update to gradle 7.3.2, add SHA256 payload digests

gradle.properties

@@ -1,10 +1,11 @@
 group = org.xbib
 name = rpm
-version = 2.1.0
+version = 2.2.0
 
-gradle.wrapper.version = 6.6.1
+org.gradle.warning.mode = ALL
+gradle.wrapper.version = 7.3.2
 gradle.publish.plugin.version = 0.14.0
-bouncycastle.version = 1.68
+bouncycastle.version = 1.71
 xbib-archive.version = 1.0.1
 ant.version = 1.10.10
 maven.version = 3.8.1
@@ -15,5 +16,3 @@ aether-connector-basic.version = 1.1.0
 aether-transport-wagon.version = 1.1.0
 slf4j.version = 1.7.30
 mvel.version = 2.4.12.Final
-
-org.gradle.warning.mode = ALL

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.6.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.2-all.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -1,7 +1,7 @@
-#!/usr/bin/env sh
+#!/bin/sh
 
 #
-# Copyright 2015 the original author or authors.
+# Copyright © 2015-2021 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,67 +17,101 @@
 #
 
 ##############################################################################
-##
+#
-##  Gradle start up script for UN*X
+#   Gradle start up script for POSIX generated by Gradle.
-##
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
 ##############################################################################
 
 # Attempt to set APP_HOME
+
 # Resolve links: $0 may be a link
-PRG="$0"
+app_path=$0
-# Need this for relative symlinks.
+
-while [ -h "$PRG" ] ; do
+# Need this for daisy-chained symlinks.
-    ls=`ls -ld "$PRG"`
+while
-    link=`expr "$ls" : '.*-> \(.*\)$'`
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
-    if expr "$link" : '/.*' > /dev/null; then
+    [ -h "$app_path" ]
-        PRG="$link"
+do
-    else
+    ls=$( ls -ld "$app_path" )
-        PRG=`dirname "$PRG"`"/$link"
+    link=${ls#*' -> '}
-    fi
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
 done
-SAVED="`pwd`"
+
-cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
 
 APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
+APP_BASE_NAME=${0##*/}
 
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
+MAX_FD=maximum
 
 warn () {
     echo "$*"
-}
+} >&2
 
 die () {
     echo
     echo "$*"
     echo
     exit 1
-}
+} >&2
 
 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
-case "`uname`" in
+case "$( uname )" in                #(
-  CYGWIN* )
+  CYGWIN* )         cygwin=true  ;; #(
-    cygwin=true
+  Darwin* )         darwin=true  ;; #(
-    ;;
+  MSYS* | MINGW* )  msys=true    ;; #(
-  Darwin* )
+  NONSTOP* )        nonstop=true ;;
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
 esac
 
 CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
@@ -87,9 +121,9 @@ CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
 if [ -n "$JAVA_HOME" ] ; then
     if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
         # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
+        JAVACMD=$JAVA_HOME/jre/sh/java
     else
-        JAVACMD="$JAVA_HOME/bin/java"
+        JAVACMD=$JAVA_HOME/bin/java
     fi
     if [ ! -x "$JAVACMD" ] ; then
         die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -98,7 +132,7 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
 else
-    JAVACMD="java"
+    JAVACMD=java
     which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
@@ -106,80 +140,95 @@ location of your Java installation."
 fi
 
 # Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
+    case $MAX_FD in #(
-    if [ $? -eq 0 ] ; then
+      max*)
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+        MAX_FD=$( ulimit -H -n ) ||
-            MAX_FD="$MAX_FD_LIMIT"
+            warn "Could not query maximum file descriptor limit"
-        fi
+    esac
-        ulimit -n $MAX_FD
+    case $MAX_FD in  #(
-        if [ $? -ne 0 ] ; then
+      '' | soft) :;; #(
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
+      *)
-        fi
+        ulimit -n "$MAX_FD" ||
-    else
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
-fi
-
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
-        fi
-        i=`expr $i + 1`
-    done
-    case $i in
-        0) set -- ;;
-        1) set -- "$args0" ;;
-        2) set -- "$args0" "$args1" ;;
-        3) set -- "$args0" "$args1" "$args2" ;;
-        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
     esac
 fi
 
-# Escape application args
+# Collect all arguments for the java command, stacking in reverse order:
-save () {
+#   * args from the command line
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+#   * the main class name
-    echo " "
+#   * -classpath
-}
+#   * -D...appname settings
-APP_ARGS=`save "$@"`
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
 
