java.lang.Object
net.i2p.crypto.TrustedUpdate
public class TrustedUpdateextends Object
Handles signing and verification of I2P update files. Supports multiple signature types and content formats for secure software distribution.

  • Field Details

    • DEFAULT_TRUSTED_KEY

      private static final String DEFAULT_TRUSTED_KEY
      Base64 of the default trusted signing key, zzz's key.
      See Also:

    • VERSION_BYTES

      private static final int VERSION_BYTES
      Bytes in the version field.
      See Also:

    • HEADER_BYTES

      public static final int HEADER_BYTES
      Bytes preceding the version in an update file: a signature followed by a 16-byte version.

    • PROP_TRUSTED_KEYS

      private static final String PROP_TRUSTED_KEYS
      Config key of the trusted update keys.
      See Also:

    • _context

      private final I2PAppContext _context
      The app context.

    • _log

      private final Log _log
      The log for update verification.

    • _trustedKeys

      private final Map<SigningPublicKey, String> _trustedKeys
      The trusted keys, by signing key, named by signer.

    • _newVersion

      private String _newVersion
      The version of the verified update.

    • KEYSIZE_B64_BYTES

      private static final int KEYSIZE_B64_BYTES
      Key size in base64 bytes (padding + key data, 172).

    • DEFAULT_KEYS

      private static final Map<String,String> DEFAULT_KEYS
      The built-in trusted keys.

  • Constructor Details

    • TrustedUpdate

      public TrustedUpdate()
      Trusted update verifier using the default global context.

    • TrustedUpdate

      public TrustedUpdate(I2PAppContext context)
      Trusted update verifier using the given context.
      Parameters:
      context - An instance of I2PAppContext.

  • Method Details

    • getKeys

      public Map<SigningPublicKey, String> getKeys()
      Returns the signing keys whose releases this router accepts, in an unmodifiable view.
      Returns:
      the trusted signing public keys, each mapped to its owner name, which may be empty when the key was supplied without one

    • addKey

      public final boolean addKey(String key, String name)
      Duplicate keys or names rejected, except that duplicate empty names are allowed.
      Parameters:
      key - 172 character base64 string
      name - non-null but "" ok
      Returns:
      true if successful

    • haveKey

      public boolean haveKey(String key)
      Do we know about the following key?
      Parameters:
      key - the base64 signing key to look up; any other length returns false
      Returns:
      true if the key is trusted

    • main

      public static void main(String[] args)
      Parses command line arguments when this class is used from the command line. Exits 1 on failure so this can be used in scripts.
      Parameters:
      args - Command line parameters.

    • needsUpdate

      public static final boolean needsUpdate(String currentVersion, String newVersion)
      Checks if the given version is newer than the given current version.
      Parameters:
      currentVersion - The current version.
      newVersion - The version to test.
      Returns:
      true if the given version is newer than the current version, otherwise false.

    • genKeysCLI

      private static final boolean genKeysCLI(String publicKeyFile, String privateKeyFile)
      Generate signing key pair files via CLI.
      Parameters:
      publicKeyFile - path of the public key file to create, not overwritten if it exists
      privateKeyFile - path of the private key file to create, not overwritten if it exists
      Returns:
      true if key files were generated successfully

    • showUsageCLI

      private static final void showUsageCLI()
      Shows the command line usage.

    • showVersionCLI

      private static final boolean showVersionCLI(String signedFile)
      Display version string from a signed file via CLI.
      Parameters:
      signedFile - path of the signed file to read the version from
      Returns:
      true if version string was extracted from the file

    • signCLI

      private static final boolean signCLI(String inputFile, String signedFile, String privateKeyFile, String version)
      Sign an input file via CLI.
      Parameters:
      inputFile - path of the file to sign
      signedFile - path of the signed output file to write
      privateKeyFile - path of the signing private key file to read
      version - version string to embed in the signed file
      Returns:
      true if the file was signed successfully

    • verifySigCLI

      private static final boolean verifySigCLI(String signedFile)
      Verify signature on a signed file via CLI.
      Parameters:
      signedFile - path of the signed file whose signature is checked
      Returns:
      true if the signature is valid

    • verifyUpdateCLI

      private static final boolean verifyUpdateCLI(String signedFile)
      Check whether a signed file is a newer version via CLI.
      Parameters:
      signedFile - path of the signed file whose version is compared with the running CoreVersion
      Returns:
      true if the signed file is a newer version

    • verifyVersionCLI

      private static final boolean verifyVersionCLI(String signedFile)
      True if there's no version mismatch.
      Parameters:
      signedFile - path of the signed file whose header and zip comment versions are compared
      Returns:
      true if there's no version mismatch

    • getTrustedKeysString

      public String getTrustedKeysString()
      Fetches the trusted keys for the current instance. We could sort it but don't bother.
      Returns:
      A String containing the trusted keys, delimited by CR LF line breaks.

