Skip JAR checking for overlays

It depends on overlay-info.txt resource being present.
Evolveum · Jan 23, 2024 · a40a6fa · a40a6fa
1 parent 4362396
commit a40a6fa
Show file tree

Hide file tree

Showing 4 changed files with 37 additions and 7 deletions.
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/MidPointJarSignatureChecker.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/MidPointJarSignatureChecker.java
@@ -27,7 +27,11 @@
 import java.util.jar.JarEntry;
 import java.util.jar.JarFile;
 
-/** Checks the signature of `midpoint.jar` file. Currently, it uses enclosed certificate file to check the authenticity. */
+/**
+ * Checks the signature of `midpoint.jar` file (if applicable).
+ *
+ * Currently, it uses enclosed certificate file to check the authenticity.
+ */
 public class MidPointJarSignatureChecker {
 
     private static final Trace LOGGER = TraceManager.getTrace(MidPointJarSignatureChecker.class);
@@ -38,6 +42,10 @@ public static void setupJarSignature() {
     }
 
     private static @NotNull Validity checkJarSignature() {
+        if (isOverlayDetected()) {
+            return Validity.OVERLAY_DETECTED;
+        }
+
         try {
             var home = new ApplicationHome(MidPointSpringApplication.class);
             var source = home.getSource();
@@ -54,6 +62,15 @@ public static void setupJarSignature() {
         }
     }
 
+    private static boolean isOverlayDetected() {
+        if (MidPointJarSignatureChecker.class.getClassLoader().getResource("overlay-info.txt") != null) {
+            LOGGER.info("The overlay-info.txt file was found, skipping JAR signature check");
+            return true;
+        } else {
+            return false;
+        }
+    }
+
     private static Validity verify(JarFile jar) throws IOException, CertificateException {
 
         X509Certificate ourCertificate;
@@ -66,7 +83,6 @@ private static Validity verify(JarFile jar) throws IOException, CertificateExcep
             ourCertificate = (X509Certificate) certFactory.generateCertificate(cert);
         }
 
-        int checkedFiles = 0;
         byte[] scratchBuffer = new byte[8192];
         Enumeration<JarEntry> entries = jar.entries();
         while (entries.hasMoreElements()) {
@@ -106,10 +122,9 @@ private static Validity verify(JarFile jar) throws IOException, CertificateExcep
                     LOGGER.info("File without matching certificate in JAR: {}", entry);
                     return Validity.INVALID;
                 }
-                checkedFiles++;
             }
         }
-        LOGGER.info("JAR signature verification succeeded for all {} relevant entries in {}", checkedFiles, jar.getName());
+        LOGGER.info("JAR signature verification succeeded for {}", jar.getName());
         return Validity.VALID;
     }
 }
diff --git a/...admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/PageAbout.html b/...admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/PageAbout.html
@@ -57,6 +57,9 @@ <h3 class="card-title"><wicket:message key="PageAbout.title.basic"/></h3>
                                             <i class="fa fa-exclamation-circle color-yellow"></i>
                                             <wicket:message key="PageAbout.unofficialBuild"/>
                                         </span>
+                                        <span wicket:id="overlay">
+                                            <wicket:message key="PageAbout.overlay"/>
+                                        </span>
                                     </td>
                                 </tr>
                             </table>

diff --git a/...admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/PageAbout.java b/...admin-gui/src/main/java/com/evolveum/midpoint/web/page/admin/configuration/PageAbout.java
@@ -107,6 +107,7 @@ public class PageAbout extends PageAdminConfiguration {
     private static final String ID_VALUE = "value";
     private static final String ID_OFFICIAL_BUILD = "officialBuild";
     private static final String ID_UNOFFICIAL_BUILD = "unofficialBuild";
+    private static final String ID_OVERLAY = "overlay";
     private static final String ID_LIST_SYSTEM_ITEMS = "listSystemItems";
     private static final String ID_TEST_REPOSITORY = "testRepository";
     private static final String ID_TEST_REPOSITORY_CHECK_ORG_CLOSURE = "testRepositoryCheckOrgClosure";
@@ -210,12 +211,16 @@ private void initLayout() {
         add(build);
 
         boolean jarSignatureValid = JarSignatureHolder.isJarSignatureValid();
+        boolean overlay = JarSignatureHolder.isOverlayDetected();
         add(new WebMarkupContainer(ID_OFFICIAL_BUILD)
                 .setRenderBodyOnly(true)
-                .setVisible(jarSignatureValid));
+                .setVisible(!overlay && jarSignatureValid));
         add(new WebMarkupContainer(ID_UNOFFICIAL_BUILD)
                 .setRenderBodyOnly(true)
-                .setVisible(!jarSignatureValid));
+                .setVisible(!overlay && !jarSignatureValid));
+        add(new WebMarkupContainer(ID_OVERLAY)
+                .setRenderBodyOnly(true)
+                .setVisible(overlay));
 
         ListView<LabeledString> listSystemItems = new ListView<>(ID_LIST_SYSTEM_ITEMS, getItems()) {
             private static final long serialVersionUID = 1L;

diff --git a/...mmon/src/main/java/com/evolveum/midpoint/repo/common/subscription/JarSignatureHolder.java b/...mmon/src/main/java/com/evolveum/midpoint/repo/common/subscription/JarSignatureHolder.java
@@ -24,6 +24,10 @@ public static boolean isJarSignatureValid() {
         return jarSignatureValidity == Validity.VALID;
     }
 
+    public static boolean isOverlayDetected() {
+        return jarSignatureValidity == Validity.OVERLAY_DETECTED;
+    }
+
     public enum Validity {
 
         /** The signature is present and valid. */
@@ -36,6 +40,9 @@ public enum Validity {
         ERROR,
 
         /** The signature checking is not applicable, e.g. because we are not running from a JAR file. */
-        NOT_APPLICABLE
+        NOT_APPLICABLE,
+
+        /** The overlay was detected, so the signature is not checked at all. */
+        OVERLAY_DETECTED
     }
 }