Author: tilman
Date: Sun Oct 21 06:57:40 2018
New Revision: 1844464
URL: http://svn.apache.org/viewvc?rev=1844464&view=rev
Log:
PDFBOX-3017: remove double code
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
URL:
http://svn.apache.org/viewvc/pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java?rev=1844464&r1=1844463&r2=1844464&view=diff
==============================================================================
---
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
(original)
+++
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
Sun Oct 21 06:57:40 2018
@@ -36,7 +36,6 @@ import java.security.cert.X509Certificat
import java.text.SimpleDateFormat;
import java.util.Collection;
import java.util.HashSet;
-import java.util.List;
import java.util.Set;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -62,7 +61,6 @@ import org.bouncycastle.asn1.cms.Attribu
import org.bouncycastle.asn1.cms.AttributeTable;
import org.bouncycastle.asn1.cms.CMSAttributes;
import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
-import org.bouncycastle.asn1.x509.KeyPurposeId;
import org.bouncycastle.asn1.x509.Time;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
@@ -285,30 +283,7 @@ public final class ShowSignature
X509Certificate certFromSignedData = new
JcaX509CertificateConverter().getCertificate(certificateHolder);
System.out.println("certFromSignedData: " + certFromSignedData);
- // Check whether signer certificate is "valid for usage"
- // https://stackoverflow.com/a/52765021/535646
- //
https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSig/changes.html#id1
- boolean[] keyUsage = certFromSignedData.getKeyUsage();
- if (keyUsage != null && !keyUsage[0] && !keyUsage[1])
- {
- // (unclear what "signTransaction" is)
- // https://tools.ietf.org/html/rfc5280#section-4.2.1.3
- System.err.println("Certificate key usage does not include " +
- "digitalSignature nor nonRepudiation");
- }
- List<String> extendedKeyUsage =
certFromSignedData.getExtendedKeyUsage();
- if (extendedKeyUsage != null &&
-
!extendedKeyUsage.contains(KeyPurposeId.id_kp_emailProtection.toString()) &&
-
!extendedKeyUsage.contains(KeyPurposeId.id_kp_codeSigning.toString()) &&
-
!extendedKeyUsage.contains(KeyPurposeId.anyExtendedKeyUsage.toString()) &&
- !extendedKeyUsage.contains("1.2.840.113583.1.1.5") &&
- // not mentioned in Adobe document, but tolerated in practice
- !extendedKeyUsage.contains("1.3.6.1.4.1.311.10.3.12"))
- {
- System.err.println("Certificate extended key usage does not
include " +
- "emailProtection, nor codeSigning, nor
anyExtendedKeyUsage, " +
- "nor 'Adobe Authentic Documents Trust'");
- }
+ SigUtils.checkCertificateUsage(certFromSignedData);
if (signerInformation.getUnsignedAttributes() != null)
{
