From 1e22b94c8cae602df3b0848b4648fccccf4afcd2 Mon Sep 17 00:00:00 2001
From: Ed Merks <ed.merks@gmail.com>
Date: Sun, 13 Nov 2022 11:57:00 +0100
Subject: [PATCH] Enhance the aggregator to handle problems with expired
 signatures

https://github.com/eclipse-cbi/p2repo-aggregator/issues/12
---
 .../META-INF/MANIFEST.MF                      |   4 +
 .../plugin.xml                                |   7 +
 .../cbi/p2repo/aggregator/engine/Builder.java |  14 +
 .../aggregator/engine/MirrorGenerator.java    | 102 ++++++-
 .../aggregator/engine/SignatureCleaner.java   | 285 ++++++++++++++++++
 .../engine/ValidationSetVerifier.java         |   3 +-
 .../org/eclipse/cbi/p2repo/cli/Headless.java  |   2 +-
 7 files changed, 400 insertions(+), 17 deletions(-)
 create mode 100644 plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/SignatureCleaner.java

diff --git a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/META-INF/MANIFEST.MF b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/META-INF/MANIFEST.MF
index 37711046c..f73785d9d 100644
--- a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/META-INF/MANIFEST.MF
+++ b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/META-INF/MANIFEST.MF
@@ -37,3 +37,7 @@ Require-Bundle: org.apache.ant,
  org.eclipse.cbi.p2repo.p2.maven
 Bundle-Vendor: %providerName
 Automatic-Module-Name: org.eclipse.cbi.p2repo.aggregator.engine
+Import-Package: org.bouncycastle.openpgp,
+ org.bouncycastle.openpgp.bc,
+ org.bouncycastle.bcpg,
+ org.bouncycastle.openpgp.jcajce
diff --git a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/plugin.xml b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/plugin.xml
index 1df2f9e26..3d682fb0c 100644
--- a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/plugin.xml
+++ b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/plugin.xml
@@ -15,6 +15,13 @@
             name="modify">
       </command>
    </extension>
+   <extension
+         point="org.eclipse.cbi.p2repo.cli.commands">
+      <command
+            class="org.eclipse.cbi.p2repo.aggregator.engine.SignatureCleaner"
+            name="signature-cleanup">
+      </command>
+   </extension>
    <!-- Uncomment to register MDR supporting enhanced requirements
    <extension
          id="internalRepository"
diff --git a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/Builder.java b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/Builder.java
index ca5e65835..28066206b 100644
--- a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/Builder.java
+++ b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/Builder.java
@@ -453,6 +453,12 @@ private static void send(String host, int port, EmailAddress from, List<EmailAdd
 	@Option(name = "--mavenBuildNumber", usage = "The build number to be used in metadata of maven snapshots", metaVar = "<number>")
 	private int mavenBuildNumber = -1;
 
+	@Option(name = "--signerFingerprints", usage = "Whether to generate " + MirrorGenerator.SIGNER_FINGERPRINTS + ", "
+			+ MirrorGenerator.SIGNER_PGP_PUBLIC_KEYS + ", " + MirrorGenerator.SIGNER_PGP_SIGNATURES
+			+ " properties in the artifact metadata for jar-signed and pgp-signed artifacts")
+	private boolean signerFingerprints = "true"
+			.equals(System.getProperty("org.eclipse.cbi.p2repo.aggregator.signerFingerprints"));
+
 	// === END OF OPTIONS ===
 
 	@Argument
@@ -818,6 +824,14 @@ public IMetadataRepositoryManager getMdrManager() {
 		return mdrManager;
 	}
 
