Overhaul CommandProvider and add trust command

Author: Aeliux

src/EasySign.Cli/BundleCommandProvider.cs

@@ -1,16 +1,17 @@
 using System.CommandLine;
+using System.Text.Json.Serialization;
 
 using Microsoft.Extensions.Logging;
 
 using SAPTeam.EasySign.CommandLine;
 
 namespace SAPTeam.EasySign.Cli
 {
-    internal class BundleCommandProvider : CommandProvider<Bundle>
+    internal class BundleCommandProvider : CommandProvider<Bundle, CommandProviderConfiguration>
     {
         private readonly ILogger _bundleLogger;
 
-        public BundleCommandProvider(string appDirectory, ILogger logger, ILogger bundleLogger) : base(appDirectory, logger)
+        public BundleCommandProvider(CommandProviderConfiguration configuration, ILogger logger, ILogger bundleLogger) : base(configuration, logger)
         {
             _bundleLogger = bundleLogger;
         }
@@ -30,9 +31,17 @@ public override RootCommand GetRootCommand()
                 Sign,
                 Verify,
                 SelfSign,
+                Trust,
             };
 
             return root;
         }
     }
+
+    [JsonSourceGenerationOptions(GenerationMode = JsonSourceGenerationMode.Metadata, WriteIndented = true, DefaultIgnoreCondition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingDefault)]
+    [JsonSerializable(typeof(CommandProviderConfiguration))]
+    internal partial class SourceGenerationConfigurationContext : JsonSerializerContext
+    {
+
+    }
 }

src/EasySign.Cli/Program.cs

@@ -1,14 +1,20 @@
 using System.CommandLine;
+using System.Text.Json.Serialization;
+using System.Text.Json;
+using System.Text;
 
 using Serilog;
 using Serilog.Extensions.Logging;
+using SAPTeam.EasySign.CommandLine;
 
 namespace SAPTeam.EasySign.Cli
 {
     internal class Program
     {
         public static string AppDirectory => AppDomain.CurrentDomain.BaseDirectory;
 
+        public static string ConfigPath => Path.Combine(AppDirectory, "config.json");
+
         private static int Main(string[] args)
         {
             Log.Logger = new LoggerConfiguration()
@@ -30,15 +36,30 @@ private static int Main(string[] args)
             Microsoft.Extensions.Logging.ILogger commandProviderLogger = new SerilogLoggerFactory(Log.Logger.ForContext("Context", "CommandProvider"))
                 .CreateLogger("CommandProvider");
 
-            int exitCode;
-            using (var cp = new BundleCommandProvider(AppDirectory, commandProviderLogger, bundleLogger))
+            CommandProviderConfiguration config;
+            if (File.Exists(ConfigPath))
+            {
+                using FileStream fs = File.OpenRead(ConfigPath);
+                config = JsonSerializer.Deserialize(fs, typeof(CommandProviderConfiguration), SourceGenerationConfigurationContext.Default) as CommandProviderConfiguration ?? new CommandProviderConfiguration();
+            }
+            else
             {
-                RootCommand root = cp.GetRootCommand();
-                exitCode = root.Invoke(args);
+                config = new CommandProviderConfiguration();
             }
-            
+
+            var cp = new BundleCommandProvider(config, commandProviderLogger, bundleLogger);
+
+            RootCommand root = cp.GetRootCommand();
+            int exitCode = root.Invoke(args);
+
             appLogger.Information("Shutting down EasySign CLI at {DateTime} with exit code {ExitCode}", DateTime.Now, exitCode);
 
+            string data = JsonSerializer.Serialize(config, config.GetType(), SourceGenerationConfigurationContext.Default);
+            using (FileStream fs = File.OpenWrite(ConfigPath))
+            {
+                fs.Write(Encoding.UTF8.GetBytes(data));
+            }
+
             Log.CloseAndFlush();
             return exitCode;
         }

src/EasySign.CommandLine/BundleWorker.cs

@@ -4,9 +4,11 @@
 
 using Spectre.Console;
 
