SCANJLIB-259 Restore default truststore location

Author: henryju

its/it-tests/src/test/java/com/sonar/scanner/lib/it/SSLTest.java

@@ -27,6 +27,7 @@
 import com.tngtech.java.junit.dataprovider.DataProviderRunner;
 import com.tngtech.java.junit.dataprovider.UseDataProvider;
 import java.net.InetAddress;
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.HashMap;
@@ -49,7 +50,9 @@
 import org.junit.After;
 import org.junit.Before;
 import org.junit.ClassRule;
+import org.junit.Rule;
 import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
 import org.junit.runner.RunWith;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -84,6 +87,9 @@ public class SSLTest {
   @ClassRule
   public static final OrchestratorRule ORCHESTRATOR = ScannerJavaLibraryTestSuite.ORCHESTRATOR;
 
+  @Rule
+  public TemporaryFolder scannerHome = new TemporaryFolder();
+
   @Before
   public void deleteData() {
     ScannerJavaLibraryTestSuite.resetData(ORCHESTRATOR);
@@ -234,7 +240,7 @@ private static Path project(String projectName) {
 
   @Test
   @UseDataProvider("variousClientTrustStores")
-  public void simple_analysis_with_server_certificate(String clientTrustStore, String keyStorePassword, boolean useJavaSslProperties) throws Exception {
+  public void simple_analysis_with_server_certificate(String clientTrustStore, String keyStorePassword, TrustStoreConfigurationMethod configMethod) throws Exception {
     assumeTrue("Support for PKCS12 keystore generated by openssl was added in SQ 10.7", !clientTrustStore.endsWith("-openssl.p12") ||
       ORCHESTRATOR.getServer().version().isGreaterThanOrEquals(10, 7));
     startSSLTransparentReverseProxy(false);
@@ -248,12 +254,23 @@ public void simple_analysis_with_server_certificate(String clientTrustStore, Str
     assertThat(clientTruststore).exists();
 
     Map<String, String> params = new HashMap<>();
-    if (useJavaSslProperties) {
-      params.put("javax.net.ssl.trustStore", clientTruststore.toString());
-      params.put("javax.net.ssl.trustStorePassword", keyStorePassword);
-    } else {
-      params.put("sonar.scanner.truststorePath", clientTruststore.toString());
-      params.put("sonar.scanner.truststorePassword", keyStorePassword);
+    switch (configMethod) {
+      case JVM_PROPERTIES:
+        params.put("javax.net.ssl.trustStore", clientTruststore.toString());
+        params.put("javax.net.ssl.trustStorePassword", keyStorePassword);
+        break;
+      case SCANNER_PROPERTIES:
+        params.put("sonar.scanner.truststorePath", clientTruststore.toString());
+        params.put("sonar.scanner.truststorePassword", keyStorePassword);
+        break;
+      case DEFAULT_LOCATION:
+        var scannerHomeDir = scannerHome.newFolder();
+        params.put("sonar.userHome", scannerHomeDir.getAbsolutePath());
+        var defaultTruststore = scannerHomeDir.toPath().resolve("ssl/truststore.p12");
+        Files.createDirectories(defaultTruststore.getParent());
+        Files.copy(clientTruststore, defaultTruststore);
+        params.put("sonar.scanner.truststorePassword", keyStorePassword);
+        break;
     }
 
     buildResult = scanner.executeSimpleProject(project("js-sample"), "https://localhost:" + httpsPort, params, Map.of());
@@ -263,13 +280,29 @@ public void simple_analysis_with_server_certificate(String clientTrustStore, Str
 