-# Collect all arguments for the java command, following the shell quoting and substitution rules
+# For Cygwin or MSYS, switch paths to Windows format before running java
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+# Collect all arguments for the java command;
+#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#     shell script including quotes and variable substitutions, so put them in
+#     double quotes to make sure that they get re-expanded; and
+#   * put everything else in single quotes, so that it's not re-expanded.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
 
 exec "$JAVACMD" "$@"

rpm-ant/src/main/java/org/xbib/rpm/ant/RpmTask.java

@@ -1,5 +1,6 @@
 package org.xbib.rpm.ant;
 
+import java.security.NoSuchAlgorithmException;
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.DirectoryScanner;
 import org.apache.tools.ant.Task;
@@ -279,7 +280,7 @@ public class RpmTask extends Task {
                         triggerPostUn.getFlag());
             }
             rpmBuilder.build(destination);
-        } catch (IOException | RpmException e) {
+        } catch (IOException | RpmException | NoSuchAlgorithmException e) {
             throw new BuildException("error while building package", e);
         }
     }

rpm-core/build.gradle

@@ -1,5 +1,5 @@
 dependencies {
-    api "org.bouncycastle:bcpg-jdk15on:${project.property('bouncycastle.version')}"
+    api "org.bouncycastle:bcpg-jdk18on:${project.property('bouncycastle.version')}"
     api "org.xbib:io-compress-bzip2:${project.property('xbib-archive.version')}"
     api "org.xbib:io-compress-xz:${project.property('xbib-archive.version')}"
 }

rpm-core/src/main/java/org/xbib/rpm/RpmBuilder.java

@@ -1,5 +1,9 @@
 package org.xbib.rpm;
 
+import java.io.ByteArrayOutputStream;
+import java.security.DigestOutputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import org.xbib.io.compress.bzip2.Bzip2OutputStream;
 import org.xbib.io.compress.xz.FilterOptions;
 import org.xbib.io.compress.xz.LZMA2Options;
@@ -54,13 +58,8 @@ import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.zip.GZIPOutputStream;
 
-/**
- *
- */
 public class RpmBuilder {
 
-    private static final Integer SHASIZE = 41;
-
     private static final String DEFAULTSCRIPTPROG = "/bin/sh";
 
