From bbf9277107555db49f6124718b20787e02943ee6 Mon Sep 17 00:00:00 2001
From: Minecon724 <git@m724.eu>
Date: Sun, 27 Oct 2024 15:00:50 +0100
Subject: [PATCH] Fix updater and signature verification

---
 README.md                                        |  15 ++++++---------
 pom.xml                                          |   4 ++--
 .../java/eu/m724/giants/updater/JarVerifier.java |   8 +++++++-
 testkeystore.jks                                 | Bin 3482 -> 0 bytes
 4 files changed, 15 insertions(+), 12 deletions(-)
 delete mode 100644 testkeystore.jks

diff --git a/README.md b/README.md
index 2777d9f..ed153e9 100644
--- a/README.md
+++ b/README.md
@@ -5,19 +5,16 @@ This plugin adds naturally spawning Giants with AI to your Minecraft server.
 ### Signing
 Public key goes into `resources/verifies_downloaded_jars.pem`
 
-A test (and default) keystore is provided:
-- keystore: `testkeystore`
-- storepass: `123456`
-- alias: `testkey`
-
-When using `mvn`, override with `-Djarsigner.`
-```
-mvn clean package -Djarsigner.keystore=/home/user/mykeystore.jks -Djarsigner.alias=mykey
-```
+A default keystore is not provided.
 
 To create a keystore and export public key:
 ```
 keytool -keystore testkeystore2.jks -genkeypair -keyalg RSA -alias testkey -validity 999999
 keytool -exportcert -alias testkey -keystore testkeystore2.jks -file cert.cer -rfc
 openssl x509 -inform pem -in cert.cer -pubkey -noout > public_key.pem
+```
+
+When using `mvn`, override with `-Djarsigner.`
+```
+mvn clean package -Djarsigner.keystore=/home/user/mykeystore.jks -Djarsigner.alias=mykey
 ```
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 636cdca..91bfd75 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,8 +6,8 @@
 
   <properties>
     <maven.compiler.release>11</maven.compiler.release>
-    <jarsigner.keystore>${project.basedir}/testkeystore.jks</jarsigner.keystore>
-    <jarsigner.alias>testkey</jarsigner.alias>
+    <jarsigner.keystore>${project.basedir}/keystore.jks</jarsigner.keystore>
+    <jarsigner.alias>mykey</jarsigner.alias>
     <jarsigner.storepass>123456</jarsigner.storepass>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
diff --git a/src/main/java/eu/m724/giants/updater/JarVerifier.java b/src/main/java/eu/m724/giants/updater/JarVerifier.java
index e4a0133..21086f3 100644
--- a/src/main/java/eu/m724/giants/updater/JarVerifier.java
+++ b/src/main/java/eu/m724/giants/updater/JarVerifier.java
@@ -7,10 +7,13 @@ import java.security.GeneralSecurityException;
 import java.security.KeyFactory;
 import java.security.PublicKey;
 import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
 import java.security.interfaces.RSAPublicKey;
 import java.security.spec.X509EncodedKeySpec;
+import java.util.ArrayList;
 import java.util.Base64;
 import java.util.Enumeration;
+import java.util.List;
 import java.util.jar.JarEntry;
 import java.util.jar.JarFile;
 import java.util.jar.Manifest;
@@ -96,11 +99,14 @@ public class JarVerifier {
 
                     // Check if any signer's public key matches our RSA key
                     boolean keyMatch = false;
+                    List<String> signerPublicKeys = new ArrayList<>();
+
                     for (CodeSigner signer : signers) {
                         for (Certificate cert : signer.getSignerCertPath().getCertificates()) {
                             PublicKey certPublicKey = cert.getPublicKey();
                             if (certPublicKey instanceof RSAPublicKey) {
                                 RSAPublicKey rsaKey = (RSAPublicKey) certPublicKey;
+                                signerPublicKeys.add(Base64.getEncoder().encodeToString(rsaKey.getEncoded()));
                                 if (rsaKey.getModulus().equals(publicKey.getModulus()) &&
                                         rsaKey.getPublicExponent().equals(publicKey.getPublicExponent())) {
                                     keyMatch = true;
@@ -112,7 +118,7 @@ public class JarVerifier {
                     }
 