   @DataProvider()
   public static Object[][] variousClientTrustStores() {
-    return new Object[][]{
-      {KEYSTORE_CLIENT_WITH_CA_KEYTOOL, CLIENT_WITH_CA_KEYSTORE_PASSWORD, true},
-      {KEYSTORE_CLIENT_WITH_CA_OPENSSL, CLIENT_WITH_CA_KEYSTORE_PASSWORD, false},
-      {KEYSTORE_CLIENT_WITH_CERTIFICATE_KEYTOOL, CLIENT_WITH_CERTIFICATE_KEYSTORE_PASSWORD, true},
-      {KEYSTORE_CLIENT_WITH_CERTIFICATE_OPENSSL, CLIENT_WITH_CERTIFICATE_KEYSTORE_PASSWORD, false},
-      {KEYSTORE_CLIENT_WITH_CERTIFICATE_OPENSSL_JDKTRUST, CLIENT_WITH_CERTIFICATE_KEYSTORE_PASSWORD, false},
-      {KEYSTORE_CLIENT_WITH_CERTIFICATE_OPENSSL_JDKTRUST, CLIENT_WITH_CERTIFICATE_KEYSTORE_PASSWORD, true}
-    };
+    Map<String, String> keystoresAndPasswords = Map.of(
+      KEYSTORE_CLIENT_WITH_CA_KEYTOOL, CLIENT_WITH_CA_KEYSTORE_PASSWORD,
+      KEYSTORE_CLIENT_WITH_CA_OPENSSL, CLIENT_WITH_CA_KEYSTORE_PASSWORD,
+      KEYSTORE_CLIENT_WITH_CERTIFICATE_KEYTOOL, CLIENT_WITH_CERTIFICATE_KEYSTORE_PASSWORD,
+      KEYSTORE_CLIENT_WITH_CERTIFICATE_OPENSSL, CLIENT_WITH_CERTIFICATE_KEYSTORE_PASSWORD,
+      KEYSTORE_CLIENT_WITH_CERTIFICATE_OPENSSL_JDKTRUST, CLIENT_WITH_CERTIFICATE_KEYSTORE_PASSWORD);
+
+    Object[][] result = new Object[keystoresAndPasswords.size() * TrustStoreConfigurationMethod.values().length][3];
+    int index = 0;
+    for (TrustStoreConfigurationMethod method : TrustStoreConfigurationMethod.values()) {
+      for (Map.Entry<String, String> keystoreAndPassword : keystoresAndPasswords.entrySet()) {
+        result[index][0] = keystoreAndPassword.getKey();
+        result[index][1] = keystoreAndPassword.getValue();
+        result[index][2] = method;
+        index++;
+      }
+    }
+    return result;
+  }
+
+  private enum TrustStoreConfigurationMethod {
+    JVM_PROPERTIES,
+    SCANNER_PROPERTIES,
+    DEFAULT_LOCATION
   }
 }

lib/src/main/java/org/sonarsource/scanner/lib/ScannerEngineBootstrapper.java

@@ -20,7 +20,6 @@
 package org.sonarsource.scanner.lib;
 
 import java.net.InetSocketAddress;
-import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.time.temporal.ChronoUnit;
@@ -53,7 +52,6 @@
 import org.sonarsource.scanner.lib.internal.util.System2;
 import org.sonarsource.scanner.lib.internal.util.VersionUtils;
 
-import static java.util.Optional.ofNullable;
 import static org.sonarsource.scanner.lib.EnvironmentConfig.TOKEN_ENV_VARIABLE;
 import static org.sonarsource.scanner.lib.ScannerProperties.SCANNER_ARCH;
 import static org.sonarsource.scanner.lib.ScannerProperties.SCANNER_OS;
@@ -63,6 +61,14 @@
 import static org.sonarsource.scanner.lib.ScannerProperties.SONAR_SCANNER_TRUSTSTORE_PASSWORD;
 import static org.sonarsource.scanner.lib.ScannerProperties.SONAR_SCANNER_TRUSTSTORE_PATH;
 import static org.sonarsource.scanner.lib.ScannerProperties.SONAR_TOKEN;
+import static org.sonarsource.scanner.lib.internal.JvmProperties.HTTPS_PROXY_HOST;
+import static org.sonarsource.scanner.lib.internal.JvmProperties.HTTPS_PROXY_PORT;
+import static org.sonarsource.scanner.lib.internal.JvmProperties.HTTP_PROXY_HOST;
+import static org.sonarsource.scanner.lib.internal.JvmProperties.HTTP_PROXY_PORT;
+import static org.sonarsource.scanner.lib.internal.JvmProperties.JAVAX_NET_SSL_KEY_STORE;
+import static org.sonarsource.scanner.lib.internal.JvmProperties.JAVAX_NET_SSL_KEY_STORE_PASSWORD;
+import static org.sonarsource.scanner.lib.internal.JvmProperties.JAVAX_NET_SSL_TRUST_STORE;
+import static org.sonarsource.scanner.lib.internal.JvmProperties.JAVAX_NET_SSL_TRUST_STORE_PASSWORD;
 