     private static final char[] ILLEGAL_CHARS_VARIABLE = new char[]{'-', '/'};
@@ -1117,7 +1116,7 @@ public class RpmBuilder {
      * @throws IOException  there was an IO error
      * @throws RpmException if RPM could not be generated
      */
-    public void build(Path directory) throws RpmException, IOException {
+    public void build(Path directory) throws RpmException, IOException, NoSuchAlgorithmException {
         if (packageName == null) {
             setPackageName(format.getLead().getName() + "." + format.getLead().getArch().toString().toLowerCase() + ".rpm");
         }
@@ -1137,8 +1136,7 @@ public class RpmBuilder {
      * @throws RpmException if RPM generation fails
      */
     @SuppressWarnings("unchecked")
-    public void build(SeekableByteChannel channel) throws RpmException, IOException {
+    public void build(SeekableByteChannel channel) throws RpmException, IOException, NoSuchAlgorithmException {
-        WritableChannelWrapper output = new WritableChannelWrapper(channel);
         format.getHeader().createEntry(HeaderTag.REQUIRENAME, getStringList(requires));
         format.getHeader().createEntry(HeaderTag.REQUIREVERSION, getVersions(requires));
         format.getHeader().createEntry(HeaderTag.REQUIREFLAGS, getFlags(requires));
@@ -1164,22 +1162,16 @@ public class RpmBuilder {
             format.getHeader().createEntry(HeaderTag.BASENAMES, contents.getBaseNames());
         }
         if (triggerCounter > 0) {
-            format.getHeader().createEntry(HeaderTag.TRIGGERSCRIPTS,
+            format.getHeader().createEntry(HeaderTag.TRIGGERSCRIPTS, triggerscripts.toArray(new String[0]));
-                    triggerscripts.toArray(new String[0]));
+            format.getHeader().createEntry(HeaderTag.TRIGGERNAME, triggernames.toArray(new String[0]));
-            format.getHeader().createEntry(HeaderTag.TRIGGERNAME,
+            format.getHeader().createEntry(HeaderTag.TRIGGERVERSION, triggerversions.toArray(new String[0]));
-                    triggernames.toArray(new String[0]));
+            format.getHeader().createEntry(HeaderTag.TRIGGERFLAGS, triggerflags.toArray(new Integer[0]));
-            format.getHeader().createEntry(HeaderTag.TRIGGERVERSION,
+            format.getHeader().createEntry(HeaderTag.TRIGGERINDEX, triggerindexes.toArray(new Integer[0]));
-                    triggerversions.toArray(new String[0]));
+            format.getHeader().createEntry(HeaderTag.TRIGGERSCRIPTPROG, triggerscriptprogs.toArray(new String[0]));
-            format.getHeader().createEntry(HeaderTag.TRIGGERFLAGS,
-                    triggerflags.toArray(new Integer[0]));
-            format.getHeader().createEntry(HeaderTag.TRIGGERINDEX,
-                    triggerindexes.toArray(new Integer[0]));
-            format.getHeader().createEntry(HeaderTag.TRIGGERSCRIPTPROG,
-                    triggerscriptprogs.toArray(new String[0]));
         }
         if (contents.size() > 0) {
-            format.getHeader().createEntry(HeaderTag.FILEDIGESTALGOS, HashAlgo.MD5.num());
+            format.getHeader().createEntry(HeaderTag.FILEDIGESTALGOS, HashAlgo.SHA256.num());
-            format.getHeader().createEntry(HeaderTag.FILEDIGESTS, contents.getDigests(HashAlgo.MD5));
+            format.getHeader().createEntry(HeaderTag.FILEDIGESTS, contents.getDigests(HashAlgo.SHA256));
             format.getHeader().createEntry(HeaderTag.FILESIZES, contents.getSizes());
             format.getHeader().createEntry(HeaderTag.FILEMODES, contents.getModes());
             format.getHeader().createEntry(HeaderTag.FILERDEVS, contents.getRdevs());
@@ -1195,92 +1187,50 @@ public class RpmBuilder {
             format.getHeader().createEntry(HeaderTag.FILECONTEXTS, contents.getContexts());
         }
         format.getHeader().createEntry(HeaderTag.PAYLOADFLAGS, "9");
-        SpecEntry<IntegerList> sigsize =
+        format.getHeader().createEntry(HeaderTag.PAYLOADDIGESTALGO, HashAlgo.SHA256.num());
-                (SpecEntry<IntegerList>) format.getSignatureHeader().addEntry(SignatureTag.LEGACY_SIGSIZE, 1);
+        SpecEntry<StringList> payloadDigest = (SpecEntry<StringList>) format.getHeader().addEntry(HeaderTag.PAYLOADDIGEST, 1);
-        SpecEntry<IntegerList> signaturHeaderPayloadEntry =
+        payloadDigest.setSize(65);
-                (SpecEntry<IntegerList>) format.getSignatureHeader().addEntry(SignatureTag.PAYLOADSIZE, 1);
+        SpecEntry<StringList> payloadDigestAlt = (SpecEntry<StringList>) format.getHeader().addEntry(HeaderTag.PAYLOADDIGESTALT, 1);
-        SpecEntry<byte[]> md5Entry =
+        payloadDigestAlt.setSize(65);
-                (SpecEntry<byte[]>) format.getSignatureHeader().addEntry(SignatureTag.LEGACY_MD5, 16);
+        SpecEntry<IntegerList> sigsize = (SpecEntry<IntegerList>) format.getSignatureHeader().addEntry(SignatureTag.LEGACY_SIGSIZE, 1);
-        SpecEntry<StringList> shaEntry =
+        SpecEntry<IntegerList> signaturHeaderPayloadEntry = (SpecEntry<IntegerList>) format.getSignatureHeader().addEntry(SignatureTag.PAYLOADSIZE, 1);
-                (SpecEntry<StringList>) format.getSignatureHeader().addEntry(SignatureTag.SHA1HEADER, 1);
+        SpecEntry<byte[]> md5Entry = (SpecEntry<byte[]>) format.getSignatureHeader().addEntry(SignatureTag.LEGACY_MD5, 16);
-        shaEntry.setSize(SHASIZE);
+        SpecEntry<StringList> shaEntry = (SpecEntry<StringList>) format.getSignatureHeader().addEntry(SignatureTag.SHA1HEADER, 1);
+        shaEntry.setSize(41);
+        SpecEntry<StringList> sha256Entry = (SpecEntry<StringList>) format.getSignatureHeader().addEntry(SignatureTag.SHA256HEADER, 1);
+        sha256Entry.setSize(65);
         SignatureGenerator signatureGenerator = new SignatureGenerator(privateKeyRing, privateKeyId, privateKeyPassphrase);
         signatureGenerator.prepare(format.getSignatureHeader(), privateKeyHashAlgo);
         format.getLead().write(channel);
-        SpecEntry<byte[]> signatureEntry =
