mirror of
https://github.com/openjdk/jdk.git
synced 2026-07-30 04:43:27 +00:00
196 lines
8.4 KiB
Java
196 lines
8.4 KiB
Java
/*
|
|
* Copyright (c) 2022, 2025, Oracle and/or its affiliates. All rights reserved.
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* version 2 for more details (a copy is included in the LICENSE file that
|
|
* accompanied this code).
|
|
*
|
|
* You should have received a copy of the GNU General Public License version
|
|
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
* or visit www.oracle.com if you need additional information or have any
|
|
* questions.
|
|
*/
|
|
|
|
import static jdk.jpackage.internal.util.function.ThrowingConsumer.toConsumer;
|
|
|
|
import java.nio.file.Path;
|
|
import jdk.jpackage.test.Annotations.Parameter;
|
|
import jdk.jpackage.test.Annotations.Test;
|
|
import jdk.jpackage.test.ApplicationLayout;
|
|
import jdk.jpackage.test.JPackageCommand;
|
|
import jdk.jpackage.test.MacHelper;
|
|
import jdk.jpackage.test.MacSign;
|
|
import jdk.jpackage.test.PackageTest;
|
|
import jdk.jpackage.test.PackageType;
|
|
import jdk.jpackage.test.TKit;
|
|
|
|
/**
|
|
* Tests generation of dmg and pkg from signed predefined app image which was
|
|
* signed using two step process (generate app image and then signed using
|
|
* --app-image and --mac-sign). Test will generate pkg and verifies its
|
|
* signature. It verifies that dmg is not signed, but app image inside dmg
|
|
* is signed. This test requires that the machine is configured with test
|
|
* certificate for "Developer ID Installer: jpackage.openjdk.java.net" in
|
|
* jpackagerTest keychain with always allowed access to this keychain for user
|
|
* which runs test.
|
|
* note:
|
|
* "jpackage.openjdk.java.net" can be over-ridden by system property
|
|
* "jpackage.mac.signing.key.user.name", and
|
|
* "jpackagerTest" can be over-ridden by system property
|
|
* "jpackage.mac.signing.keychain"
|
|
*/
|
|
|
|
/*
|
|
* @test
|
|
* @summary jpackage with --type pkg,dmg --app-image
|
|
* @library /test/jdk/tools/jpackage/helpers
|
|
* @library base
|
|
* @key jpackagePlatformPackage
|
|
* @build SigningBase
|
|
* @build jdk.jpackage.test.*
|
|
* @build SigningPackageFromTwoStepAppImageTest
|
|
* @requires (jpackage.test.MacSignTests == "run")
|
|
* @run main/othervm/timeout=720 -Xmx512m jdk.jpackage.test.Main
|
|
* --jpt-run=SigningPackageFromTwoStepAppImageTest
|
|
* --jpt-before-run=SigningBase.verifySignTestEnvReady
|
|
*/
|
|
public class SigningPackageFromTwoStepAppImageTest {
|
|
|
|
private static void verifyPKG(JPackageCommand cmd) {
|
|
if (!cmd.hasArgument("--mac-sign")) {
|
|
return; // Nothing to check if not signed
|
|
}
|
|
|
|
Path outputBundle = cmd.outputBundle();
|
|
SigningBase.verifyPkgutil(outputBundle, true, SigningBase.DEFAULT_INDEX);
|
|
SigningBase.verifySpctl(outputBundle, "install", SigningBase.DEFAULT_INDEX);
|
|
}
|
|
|
|
private static void verifyDMG(JPackageCommand cmd) {
|
|
// DMG always unsigned, so we will check it
|
|
Path outputBundle = cmd.outputBundle();
|
|
SigningBase.verifyDMG(outputBundle);
|
|
}
|
|
|
|
private static void verifyAppImageInDMG(JPackageCommand cmd) {
|
|
MacHelper.withExplodedDmg(cmd, dmgImage -> {
|
|
// We will be called with all folders in DMG since JDK-8263155, but
|
|
// we only need to verify app.
