SCAN4NET-227 Use system trusted certificate or JVM certificate store #2330

sebastien-marichal · 2025-02-19T16:58:16Z

martin-strecker-sonarsource

Looks good for me and should do the trick. I left some small comments but overall this looks promising.

martin-strecker-sonarsource · 2025-02-19T17:58:27Z

....PreProcessor.Test/AnalysisConfigProcessing/Processors/TruststorePropertiesProcessorTests.cs


        // Act
        processor.Update(config);

        // Assert
        config.LocalSettings.Should().ContainSingle(x => x.Id == SonarProperties.TruststorePassword && x.Value == input);
-        config.ScannerOptsSettings.Should().ContainSingle();
+        config.ScannerOptsSettings.Should().HaveCount(2);
+        AssertExpectedScannerOptsSettings("javax.net.ssl.trustStore", javaHomeCacerts.Replace(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar), config);
        AssertExpectedScannerOptsSettings("javax.net.ssl.trustStorePassword", expected, config);


You could additionally assert that fileWrapper.Exists(javaHomeCacerts) was called once.

martin-strecker-sonarsource · 2025-02-19T18:00:18Z

....PreProcessor.Test/AnalysisConfigProcessing/Processors/TruststorePropertiesProcessorTests.cs

+        var config = new AnalysisConfig { LocalSettings = [] };
+        using var envScope = new EnvironmentVariableScope();
+        envScope.SetVariable("JAVA_HOME", javaHome);
+        envScope.SetVariable("SONAR_SCANNER_OPTS", "-Djavax.net.ssl.trustStorePassword=itchange");


What happens if we also set another property here, e.g. -Xmx2048m?

martin-strecker-sonarsource · 2025-02-19T18:04:35Z

...er.MSBuild.PreProcessor/AnalysisConfigProcessing/Processors/TruststorePropertiesProcessor.cs

-        MapProperty(config, "javax.net.ssl.trustStore", PropertyValueOrDefault(SonarProperties.TruststorePath, LocalSettings.TruststorePath), ConvertToJavaPath, EnsureSurroundedByQuotes);
-        var password = PropertyValueOrDefault(SonarProperties.TruststorePassword, LocalSettings.TruststorePassword);
-        MapProperty(config, "javax.net.ssl.trustStorePassword", password, EnsureSurroundedByQuotes);
+        if (new Uri(LocalSettings.ServerInfo.ServerUrl).Scheme != "https"


This constructor throws. Consider using TryCreate(url, UriKind.Absolute, out var uri) instead.

martin-strecker-sonarsource · 2025-02-19T18:06:23Z

...er.MSBuild.PreProcessor/AnalysisConfigProcessing/Processors/TruststorePropertiesProcessor.cs

-        MapProperty(config, "javax.net.ssl.trustStore", PropertyValueOrDefault(SonarProperties.TruststorePath, LocalSettings.TruststorePath), ConvertToJavaPath, EnsureSurroundedByQuotes);
-        var password = PropertyValueOrDefault(SonarProperties.TruststorePassword, LocalSettings.TruststorePassword);
-        MapProperty(config, "javax.net.ssl.trustStorePassword", password, EnsureSurroundedByQuotes);
+        if (new Uri(LocalSettings.ServerInfo.ServerUrl).Scheme != "https"


Suggested change

if (new Uri(LocalSettings.ServerInfo.ServerUrl).Scheme != "https"

if (new Uri(LocalSettings.ServerInfo.ServerUrl).Scheme != Uri.UriSchemeHttps

martin-strecker-sonarsource · 2025-02-19T18:09:40Z

...er.MSBuild.PreProcessor/AnalysisConfigProcessing/Processors/TruststorePropertiesProcessor.cs

+            return null;
+        }
+
+        return sonarScannerOpts.Split(' ').FirstOrDefault(x => x.StartsWith($"-D{JAVAX_NET_SSL_TRUST_STORE_PASSWORD}=")) is { } truststorePassword