+        SpecEntry<byte[]> signatureEntry = (SpecEntry<byte[]>) format.getSignatureHeader().addEntry(SignatureTag.SIGNATURES, 16);
-                (SpecEntry<byte[]>) format.getSignatureHeader().addEntry(SignatureTag.SIGNATURES, 16);
         signatureEntry.setValues(createHeaderIndex(HeaderTag.SIGNATURES.getCode(), format.getSignatureHeader().count()));
+        WritableChannelWrapper output = new WritableChannelWrapper(channel);
         ChannelWrapper.empty(output, ByteBuffer.allocate(format.getSignatureHeader().write(channel)));
-        ChannelWrapper.Key<Integer> sigsizekey = output.start();
+        ChannelWrapper.Key<Integer> sigsizekey = output.startCount();
-        ChannelWrapper.Key<byte[]> shakey = signatureGenerator.startDigest(output, "SHA");
         ChannelWrapper.Key<byte[]> md5key = signatureGenerator.startDigest(output, "MD5");
+        ChannelWrapper.Key<byte[]> shakey = signatureGenerator.startDigest(output, "SHA");
+        ChannelWrapper.Key<byte[]> sha256key = signatureGenerator.startDigest(output, "SHA-256");
         signatureGenerator.startBeforeHeader(output, privateKeyHashAlgo);
         // Region concept. This tag contains an index record which specifies the portion of the Header Record
         // which was used for the calculation of a signature. This data shall be preserved or any header-only signature
         // will be invalidated.
-        SpecEntry<byte[]> immutable =
+        SpecEntry<byte[]> immutable = (SpecEntry<byte[]>) format.getHeader().addEntry(HeaderTag.HEADERIMMUTABLE, 16);
-                (SpecEntry<byte[]>) format.getHeader().addEntry(HeaderTag.HEADERIMMUTABLE, 16);
         immutable.setValues(createHeaderIndex(HeaderTag.IMMUTABLE.getCode(), format.getHeader().count()));
+        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+        MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
+        DigestOutputStream digestOutputStream = new DigestOutputStream(byteArrayOutputStream, messageDigest);
+        int length = processPayload(digestOutputStream);
+        signaturHeaderPayloadEntry.setValues(IntegerList.of(length));
+        byte[] payload = byteArrayOutputStream.toByteArray();
+        byte[] payloadDigestBytes = messageDigest.digest();
+        String hex = hex(payloadDigestBytes);
+        payloadDigest.setValues(StringList.of(hex));
+        payloadDigestAlt.setValues(StringList.of(hex));
         format.getHeader().write(output);
         shaEntry.setValues(StringList.of(hex(output.finish(shakey))));
+        sha256Entry.setValues(StringList.of(hex(output.finish(sha256key))));
         signatureGenerator.finishAfterHeader(output);
-        OutputStream compressedOutputStream = createCompressedStream(Channels.newOutputStream(output));
+        output.write(ByteBuffer.wrap(payload));
-        WritableChannelWrapper compressedOutput =
-                new WritableChannelWrapper(Channels.newChannel(compressedOutputStream));
-        ChannelWrapper.Key<Integer> payloadkey = compressedOutput.start();
-        int total = 0;
-        ByteBuffer buffer = ByteBuffer.allocate(4096);
-        for (CpioHeader header : contents.headers()) {
-            if ((header.getFlags() & Directive.GHOST.flag()) == Directive.GHOST.flag()) {
-                continue;
-            }
-            String path = header.getName();
-            if (path.startsWith("/")) {
-                header.setName("." + path);
-            }
-            total = header.write(compressedOutput, total);
-            Object object = contents.getSource(header);
-            if (object instanceof Path) {
-                try (ReadableByteChannel readableByteChannel = Files.newByteChannel((Path) object)) {
-                    while (readableByteChannel.read(buffer.rewind()) > 0) {
-                        total += compressedOutput.write(buffer.flip());
-                        buffer.compact();
-                    }
-                    total += header.skip(compressedOutput, total);
-                }
-            } else if (object instanceof InputStream) {
-                try (ReadableByteChannel in = Channels.newChannel(((InputStream) object))) {
-                    while (in.read(buffer.rewind()) > 0) {
-                        total += compressedOutput.write(buffer.flip());
-                        buffer.compact();
-                    }
-                    total += header.skip(compressedOutput, total);
-                }
-            } else if (object instanceof URL) {
-                try (ReadableByteChannel in = Channels.newChannel(((URL) object).openConnection().getInputStream())) {
-                    while (in.read(buffer.rewind()) > 0) {
-                        total += compressedOutput.write(buffer.flip());
-                        buffer.compact();
-                    }
-                    total += header.skip(compressedOutput, total);
-                }
-            } else if (object != null) {
-                String string = object.toString();
-                total += compressedOutput.write(ByteBuffer.wrap(string.getBytes(StandardCharsets.UTF_8)));
-                total += header.skip(compressedOutput, string.length());
-            }
-        }
-        CpioHeader trailer = new CpioHeader();
-        trailer.setLast();
-        total = trailer.write(compressedOutput, total);
-        trailer.skip(compressedOutput, total);
-        int length = compressedOutput.finish(payloadkey);
-        int pad = difference(length, 3);
-        ChannelWrapper.empty(compressedOutput, ByteBuffer.allocate(pad));
-        length += pad;
-        signaturHeaderPayloadEntry.setValues(IntegerList.of(length));
-        // flush compressed stream here
-        compressedOutputStream.flush();
         md5Entry.setValues(output.finish(md5key));
         sigsize.setValues(IntegerList.of(output.finish(sigsizekey)));
         signatureGenerator.finishAfterPayload(output);
@@ -1321,6 +1271,68 @@ public class RpmBuilder {
         return outputStream;
     }
 
