jmx4perl

 view release on metacpan or  search on metacpan

Build.PL  view on Meta::CPAN

              "XML::LibXML" => 0,         # req
              "File::Temp" => 0,          # req
              "Digest::MD5" => 0,         # opt
              "Digest::SHA1" => 0,        # opt
              "XML::Twig" => 0,           # opt
              "Term::ProgressBar" => 0    # opt
             );
    add_script("scripts/jolokia" => 1);
    my $has_openpgp = eval "require Crypt::OpenPGP; 1";
    if (!$has_openpgp) {
        my $check = `gpg --version`;
        if ($?) {
            $check = `gpg2 --version`;
            if ($?) {
                $msg = <<EOT;
                
jolokia uses PGP verification for the files downloaded, but neither
Crypt::OpenPGP nor GnuPG is installed. It is highly recommended to 
install at least one of them. Installing Crypt::OpenPGP however can 
be a pain due to its large set of dependencies.

Use Crypt::OpenPGP ? (y/n)
EOT

lib/JMX/Jmx4Perl/Agent/Jolokia/Verifier.pm  view on Meta::CPAN

        my $module = shift;
        eval "require $module";
        die $@ if $@;
        my $verifier;
        eval "\$verifier = new $module()";
        die $@ if $@;
        return $verifier;        
    };

    my $prefix = "JMX::Jmx4Perl::Agent::Jolokia::Verifier::";
    if (`gpg --version` =~ /GnuPG/m) {
        push @VERIFIERS,$create->($prefix . "GnuPGVerifier");        
    } else {
        push @WARNINGS,"No signature verification available. Please install GnupPG.";
    }

    # Disabled support for OpenPGP since it doesn't support the digest
    # algorithm used for signging the jolokia artefacts 
    # } elsif (eval "requireCrypt::OpenPGP; 1") { 
    #    push @VERIFIERS,$create->($prefix . "OpenPGPVerifier");

lib/JMX/Jmx4Perl/Agent/Jolokia/Verifier/GnuPGVerifier.pm  view on Meta::CPAN

use JMX::Jmx4Perl::Agent::Jolokia::Verifier::PGPKey;
use Module::Find;
use Data::Dumper;
use File::Temp qw/tempfile/;

use strict;

=head1 NAME

JMX::Jmx4Perl::Agent::Jolokia::Verifier::GnuPGVerifier - Verifies PGP
signature with a natively installed GnuPG (with gpg found in the path)

=head1 DESCRIPTION

This verifier uses a natively installed GPG for validating a PGP signature
obtained from the download site. It's similar to
L<JMX::Jmx4Perl::Agent::Jolokia::Verifier::OpenPGPVerifier> except that it will
use a locally installed GnuPG installation. Please note, that it will import
the public key used for signature verification into the local keystore. 

=cut 

sub new { 
    my $class = shift;
    my $self = {};
    ($self->{gpg},$self->{version}) = &_gpg_version();
    bless $self,(ref($class) || $class);
}

sub extension { 
    return ".asc";
}

sub name { 
    return "GnuPG";
}

sub verify {
    my $self = shift;
    my %args = @_;

    my $log = $args{logger};
    my $gpg = $self->{gpg};

    die "Neither 'path' nor 'data' given for specifying the file/data to verify" 
      unless $args{path} || $args{data};

    my $signature_path = $self->_store_tempfile($args{signature});
    my $path = $args{path} ? $args{path} : $self->_store_tempfile($args{data});
    my @cmd = (
               $gpg,
               qw(--verify --batch --no-tty -q --logger-fd=1),
              );
    eval {
        push @cmd, $signature_path,$path;
        # Unset language for proper parsing of the output independent
        # of the locale
        local $ENV{LANG} = undef;
        my $cmd = join ' ', @cmd;
        my $output = `$cmd`;
        if ($output =~ /public\s*key/i) {
            # Import key and retry
            $self->_import_key(\%args);
            $output = `$cmd`;
        }
            
        $self->_verify_gpg_output($?,$output,\%args);
    };
    
    # Always cleanup
    my $error = $@;
    unlink $signature_path;
    unlink $path unless $args{path};
    die $error if $error;

}

sub _verify_gpg_output {
    my $self = shift;
    my $code = shift;
    my $output = shift;
    my $args = shift;
    my $log = $args->{logger};
    my $key = $1 if $output =~ /\s+([\dA-F]{8})/;
#    print $output,"\n";
    if ($code) {        
        $log->error("Invalid signature",$args->{path} ? " for " . $args->{path}  : "",$key ? " (key: $key)" : "");
        die "\n";        
    } else { 
        $log->info("Good PGP signature" . ($key ? " ($key)" : ""));
    }
}

sub _import_key {
    my $self = shift;
    my $args = shift;

    my $gpg = $self->{gpg};
    my $log = $args->{logger};
    my $key_path = $self->_store_tempfile($JMX::Jmx4Perl::Agent::Jolokia::Verifier::PGPKey::KEY);

    my @cmd = ($gpg,qw(--import --verbose --batch --no-tty  --logger-fd=1),$key_path);
    my $cmd = join ' ', @cmd;
    my $output = `$cmd 2>&1`;
    if ($?) {
        $log->error("Cannot add public PGP used for verification to local keystore: $output");
        die "\n";
    } else {
        #$log->info($output);
        my $info = $1 if $output =~ /([\dA-F]{8}.*import.*)$/mi;
        $log->info($info ? $info : "Added jmx4perl key");
    }
    unlink $key_path;
}


sub _gpg_version {
    my $gpg = "gpg2";
    my $out = `gpg2 --version`;
    if ($?) {
        $out = `gpg --version`;
        $gpg = "gpg";
        if ($?) {
            die "Cannot find gpg or gpg2: $out\n";
        }
    }
    $out =~ /GnuPG.*?(\S+)\s*$/m;
    return ($gpg,$1);
}

sub _store_tempfile {
    my $self = shift;
    my $sig = shift || die "No data given to store in temp file";
    my ($fh,$path) = tempfile();
    print $fh $sig;
    close $fh;
    return $path;
}

lib/JMX/Jmx4Perl/Agent/Jolokia/Verifier/OpenPGPVerifier.pm  view on Meta::CPAN

This verifier uses L<Crypt::OpenPGP> for validating a PGP signature obtained
from the download site. Ie. each URL used for download should have (and does
have) and associated signature ending with F<.asc>. This verifier typically
quite robust, however installing L<Crypt::OpenPGP> is a bit clumsy, so you
might omit this one.

=head1 IMPORTANT

It is not used currently since the new agents has been signed with 'digest
algortihm 10' which is not supported by OpenPGP. Use a native GnuPG instead
(i.e. a 'gpg' which is in the path)

=cut 

sub new { 
    my $class = shift;
    my $self = {};
    $self->{keyring} = $JMX::Jmx4Perl::Agent::Jolokia::Verifier::PGPKey::KEY;
    bless $self,(ref($class) || $class);
}