Index: trunk/src/org/openstreetmap/josm/io/CertificateAmendment.java =================================================================== --- trunk/src/org/openstreetmap/josm/io/CertificateAmendment.java (revision 13449) +++ trunk/src/org/openstreetmap/josm/io/CertificateAmendment.java (revision 13450) @@ -5,5 +5,4 @@ import java.io.ByteArrayInputStream; -import java.io.File; import java.io.IOException; import java.io.InputStream; @@ -49,21 +48,11 @@ * @since 11943 */ - public static class CertAmend { - private final String id; + public abstract static class CertAmend { private final String filename; private final String sha256; - CertAmend(String id, String filename, String sha256) { - this.id = id; - this.filename = filename; - this.sha256 = sha256; - } - - /** - * Returns the certificate identifier. - * @return path for JOSM embedded certificate, alias for Windows platform certificate - */ - public final String getId() { - return id; + CertAmend(String filename, String sha256) { + this.filename = Objects.requireNonNull(filename); + this.sha256 = Objects.requireNonNull(sha256); } @@ -87,8 +76,74 @@ /** + * An embedded certificate amendment. + * @since 13450 + */ + public static class EmbeddedCertAmend extends CertAmend { + private final String url; + + EmbeddedCertAmend(String url, String filename, String sha256) { + super(filename, sha256); + this.url = Objects.requireNonNull(url); + } + + /** + * Returns the embedded URL in JOSM jar. + * @return path for JOSM embedded certificate + */ + public final String getUrl() { + return url; + } + + @Override + public String toString() { + return url; + } + } + + /** + * A certificate amendment relying on native platform certificate store. + * @since 13450 + */ + public static class NativeCertAmend extends CertAmend { + private final String winAlias; + private final String macAlias; + + NativeCertAmend(String winAlias, String macAlias, String filename, String sha256) { + super(filename, sha256); + this.winAlias = Objects.requireNonNull(winAlias); + this.macAlias = Objects.requireNonNull(macAlias); + } + + /** + * Returns the Windows alias in System Root Certificates keystore. + * @return the Windows alias in System Root Certificates keystore + */ + public final String getWinAlias() { + return winAlias; + } + + /** + * Returns the macOS alias in System Root Certificates keychain. + * @return the macOS alias in System Root Certificates keychain + */ + public final String getMacAlias() { + return macAlias; + } + + @Override + public String toString() { + String result = winAlias; + if (!winAlias.equals(macAlias)) { + result += " / " + macAlias; + } + return result; + } + } + + /** * Certificates embedded in JOSM */ - private static final CertAmend[] CERT_AMEND = { - new CertAmend("resource://data/security/DST_Root_CA_X3.pem", "DST_Root_CA_X3.pem", + private static final EmbeddedCertAmend[] CERT_AMEND = { + new EmbeddedCertAmend("resource://data/security/DST_Root_CA_X3.pem", "DST_Root_CA_X3.pem", "0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739") }; @@ -96,15 +151,17 @@ /** * Certificates looked into platform native keystore and not embedded in JOSM. - * Identifiers must match Windows keystore aliases and Unix filenames for efficient search. - */ - private static final CertAmend[] PLATFORM_CERT_AMEND = { + * Identifiers must match Windows/macOS keystore aliases and Unix filenames for efficient search. + */ + private static final NativeCertAmend[] PLATFORM_CERT_AMEND = { // Government of Netherlands - new CertAmend("Staat der Nederlanden Root CA - G2", "Staat_der_Nederlanden_Root_CA_-_G2.crt", + new NativeCertAmend("Staat der Nederlanden Root CA - G2", "Staat der Nederlanden Root CA - G2", + "Staat_der_Nederlanden_Root_CA_-_G2.crt", "668c83947da63b724bece1743c31a0e6aed0db8ec5b31be377bb784f91b6716f"), // Government of Netherlands - new CertAmend("Government of Netherlands G3", "Staat_der_Nederlanden_Root_CA_-_G3.crt", + new NativeCertAmend("Government of Netherlands G3", "Staat der Nederlanden Root CA - G3", + "Staat_der_Nederlanden_Root_CA_-_G3.crt", "3c4fb0b95ab8b30032f432b86f535fe172c185d0fd39865837cf36187fa6f428"), // Trusted and used by French Government - https://www.certigna.fr/autorites/index.xhtml?ac=Racine#lracine - new CertAmend("Certigna", "Certigna.crt", + new NativeCertAmend("Certigna", "Certigna", "Certigna.crt", "e3b6a2db2ed7ce48842f7ac53241c7b71d54144bfb40c11f3f1d0b42f5eea12d"), }; @@ -132,6 +189,6 @@ boolean certificateAdded = false; // Add embedded certificates. Exit in case of error - for (CertAmend certAmend : CERT_AMEND) { - try (CachedFile certCF = new CachedFile(certAmend.id)) { + for (EmbeddedCertAmend certAmend : CERT_AMEND) { + try (CachedFile certCF = new CachedFile(certAmend.url)) { X509Certificate cert = (X509Certificate) cf.generateCertificate( new ByteArrayInputStream(certCF.getByteContent())); @@ -144,5 +201,5 @@ try { // Try to add platform certificates. Do not exit in case of error (embedded certificates may be OK) - for (CertAmend certAmend : PLATFORM_CERT_AMEND) { + for (NativeCertAmend certAmend : PLATFORM_CERT_AMEND) { X509Certificate cert = Main.platform.getX509Certificate(certAmend); if (checkAndAddCertificate(md, cert, certAmend, keyStore)) { @@ -170,5 +227,5 @@ throw new IllegalStateException( tr("Error adding certificate {0} - certificate fingerprint mismatch. Expected {1}, was {2}", - certAmend.id, certAmend.sha256, sha256)); + certAmend, certAmend.sha256, sha256)); } if (certificateIsMissing(keyStore, cert)) { @@ -176,5 +233,5 @@ Logging.debug(tr("Adding certificate for TLS connections: {0}", cert.getSubjectX500Principal().getName())); } - String alias = "josm:" + new File(certAmend.id).getName(); + String alias = "josm:" + certAmend.filename; keyStore.setCertificateEntry(alias, cert); return true; Index: trunk/src/org/openstreetmap/josm/tools/PlatformHook.java =================================================================== --- trunk/src/org/openstreetmap/josm/tools/PlatformHook.java (revision 13449) +++ trunk/src/org/openstreetmap/josm/tools/PlatformHook.java (revision 13450) @@ -20,5 +20,5 @@ import org.openstreetmap.josm.data.projection.datum.NTV2Proj4DirGridShiftFileSource; -import org.openstreetmap.josm.io.CertificateAmendment.CertAmend; +import org.openstreetmap.josm.io.CertificateAmendment.NativeCertAmend; import org.openstreetmap.josm.spi.preferences.Config; import org.openstreetmap.josm.tools.date.DateUtils; @@ -211,7 +211,7 @@ * @throws CertificateException in case of error * @throws NoSuchAlgorithmException in case of error - * @since 11943 - */ - default X509Certificate getX509Certificate(CertAmend certAmend) + * @since 13450 + */ + default X509Certificate getX509Certificate(NativeCertAmend certAmend) throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException { return null; Index: trunk/src/org/openstreetmap/josm/tools/PlatformHookOsx.java =================================================================== --- trunk/src/org/openstreetmap/josm/tools/PlatformHookOsx.java (revision 13449) +++ trunk/src/org/openstreetmap/josm/tools/PlatformHookOsx.java (revision 13450) @@ -8,4 +8,5 @@ import java.awt.Window; import java.awt.event.KeyEvent; +import java.io.ByteArrayInputStream; import java.io.File; import java.io.IOException; @@ -14,11 +15,19 @@ import java.lang.reflect.Method; import java.lang.reflect.Proxy; +import java.nio.charset.StandardCharsets; +import java.security.KeyStoreException; +import java.security.NoSuchAlgorithmException; +import java.security.cert.CertificateException; +import java.security.cert.CertificateFactory; +import java.security.cert.X509Certificate; import java.util.Arrays; import java.util.List; import java.util.Objects; +import java.util.concurrent.ExecutionException; import javax.swing.UIManager; import org.openstreetmap.josm.Main; +import org.openstreetmap.josm.io.CertificateAmendment.NativeCertAmend; /** @@ -427,3 +436,18 @@ Main.pref.getJOSMDirectoryBaseName()); } + + @Override + public X509Certificate getX509Certificate(NativeCertAmend certAmend) + throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException { + try { + // Get platform certificate in PEM format + String pem = Utils.execOutput(Arrays.asList("security", "find-certificate", + "-c", certAmend.getMacAlias(), "-p", "/System/Library/Keychains/SystemRootCertificates.keychain")); + Logging.debug(pem); + return (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate( + new ByteArrayInputStream(pem.getBytes(StandardCharsets.UTF_8))); + } catch (ExecutionException | InterruptedException | IllegalArgumentException e) { + throw new IOException(e); + } + } } Index: trunk/src/org/openstreetmap/josm/tools/PlatformHookUnixoid.java =================================================================== --- trunk/src/org/openstreetmap/josm/tools/PlatformHookUnixoid.java (revision 13449) +++ trunk/src/org/openstreetmap/josm/tools/PlatformHookUnixoid.java (revision 13450) @@ -26,5 +26,5 @@ import org.openstreetmap.josm.Main; -import org.openstreetmap.josm.io.CertificateAmendment.CertAmend; +import org.openstreetmap.josm.io.CertificateAmendment.NativeCertAmend; import org.openstreetmap.josm.spi.preferences.Config; @@ -398,5 +398,5 @@ @Override - public X509Certificate getX509Certificate(CertAmend certAmend) + public X509Certificate getX509Certificate(NativeCertAmend certAmend) throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException { File f = new File("/usr/share/ca-certificates/mozilla", certAmend.getFilename()); Index: trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java =================================================================== --- trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java (revision 13449) +++ trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java (revision 13450) @@ -71,5 +71,5 @@ import org.openstreetmap.josm.data.StructUtils.StructEntry; import org.openstreetmap.josm.data.StructUtils.WriteExplicitly; -import org.openstreetmap.josm.io.CertificateAmendment.CertAmend; +import org.openstreetmap.josm.io.CertificateAmendment.NativeCertAmend; import org.openstreetmap.josm.spi.preferences.Config; @@ -439,9 +439,9 @@ @Override - public X509Certificate getX509Certificate(CertAmend certAmend) + public X509Certificate getX509Certificate(NativeCertAmend certAmend) throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException { KeyStore ks = getRootKeystore(); // Search by alias (fast) - Certificate result = ks.getCertificate(certAmend.getId()); + Certificate result = ks.getCertificate(certAmend.getWinAlias()); if (result instanceof X509Certificate) { return (X509Certificate) result; Index: trunk/src/org/openstreetmap/josm/tools/Utils.java =================================================================== --- trunk/src/org/openstreetmap/josm/tools/Utils.java (revision 13449) +++ trunk/src/org/openstreetmap/josm/tools/Utils.java (revision 13450) @@ -847,6 +847,6 @@ all = new StringBuilder(line); } else { - all.append('\n'); - all.append(line); + all.append('\n') + .append(line); } }