+using static System.Net.Mime.MediaTypeNames;
+
 namespace SAPTeam.EasySign.CommandLine
 {
-    public abstract partial class CommandProvider<TBundle>
+    public abstract partial class CommandProvider<TBundle, TConfiguration>
     {
         /// <summary>
         /// Gets or sets the bundle.
@@ -273,7 +275,8 @@ protected virtual void RunInfo(StatusContext statusContext)
         /// </summary>
         /// <param name="statusContext">The status context for interacting with <see cref="AnsiConsole.Status"/>.</param>
         /// <param name="certificates">The certificates.</param>
-        protected virtual void RunSign(StatusContext statusContext, X509Certificate2Collection certificates)
+        /// <param name="skipVerify">A value indicating whether to skip certificate verification.</param>
+        protected virtual void RunSign(StatusContext statusContext, X509Certificate2Collection certificates, bool skipVerify)
         {
             Logger.LogInformation("Running sign command");
 
@@ -305,14 +308,17 @@ protected virtual void RunSign(StatusContext statusContext, X509Certificate2Coll
 
                 CertificateUtilities.DisplayCertificate(cert);
 
-                Logger.LogDebug("Verifying certificate {cert}", cert);
-                statusContext.Status("[yellow]Verifying Certificate[/]");
-
-                bool verifyCert = VerifyCertificate(cert, false);
-                if (!verifyCert)
+                if (!skipVerify)
                 {
-                    Logger.LogWarning("Skipping signing with {cert}", cert);
-                    continue;
+                    Logger.LogDebug("Verifying certificate {cert}", cert);
+                    statusContext.Status("[yellow]Verifying Certificate[/]");
+
+                    bool verifyCert = VerifyCertificate(cert, false);
+                    if (!verifyCert)
+                    {
+                        Logger.LogWarning("Skipping signing with {cert}", cert);
+                        continue;
+                    }
                 }
 
                 Logger.LogDebug("Acquiring RSA private key for {cert}", cert);
@@ -526,6 +532,9 @@ protected bool VerifyCertificate(X509Certificate2 certificate, bool ignoreTime)
                 throw new ApplicationException("Bundle is not initialized");
             }
 
+            List<bool> verificationResults = [];
+            List<X509ChainStatus[]> verificationStatuses = [];
+
             X509Certificate2? rootCA;
             if ((rootCA = GetSelfSigningRootCA()) != null)
             {
@@ -537,9 +546,12 @@ protected bool VerifyCertificate(X509Certificate2 certificate, bool ignoreTime)
                 selfSignPolicy.VerificationFlags |= X509VerificationFlags.IgnoreNotTimeValid;
                 selfSignPolicy.RevocationMode = X509RevocationMode.NoCheck;
 
-                bool selfSignVerification = Bundle.VerifyCertificate(certificate, out _, policy: selfSignPolicy);
+                bool selfSignVerification = Bundle.VerifyCertificate(certificate, out X509ChainStatus[] selfSignChainStatuses, policy: selfSignPolicy);
                 Logger.LogInformation("Certificate verification with self-signing root CA for {cert}: {result}", certificate, selfSignVerification);
 
+                verificationResults.Add(selfSignVerification);
+                verificationStatuses.Add(selfSignChainStatuses);
+
                 if (selfSignVerification)
                 {
                     AnsiConsole.MarkupLine($"[{Color.Green}] Certificate Verification with Self-Signing Root CA Successful[/]");
@@ -548,29 +560,48 @@ protected bool VerifyCertificate(X509Certificate2 certificate, bool ignoreTime)
             }
 
             X509ChainPolicy policy = new();
+            policy.ExtraStore.AddRange(Configuration.LoadCertificates(CertificateStore.IntermediateCA));
 
             if (ignoreTime)
             {
                 policy.VerificationFlags |= X509VerificationFlags.IgnoreCtlNotTimeValid;
             }
 