 /**
  * Entry point to run a Sonar analysis programmatically.
@@ -75,10 +81,6 @@ public class ScannerEngineBootstrapper {
   private static final String SONARCLOUD_REST_API = "https://api.sonarcloud.io";
   static final String SQ_VERSION_NEW_BOOTSTRAPPING = "10.6";
   static final String SQ_VERSION_TOKEN_AUTHENTICATION = "10.0";
-  private static final String JAVAX_NET_SSL_TRUST_STORE = "javax.net.ssl.trustStore";
-  private static final String JAVAX_NET_SSL_TRUST_STORE_PASSWORD = "javax.net.ssl.trustStorePassword";
-  private static final String JAVAX_NET_SSL_KEY_STORE = "javax.net.ssl.keyStore";
-  private static final String JAVAX_NET_SSL_KEY_STORE_PASSWORD = "javax.net.ssl.keyStorePassword";
 
   private final IsolatedLauncherFactory launcherFactory;
   private final ScannerEngineLauncherFactory scannerEngineLauncherFactory;
@@ -124,11 +126,11 @@ public ScannerEngineBootstrapResult bootstrap() {
       LOG.debug("Scanner max available memory: {}", FileUtils.byteCountToDisplaySize(Runtime.getRuntime().maxMemory()));
     }
     initBootstrapDefaultValues();
-    adaptJvmSslPropertiesToScannerProperties(bootstrapProperties, system);
     var immutableProperties = Map.copyOf(bootstrapProperties);
+    var sonarUserHome = resolveSonarUserHome(immutableProperties);
+    var httpConfig = new HttpConfig(immutableProperties, sonarUserHome, system);
     var isSonarCloud = isSonarCloud(immutableProperties);
     var isSimulation = immutableProperties.containsKey(InternalProperties.SCANNER_DUMP_TO_FILE);
-    var sonarUserHome = resolveSonarUserHome(immutableProperties);
     var fileCache = FileCache.create(sonarUserHome);
 
     if (isSimulation) {
@@ -138,7 +140,6 @@ public ScannerEngineBootstrapResult bootstrap() {
 
     // No HTTP call should be made before this point
     try {
-      var httpConfig = new HttpConfig(immutableProperties, sonarUserHome);
       scannerHttpClient.init(httpConfig);
 