+    private int processPayload(OutputStream outputStream) throws IOException {
+        OutputStream compressedOutputStream = createCompressedStream(outputStream);
+        WritableChannelWrapper compressedOutput = new WritableChannelWrapper(Channels.newChannel(compressedOutputStream));
+        ChannelWrapper.Key<Integer> payloadkey = compressedOutput.startCount();
+        int total = 0;
+        ByteBuffer buffer = ByteBuffer.allocate(4096);
+        for (CpioHeader header : contents.headers()) {
+            if ((header.getFlags() & Directive.GHOST.flag()) == Directive.GHOST.flag()) {
+                continue;
+            }
+            String path = header.getName();
+            if (path.startsWith("/")) {
+                header.setName("." + path);
+            }
+            total = header.write(compressedOutput, total);
+            Object object = contents.getSource(header);
+            if (object instanceof Path) {
+                try (ReadableByteChannel readableByteChannel = Files.newByteChannel((Path) object)) {
+                    while (readableByteChannel.read(buffer.rewind()) > 0) {
+                        ByteBuffer byteBuffer = buffer.flip();
+                        total += compressedOutput.write(byteBuffer);
+                        buffer.compact();
+                    }
+                    total += header.skip(compressedOutput, total);
+                }
+            } else if (object instanceof InputStream) {
+                try (ReadableByteChannel in = Channels.newChannel(((InputStream) object))) {
+                    while (in.read(buffer.rewind()) > 0) {
+                        ByteBuffer byteBuffer = buffer.flip();
+                        total += compressedOutput.write(byteBuffer);
+                        buffer.compact();
+                    }
+                    total += header.skip(compressedOutput, total);
+                }
+            } else if (object instanceof URL) {
+                try (ReadableByteChannel in = Channels.newChannel(((URL) object).openConnection().getInputStream())) {
+                    while (in.read(buffer.rewind()) > 0) {
+                        ByteBuffer byteBuffer = buffer.flip();
+                        total += compressedOutput.write(byteBuffer);
+                        buffer.compact();
+                    }
+                    total += header.skip(compressedOutput, total);
+                }
+            } else if (object != null) {
+                String string = object.toString();
+                ByteBuffer byteBuffer = ByteBuffer.wrap(string.getBytes(StandardCharsets.UTF_8));
+                total += compressedOutput.write(byteBuffer);
+                total += header.skip(compressedOutput, string.length());
+            }
+        }
+        CpioHeader trailer = new CpioHeader();
+        trailer.setLast();
+        total = trailer.write(compressedOutput, total);
+        trailer.skip(compressedOutput, total);
+        int length = compressedOutput.finish(payloadkey);
+        int pad = difference(length, 3);
+        ChannelWrapper.empty(compressedOutput, ByteBuffer.allocate(pad));
+        length += pad;
+        compressedOutputStream.flush();
+        return length;
+    }
+
     /**
      * Return the content of the specified script file as a String.
      *

