024 + 1L;
-
- @Override
- public boolean isInteractive() {
- return false;
- }
+ private static final long MAX_SIZE = 16 * 1024 + 1L;
Review Comment:
See https://wiki.gnupg.org/LargeKeys
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1541070087
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -52,12 +52,7 @@ public final class GpgConfLoader implements GnupgSignatureArtifactGeneratorFacto
/**
* Maximum key size, see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>.
*/
- private static final long MAX_SIZE = 5 * 1024 + 1L;
-
- @Override
- public boolean isInteractive() {
- return false;
- }
+ private static final long MAX_SIZE = 16 * 1024 + 1L;
Review Comment:
See https://wiki.gnupg.org/LargeKeys
In other words, use Ed25519 key, and leave RSA ones (that are 60 times slower as well) to oblivion. Btw, GnuPG 2.4.x (unsure here, maybe since 2.1?) _by default_ generates Ed25519 keys (unless explicitly asked for RSA). The RSA keys are slowly being phased out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas merged PR #448:
URL: https://github.com/apache/maven-resolver/pull/448
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1543239313
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgAgentPasswordLoader.java:
##########
@@ -102,23 +114,43 @@ private String load(long keyId, Path socketPath) throws IOException {
os.flush();
expectOK(in);
}
- String hexKeyId = Long.toHexString(keyId & 0xFFFFFFFFL);
+ String hexKeyFingerprint = Hex.toHexString(fingerprint);
+ String displayFingerprint = hexKeyFingerprint.toUpperCase(Locale.ROOT);
// https://unix.stackexchange.com/questions/71135/how-can-i-find-out-what-keys-gpg-agent-has-cached-like-how-ssh-add-l-shows-yo
- String instruction = "GET_PASSPHRASE " + hexKeyId + " " + "Passphrase+incorrect"
- + " GnuPG+Key+Passphrase Enter+passphrase+for+encrypted+GnuPG+key+" + hexKeyId
+ String instruction = "GET_PASSPHRASE "
+ + (!interactive ? "--no-ask " : "")
+ + hexKeyFingerprint
+ + " "
+ + "X "
+ + "GnuPG+Passphrase "
+ + "Please+enter+the+passphrase+to+unlock+the+OpenPGP+secret+key+with+fingerprint:+"
+ + displayFingerprint
+ "+to+use+it+for+signing+Maven+Artifacts\n";
os.write((instruction).getBytes());
os.flush();
- return new String(Hex.decode(expectOK(in).trim()));
+ String pw = mayExpectOK(in);
Review Comment:
Especially, if we call `getChars()` a few lines later...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "michael-o (via GitHub)" <gi...@apache.org>.
michael-o commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1543487992
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -66,13 +66,14 @@ public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOExce
GnupgConfigurationKeys.DEFAULT_KEY_FILE_PATH,
GnupgConfigurationKeys.CONFIG_PROP_KEY_FILE_PATH));
if (!keyPath.isAbsolute()) {
- keyPath = session.getLocalRepository().getBasePath().resolve(keyPath);
+ keyPath =
+ Paths.get(System.getProperty("user.home")).resolve(keyPath).toAbsolutePath();
}
if (Files.isRegularFile(keyPath)) {
if (Files.size(keyPath) < MAX_SIZE) {
return Files.readAllBytes(keyPath);
} else {
- logger.warn("Refusing to load key {}; is larger than 5KB", keyPath);
+ logger.warn("Refusing to load file {}; is larger than 64KB", keyPath);
Review Comment:
64 KiB
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1543598726
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -66,13 +66,14 @@ public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOExce
GnupgConfigurationKeys.DEFAULT_KEY_FILE_PATH,
GnupgConfigurationKeys.CONFIG_PROP_KEY_FILE_PATH));
if (!keyPath.isAbsolute()) {
- keyPath = session.getLocalRepository().getBasePath().resolve(keyPath);
+ keyPath =
+ Paths.get(System.getProperty("user.home")).resolve(keyPath).toAbsolutePath();
}
if (Files.isRegularFile(keyPath)) {
if (Files.size(keyPath) < MAX_SIZE) {
return Files.readAllBytes(keyPath);
} else {
- logger.warn("Refusing to load key {}; is larger than 5KB", keyPath);
+ logger.warn("Refusing to load file {}; is larger than 64KB", keyPath);
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#issuecomment-2026851197
Anything else important around here? Would like to cut next alpha ASAP
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1543238396
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgAgentPasswordLoader.java:
##########
@@ -102,23 +114,43 @@ private String load(long keyId, Path socketPath) throws IOException {
os.flush();
expectOK(in);
}
- String hexKeyId = Long.toHexString(keyId & 0xFFFFFFFFL);
+ String hexKeyFingerprint = Hex.toHexString(fingerprint);
+ String displayFingerprint = hexKeyFingerprint.toUpperCase(Locale.ROOT);
// https://unix.stackexchange.com/questions/71135/how-can-i-find-out-what-keys-gpg-agent-has-cached-like-how-ssh-add-l-shows-yo
- String instruction = "GET_PASSPHRASE " + hexKeyId + " " + "Passphrase+incorrect"
- + " GnuPG+Key+Passphrase Enter+passphrase+for+encrypted+GnuPG+key+" + hexKeyId
+ String instruction = "GET_PASSPHRASE "
+ + (!interactive ? "--no-ask " : "")
+ + hexKeyFingerprint
+ + " "
+ + "X "
+ + "GnuPG+Passphrase "
+ + "Please+enter+the+passphrase+to+unlock+the+OpenPGP+secret+key+with+fingerprint:+"
+ + displayFingerprint
+ "+to+use+it+for+signing+Maven+Artifacts\n";
os.write((instruction).getBytes());
os.flush();