       var serverVersion = !isSonarCloud ? getServerVersion(scannerHttpClient) : null;
@@ -151,7 +152,10 @@ public ScannerEngineBootstrapResult bootstrap() {
       ScannerEngineFacade scannerFacade;
       if (isSonarCloud || VersionUtils.isAtLeastIgnoringQualifier(serverVersion, SQ_VERSION_NEW_BOOTSTRAPPING)) {
         var launcher = scannerEngineLauncherFactory.createLauncher(scannerHttpClient, fileCache, immutableProperties);
-        scannerFacade = new NewScannerEngineFacade(immutableProperties, launcher, isSonarCloud, serverVersion);
+
+        var adaptedProperties = adaptSslPropertiesToScannerProperties(immutableProperties, httpConfig);
+
+        scannerFacade = new NewScannerEngineFacade(adaptedProperties, launcher, isSonarCloud, serverVersion);
       } else {
         var launcher = launcherFactory.createLauncher(scannerHttpClient, fileCache);
         var adaptedProperties = adaptDeprecatedPropertiesForInProcessBootstrapping(immutableProperties, httpConfig);
@@ -215,11 +219,12 @@ Map<String, String> adaptDeprecatedPropertiesForInProcessBootstrapping(Map<Strin
     }
     var proxy = httpConfig.getProxy();
     if (proxy != null) {
-      setSystemPropertyIfNotAlreadySet("http.proxyHost", ((InetSocketAddress) proxy.address()).getHostString());
-      setSystemPropertyIfNotAlreadySet("https.proxyHost", ((InetSocketAddress) proxy.address()).getHostString());
-      setSystemPropertyIfNotAlreadySet("http.proxyPort", "" + ((InetSocketAddress) proxy.address()).getPort());
-      setSystemPropertyIfNotAlreadySet("https.proxyPort", "" + ((InetSocketAddress) proxy.address()).getPort());
+      setSystemPropertyIfNotAlreadySet(HTTP_PROXY_HOST, ((InetSocketAddress) proxy.address()).getHostString());
+      setSystemPropertyIfNotAlreadySet(HTTPS_PROXY_HOST, ((InetSocketAddress) proxy.address()).getHostString());
+      setSystemPropertyIfNotAlreadySet(HTTP_PROXY_PORT, String.valueOf(((InetSocketAddress) proxy.address()).getPort()));
+      setSystemPropertyIfNotAlreadySet(HTTPS_PROXY_PORT, String.valueOf(((InetSocketAddress) proxy.address()).getPort()));
     }
+    // Those are not standard JVM properties, but they are supported by the Scanner Engine.
     setSystemPropertyIfNotAlreadySet("http.proxyUser", httpConfig.getProxyUser());
     setSystemPropertyIfNotAlreadySet("http.proxyPassword", httpConfig.getProxyPassword());
 
@@ -237,7 +242,7 @@ Map<String, String> adaptDeprecatedPropertiesForInProcessBootstrapping(Map<Strin
     return Map.copyOf(adaptedProperties);
   }
 