rpm-core/src/main/java/org/xbib/rpm/RpmReader.java

@@ -133,17 +133,17 @@ public class RpmReader {
      */
     public Format readHeader(ReadableChannelWrapper channelWrapper) throws IOException {
         Format format = new Format();
-        ChannelWrapper.Key<Integer> headerStartKey = channelWrapper.start();
+        ChannelWrapper.Key<Integer> headerStartKey = channelWrapper.startCount();
-        ChannelWrapper.Key<Integer> lead = channelWrapper.start();
+        ChannelWrapper.Key<Integer> lead = channelWrapper.startCount();
         format.getLead().read(channelWrapper);
-        ChannelWrapper.Key<Integer> signature = channelWrapper.start();
+        ChannelWrapper.Key<Integer> signature = channelWrapper.startCount();
         int count = format.getSignatureHeader().read(channelWrapper);
         SpecEntry<?> sigEntry = format.getSignatureHeader().getEntry(SignatureTag.SIGNATURES);
         int expected = sigEntry == null ? 0 :
                 ByteBuffer.wrap((byte[]) sigEntry.getValues(), 8, 4).getInt() / -16;
         Integer headerStartPos = channelWrapper.finish(headerStartKey);
         format.getHeader().setStartPos(headerStartPos);
-        ChannelWrapper.Key<Integer> headerKey = channelWrapper.start();
+        ChannelWrapper.Key<Integer> headerKey = channelWrapper.startCount();
         count = format.getHeader().read(channelWrapper);
         SpecEntry<?> immutableEntry = format.getHeader().getEntry(HeaderTag.HEADERIMMUTABLE);
         expected = immutableEntry == null ? 0 :

rpm-core/src/main/java/org/xbib/rpm/header/HeaderTag.java

@@ -96,7 +96,14 @@ public enum HeaderTag implements EntryType {
     OBSOLETEVERSION(1115, STRING_LIST_ENTRY, StringList.class, "obsoleteversion"),
     FILEDIGESTALGOS(1177, INT32_ENTRY, IntegerList.class, "filedigestalgos"),
     SIGNATURES(0x0000003e, INT32_ENTRY, IntegerList.class, "_signatures"),
-    IMMUTABLE(0x0000003f, INT32_ENTRY, IntegerList.class, "_immutable");
+    IMMUTABLE(0x0000003f, INT32_ENTRY, IntegerList.class, "_immutable"),
+    DISTURL( 1123, STRING_ENTRY, String.class,"disturl"),
+    DISTTAG( 1155, STRING_ENTRY,  String.class,"disttag"),
+    BUGURL( 5012, STRING_ENTRY, String.class,"bugurl"),
+    ENCODING( 5062, STRING_ENTRY, String.class,"encoding"),
+    PAYLOADDIGEST( 5092, STRING_LIST_ENTRY, StringList.class,"payloaddigest"),
+    PAYLOADDIGESTALGO( 5093, INT32_ENTRY,  IntegerList.class,"payloaddigestalgo"),
+    PAYLOADDIGESTALT( 5097, STRING_LIST_ENTRY,  StringList.class, "payloaddigestalt");
 
     private final int code;
 

rpm-core/src/main/java/org/xbib/rpm/io/ChannelWrapper.java

@@ -5,6 +5,7 @@ import java.nio.BufferUnderflowException;
 import java.nio.ByteBuffer;
 import java.nio.channels.ReadableByteChannel;
 import java.nio.channels.WritableByteChannel;
+import java.security.MessageDigest;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -17,41 +18,20 @@ public abstract class ChannelWrapper {
 
     final Map<Key<?>, Consumer<?>> consumers = new HashMap<>();
 
-    public Key<Integer> start(WritableByteChannel output) {
-        Key<Integer> object = new Key<>();
-        consumers.put(object, new Consumer<Integer>() {
-            int count;
-
-            @Override
-            public void consume(ByteBuffer buffer) {
-                try {
-                    count += output.write(buffer);
-                } catch (IOException e) {
-                    throw new RuntimeException(e);
-                }
-            }
-
-            @Override
-            public Integer finish() {
-                return count;
-            }
-        });
-        return object;
-    }
-
     /**
      * Initializes a byte counter on this channel.
      *
      * @return reference to the new key added to the consumers
      */
-    public Key<Integer> start() {
+    public Key<Integer> startCount() {
         Key<Integer> object = new Key<>();
         consumers.put(object, new Consumer<Integer>() {
             int count;
 
             @Override
             public void consume(ByteBuffer buffer) {
-                count += buffer.remaining();
+                int c = buffer.remaining();
+                count += c;
             }
 
