From df4cb2a49608dd60ce09533e2c395948c33fbdbe Mon Sep 17 00:00:00 2001
From: kohsuke <kohsuke@71c3de6d-444a-0410-be80-ed276b4c234a>
Date: Sun, 25 Oct 2009 18:43:50 +0000
Subject: [PATCH] trust our own root CAs so that the community doesn't have to
 rely on normal CAs that are quite expensive.

git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@23182 71c3de6d-444a-0410-be80-ed276b4c234a
---
 .../main/java/hudson/model/UpdateCenter.java  | 11 ++++++++
 .../update-center-rootCAs/hudson-community    | 28 +++++++++++++++++++
 .../hudson-community.txt                      |  1 +
 3 files changed, 40 insertions(+)
 create mode 100644 war/resources/WEB-INF/update-center-rootCAs/hudson-community
 create mode 100644 war/resources/WEB-INF/update-center-rootCAs/hudson-community.txt

diff --git a/core/src/main/java/hudson/model/UpdateCenter.java b/core/src/main/java/hudson/model/UpdateCenter.java
index 1f69e66b88..722b868cf3 100644
--- a/core/src/main/java/hudson/model/UpdateCenter.java
+++ b/core/src/main/java/hudson/model/UpdateCenter.java
@@ -49,6 +49,7 @@ import org.jvnet.hudson.crypto.SignatureOutputStream;
 import org.jvnet.hudson.crypto.CertificateUtil;
 
 import javax.servlet.ServletException;
+import javax.servlet.ServletContext;
 import javax.net.ssl.SSLHandshakeException;
 import java.io.File;
 import java.io.FileOutputStream;
@@ -81,6 +82,8 @@ import java.security.GeneralSecurityException;
 import java.security.Signature;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
+import java.security.cert.TrustAnchor;
+import java.security.cert.Certificate;
 
 import com.trilead.ssh2.crypto.Base64;
 
@@ -231,6 +234,14 @@ public class UpdateCenter extends AbstractModelObject {
                 c.checkValidity();
                 certs.add(c);
             }
+
+            // all default root CAs in JVM are trusted, plus certs bundled in Hudson
+            Set<TrustAnchor> anchors = CertificateUtil.getDefaultRootCAs();
+            ServletContext context = Hudson.getInstance().servletContext;
+            for (String cert : (Set<String>) context.getResourcePaths("/WEB-INF/update-center-rootCAs")) {
+                if (cert.endsWith(".txt"))  continue;       // skip text files that are meant to be documentation
+                anchors.add(new TrustAnchor((X509Certificate)cf.generateCertificate(context.getResourceAsStream(cert)),null));
+            }
             CertificateUtil.validatePath(certs);
         }
 
diff --git a/war/resources/WEB-INF/update-center-rootCAs/hudson-community b/war/resources/WEB-INF/update-center-rootCAs/hudson-community
new file mode 100644
index 0000000000..3e249a32d1
--- /dev/null
+++ b/war/resources/WEB-INF/update-center-rootCAs/hudson-community
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE1jCCA76gAwIBAgIJAImLL4rgC+O7MA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxMLU2FudGEgQ2xh
+cmExFzAVBgNVBAoTDkh1ZHNvbiBwcm9qZWN0MRcwFQYDVQQLEw5IdWRzb24gUm9v
+dCBDQTEXMBUGA1UEAxMOSHVkc29uIFJvb3QgQ0ExHTAbBgkqhkiG9w0BCQEWDmh1
+ZHNvbkBzdW4uY29tMB4XDTA5MTAyNTE3NTI0MFoXDTE5MTAyMzE3NTI0MFowgaIx
+CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQHEwtTYW50
+YSBDbGFyYTEXMBUGA1UEChMOSHVkc29uIHByb2plY3QxFzAVBgNVBAsTDkh1ZHNv
+biBSb290IENBMRcwFQYDVQQDEw5IdWRzb24gUm9vdCBDQTEdMBsGCSqGSIb3DQEJ
+ARYOaHVkc29uQHN1bi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQCp1h/pnrYRAGK6nse+3d2W4xshInJwwnR/1D3NwBLA9xs/DOrlxX96b8CbXNoW
+DGc7DpvlwpKfnhOx2jgT5/Jf3bbwQdIntXp9DPQyYLFzekNBZyd3aRySgODpdRW0
+nHcNtQWqn7jvMfu16njUer0x+ipPDCMxOvEZCSjYKrok2PUlQhN/BeS3av9vxSPi
+3FDhDukYimzhiuZiteXb1oij67FBWdI3cYAsQmU1KJyxBwLJ44cLmfLf0I1Sl6Tz
+XcTiSAYvxLogf/ESYtchBjdvmEupv611HWYjbdi4XnjW0tj+NzOcaEcsDC6f5BSt
+TxSJ3T69pIpNZjjxHNMHB01vAgMBAAGjggELMIIBBzAdBgNVHQ4EFgQUUaZC6oV8
+pWg5kT4VoAkNH5etnF8wgdcGA1UdIwSBzzCBzIAUUaZC6oV8pWg5kT4VoAkNH5et
+nF+hgaikgaUwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQw
+EgYDVQQHEwtTYW50YSBDbGFyYTEXMBUGA1UEChMOSHVkc29uIHByb2plY3QxFzAV
+BgNVBAsTDkh1ZHNvbiBSb290IENBMRcwFQYDVQQDEw5IdWRzb24gUm9vdCBDQTEd
+MBsGCSqGSIb3DQEJARYOaHVkc29uQHN1bi5jb22CCQCJiy+K4AvjuzAMBgNVHRME
+BTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQAYAYVICF98VHVt/0L8MjxKtuHNjZ2q
+5Wius5tT+uWufer5y083YGlnQzch/622NNR14koJMioD0FR3XqEGeakJexB3hj3K
+Iqp7+nkqFcjZycujGTsix6zJ8Mwc2lHbCTt5EZsr5YYzeT6IWbeOofsRBsqA1Ygc
+L6pT0oFf1nl+RKxa0EANj6RO9fOjAp9cTndZjynvE8J8S1RDPC98IRmSCiwZKCQc
+9KE6D+Sk9XZO3pff6NGo8DA1MOoMGB8lxXWZxMvqkaZdB6UTnvWsvPvpqwFA/mj0
+M/hYpqAOSqTttQMLuQBuYj5YbPjh0843azZXP5xm62TK+E+q7sdedeuA
+-----END CERTIFICATE-----
diff --git a/war/resources/WEB-INF/update-center-rootCAs/hudson-community.txt b/war/resources/WEB-INF/update-center-rootCAs/hudson-community.txt
new file mode 100644
index 0000000000..a2db540657
--- /dev/null
+++ b/war/resources/WEB-INF/update-center-rootCAs/hudson-community.txt
@@ -0,0 +1 @@
+This root CA is used to hand out certificates to the community members, allowing people to run update centers without using an expensive regular certificates from vendors like VeriSign.