                     if (!keyMatch) {
-                        throw new VerificationException("Entry not signed with matching RSA key: " + entry.getName());
+                        throw new VerificationException("Entry " + entry.getName() + " signed with " + String.join(", ", signerPublicKeys) + ", none of which match " + Base64.getEncoder().encodeToString(publicKey.getEncoded()));
                     }
                 }
             }
diff --git a/testkeystore.jks b/testkeystore.jks
deleted file mode 100644
index 6c10b16daafbf741f31291b4e54816a18e5d290a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3482
zcma)9S2P@q61Hpg&g#9aXki!8LI_rg-X)?%?^Y)pWy2B?MDHzFq9$5a3lcrLMU?17
zjTR+DuK(P7{{P&kdmm=z%=gXAnWy>AKv5KFKma}zMWIAUB81jJpHTpa00k%t7zjmi
z`vw+-qKFRuiy~SEp@<f4;IB7^BP9Dz7da^aSb!o5zX6d@$G<xWD4-9aGXJFHP+<@l
zw<Fl!t;IwGZypAk2HRhFfty8uz+2Qn02h>;koeydfg}WYP<BER8?*+%0Urbq0#VOm
zhfH4i>InUOYuh)_Wt(-g2=(p>q#PBcwu+m=(|=QEp32RR>>w%hAE3c|;Ir>37rS#(
z46B{h1gkav7|C^o#kmmX1qBS=iaOB7*LgmwtSc%Ii?`#<$6U(PHP!oLb%;n!kWP}D
z_~O^lHQjx1n#<F$hUEKMt@8esWc8D2?V@CE0~MsK93s`WE7UDHD(YuiRX)0JevXQh
zofHCd?~e-Wk;e70(H*nXP8g^ychWVok|{l%!CQPvkm|EmAO$K(yW+lnDf0|Rs~%ec
z6t(M3h|oSZ5cB`=OC%bJ(Ec;^Jc@)BB2C)4A3J*XNln)6II)5|T5#mO?UCSGqwJ-j
zlqo_Wrp;<A&aDAooH#3~VK~0o#2Uuo>ynI2x)*R_&OsOtN&CVrrw#dVWVlf+X(~v&
zd5$~lMx=5953nw#8|u6-$I|yro^_k7=1!>hWq<GdxqP*k&ue8b4+|`beyQ%Ig$W2y
z4X;e!=a2i|dKBi#Q55MLoC(8@?KlQy4waFZf!#Y!3zmzQ-WAS~tQY{<wGATgjCn|#
zzj~D;@MbV)^X%3)sJ4KF9D@rf={ipZwVcK<UQudG&E~VJMU{8#;~c{h>N$C@`_?jq
z@g}!}-p3bKsqXVK@%*8mKWEWdYhC)Nyjao|fzj%wAKK12H;j@jb2l`~6ZQ5|Bn7}|
z!|1ioR&ZRh$1;^yPSf^|`5%*<-6$tG;R=FR&U2xAWf?=&aR}SYV0NA!=<$zE9^%9R
zF<5VI!iewdgqll*<A<+YFwxb=&OHuZmmIb3mFWWEreUXCvpMaMBSWk95OB9yNVh$G