+	public boolean isSignerFingerprints() {
+		return signerFingerprints;
+	}
+
+	public void setSignerFingerprints(boolean signerFingerprints) {
+		this.signerFingerprints = signerFingerprints;
+	}
+
 	/**
 	 * @return the provisioningAgent
 	 */
diff --git a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/MirrorGenerator.java b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/MirrorGenerator.java
index aa1b8a17d..2d3be2baa 100644
--- a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/MirrorGenerator.java
+++ b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/MirrorGenerator.java
@@ -19,6 +19,13 @@
 import java.io.OutputStream;
 import java.lang.reflect.Field;
 import java.nio.file.Paths;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.SignatureException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Iterator;
@@ -52,6 +59,7 @@
 import org.eclipse.core.runtime.Status;
 import org.eclipse.core.runtime.SubMonitor;
 import org.eclipse.equinox.internal.p2.artifact.processors.checksum.ChecksumUtilities;
+import org.eclipse.equinox.internal.p2.artifact.processors.pgp.PGPSignatureVerifier;
 import org.eclipse.equinox.internal.p2.artifact.repository.MirrorRequest;
 import org.eclipse.equinox.internal.p2.artifact.repository.RawMirrorRequest;
 import org.eclipse.equinox.internal.p2.artifact.repository.simple.SimpleArtifactRepository;
@@ -67,10 +75,22 @@
 import org.eclipse.equinox.p2.repository.artifact.IArtifactRepository;
 import org.eclipse.equinox.p2.repository.artifact.IFileArtifactRepository;
 import org.eclipse.equinox.p2.repository.artifact.spi.ArtifactDescriptor;
+import org.eclipse.equinox.p2.repository.spi.PGPPublicKeyService;
 import org.eclipse.equinox.spi.p2.publisher.PublisherHelper;
+import org.eclipse.osgi.signedcontent.SignedContent;
+import org.eclipse.osgi.signedcontent.SignedContentFactory;
+import org.eclipse.osgi.signedcontent.SignerInfo;
+import org.osgi.framework.BundleContext;
+import org.osgi.framework.ServiceReference;
 
 public class MirrorGenerator extends BuilderPhase {
 
+	public static final String SIGNER_FINGERPRINTS = "cbi-signer.fingerprints";
+
+	public static final String SIGNER_PGP_PUBLIC_KEYS = "cbi-pgp.publicKeys";
+
+	public static final String SIGNER_PGP_SIGNATURES = "cbi-pgp.signatures";
+
 	/**
 	 * A request to restore the canonical form after a raw copy of the optimized form
 	 */
@@ -200,8 +220,8 @@ private static boolean canProcessPacked(IArtifactDescriptor desc) {
 	}
 
 	static void mirror(ExecutorService executor, Collection<IArtifactKey> keysToInstall, IArtifactRepository cache,
-			IArtifactRepository source, IFileArtifactRepository dest, Transport transport, PackedStrategy strategy,
-			List<String> errors, IProgressMonitor monitor) {
+			IArtifactRepository source, IFileArtifactRepository dest, boolean isSignerFingerprint,
+			Transport transport, PackedStrategy strategy, List<String> errors, IProgressMonitor monitor) {
 		IQueryResult<IArtifactKey> result = source.query(ArtifactKeyQuery.ALL_KEYS, null);
 		IArtifactKey[] keys = result.toArray(IArtifactKey.class);
 		MonitorUtils.begin(monitor, keys.length * 100);
@@ -281,15 +301,15 @@ static void mirror(ExecutorService executor, Collection<IArtifactKey> keysToInst
 							case SKIP:
 								if (!checkIfTargetPresent(dest, key, false)) {
 									LogUtils.debug("    doing copy of canonical artifact");
-									mirror(sourceForCopy, dest, canonical, new ArtifactDescriptor(canonical), transport,
-											MonitorUtils.subMonitor(monitor, 90));
+									mirror(sourceForCopy, dest, canonical, new ArtifactDescriptor(canonical),
+											isSignerFingerprint, transport, MonitorUtils.subMonitor(monitor, 90));
 								}
 								break;
 							case COPY:
 								if (!checkIfTargetPresent(dest, key, true)) {
 									LogUtils.debug("    doing copy of optimized artifact");
-									mirror(sourceForCopy, dest, optimized, new ArtifactDescriptor(optimized), transport,
-											MonitorUtils.subMonitor(monitor, 90));
+									mirror(sourceForCopy, dest, optimized, new ArtifactDescriptor(optimized),
+											isSignerFingerprint, transport, MonitorUtils.subMonitor(monitor, 90));
 								}
 								break;
 							default:
@@ -309,8 +329,8 @@ static void mirror(ExecutorService executor, Collection<IArtifactKey> keysToInst
 										break;
 								} else {
 									LogUtils.debug("    doing copy of optimized artifact");
-									mirror(sourceForCopy, dest, optimized, new ArtifactDescriptor(optimized), transport,
-											MonitorUtils.subMonitor(monitor, 70));
+									mirror(sourceForCopy, dest, optimized, new ArtifactDescriptor(optimized),
+											isSignerFingerprint, transport, MonitorUtils.subMonitor(monitor, 70));
 								}
 