             @Override
@@ -68,7 +48,7 @@ public abstract class ChannelWrapper {
      * @param consumer the channel consumer
      * @return reference to the new key added to the consumers
      */
-    public Key<byte[]> start(Consumer<byte[]> consumer) {
+    public Key<byte[]> startCount(Consumer<byte[]> consumer) {
         Key<byte[]> object = new Key<>();
         consumers.put(object, consumer);
         return object;

rpm-core/src/main/java/org/xbib/rpm/payload/Contents.java

@@ -1,6 +1,5 @@
 package org.xbib.rpm.payload;
 
-import org.xbib.rpm.exception.RpmException;
 import org.xbib.rpm.header.IntegerList;
 import org.xbib.rpm.header.ShortList;
 import org.xbib.rpm.header.StringList;
@@ -508,10 +507,10 @@ public class Contents {
      *
      * @param hashAlgo the hash algo
      * @return the digest hashes
-     * @throws RpmException if the algorithm isn't supported
+     * @throws NoSuchAlgorithmException if the algorithm isn't supported
      * @throws IOException there was an IO error
      */
-    public StringList getDigests(HashAlgo hashAlgo) throws IOException, RpmException {
+    public StringList getDigests(HashAlgo hashAlgo) throws IOException, NoSuchAlgorithmException {
         ByteBuffer buffer = ByteBuffer.allocate(4096);
         StringList array = new StringList();
         for (CpioHeader header : headers) {
@@ -525,8 +524,6 @@ public class Contents {
                             buffer.rewind();
                         }
                         value = hex(input.finish(key));
-                    } catch (NoSuchAlgorithmException e) {
-                        throw new RpmException(e);
                     }
                 }
             } else if (object instanceof URL) {
@@ -540,8 +537,6 @@ public class Contents {
                             }
                             value = hex(input.finish(key));
                         }
-                    } catch (NoSuchAlgorithmException e) {
-                        throw new RpmException(e);
                     }
                 }
             }
@@ -576,7 +571,7 @@ public class Contents {
                 }
             }
         };
-        return input.start(consumer);
+        return input.startCount(consumer);
     }
 
     /**

rpm-core/src/main/java/org/xbib/rpm/security/HashAlgo.java

@@ -4,7 +4,6 @@ package org.xbib.rpm.security;
 /**
  * Enumeration of hash algorithms as of RFC 4880.
  *
- * See also {@link org.bouncycastle.bcpg.HashAlgorithmTags}
  */
 public enum HashAlgo {
 

rpm-core/src/main/java/org/xbib/rpm/security/SignatureGenerator.java

@@ -26,7 +26,6 @@ import java.io.InputStream;
 import java.nio.ByteBuffer;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.security.SignatureException;
 import java.util.Iterator;
 
 /**
@@ -75,8 +74,8 @@ public class SignatureGenerator {
     public void startBeforeHeader(WritableChannelWrapper output, HashAlgo algo) throws RpmException {
         if (enabled) {
             try {
-                headerOnlyKey = output.start(new SignatureConsumer(algo.num()));
+                headerOnlyKey = output.startCount(new SignatureConsumer(algo.num()));
-                headerAndPayloadKey = output.start(new SignatureConsumer(algo.num()));
+                headerAndPayloadKey = output.startCount(new SignatureConsumer(algo.num()));
             } catch (PGPException e) {
                 throw new RpmException(e);
             }
@@ -113,7 +112,7 @@ public class SignatureGenerator {
                     }
                 }
             };
-            return output.start(consumer);
+            return output.startCount(consumer);
         } catch (NoSuchAlgorithmException e) {
             throw new RpmException(e);
         }
@@ -199,7 +198,7 @@ public class SignatureGenerator {
             int keyAlgorithm = privateKey.getPublicKeyPacket().getAlgorithm();
             BcPGPContentSignerBuilder contentSignerBuilder =
                     new BcPGPContentSignerBuilder(keyAlgorithm, hashAlgorithm);
-            this.pgpSignatureGenerator = new PGPSignatureGenerator(contentSignerBuilder);
+            pgpSignatureGenerator = new PGPSignatureGenerator(contentSignerBuilder);
             pgpSignatureGenerator.init(PGPSignature.BINARY_DOCUMENT, privateKey);
         }
 

rpm-core/src/main/java/org/xbib/rpm/signature/SignatureTag.java

@@ -23,7 +23,7 @@ public enum SignatureTag implements EntryType {
     LONGSIGSIZE(270, INT64_ENTRY, "longsigsize"),
     LONGARCHIVESIZE(271, INT64_ENTRY, "longarchivesize"),
     // 272 is reserved
-    SHA256(273, BIN_ENTRY, "sha256"),
+    SHA256HEADER(273, STRING_ENTRY, "sha256header"),
 