zB6=p#y0dC4S!@ZyVn8(SdaYDHD<74~4gQMEW5BNH-1R3ZyT{*&zRDpRnTz^{j^Zon
zEjNl*w0T=uv1{SfUg%qQZJqw|#60eIC|Xkef&n~C=#&v)enQ#V5~S0!8$afUNJ?6S
zO183Y1l`KAG<zII^yVHNO6|%Ex#3N4Cc(!T3b`*|5fS^N&+`Rsp$fE*b}6jrDDbs)
z&i3NQRjC_HLzbq_Ct!Qzf;5$DLngp=&QgEd0x?JsL-L+XtAAH$u3{3ce@qoVV|L;A
z!0U)|#0o+<&Nk#N<*9LcsOGr7tJEA{eA%j;(O^X0pz>Rs87!T)^kgDn7%!U#f-TP5
z3(@0nqE-!JlEz1iH0EG0Qf?dRb-?Wx7D*FRG|D;JUw}4RA^--E#p=^F+YYAzH%5KT
zFVlMU+C&*d)bvSOv;QXIpo#tqt*Uc_X1@0==XVN7qmdv2-Y8qJ!pHv5PfrJ~?-s>V
z80xY&Hq8_#HU(!=R8_Q51f=2u6IaL!!o$oc_XLVN&iQ<Z2|~HZO{$9RsRs4D+794U
z%kv~Op(?V$%`5hk*dHbw^7Ym=)CYX6zkig}gnDHuO%i=!3jb_y$FB3C@iT*o35ppL
z-UbGLq{&spxn01;l=oh#)X7%Yp!M>7tjMqFwQsZSk<GfL?g^JqdNx16GJlPVk3}-Z
zUP*6C3_ejk=BNEYtgl%#MIVlp%Y!^NyvsdN2{>RvM1#WUCiN)O7C18?k7y6w5C!3Z
zzG_<D9AfMrG@9u$gfL{@RRayG517R9bxkDR1*C8-oP<CE(Gn?XDUZWF_8ua<B|c`H
zyv(fH^&@?mT`VwGgnp6uR@@gL)~l*Z?8!FPPKXbh;`B^m$i7Na{p^>jA1><Pc-|Ah
zpPZX9!@%@prr6Hsd$Tjkmr*H*BHh+1O?>_{6D$FedR|TD+vk1bwT;@#1hz)z2J5JA
zWSaI*rf2|gXTF85N;Z8zy*wu9HN~Ag#N?;-u(iDk$cxc?tRDTIeb#jTDyn1r4&dh0
zZu5<fT*W*FP}GGw-Z#aXJ6sR3^4U2*d4;5(SLGBjmqY}T8j=b|ITz;3L>14*qanGX
zkx6YVzq;HTItlh>7RTLm-Txr@7-jR|Eh<yW<&uM2>pv(tbi;Y5`3?3a3#h`MYWuVC
zQYGtSlw72M1HRp^k7my0vu!3z7CsXM<bg8BM%XXXrFbD*zbq8DBC#U}^@nsqzok9x
zy{Wvi;>{Z*vdwfM%#?p7c*XJy*!=fuCAhEcI-1-u?-Z=9w_e(?<n_%`IP&Vri%#$L
z_2ys7j(jzDPkLXPl6!>xDMR%dP6AVPGi9q!BNMSf*3BXZhBptr+S>LfN`sEI+}Q)i
zI4^8#+U~c$va^_amnLWC_o6ZF1j0fBPS)rf(8x;mmX1|oq+IIa{nOrGnOBcuRV2yI
z3dw=SG<}xrGF~u$1Pm`k7cv`<dOQ*GklI0;llkjMzC}|&RDEW%A_w8@X*iccFB-s8
zmq?`vCV*#7LI%W6hkV(9*n>Wp6o_<+ugsR4L+BTTF~s${^ZeF3ocVNg@VMq@6MWon
z-M`5A=wntGO!+U-{EsM;fML`elz4u44tTyd-t8s^L%IK<>0w|Ht+9)T0~btM0t$sm
zic89hOGrUc1hBu0hzJW%1Uxqo2M~aF6Bz$t0RKzqD?~Qzc@22l26obRN&~Zihy2Zu