 								if (isVerify)
@@ -362,8 +382,8 @@ static void mirror(ExecutorService executor, Collection<IArtifactKey> keysToInst
 	}
 
 	static IArtifactDescriptor mirror(IArtifactRepository source, IFileArtifactRepository dest,
-			IArtifactDescriptor sourceDesc, IArtifactDescriptor targetDesc, Transport transport,
-			IProgressMonitor monitor) throws OperationCanceledException, CoreException {
+			IArtifactDescriptor sourceDesc, IArtifactDescriptor targetDesc, boolean signerFingerprint,
+			Transport transport, IProgressMonitor monitor) throws OperationCanceledException, CoreException {
 		if (dest.contains(targetDesc))
 			return targetDesc;
 
@@ -381,6 +401,9 @@ static IArtifactDescriptor mirror(IArtifactRepository source, IFileArtifactRepos
 						isPacked(targetDesc));
 				if (destDesc != null) {
 					updateCheckSum(dest, destDesc);
+					if (signerFingerprint) {
+						addSignatureFingerprint(dest, destDesc);
+					}
 					// All is well.
 					return targetDesc;
 				}
@@ -409,7 +432,8 @@ private static void updateCheckSum(IFileArtifactRepository dest, IArtifactDescri
 		if (!downloadChecksums.containsKey("sha-256")) {
 			File artifactFile = dest.getArtifactFile(destDesc);
 			Map<String, String> caculatedCheckSums = new LinkedHashMap<>();
-			IStatus status = ChecksumUtilities.calculateChecksums(artifactFile, caculatedCheckSums, Set.of("md5"));
+			IStatus status = ChecksumUtilities.calculateChecksums(artifactFile, caculatedCheckSums,
+					Set.of("md5", "sha-1"));
 			if (!status.isMultiStatus()) {
 				throw new CoreException(status);
 			}
@@ -419,6 +443,53 @@ private static void updateCheckSum(IFileArtifactRepository dest, IArtifactDescri
 		}
 	}
 
+	private static void addSignatureFingerprint(IFileArtifactRepository dest, IArtifactDescriptor destDesc)
+			throws CoreException {
+		String classifier = destDesc.getArtifactKey().getClassifier();
+		if ("osgi.bundle".equals(classifier) || "org.eclipse.update.feature".equals(classifier)) {
+			ArtifactDescriptor destinationDescriptor = (ArtifactDescriptor) destDesc;
+
+			String pgpSignatures = destinationDescriptor.getProperty(PGPSignatureVerifier.PGP_SIGNATURES_PROPERTY_NAME);
+			if (pgpSignatures != null) {
+				destinationDescriptor.setProperty(SIGNER_PGP_SIGNATURES, pgpSignatures);
+			}
+
+			String pgpPublicKeys = destinationDescriptor
+					.getProperty(PGPSignatureVerifier.PGP_SIGNER_KEYS_PROPERTY_NAME);
+			if (pgpPublicKeys != null) {
+				destinationDescriptor.setProperty(SIGNER_PGP_PUBLIC_KEYS, pgpPublicKeys);
+			}
+
+			BundleContext context = Engine.getDefault().getBundle().getBundleContext();
+			ServiceReference<SignedContentFactory> contentFactoryRef = context
+					.getServiceReference(SignedContentFactory.class);
+			SignedContentFactory service = context.getService(contentFactoryRef);
+			File artifactFile = dest.getArtifactFile(destDesc);
+			try {
+				SignedContent signedContent = service.getSignedContent(artifactFile);
+				if (signedContent.isSigned()) {
+					List<String> signers = new ArrayList<>();
+					SignerInfo[] signerInfos = signedContent.getSignerInfos();
+					for (SignerInfo signerInfo : signerInfos) {
+						MessageDigest digest = MessageDigest.getInstance("SHA-256");
+						Certificate[] certificateChain = signerInfo.getCertificateChain();
+						for (Certificate certificate : certificateChain) {
+							byte[] encoded = certificate.getEncoded();
+							digest.update(encoded);
+						}
+						signers.add(PGPPublicKeyService.toHex(digest.digest()));
+					}
+					destinationDescriptor.addProperties(Map.of(SIGNER_FINGERPRINTS, String.join(" ", signers)));
+				}
+			} catch (InvalidKeyException | SignatureException | CertificateException | NoSuchAlgorithmException
+					| NoSuchProviderException | IOException e) {
+				throw ExceptionUtils.wrap(e);
+			} finally {
+				context.ungetService(contentFactoryRef);
+			}
+		}
+	}
+
 	private static void unpack(IArtifactRepository source, IFileArtifactRepository target,
 			IArtifactDescriptor optimized, Transport transport, IProgressMonitor monitor) throws CoreException {
 		CanonicalizeRequest request = new CanonicalizeRequest(optimized, source, target, transport);
@@ -485,6 +556,7 @@ public void run(IProgressMonitor monitor) throws CoreException {
 