I think it is safe to specify StringComparison.OrdinalIgnoreCase:

Suggested change

return sonarScannerOpts.Split(' ').FirstOrDefault(x => x.StartsWith($"-D{JAVAX_NET_SSL_TRUST_STORE_PASSWORD}=")) is { } truststorePassword

return sonarScannerOpts.Split(' ').FirstOrDefault(x => x.StartsWith($"-D{JAVAX_NET_SSL_TRUST_STORE_PASSWORD}=", StringComparison.OrdinalIgnoreCase)) is { } truststorePassword

I am not sure, I think the properties are case sensitive.
During my test I made several times the mistake of writing down the javax properties like truststore instead of trustStore.

martin-strecker-sonarsource · 2025-02-19T18:10:35Z

...er.MSBuild.PreProcessor/AnalysisConfigProcessing/Processors/TruststorePropertiesProcessor.cs

+        var javaHome = Environment.GetEnvironmentVariable("JAVA_HOME");
+        if (javaHome is null)
+        {
+            // TODO: propagate the error?


I don't think so. A debug log should be enough.

It will not fail before the end step then.

If the JRE provisioning is enabled, JAVA_HOME does not have to be set. There might be cases where the provisioned JRE trusts the server anyhow. The JRE comes with a default set of CA roots. If we fail it here, it would break https servers with a proper purchased certificate or one from https://letsencrypt.org/
Or am I miss something here?

If this is from letsencrypt, it should be trusted without giving a store.
My understanding of purchased certificates is that you don't need to provide a truststore as they should be valid from some public CA.

I would be for failing the execution to follow the fail fast principle but I am not 100% sure that in this case there is no scenario where it would work.

The scenario is:

JRE provisioning is enabled and executed

JAVA_HOME is not set

The server is providing a certificate from a CA root trusted by the provisioned JRE (e.g. Let's Encrypt, Digi Cert, etc.)

The user doesn't specify anything (truststorePath is null)

We are on Linux

FindJavaTruststorePath is called

-> We would fail the begin step, even though everything would just work.

Can we safely assume that the cacerts of JAVA_HOME would be the same the one from the provisioned JRE?

If we take the same scenario with JAVA_HOME set, we will tell the provisioned JRE to use the local cacerts rather that the one download. I wonder if there is a possibility for the scenario to succeed with one and not the other where in theory it should succeed with both.

The root ca certs change on a regular basis (see e.g. here https://learn.microsoft.com/en-us/security/trusted-root/release-notes). It is likely that we will have different CA roots in both locations.

Note: I think this is a problem the scanner-cli may have as well.

Also: As a user, you can install custom root CAs in your JAVA_HOME, but you can not install root CAs in the provisioned JRE. Therefore, we should prefer JAVA_HOME over the provisioned JRE.

Sounds good to me, I will only do a log.

martin-strecker-sonarsource · 2025-02-19T18:11:14Z

...er.MSBuild.PreProcessor/AnalysisConfigProcessing/Processors/TruststorePropertiesProcessor.cs

+            return null;
+        }
+
+        var javaTruststorePath = Path.Combine(javaHome, "lib", "security", "cacerts");


Please add a link to some kind of documentation or ticket about the source of these path.

martin-strecker-sonarsource · 2025-02-19T18:17:09Z

src/SonarScanner.MSBuild.PreProcessor/WebClientDownloaderBuilder.cs

@@ -131,6 +131,7 @@ private static bool ServerCertificateCustomValidationCallback(X509Certificate2Co
    {
        if (errors is SslPolicyErrors.None)
        {
+            logger.LogWarning(Resources.WARN_CertificateTrustedBySystem);


The remote server certificate is trusted by the operating system. Provided truststore was not required.

