Be able to specify a list of keys to trust

[alexanderkjall]

As I understood it this plugin verifies the .jar files with the help of the .asc files and the key server that you specify.

Correct me if I'm wrong, but this doesn't prevent an attacker from injecting both a malicious jar file and an asc file that contains a matching signature for the jar file.

If I could specify what key a specific dependency should be signed with this should remove that hole, or maybe just specify a list of keys that are globally trusted.

[slawekjaranowski]

You have right, plugin verifies artifacts with the help of corresponding .asc file.
This behavior allow attacker to do as you write.

Maven Central require pgp signatures from some years and currently there are not exist some global method to check those signature.
I couldn't find tools to automatically check so I have started to write this one.

Your idea is good, I will try to add functionality for achieve more security.

I see a few feature:

• maps artifacts, maven gav with key which is allowed to sign those
• list of trusted keys which is allowed to sign any artifact
• list of trusted kays which can be used to verify another keys

[slawekjaranowski]

I have prepared some feature for your proposition.
Now you can prepare maps for artifact and keys.

You can look into s4u/pgpverify-maven-plugin/src/it/sigOkKeysMap for examples

[alexanderkjall]

Looks very good, this makes the plugin significantly more useful. Will test it in the coming days.

[alexanderkjall]

Seems that there is an incompability between this patch and mine, if someone signs their jar and pom files with different keys then it breaks.

I think this is an example of that:
commons-chain:commons-chain:1.2=0xB95BBD3FA43C4492
commons-chain:commons-chain:1.2=0x1861C322C56014B2

[slawekjaranowski]

You can put many keys for one line, eg:
commons-chain:commons-chain:1.2=0xB95BBD3FA43C4492,0x1861C322C56014B2

This case is strange, I thought that building jars and pom is doing in one task ...

[slawekjaranowski]

You found interesting case, as I see
http://search.maven.org/#browse%7C-1743192320

I guess files are modified and upload manualy for this artifact.
It is very danger because we can get different files in different time for the same version, no more coments ...

And I see that checksum files (.md5, .sha1) has different time of modification with connected file.