    • getVersionString

      public static String getVersionString(File signedFile)
      Reads the version string from a signed update file.
      Parameters:
      signedFile - A signed update file.
      Returns:
      The version string read, or an empty string if no version string is present.

    • getVersionString

      public static String getVersionString(InputStream inputStream)
      Reads the version string from an input stream.
      Parameters:
      inputStream - containing at least 56 bytes
      Returns:
      The version string read, or an empty string if no version string is present.

    • newVersion

      public String newVersion()
      Version in the .sud file, valid only after calling migrateVerified(String, File, File).
      Returns:
      the new version string

    • isUpdatedVersion

      public boolean isUpdatedVersion(String currentVersion, File signedFile)
      Verifies that the version of the given signed update file is newer than currentVersion.
      Parameters:
      currentVersion - The current version to check against.
      signedFile - The signed update file.
      Returns:
      true if the signed update file's version is newer than the current version, otherwise false.

    • migrateVerified

      public String migrateVerified(String currentVersion, File signedFile, File outputFile)
      Verifies the signature of a signed update file, and if it's valid and the file's version is newer than the given current version, migrates the data out of signedFile and into outputFile.

      As of 0.8.8, the embedded file must be a zip file with a standard zip header and a UTF-8 zip file comment matching the version in the sud header. This prevents spoofing the version, since the sud signature does NOT cover the version in the header. (We do this for sud/su2 files but not plugin xpi2p files - don't use this method for plugin files).

      Parameters:
      currentVersion - The current version to check against.
      signedFile - A signed update file.
      outputFile - The file to write the verified data to.
      Returns:
      null if the signature and version were valid and the data was moved, and an error String otherwise.

    • verifyVersionMatch

      private boolean verifyVersionMatch(File signedFile)
      Verify the version in the sud header matches the version in the zip comment (and that the embedded file is a zip file at all) isUpdatedVersion(String, File) must be called first to set _newVersion.
      Parameters:
      signedFile - the signed update file, its zip comment is compared against the version read earlier
      Returns:
      true if matches

    • migrateFile

      public String migrateFile(File signedFile, File outputFile)
      Extract the file. Skips and ignores the signature and version. No verification.
      Parameters:
      signedFile - A signed update file.
      outputFile - The file to write the verified data to.
      Returns:
      null if the data was moved, and an error String otherwise.

    • sign

      public Signature sign(String inputFile, String signedFile, String privateKeyFile, String version)
      Uses the given private key to sign the given input file along with its version string using DSA. The output will be a signed update file where the first 40 bytes are the resulting DSA signature, the next 16 bytes are the input file's version string encoded in UTF-8 (padded with trailing 0h characters if necessary), and the remaining bytes are the raw bytes of the input file.
      Parameters:
      inputFile - The file to be signed.
      signedFile - The signed update file to write.
      privateKeyFile - The name of the file containing the private key to sign inputFile with.
      version - The version string of the input file. If this is longer than 16 characters it will be truncated.
      Returns:
      An instance of Signature, or null if there was an error.

    • sign

      public Signature sign(String inputFile, String signedFile, SigningPrivateKey signingPrivateKey, String version)
      Uses the given SigningPrivateKey to sign the given input file along with its version string using DSA. The output will be a signed update file where the first 40 bytes are the resulting DSA signature, the next 16 bytes are the input file's version string encoded in UTF-8 (padded with trailing 0h characters if necessary), and the remaining bytes are the raw bytes of the input file.
      Parameters:
      inputFile - The file to be signed.
      signedFile - The signed update file to write.
      signingPrivateKey - An instance of SigningPrivateKey to sign inputFile with.
      version - The version string of the input file. If this is longer than 16 characters it will be truncated.
      Returns:
      An instance of Signature, or null if there was an error.

    • verify

      public boolean verify(File signedFile)
      Verifies the DSA signature of a signed update file.
      Parameters:
      signedFile - The signed update file to check.
      Returns:
      true if the file has a valid signature, otherwise false.

    • verifyAndGetSigner

      public String verifyAndGetSigner(File signedFile)
      Verifies the DSA signature of a signed update file.
      Parameters:
      signedFile - The signed update file to check.
      Returns:
      signer (could be empty string) or null if invalid

    • verify

      public boolean verify(String signedFile, String publicKeyFile)
      Verifies the DSA signature of a signed update file.
      Parameters:
      signedFile - The signed update file to check.
      publicKeyFile - A file containing the public key to use for verification.
      Returns:
      true if the file has a valid signature, otherwise false.

    • verify

      public boolean verify(File signedFile, SigningPublicKey signingPublicKey)
      Verifies the DSA signature of a signed update file.
      Parameters:
      signedFile - The signed update file to check.
      signingPublicKey - An instance of SigningPublicKey to use for verification.
      Returns:
      true if the file has a valid signature, otherwise false.