DFLOW-151 - JVM client setup (Windows) by akushsky · Pull Request #10 · jfrog/package-reroute

akushsky · 2026-06-09T13:17:41Z

Summary

Adds a Windows client-side installer + validator that wires a corporate CA into the JVM trust path so Maven / Gradle / sbt / Apache Ivy traffic redirected through package-reroute validates correctly. JVM trust only — does not configure Node/npm/Python and does not touch Docker credentials (pair with install_certs_windows.ps1 for those).

Single path on Windows. -Djavax.net.ssl.trustStoreType=Windows-ROOT is not exposed in v1: the Gradle Daemon stale-cache issue (gradle/gradle#6584) was fixed in Gradle 8.3 via gradle/gradle#25106, but we keep the JKS+JAVA_TOOL_OPTIONS recipe uniform across Linux/macOS/Windows and avoid silently breaking developers still on Gradle < 8.3. The script:

Build a per-user JKS truststore at %LOCALAPPDATA%\JFrog\package-route-jvm\truststore.jks containing the customer CA.
Set JAVA_TOOL_OPTIONS at User scope via [Environment]::SetEnvironmentVariable(..., 'User') → writes HKCU\Environment + broadcasts WM_SETTINGCHANGE.

No Administrator required. User-scope writes to HKCU\Environment without elevation; %LOCALAPPDATA% is per-user.

Base branch

Stacked on feature/DFLOW-152-jvm-macos (PR #9), which is stacked on feature/DFLOW-150-jvm-linux (PR #8). Diff shows only Windows-specific files. When PR #9 merges, GitHub auto-rebases this to feature/DFLOW-150-jvm-linux; after PR #8 merges, to main.

Files

install_certs_jvm_windows.ps1 — installer.
validate_certs_jvm_windows.ps1 — companion validator.
_jvm_windows_paths.ps1 — shared constants (dot-sourced).
testing/test_install_certs_jvm_windows.ps1 — smoke runner (15 invariants).
.github/workflows/ci.yml — new test-windows-jvm job.
README.md — new "Windows (JVM)" section.

Design symmetry with siblings

validate_pem ported to PowerShell using System.Security.Cryptography.X509Certificates (no openssl dependency for the install path; DER input rejected for cross-platform predictability).
-CertName regex ^[A-Za-z0-9._-]+$ rejects path-traversal at parse time.
Idempotent re-install: JKS removed-then-recreated (single alias guaranteed); env var replaced (not appended).
Validator asserts trustedCertEntry-only — a PrivateKeyEntry makes it fail loud (cross-platform invariant).
Validator accepts -CertName as a no-op for fleet-wrapper parity with the Linux validator.
Test runner captures stdout+stderr per invocation; dumps on UNEXPECTED exit only.

Test plan

15 invariants on windows-latest:

CI uses actions/setup-java@v4 (Temurin 21) to provide keytool.exe via JAVA_HOME.

🤖 Generated with Claude Code

github-actions · 2026-06-09T13:31:24Z

Qodana for JVM

It seems all right 👌

No new problems were found according to the checks applied

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

Register at Qodana Cloud and configure the action
Use GitHub Code Scanning with Qodana
Host Qodana report at GitHub Pages
Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.1.0
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

Or via our issue tracker: https://jb.gg/qodana-issue
Or share your feedback: https://jb.gg/qodana-discussions

