From 4d7a16257f674b061851b5a2ee63f61b900cb6f1 Mon Sep 17 00:00:00 2001 From: Thomas Wolf Date: Mon, 4 May 2020 11:38:46 +0200 Subject: Include full IssuerFingerprint in GPG signature Update dependency to Bouncy Castle to 1.65. Add the IssuerFingerprint as a hashed sub-packet in the signature. If added unhashed, GPG ignores it. Bug: 553206 Change-Id: I6807e8e2385e6ec5790f388e4753a44aa9474ebb Signed-off-by: Thomas Wolf --- .../src/org/eclipse/jgit/lib/internal/BouncyCastleGpgSigner.java | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'org.eclipse.jgit/src/org/eclipse/jgit/lib/internal') diff --git a/org.eclipse.jgit/src/org/eclipse/jgit/lib/internal/BouncyCastleGpgSigner.java b/org.eclipse.jgit/src/org/eclipse/jgit/lib/internal/BouncyCastleGpgSigner.java index 388169637e..dfcfdab115 100644 --- a/org.eclipse.jgit/src/org/eclipse/jgit/lib/internal/BouncyCastleGpgSigner.java +++ b/org.eclipse.jgit/src/org/eclipse/jgit/lib/internal/BouncyCastleGpgSigner.java @@ -25,6 +25,7 @@ import org.bouncycastle.openpgp.PGPPrivateKey; import org.bouncycastle.openpgp.PGPSecretKey; import org.bouncycastle.openpgp.PGPSignature; import org.bouncycastle.openpgp.PGPSignatureGenerator; +import org.bouncycastle.openpgp.PGPSignatureSubpacketGenerator; import org.bouncycastle.openpgp.operator.jcajce.JcaPGPContentSignerBuilder; import org.bouncycastle.openpgp.operator.jcajce.JcePBESecretKeyDecryptorBuilder; import org.eclipse.jgit.annotations.NonNull; @@ -117,6 +118,11 @@ public class BouncyCastleGpgSigner extends GpgSigner { HashAlgorithmTags.SHA256).setProvider( BouncyCastleProvider.PROVIDER_NAME)); signatureGenerator.init(PGPSignature.BINARY_DOCUMENT, privateKey); + PGPSignatureSubpacketGenerator subpacketGenerator = new PGPSignatureSubpacketGenerator(); + subpacketGenerator.setIssuerFingerprint(false, + secretKey.getPublicKey()); + signatureGenerator + .setHashedSubpackets(subpacketGenerator.generate()); ByteArrayOutputStream buffer = new ByteArrayOutputStream(); try (BCPGOutputStream out = new BCPGOutputStream( new ArmoredOutputStream(buffer))) { -- cgit v1.2.3