     LEGACY_SIGSIZE(1000, INT32_ENTRY, "sigsize"),
     LEGACY_PGP(1002, BIN_ENTRY, "pgp"),

rpm-core/src/test/java/org/xbib/rpm/security/SignatureGeneratorTest.java

@@ -1,42 +1,34 @@
 package org.xbib.rpm.security;
 
 import static org.junit.jupiter.api.Assertions.assertTrue;
-import org.bouncycastle.openpgp.PGPException;
 import org.junit.jupiter.api.Test;
 import org.xbib.rpm.RpmBuilder;
-import org.xbib.rpm.exception.RpmException;
 import org.xbib.rpm.lead.Architecture;
 import org.xbib.rpm.lead.Os;
 import org.xbib.rpm.lead.PackageType;
 import org.xbib.rpm.payload.Directive;
-import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 import java.util.EnumSet;
 
-/**
- *
- */
 public class SignatureGeneratorTest {
 
     @Test
     public void testReadingFirstKey() {
-        SignatureGenerator generator =
+        SignatureGenerator generator = new SignatureGenerator(getClass().getResourceAsStream("/pgp/test-secring.gpg"),
-                new SignatureGenerator(getClass().getResourceAsStream("/pgp/test-secring.gpg"),
                         null, "test");
         assertTrue(generator.isEnabled());
     }
 
     @Test
     public void testFindByKey() {
-        SignatureGenerator generator =
+        SignatureGenerator generator = new SignatureGenerator(getClass().getResourceAsStream("/pgp/test-secring.gpg"),
-                new SignatureGenerator(getClass().getResourceAsStream("/pgp/test-secring.gpg"),
                         0xF02C6D2CL, "test");
         assertTrue(generator.isEnabled());
     }
 
     @Test
-    public void testBuildWithTestSignature() throws IOException, PGPException, RpmException {
+    public void testBuildWithTestSignature() throws Exception {
         String pubRing = "build/test-pubring.gpg";
         String secRing = "build/test-secring.gpg";
         String id = "test@example.com";
@@ -71,17 +63,23 @@ public class SignatureGeneratorTest {
     }
 
     @Test
-    public void testBuildWithSignature() throws IOException, RpmException {
+    public void testBuildWithSignature() throws Exception {
-        String secRing = "src/test/resources/pgp/test-secring.gpg";
+        //String secRing = "src/test/resources/pgp/test-secring.gpg";
-        String pass = "test";
+        //String pass = "test";
+        String secRing = "/home/joerg/.gnupg/secring.gpg";
+        String pass = "jhbz2011";
         RpmBuilder rpmBuilder = new RpmBuilder();
         rpmBuilder.setPackage("signing-test", "1.0", "3");
         rpmBuilder.setBuildHost("localhost");
         rpmBuilder.setLicense("GPL");
         rpmBuilder.setPlatform(Architecture.NOARCH, Os.LINUX);
         rpmBuilder.setType(PackageType.BINARY);
+        rpmBuilder.setPrivateKeyHashAlgo("SHA256");
         rpmBuilder.setPrivateKeyRing(Files.newInputStream(Paths.get(secRing)));
         rpmBuilder.setPrivateKeyPassphrase(pass);
+        EnumSet<Directive> directives = EnumSet.of(Directive.CONFIG, Directive.DOC, Directive.NOREPLACE);
+        rpmBuilder.addFile("/etc", Paths.get("src/test/resources/prein.sh"), 493, 493,
+                directives, "jabberwocky", "vorpal", true);
         rpmBuilder.build(Paths.get("build"));
     }
 }

rpm-core/src/test/java/org/xbib/rpm/security/SignatureReaderTest.java

@@ -9,9 +9,6 @@ import org.xbib.rpm.signature.SignatureTag;
 
 import java.nio.file.Paths;
 
-/**
- *
- */
 public class SignatureReaderTest {
 
     @Test

settings.gradle

@@ -2,5 +2,7 @@ rootProject.name = name
 
 include 'rpm-core'
 include 'rpm-ant'
-include 'maven-plugin-rpm'
+// gradle plugin moved to antoher repository
-include 'gradle-plugin-rpm'
+//include 'gradle-plugin-rpm'
+// maven plugin was removed in gradle
+//include 'maven-plugin-rpm'