z|3~N(V(72UK8hPiQ{u=c!P0`^C{TflW)gu{x}6o@ENICEc|mwgQxPE?$~TLZ!s5(X
zw$ThK?^wi21q>dP0!@ZPNws$rs_g_?O6Jd*<GnYYR6BhPp)ZCh?LGb;(m5hIFiW8L
zrvELYNWzBeu}UV!N8q90gZ4#tel4G8HL3}7Cey>3>Rtnun%aecx6WNSm*?{E<b~N^
zGwNcgHnM(g(1h$sS-nS_>wf}`*LzJSL+$mhYJ^obrh<V)Wx7G@SQ9vuz}L2oCBh-$
z(Ye<lF4Yc<=*v|tx|?FlIq!_jXBz7m+)W?YoD|!_6b>WSQfo$fvKO2QGnwgigrWI&
z4-Ra1(xwgMwHlTers;LzPzhS*bWc78Gu%^-k}bqQrT&M{Q<`98Oh*&Sz;PYB6bhnx
z8`wWAm0()ue84BOp1pf{s-@0U5mW0MtM=+*rP#CXwNDX?(yHA;f)MAYqxPglXC7=+
zSajg4?TOLOtuOl~4N0g#=7NYM${9-qnlVwcNQ=PLns6{?g8dDr5!@z#9)A;VHvdas
z&|X-$8q1=?`NJ#O4D|x{@}bDj;8PkxkR@+uflr^CqI4{f!@k79DYQH^fYHh)=J4wU
zJ@90qGWt?<o=d<%wSQAg;X#+obgp6!VV!(iME4t72dJ;7p=0n_fLyk|w4QIHMJ7F%
zwq7wRhLdvsUSw$bo%h$A-iPLEdfcc_CTFt}0)D3!iK5U!8=X(uLY_KTy%l4wqA$d8
z!xuu-j2@ULTr%bG){`cyv$@Feub2&ujmjbaTP3-vuEnOo=-kY9X-#+j7yaQfa5i^h
za(!{Z^4B|c<a~{B*tp`axlOGU;!S#XyGBlx7UIRytw}zI`6uK?`@c!3<EQ$x%QRLl
zENh%t6;Tmexhf8$B4tM9<AXhYa$#j07rq>5#Didez$2ol%a3>A@}JwG)<{+Xp)w+U
z9Qx@pN}SYOaJ0jT=&_oDWJe2^kNoQv?%J*hd>@?!Y%7K_t?w+%2$P=N5`)wk7bV5W
ziDNALulNl%#T_h@EIjK2pSOWNtRII>D{2L=rmj-5Z`sZ&<*4!+{Arz!!<#if(s=$S
zq$O6(P>-o(n(yg%R>tinVP*~=Vkp79VV#d7WLXU4cYeo=y5i)$qkv!bYBl~&A`z>F
z^3UtH#H1ow#JuD8@$gYhB~!6(cSox1ZzuY@=U3hL(~%c(z$&XT+@}800PI2bKqR;+
zW@O5&Q&RU0e~Yw{5XHq`S>@YPN~xK@Ybvi+?74ivN+TwxuwJ3(X0yFq$XXi_?e3tQ
zvB{9((M9X<7<ztag*eq<qh2!}$dmcfH8;p|yV2*jD<0LlLoJ()=3~sq6JrDwPTEvO
zlPa|gYD&MvJ5F+uH*N&foRL->5)fT<Csu1|gh;L(RP0tRo|(FauDAwhAsem-0-F=>
zVxFmv3YRJeJ#OXRV|=uK<++pg$=qflqd8;{=oiU)#GXvj_r7~Lx~8I63e>;0U>7K$
zgq!<x0IFf4kxqXrF+|&O3uN_PjCgJczUXfWap%jGEcg2@B^k~88pM_JD7!503x4u*
z^6%+V-Kh^10FkFq9ViS+@%O(11Q6hXxajn6osOY5Q;G!T2hh!$Gp9raG=!)H^_W)-
i2+43ceh|2FWS#KEKD)Jld|D}TUN`XJA|39p6ZtR5#!F2A