             Logger.LogDebug("Verifying certificate {cert} with system trust store", certificate);
-            bool defaultVerification = Bundle.VerifyCertificate(certificate, out X509ChainStatus[] statuses, policy);
-
+            bool defaultVerification = Bundle.VerifyCertificate(certificate, out X509ChainStatus[] defaultChainStatuses, policy);
             Logger.LogInformation("Certificate verification with system trust store for {cert}: {result}", certificate, defaultVerification);
 
-            if (!defaultVerification)
+            verificationResults.Add(defaultVerification);
+            verificationStatuses.Add(defaultChainStatuses);
+
+            if (!verificationResults.Any(x => x) && Configuration.TrustedRootCA.Count > 0)
             {
-                Utilities.EnumerateStatuses(statuses);
+                policy.TrustMode = X509ChainTrustMode.CustomRootTrust;
+                policy.CustomTrustStore.AddRange(Configuration.LoadCertificates(CertificateStore.TrustedRootCA));
+
+                Logger.LogDebug("Verifying certificate {cert} with custom trust store", certificate);
+                bool customVerification = Bundle.VerifyCertificate(certificate, out X509ChainStatus[] customChainStatuses, policy);
+                Logger.LogInformation("Certificate verification with custom trust store for {cert}: {result}", certificate, defaultVerification);
+
+                verificationResults.Add(customVerification);
+                verificationStatuses.Add(customChainStatuses);
             }
-            else
+
+            if (!verificationResults.Any(x => x))
             {
-                AnsiConsole.MarkupLine($"[green] Certificate Verification Successful[/]");
-                return true;
+                var statuses = verificationStatuses.Aggregate((prev, next) =>
+                {
+                    return prev.Intersect(next).ToArray();
+                });
+
+                Utilities.EnumerateStatuses(statuses);
+
+                AnsiConsole.MarkupLine($"[red] Certificate Verification Failed[/]");
+                return false;
             }
 
-            AnsiConsole.MarkupLine($"[red] Certificate Verification Failed[/]");
-            return false;
+            AnsiConsole.MarkupLine($"[green] Certificate Verification Successful[/]");
+            return true;
         }
     }
 }

src/EasySign.CommandLine/CertificateStore.cs

@@ -0,0 +1,29 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SAPTeam.EasySign.CommandLine
+{
+    /// <summary>
+    /// Enumeration of certificate stores in the <see cref="CommandProviderConfiguration"/>.
+    /// </summary>
+    public enum CertificateStore
+    {
+        /// <summary>
+        /// The trusted root CA store.
+        /// </summary>
+        TrustedRootCA,
+
+        /// <summary>
+        /// The intermediate CA store.
+        /// </summary>
+        IntermediateCA,
+
+        /// <summary>
+        /// The self-signed certificate store.
+        /// </summary>
+        IssuedCertificates,
+    }
+}

src/EasySign.CommandLine/CertificateUtilities.cs

@@ -182,15 +182,14 @@ public static X509Certificate2Collection ImportPFX(byte[] data, string? password
 
             return collection;
         }
-            
 
         /// <summary>
-        /// Prompts the user for certificate subject information and generates a standardized subject name.
+        /// Prompts the user for certificate subject information and generates a <see cref="CertificateSubject"/>.
         /// </summary>
         /// <returns>
-        /// The formatted certificate subject string.
+        /// The <see cref="CertificateSubject"/> representing the generated subject.
         /// </returns>
-        public static string GetSubjectNameFromUser()
+        public static CertificateSubject GetSubjectFromUser()
         {
             string? commonName = null;
 
@@ -224,7 +223,7 @@ public static string GetSubjectNameFromUser()
                                           organizationalUnit: organizationalUnit,
                                           locality: locality,
                                           state: state,
-                                          country: country).ToString();
+                                          country: country);
         }
 
         /// <summary>