Critical: - C1: capture $LASTEXITCODE IMMEDIATELY after the native call in Invoke-Installer / Invoke-Validator, BEFORE the Out-String pipeline. Under $ErrorActionPreference='Stop' a pipeline element raising any error would jump past `$rc = $LASTEXITCODE` and leave $rc carrying a stale value from a previous step -- which can silently flip an -ExpectFail assertion into a phantom pass. Important: - I10: new Invoke-Keytool helper that wraps the inline `& $Keytool -list` calls (alias-count assertion in test #3, custom-alias assertion in test #4) with $ErrorActionPreference='Continue'. JDK 17+ has been observed emitting crypto-policy notices to stderr at rc=0 from `-list`; under Stop those would terminate the test. Same pattern installer + validator already use for their own keytool calls. - I12: Cleanup() switched from -ErrorAction SilentlyContinue to probe-then-warn. A locked $JksDir from a leaked keytool.exe child of the previous test now produces a clear warning instead of silently failing and then dying mid-Build-JksTruststore in the next test. - I16: print openssl version + emit Write-Warning if it's older than 3.2 (test #7 requires -not_before / -not_after introduced in 3.2). A future image bump that drops openssl below 3.2 will surface as a yellow CI annotation instead of a silent SKIP that nobody notices. New tests (raising the matrix from 10 to 14): - I19: docstring split #10 into 10 + 11 (30-day-expiry vs bundle-warn were rolled into one bullet but are distinct invariants). - I14: new test #12 -- JTO env var REPLACES on re-install. Pre-seeds a sentinel value before install, then asserts the sentinel is gone post-install. Catches a future regression that flips to append-mode. - I13: new test #13 -- missing keytool fails cleanly. Spawns the installer in a child shell with $env:JAVA_HOME=$null and a PATH stripped of all JDK locations; asserts rc!=0 + error message mentions keytool. Exercises Require-Keytool's pre-flight probe (added in the installer hardening commit). - I15: new test #14 -- mandatory -UseCert. Invokes the installer with no args under -NonInteractive (no hang waiting for prompt); asserts rc!=0. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds a Windows client-side installer + validator that wires a corporate CA into the JVM trust path so Maven / Gradle / sbt / Apache Ivy traffic redirected through package-reroute validates correctly. JVM trust only -- does not configure Node/npm/Python and does not touch Docker credentials. Pair with install_certs_windows.ps1 for those flows. Based on the published research wiki (DFLOW-136): https://jfrog-int.atlassian.net/wiki/spaces/RTFACT/pages/2440101931 Sibling to DFLOW-150 (Linux) and DFLOW-152 (macOS). Single path on Windows -- there is no Windows-ROOT trustStoreType option because the Gradle Daemon caches a stale store (gradle/gradle#6584): 1. Build a per-user JKS truststore at %LOCALAPPDATA%\JFrog\package-route-jvm\truststore.jks 2. Set JAVA_TOOL_OPTIONS at User scope via [Environment]::SetEnvironmentVariable(..., 'User') which writes HKCU\Environment AND broadcasts WM_SETTINGCHANGE. No Administrator required (User-scope writes to HKCU\Environment without elevation; %LOCALAPPDATA% is per-user). Files: install_certs_jvm_windows.ps1 Installer (~370 lines). validate_certs_jvm_windows.ps1 Companion validator. _jvm_windows_paths.ps1 Shared constants dot-sourced. testing/test_install_certs_jvm_windows.ps1 14-invariant smoke runner. .github/workflows/ci.yml New test-windows-jvm job. README.md New "Windows (JVM)" section. Hardening fixes folded in from a round of pr-review-toolkit review (5 agents, 28 findings: 2 Critical + 21 Important + 5 Minor): Critical: - SetEnvironmentVariable round-trip verify. Windows 10 1607+ silently truncates user-env values > 2047 chars rather than throwing; future JTO extensions would corrupt HKCU. Now reads back and hard-fails on mismatch. - Test runner captures $LASTEXITCODE IMMEDIATELY after the native powershell.exe call, BEFORE the Out-String pipeline. Without this an intervening pipeline error leaves $rc carrying a stale value from a previous step and -ExpectFail can phantom-pass. Important production-code: - Require-Keytool now probes `keytool -help` to reject corrupt 0-byte stubs and broken-runtime keytools. - Build-JksTruststore post-import verify: runs keytool -list and asserts at least one trustedCertEntry, catching JBR-bundled keytool cases where rc=0 hides a non-standard java.security provider list. - Build-JksTruststore precondition checks for $env:LOCALAPPDATA existence + readability (OneDrive Known-Folder-Move, roaming-profile failures get actionable diagnostics). - Test-CaCertificate basicConstraints comment documents the legacy-cert behavior (extension absent -> accept, matches Linux/macOS siblings). - Maintenance comment on $prevEAP capture / restore. - Set-JavaToolOptions now quotes the trustStorePassword value. - Build-JksTruststore surfaces keytool's non-failure stderr warnings (JKS deprecation, weak-algo notices) on the success path. - Test-UserEnvVar regex anchors both branches so a path like $JksPath.bak.pkcs12 doesn't false-positive as a prefix match. - Test-UserEnvVar warns on Machine-scope sibling env vars to flag mixed-scope misconfig. - Validator's WarnCount infrastructure now actually fires on the Machine-scope path. Important test-runner: - Invoke-Keytool helper wraps inline `keytool -list` in tests with EAP=Continue, matching the installer/validator pattern. JDK 17+ crypto-policy notices to stderr won't terminate