|
|
if (dmgImage.endsWith(cmd.name() + ".app")) {
|
|
Path launcherPath = ApplicationLayout.platformAppImage()
|
|
.resolveAt(dmgImage).launchersDirectory().resolve(cmd.name());
|
|
SigningBase.verifyCodesign(launcherPath, true, SigningBase.DEFAULT_INDEX);
|
|
SigningBase.verifyCodesign(dmgImage, true, SigningBase.DEFAULT_INDEX);
|
|
SigningBase.verifySpctl(dmgImage, "exec", SigningBase.DEFAULT_INDEX);
|
|
}
|
|
});
|
|
}
|
|
|
|
@Test
|
|
// ({"sign or not", "signing-key or sign-identity"})
|
|
// Sign and signing-key
|
|
@Parameter({"true", "true"})
|
|
// Sign and sign-identity
|
|
@Parameter({"true", "false"})
|
|
// Unsigned
|
|
@Parameter({"false", "true"})
|
|
public void test(boolean signAppImage, boolean signingKey) throws Exception {
|
|
MacSign.withKeychain(toConsumer(keychain -> {
|
|
test(keychain, signAppImage, signingKey);
|
|
}), SigningBase.StandardKeychain.MAIN.keychain());
|
|
}
|
|
|
|
private void test(MacSign.ResolvedKeychain keychain, boolean signAppImage, boolean signingKey) throws Exception {
|
|
|
|
Path appimageOutput = TKit.createTempDirectory("appimage");
|
|
|
|
// Generate app image. Signed or unsigned based on test
|
|
// parameter. We should able to sign predfined app images
|
|
// which are signed or unsigned.
|
|
JPackageCommand appImageCmd = JPackageCommand.helloAppImage()
|
|
.setArgumentValue("--dest", appimageOutput);
|
|
if (signAppImage) {
|
|
appImageCmd.addArguments("--mac-sign",
|
|
"--mac-signing-keychain", keychain.name());
|
|
if (signingKey) {
|
|
appImageCmd.addArguments("--mac-signing-key-user-name",
|
|
SigningBase.getDevName(SigningBase.DEFAULT_INDEX));
|
|
} else {
|
|
appImageCmd.addArguments("--mac-app-image-sign-identity",
|
|
SigningBase.getAppCert(SigningBase.DEFAULT_INDEX));
|
|
}
|
|
}
|
|
|
|
// Generate app image
|
|
appImageCmd.executeAndAssertHelloAppImageCreated();
|
|
|
|
// Double check if it is signed or unsigned based on signAppImage
|
|
SigningBase.verifyAppImageSignature(appImageCmd, signAppImage);
|
|
|
|
// Sign app image
|
|
JPackageCommand appImageSignedCmd = new JPackageCommand();
|
|
appImageSignedCmd.setPackageType(PackageType.IMAGE)
|
|
.addArguments("--app-image", appImageCmd.outputBundle().toAbsolutePath())
|
|
.addArguments("--mac-sign")
|
|
.addArguments("--mac-signing-keychain", keychain.name());
|
|
if (signingKey) {
|
|
appImageSignedCmd.addArguments("--mac-signing-key-user-name",
|
|
SigningBase.getDevName(SigningBase.DEFAULT_INDEX));
|
|
} else {
|
|
appImageSignedCmd.addArguments("--mac-app-image-sign-identity",
|
|
SigningBase.getAppCert(SigningBase.DEFAULT_INDEX));
|
|
}
|
|
appImageSignedCmd.executeAndAssertImageCreated();
|
|
|
|
// Should be signed app image
|
|
SigningBase.verifyAppImageSignature(appImageCmd, true);
|
|
|
|
new PackageTest()
|
|
.forTypes(PackageType.MAC)
|
|
.addInitializer(cmd -> {
|
|
cmd.addArguments("--app-image", appImageCmd.outputBundle());
|
|
cmd.removeArgumentWithValue("--input");
|
|
if (signAppImage) {
|
|
cmd.addArguments("--mac-sign",
|
|
"--mac-signing-keychain",
|
|
keychain.name());
|
|
if (signingKey) {
|
|
cmd.addArguments("--mac-signing-key-user-name",
|
|
SigningBase.getDevName(SigningBase.DEFAULT_INDEX));
|
|
} else {
|
|
cmd.addArguments("--mac-installer-sign-identity",
|
|
SigningBase.getInstallerCert(SigningBase.DEFAULT_INDEX));
|
|
}
|
|
}
|
|
})
|
|
.forTypes(PackageType.MAC_PKG)
|
|
.addBundleVerifier(
|
|
SigningPackageFromTwoStepAppImageTest::verifyPKG)
|
|
.forTypes(PackageType.MAC_DMG)
|
|
.addInitializer(cmd -> {
|
|
if (signAppImage && !signingKey) {
|
|
// jpackage throws expected error with
|
|
// --mac-installer-sign-identity and DMG type
|
|
cmd.removeArgument("--mac-sign");
|
|
cmd.removeArgumentWithValue("--mac-signing-keychain");
|
|
cmd.removeArgumentWithValue("--mac-installer-sign-identity");
|
|
}
|
|
})
|
|
.addBundleVerifier(
|
|
SigningPackageFromTwoStepAppImageTest::verifyDMG)
|
|
.addBundleVerifier(
|
|
SigningPackageFromTwoStepAppImageTest::verifyAppImageInDMG)
|
|
.run();
|
|
}
|
|
}
|