If this is issued as a warning, it sounds like the command line argument can be removed from the begin step call. Is this always true? I know we set JAVAX_NET_SSL_TRUST_STORE_TYPE=Windows-ROOT but is this always working as intended. And what about Linux, here? I would turn this into a debug message. It does no harm if the user specified the file, right?
I would also remove this part: Provided truststore was not required.

I will update the message. I think it is important to keep in the message that a truststore has been provided to have context.
Something like: Provided truststore was not used.

sonarqubecloud · 2025-02-21T14:28:40Z

Quality Gate failed

Failed conditions
6 New issues

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

SCAN4NET-227 Use system trusted certificate or JVM certificate store

b702ab9

martin-strecker-sonarsource requested changes Feb 19, 2025

View reviewed changes

sebastien-marichal added 2 commits February 20, 2025 11:40

Addressing comment, add UTs & ITs

e987ee6

More ITs & code smells

ff0a12d

sebastien-marichal force-pushed the sma/cert-fallback branch from 1068943 to 70e2345 Compare February 21, 2025 15:20

Add JreTruststoreResolver

7bb1f16

sebastien-marichal force-pushed the sma/cert-fallback branch from 70e2345 to 7bb1f16 Compare February 21, 2025 16:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SCAN4NET-227 Use system trusted certificate or JVM certificate store #2330

SCAN4NET-227 Use system trusted certificate or JVM certificate store #2330

sebastien-marichal commented Feb 19, 2025 •

edited by jira bot

Loading

martin-strecker-sonarsource left a comment

martin-strecker-sonarsource Feb 19, 2025

martin-strecker-sonarsource Feb 19, 2025

martin-strecker-sonarsource Feb 19, 2025

martin-strecker-sonarsource Feb 19, 2025

martin-strecker-sonarsource Feb 19, 2025

sebastien-marichal Feb 20, 2025 •

edited

Loading

martin-strecker-sonarsource Feb 19, 2025

sebastien-marichal Feb 20, 2025

martin-strecker-sonarsource Feb 20, 2025

sebastien-marichal Feb 20, 2025

martin-strecker-sonarsource Feb 20, 2025

sebastien-marichal Feb 20, 2025

martin-strecker-sonarsource Feb 20, 2025

martin-strecker-sonarsource Feb 20, 2025

martin-strecker-sonarsource Feb 20, 2025 •

edited

Loading

sebastien-marichal Feb 20, 2025

martin-strecker-sonarsource Feb 19, 2025

martin-strecker-sonarsource Feb 19, 2025

sebastien-marichal Feb 20, 2025

sonarqubecloud bot commented Feb 21, 2025

	if (new Uri(LocalSettings.ServerInfo.ServerUrl).Scheme != "https"
	if (new Uri(LocalSettings.ServerInfo.ServerUrl).Scheme != Uri.UriSchemeHttps

	return sonarScannerOpts.Split(' ').FirstOrDefault(x => x.StartsWith($"-D{JAVAX_NET_SSL_TRUST_STORE_PASSWORD}=")) is { } truststorePassword
	return sonarScannerOpts.Split(' ').FirstOrDefault(x => x.StartsWith($"-D{JAVAX_NET_SSL_TRUST_STORE_PASSWORD}=", StringComparison.OrdinalIgnoreCase)) is { } truststorePassword

SCAN4NET-227 Use system trusted certificate or JVM certificate store #2330

Are you sure you want to change the base?

SCAN4NET-227 Use system trusted certificate or JVM certificate store #2330

Conversation

sebastien-marichal commented Feb 19, 2025 • edited by jira bot Loading

martin-strecker-sonarsource left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sebastien-marichal Feb 20, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

martin-strecker-sonarsource Feb 20, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonarqubecloud bot commented Feb 21, 2025

Quality Gate failed

sebastien-marichal commented Feb 19, 2025 •

edited by jira bot

Loading

sebastien-marichal Feb 20, 2025 •

edited

Loading

martin-strecker-sonarsource Feb 20, 2025 •

edited

Loading