 		SubMonitor subMon = SubMonitor.convert(monitor, 20 + 100 * contribs.size());
 		boolean artifactErrors = false;
+		boolean isSignerFingerprints = builder.isSignerFingerprints();
 		try {
 			IArtifactRepository tempAr = builder.getTemporaryArtifactRepository(subMon.newChild(10));
 			IFileArtifactRepository aggregationAr = builder.getAggregationArtifactRepository(subMon.newChild(10));
@@ -521,8 +593,8 @@ public void run(IProgressMonitor monitor) throws CoreException {
 						contribMonitor.subTask(msg);
 						IArtifactRepository childAr = builder.getArtifactRepository(repo, contribMonitor.newChild(1,
 								SubMonitor.SUPPRESS_BEGINTASK | SubMonitor.SUPPRESS_SETTASKNAME));
-						mirror(executor, keysToMirror, tempAr, childAr, aggregationAr, getTransport(), packedStrategy,
-								errors, contribMonitor.newChild(94,
+						mirror(executor, keysToMirror, tempAr, childAr, aggregationAr, isSignerFingerprints,
+								getTransport(), packedStrategy, errors, contribMonitor.newChild(94,
 										SubMonitor.SUPPRESS_BEGINTASK | SubMonitor.SUPPRESS_SETTASKNAME));
 					} else
 						MonitorUtils.worked(contribMonitor, 95);
@@ -558,14 +630,14 @@ public void run(IProgressMonitor monitor) throws CoreException {
 			throw ExceptionUtils.fromMessage("Not all artifacts could be mirrored, see log for details");
 	}
 
-	private void xzCompress(IFileArtifactRepository aggregationAr) {
+	public static void xzCompress(IArtifactRepository aggregationAr) {
 		try {
 			LogUtils.info("XZ compressing: " + aggregationAr.getLocation());
 			XZCompressor xzCompressor = new XZCompressor();
 			xzCompressor.setRepoFolder(Paths.get(aggregationAr.getLocation()).toString());
 			xzCompressor.compressRepo();
 		} catch (IOException e) {
-			ExceptionUtils.wrap(e);
+			throw new RuntimeException(e);
 		}
 	}
 