-  private void setSystemPropertyIfNotAlreadySet(String key, String value) {
+  private void setSystemPropertyIfNotAlreadySet(String key, @Nullable String value) {
     if (system.getProperty(key) == null && StringUtils.isNotBlank(value)) {
       System.setProperty(key, value);
     }
@@ -290,30 +295,20 @@ private void initBootstrapDefaultValues() {
    * by inserting the trusted certificate in the Scanner JVM truststore, or passing JVM SSL properties
    * we need to adapt the properties, at least temporarily, until we have helped most users to migrate.
    */
-  static void adaptJvmSslPropertiesToScannerProperties(Map<String, String> bootstrapProperties, System2 system) {
-    if (!bootstrapProperties.containsKey(SONAR_SCANNER_TRUSTSTORE_PATH)) {
-      var jvmTrustStoreProp = system.getProperty(JAVAX_NET_SSL_TRUST_STORE);
-      if (StringUtils.isBlank(jvmTrustStoreProp)) {
-        var defaultJvmTrustStoreLocation = Paths.get(System.getProperty("java.home"), "lib", "security", "cacerts");
-        if (Files.isRegularFile(defaultJvmTrustStoreLocation)) {
-          LOG.debug("Mapping default scanner JVM truststore location '{}' to new properties", defaultJvmTrustStoreLocation);
-          bootstrapProperties.put(SONAR_SCANNER_TRUSTSTORE_PATH, defaultJvmTrustStoreLocation.toString());
-          bootstrapProperties.putIfAbsent(SONAR_SCANNER_TRUSTSTORE_PASSWORD, System.getProperty(JAVAX_NET_SSL_TRUST_STORE_PASSWORD, "changeit"));
-        }
-      } else {
-        bootstrapProperties.putIfAbsent(SONAR_SCANNER_TRUSTSTORE_PATH, jvmTrustStoreProp);
-        ofNullable(system.getProperty(JAVAX_NET_SSL_TRUST_STORE_PASSWORD))
-          .ifPresent(password -> bootstrapProperties.putIfAbsent(SONAR_SCANNER_TRUSTSTORE_PASSWORD, password));
-      }
+  static Map<String, String> adaptSslPropertiesToScannerProperties(Map<String, String> bootstrapProperties, HttpConfig httpConfig) {
+    var result = new HashMap<>(bootstrapProperties);
+    var keyStore = httpConfig.getSslConfig().getKeyStore();
+    if (keyStore != null && keyStore.isFromJvm()) {
+      result.put(SONAR_SCANNER_KEYSTORE_PATH, keyStore.getPath().toString());
+      keyStore.getKeyStorePassword().ifPresent(password -> result.put(SONAR_SCANNER_KEYSTORE_PASSWORD, password));
     }
-    if (!bootstrapProperties.containsKey(SONAR_SCANNER_KEYSTORE_PATH)) {
-      var keystoreProp = system.getProperty(JAVAX_NET_SSL_KEY_STORE);
-      if (!StringUtils.isBlank(keystoreProp)) {
-        bootstrapProperties.put(SONAR_SCANNER_KEYSTORE_PATH, keystoreProp);
-        ofNullable(system.getProperty(JAVAX_NET_SSL_KEY_STORE_PASSWORD))
-          .ifPresent(password -> bootstrapProperties.putIfAbsent(SONAR_SCANNER_KEYSTORE_PASSWORD, password));
-      }
+
+    var trustStore = httpConfig.getSslConfig().getTrustStore();
+    if (trustStore != null && trustStore.isFromJvm()) {
+      result.put(SONAR_SCANNER_TRUSTSTORE_PATH, trustStore.getPath().toString());
+      trustStore.getKeyStorePassword().ifPresent(password -> result.put(SONAR_SCANNER_TRUSTSTORE_PASSWORD, password));
     }
+    return Map.copyOf(result);
   }
 
   private String getSonarCloudUrl() {

lib/src/main/java/org/sonarsource/scanner/lib/ScannerProperties.java

@@ -87,6 +87,7 @@ private ScannerProperties() {
   public static final String SONAR_SCANNER_TRUSTSTORE_PATH = "sonar.scanner.truststorePath";
   public static final String SONAR_SCANNER_TRUSTSTORE_PASSWORD = "sonar.scanner.truststorePassword";
   public static final String SONAR_SCANNER_SKIP_SYSTEM_TRUSTSTORE = "sonar.scanner.skipSystemTruststore";
+
   /**
    * Skip analysis.
    */

lib/src/main/java/org/sonarsource/scanner/lib/internal/JvmProperties.java

@@ -0,0 +1,37 @@
+/*
+ * SonarScanner Java Library
+ * Copyright (C) 2011-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonarsource.scanner.lib.internal;
+
+/**
+ * See <a href="https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/net/doc-files/net-properties.html">...</a>
+ */
+public class JvmProperties {
+  public static final String JAVAX_NET_SSL_TRUST_STORE = "javax.net.ssl.trustStore";
+  public static final String JAVAX_NET_SSL_TRUST_STORE_PASSWORD = "javax.net.ssl.trustStorePassword";
+  public static final String JAVAX_NET_SSL_KEY_STORE = "javax.net.ssl.keyStore";
+  public static final String JAVAX_NET_SSL_KEY_STORE_PASSWORD = "javax.net.ssl.keyStorePassword";
+  public static final String HTTP_PROXY_HOST = "http.proxyHost";
+  public static final String HTTPS_PROXY_HOST = "https.proxyHost";
+  public static final String HTTP_PROXY_PORT = "http.proxyPort";
+  public static final String HTTPS_PROXY_PORT = "https.proxyPort";
+
+  private JvmProperties() {
+  }
+}