the test. - Cleanup() switched from -ErrorAction SilentlyContinue to probe-then- warn so locked $JksDir from a leaked keytool.exe child surfaces. - openssl version banner + warning when < 3.2 (required by test #7). - 4 new tests raise the matrix from 10 to 14: JTO env var replaces on re-install (catches future append-mode regression), missing keytool fails cleanly, mandatory -UseCert no-args fails non-interactively, docstring split #10 -> #10+#11 (30-day expiry vs bundle warn). - Explicit exit 0 so child-rc from negative tests doesn't leak to the shell wrapper. Docs / future-proofing: - PowerShell 5.1+ named as a requirement in installer header. - README "JDK-version-agnostic" claim qualified ("across currently- supported JDKs; JKS format still read by JDK 8-25; future JDK dropping JKS would require a format bump"). - README "covered for free" for Gradle auto-provisioned JDKs now cross-references the Gradle Daemon caveat. - README validation row clarifies that basicConstraints absent -> accept; CA:TRUE required only when extension present. - _jvm_windows_paths.ps1 header documents the "UTF-8 BOM + ASCII-only content" guard for PowerShell 5.1's Windows-1252 default; em-dashes in source files terminate string literals mid-line under cp1252 decoding and the parser reports a baffling error 100+ lines later. Smoke matrix: 14/14 green on windows-latest in CI (Test (Windows JVM) job, Temurin 21 via actions/setup-java). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds a macOS client-side installer + validator that wires a corporate CA into the JVM trust path so Maven / Gradle / sbt / Apache Ivy traffic redirected through package-reroute validates correctly. JVM trust only — does not configure Node/npm/Python and does not touch Docker credentials. Pair with install_certs_macos.sh if you need those flows. Based on the published research wiki (DFLOW-136): https://jfrog-int.atlassian.net/wiki/spaces/RTFACT/pages/2440101931 Sibling to DFLOW-150 (Linux). Single path on macOS — there is no update-ca-trust fork because KeychainStore is broken per JDK-8321045: 1. Build a per-user JKS truststore at ~/Library/Application Support/JFrog/package-route-jvm/truststore.jks 2. Write a per-user LaunchAgent at ~/Library/LaunchAgents/com.jfrog.package-reroute.jto-env.plist calling `launchctl setenv JAVA_TOOL_OPTIONS=…` at RunAtLoad 3. Bootstrap the agent into `gui/<uid>` so Dock-launched IDEs (IntelliJ, JetBrains Toolbox, `open -a …`) inherit the env var The ~/.zshrc / ~/.bash_profile shortcut is deliberately NOT touched — verified in the research wiki to silently fail for GUI-launched IDE builds. Files: install_certs_jvm_macos.sh Installer (~540 lines). validate_certs_jvm_macos.sh Companion validator. _jvm_macos_paths.sh Shared constants sourced by both. testing/test_install_certs_jvm_macos.sh 12-invariant smoke runner. .github/workflows/ci.yml New test-macos-jvm job. README.md New "macOS (JVM)" section. Hardening fixes folded in from a round of pr-review-toolkit review (5 agents, 21 findings: 5 Critical + 13 Important + 3 Minor): Critical: - validate_pem leaf-cert (CA:FALSE) check now works on stock macOS LibreSSL. The previous `openssl x509 -ext` flag is OpenSSL 3.x-only; LibreSSL silently failed → leaf certs accepted as trust anchors. New path parses `-noout -text` output (portable across both). - chown failure capture at both call sites (JKS dir + plist). Under --all-users a silent chown would leave root-owned plists in a user's ~/Library/LaunchAgents/, which launchd silently refuses to load — exactly the phantom-success the project bans. - --cert-name semantics clarified in constants file + --help. The previous "LaunchAgent label suffix" claim was wishful thinking; the flag is alias-cosmetic only. - Test runner docstring rewritten (cleanup runs only on positive cases) and the iter_all_users "mirrors install_certs_macos.sh" claim corrected (it's a stricter filter, not a mirror). Important: - get_single_target_user filter+order matches install_certs_macos.sh (SUDO_USER → /dev/console → logname; rejects loginwindow pseudo-user). - get_user_home eval-on-username fallback replaced with dscacheutil. - bootstrap_launch_agent retry bumped 5×100ms → 20×100ms to survive EDR exec latency; warn text no longer suggests a logout dance. - Validator --help documents the absence of --cert-name. - Validator final summary qualifies "All checks passed" with a WARN count so a green exit doesn't over-promise when launchctl getenv was skipped (no GUI session). - install_as_test_user / validate_as_test_user capture combined stdout/stderr to a tempfile; dump on UNEXPECTED exit only. - Smoke matrix gained 3 new invariants: --all-users iteration (#11), plist content validation via plutil -extract (#10), validate_pem warn-paths for 30-day-expiry and multi-cert bundle (#12). - Test #9 (launchctl getenv) now retries 20×100ms to mirror the installer. - CI workflow uses explicit `sudo env JAVA_HOME=… PATH=…` instead of --preserve-env, surviving future actions/setup-java renames. PATH includes /usr/sbin so chown is resolvable under sudo. Minor: - README requirements list names plutil/launchctl/dscl/stat. - README "five launch contexts" claim scoped to what the test actually verifies. - JKS_PASSWORD "not a secret" comment scoped to trustedCertEntry-only stores (PrivateKeyEntry would change the calculus). Smoke matrix: 12/12 green locally on dev Mac, 12/12 green on CI (Test (macOS JVM) job, macos-latest runner with Temurin 21). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>