diff --git a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/SignatureCleaner.java b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/SignatureCleaner.java
new file mode 100644
index 000000000..d850c290f
--- /dev/null
+++ b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/SignatureCleaner.java
@@ -0,0 +1,285 @@
+/**
+ * Copyright (c) 2021 Eclipse contributors and others.
+ *
+ * This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License 2.0
+ * which accompanies this distribution, and is available at
+ * https://www.eclipse.org/legal/epl-2.0/
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ */
+package org.eclipse.cbi.p2repo.aggregator.engine;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Consumer;
+
+import org.bouncycastle.bcpg.ArmoredInputStream;
+import org.bouncycastle.bcpg.ArmoredOutputStream;
+import org.bouncycastle.bcpg.BCPGOutputStream;
+import org.bouncycastle.openpgp.PGPCompressedData;
+import org.bouncycastle.openpgp.PGPException;
+import org.bouncycastle.openpgp.PGPObjectFactory;
+import org.bouncycastle.openpgp.PGPPublicKey;
+import org.bouncycastle.openpgp.PGPPublicKeyRing;
+import org.bouncycastle.openpgp.PGPPublicKeyRingCollection;
+import org.bouncycastle.openpgp.PGPRuntimeOperationException;
+import org.bouncycastle.openpgp.PGPSignature;
+import org.bouncycastle.openpgp.PGPSignatureList;
+import org.bouncycastle.openpgp.PGPUtil;
+import org.bouncycastle.openpgp.bc.BcPGPObjectFactory;
+import org.bouncycastle.openpgp.jcajce.JcaPGPObjectFactory;
+import org.eclipse.cbi.p2repo.cli.AbstractCommand;
+import org.eclipse.cbi.p2repo.p2.util.P2Utils;
+import org.eclipse.cbi.p2repo.util.IOUtils;
+import org.eclipse.cbi.p2repo.util.LogUtils;
+import org.eclipse.core.runtime.IProgressMonitor;
+import org.eclipse.core.runtime.IStatus;
+import org.eclipse.core.runtime.Status;
+import org.eclipse.equinox.internal.p2.artifact.processors.pgp.PGPPublicKeyStore;
+import org.eclipse.equinox.internal.p2.artifact.processors.pgp.PGPSignatureVerifier;
+import org.eclipse.equinox.internal.p2.artifact.repository.Activator;
+import org.eclipse.equinox.internal.p2.artifact.repository.simple.SimpleArtifactRepository;
+import org.eclipse.equinox.internal.p2.core.helpers.LogHelper;
+import org.eclipse.equinox.p2.core.IProvisioningAgent;
+import org.eclipse.equinox.p2.metadata.IArtifactKey;
+import org.eclipse.equinox.p2.query.IQueryResult;
+import org.eclipse.equinox.p2.repository.artifact.ArtifactKeyQuery;
+import org.eclipse.equinox.p2.repository.artifact.IArtifactDescriptor;
+import org.eclipse.equinox.p2.repository.artifact.IArtifactRepository;
+import org.eclipse.equinox.p2.repository.artifact.IArtifactRepositoryManager;
+import org.eclipse.equinox.p2.repository.artifact.spi.ArtifactDescriptor;
+import org.eclipse.equinox.p2.repository.spi.PGPPublicKeyService;
+import org.kohsuke.args4j.Option;
+
+public class SignatureCleaner extends AbstractCommand {
+	public enum PGPActionType {
+		DISCARD, KEEP, REPLACE, MERGE
+	}
+
+	@Option(name = "--repositoryLocation", usage = "The repository to clean.")
+	private String repositoryLocation;
+
+	@Option(name = "--rejectedFingerprints", usage = "A comma-separated list of SHA-256 signature fingerprints considered insecure.")
+	private String rejectedFingerprints;
+
+	@Option(name = "--mergePGP", usage = "Specify how to handle PGP keys and signatues. DISCARD them, KEEP the current ones, REPLACE the current ones with the originals, or MERGE the current ones with the originals.")
+	private PGPActionType pgpAction = PGPActionType.REPLACE;
+
+	@Override
+	public String getShortDescription() {
+		return "Cleans up the signatures in the repository as produced when built with --signerFingerprints";
+	}
+
+	@Override
+	protected int run(IProgressMonitor monitor) throws Exception {
+		Path agentLocation = Files.createTempDirectory("signature-clearner");
+		IProvisioningAgent provisioningAgent = P2Utils.createDedicatedProvisioningAgent(agentLocation.toUri());
+			IArtifactRepositoryManager repositoryManager = P2Utils.getRepositoryManager(provisioningAgent,
+					IArtifactRepositoryManager.class);
+			try {
+			IArtifactRepository repository = repositoryManager.loadRepository(Path.of(repositoryLocation).toUri(),
+					monitor);
+
+			Set<String> rejectedFingerprints = this.rejectedFingerprints == null ? Set.of()
+					: new HashSet<>(Arrays.asList(this.rejectedFingerprints.split(",")));
