cybercore-systems/cybercore-signer
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

ci(security): generate cyclonedx sbom, add sbom upload to ci and update stride security model

Browse Source
This commit is contained in:
Claudecio Martins
2026-10-20 15:13:52 -03:00
parent 300944697f
commit 06c90b4e86
7 changed files with 109 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/cybercore-core/src/main/java/br/com/cybercore/signer/core/security/ApplicationRegistry.java
+3 -2
View File
@@ -54,10 +54,11 @@ public final class ApplicationRegistry {
}
private static Path resolveKeyPathForStorage(Path storagePath) {
if (storagePath == null || storagePath.getParent() == null) {
if (storagePath == null) {
return null;
}
return storagePath.getParent().resolve(".vault_key");
Path parent = storagePath.getParent();
return parent != null ? parent.resolve(".vault_key") : null;
}
private static Path resolveDefaultStoragePath() {
modules/cybercore-core/src/main/java/br/com/cybercore/signer/core/security/HmacIntegrityManager.java
+12 -8
View File
@@ -26,6 +26,7 @@ import java.util.Set;
public class HmacIntegrityManager {
private static final Logger logger = LoggerFactory.getLogger(HmacIntegrityManager.class);
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
private static final String HMAC_ALGORITHM = "HmacSHA256";
private static final int KEY_SIZE_BYTES = 32;
private static final String DEFAULT_KEY_FILE = ".vault_key";
@@ -50,7 +51,7 @@ public class HmacIntegrityManager {
private synchronized void initSecretKey() {
if (keyPath == null) {
byte[] ephemeralKey = new byte[KEY_SIZE_BYTES];
new SecureRandom().nextBytes(ephemeralKey);
SECURE_RANDOM.nextBytes(ephemeralKey);
this.secretKey = ephemeralKey;
return;
}
@@ -67,7 +68,7 @@ public class HmacIntegrityManager {
// Gera nova chave criptográfica forte
byte[] newKey = new byte[KEY_SIZE_BYTES];
new SecureRandom().nextBytes(newKey);
SECURE_RANDOM.nextBytes(newKey);
this.secretKey = newKey;
Path parent = keyPath.getParent();
@@ -82,7 +83,7 @@ public class HmacIntegrityManager {
} catch (Exception e) {
logger.warn("Falha ao persistir chave em {}. Usando chave em memória: {}", keyPath, e.getMessage());
byte[] fallbackKey = new byte[KEY_SIZE_BYTES];
new SecureRandom().nextBytes(fallbackKey);
SECURE_RANDOM.nextBytes(fallbackKey);
this.secretKey = fallbackKey;
}
}
@@ -129,11 +130,14 @@ public class HmacIntegrityManager {
File file = path.toFile();
// Proteção padrão Java SE (funciona em Windows e Unix)
file.setReadable(false, false);
file.setReadable(true, true);
file.setWritable(false, false);
file.setWritable(true, true);
file.setExecutable(false, false);
boolean ok = file.setReadable(false, false);
ok = file.setReadable(true, true) && ok;
ok = file.setWritable(false, false) && ok;
ok = file.setWritable(true, true) && ok;
ok = file.setExecutable(false, false) && ok;
if (!ok) {
logger.debug("Não foi possível ajustar todos os atributos em {}", path);
}
// Permissões POSIX estritas (Linux / macOS)
if (FileSystems.getDefault().supportedFileAttributeViews().contains("posix")) {