- return new String(Hex.decode(expectOK(in).trim()));
+ String pw = mayExpectOK(in);
Review Comment:
From a security perspective, I think it's better to keep `char[]` or `byte[]` rather than a `String` when carrying passwords.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1543607695
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -66,13 +66,14 @@ public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOExce
GnupgConfigurationKeys.DEFAULT_KEY_FILE_PATH,
GnupgConfigurationKeys.CONFIG_PROP_KEY_FILE_PATH));
if (!keyPath.isAbsolute()) {
- keyPath = session.getLocalRepository().getBasePath().resolve(keyPath);
+ keyPath =
+ Paths.get(System.getProperty("user.home")).resolve(keyPath).toAbsolutePath();
}
if (Files.isRegularFile(keyPath)) {
if (Files.size(keyPath) < MAX_SIZE) {
return Files.readAllBytes(keyPath);
} else {
- logger.warn("Refusing to load key {}; is larger than 5KB", keyPath);
+ logger.warn("Refusing to load file {}; is larger than 64KB", keyPath);
Review Comment:
Ok, that looks really non standard... Honestly, it's the first time I see this notation. To refer to something we don't care, I'd rather make the `MAX_SIZE = 64000` just to keep `64 kB`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1543240703
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgAgentPasswordLoader.java:
##########
@@ -102,23 +114,43 @@ private String load(long keyId, Path socketPath) throws IOException {
os.flush();
expectOK(in);
}
- String hexKeyId = Long.toHexString(keyId & 0xFFFFFFFFL);
+ String hexKeyFingerprint = Hex.toHexString(fingerprint);
+ String displayFingerprint = hexKeyFingerprint.toUpperCase(Locale.ROOT);
// https://unix.stackexchange.com/questions/71135/how-can-i-find-out-what-keys-gpg-agent-has-cached-like-how-ssh-add-l-shows-yo
- String instruction = "GET_PASSPHRASE " + hexKeyId + " " + "Passphrase+incorrect"
- + " GnuPG+Key+Passphrase Enter+passphrase+for+encrypted+GnuPG+key+" + hexKeyId
+ String instruction = "GET_PASSPHRASE "
+ + (!interactive ? "--no-ask " : "")
+ + hexKeyFingerprint
+ + " "
+ + "X "
+ + "GnuPG+Passphrase "
+ + "Please+enter+the+passphrase+to+unlock+the+OpenPGP+secret+key+with+fingerprint:+"
+ + displayFingerprint
+ "+to+use+it+for+signing+Maven+Artifacts\n";
os.write((instruction).getBytes());
os.flush();
- return new String(Hex.decode(expectOK(in).trim()));
+ String pw = mayExpectOK(in);
Review Comment:
So just return `Hex.decode(pw.trim())` below...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1541070087
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -52,12 +52,7 @@ public final class GpgConfLoader implements GnupgSignatureArtifactGeneratorFacto
/**
* Maximum key size, see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>.
*/
- private static final long MAX_SIZE = 5 * 1024 + 1L;
-
- @Override
- public boolean isInteractive() {
- return false;
- }
+ private static final long MAX_SIZE = 16 * 1024 + 1L;
Review Comment:
See https://wiki.gnupg.org/LargeKeys
In other words, use Ed25519 key, and leave RSA ones (that are 60 times slower as well) to oblivion. Btw, GnuPG 2.4.x (unsure here, maybe since 2.1, or 2.2 or 2.3?) _by default_ generates Ed25519 keys (unless explicitly asked for RSA). The RSA keys are slowly being phased out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1541070087
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -52,12 +52,7 @@ public final class GpgConfLoader implements GnupgSignatureArtifactGeneratorFacto
/**
* Maximum key size, see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>.
*/
- private static final long MAX_SIZE = 5 * 1024 + 1L;
-
- @Override
- public boolean isInteractive() {
- return false;
- }
+ private static final long MAX_SIZE = 16 * 1024 + 1L;
Review Comment:
See https://wiki.gnupg.org/LargeKeys
In other words, use Ed25519 key, and leave RSA ones (that are 60 times slower as well) to oblivion. Btw, GnuPG 2.4.x _by default_ generates Ed25519 keys (unless explicitly asked for RSA). The RSA keys are slowly being phased out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1541068724
##########
maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/loaders/GpgConfLoader.java:
##########
@@ -52,12 +52,7 @@ public final class GpgConfLoader implements GnupgSignatureArtifactGeneratorFacto
/**
* Maximum key size, see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>.
*/
- private static final long MAX_SIZE = 5 * 1024 + 1L;
-
- @Override
- public boolean isInteractive() {
- return false;
- }
+ private static final long MAX_SIZE = 16 * 1024 + 1L;
Review Comment:
My signing key is 12k... It does not give much room.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MRESOLVER-516] Align GPG generator [maven-resolver]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on code in PR #448:
URL: https://github.com/apache/maven-resolver/pull/448#discussion_r1541047954
##########
maven-resolver-tools/src/main/java/org/eclipse/aether/tools/CollectConfiguration.java:
##########
@@ -208,6 +208,9 @@ private static String getConfigurationType(JavaDocCapable<?> javaDocCapable) {
if (type.startsWith("{@link ") && type.endsWith("}")) {
type = type.substring(7, type.length() - 1);
}
+ if (type.startsWith("java.lang.")) {
+ type = type.substring(10);
Review Comment:
Fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org