+
+			IQueryResult<IArtifactKey> keys = repository.query(ArtifactKeyQuery.ALL_KEYS, monitor);
+			for (IArtifactKey key : keys) {
+				IArtifactDescriptor[] artifactDescriptors = repository.getArtifactDescriptors(key);
+				for (IArtifactDescriptor artifactDescriptor : artifactDescriptors) {
+					ArtifactDescriptor descriptor = (ArtifactDescriptor) artifactDescriptor;
+
+					String pgpPublicKeys = descriptor.getProperty(PGPSignatureVerifier.PGP_SIGNER_KEYS_PROPERTY_NAME);
+					String pgpSignatures = descriptor.getProperty(PGPSignatureVerifier.PGP_SIGNATURES_PROPERTY_NAME);
+
+					String cbiPGPPublicKeys = descriptor.getProperty(MirrorGenerator.SIGNER_PGP_PUBLIC_KEYS);
+					String cbiPGPSignatures = descriptor.getProperty(MirrorGenerator.SIGNER_PGP_SIGNATURES);
+
+					String signerFingerprints = descriptor.getProperty(MirrorGenerator.SIGNER_FINGERPRINTS);
+					if (signerFingerprints != null) {
+						descriptor.setProperty(MirrorGenerator.SIGNER_FINGERPRINTS, null);
+						Set<String> fingerprints = rejectedFingerprints == null ? Set.of()
+								: new HashSet<>(Arrays.asList(signerFingerprints.split(" ")));
+						fingerprints.removeAll(rejectedFingerprints);
+						if (fingerprints.isEmpty()) {
+							LogUtils.info("All signatures rejected " + artifactDescriptor);
+						} else {
+							// If there are valid jar signatures, remove the PGP signature, but only if there wasn't originally one.
+							// E.g., jars that are only JCE-signed from Maven are also PGP signed.
+							if (pgpPublicKeys != null && cbiPGPPublicKeys == null) {
+								descriptor.setProperty(PGPSignatureVerifier.PGP_SIGNER_KEYS_PROPERTY_NAME, null);
+								pgpPublicKeys = null;
+							}
+							if (pgpSignatures != null && cbiPGPSignatures == null) {
+								descriptor.setProperty(PGPSignatureVerifier.PGP_SIGNATURES_PROPERTY_NAME, null);
+								pgpSignatures = null;
+							}
+						}
+					}
+
+					if (cbiPGPPublicKeys != null) {
+						descriptor.setProperty(MirrorGenerator.SIGNER_PGP_PUBLIC_KEYS, null);
+						descriptor.setProperty(PGPSignatureVerifier.PGP_SIGNER_KEYS_PROPERTY_NAME,
+								getComposedPGPKeys(pgpPublicKeys, cbiPGPPublicKeys));
+					}
+
+					if (cbiPGPSignatures != null) {
+						descriptor.setProperty(MirrorGenerator.SIGNER_PGP_SIGNATURES, null);
+
+						descriptor.setProperty(PGPSignatureVerifier.PGP_SIGNATURES_PROPERTY_NAME,
+								getCompositeSignatures(pgpSignatures, cbiPGPSignatures));
+					}
+				}
+			}
+
+			((SimpleArtifactRepository) repository).save();
+			MirrorGenerator.xzCompress(repository);
+		} finally {
+			P2Utils.ungetRepositoryManager(provisioningAgent, repositoryManager);
+			P2Utils.stopProvisioningAgent(provisioningAgent);
+			IOUtils.delete(agentLocation);
+		}
+
+		return 0;
+	}
+
+	@SuppressWarnings("unchecked")
+	private String getComposedPGPKeys(String key1, String key2) throws IOException {
+		switch (pgpAction) {
+			case DISCARD: {
+				return null;
+			}
+			case KEEP: {
+				if (key1 != null) {
+					return key1;
+				}
+				break;
+			}
+			case REPLACE: {
+				if (key2 != null) {
+					return key2;
+				}
+				break;
+			}
+			case MERGE: {
+			}
+		}
+
+		if (key1 == null) {
+			return key2;
+		}
+
+		if (key2 == null) {
+			return key1;
+		}
+
+		PGPPublicKeyStore keyStore = new PGPPublicKeyStore();
+		for (String key : new String[] { key1, key2 }) {
+			try (InputStream stream = PGPUtil
+					.getDecoderStream(new ByteArrayInputStream(key.getBytes(StandardCharsets.US_ASCII)))) {
+				new JcaPGPObjectFactory(stream).iterator().forEachRemaining(o -> {
+					if (o instanceof PGPPublicKeyRingCollection) {
+						collectKeys((PGPPublicKeyRingCollection) o, keyStore::addKey);
+					}
+					if (o instanceof PGPPublicKeyRing) {
+						collectKeys((PGPPublicKeyRing) o, keyStore::addKey);
+					}
+					if (o instanceof PGPPublicKey) {
+						keyStore.addKey((PGPPublicKey) o);
+					}
+				});
+			} catch (IOException | PGPRuntimeOperationException e) {
+				LogHelper.log(new Status(IStatus.ERROR, Activator.ID, e.getMessage(), e));
+			}
+		}
+
+		String result = keyStore.toArmoredString().replace("\r\n", "\n")
+				.replaceAll("(-----BEGIN [^-]+-----)\nVersion: [^\n]*", "$1").trim();
+		return result;
+	}
+
+	private static void collectKeys(PGPPublicKeyRingCollection pgpPublicKeyRingCollection,
+			Consumer<PGPPublicKey> collector) {
+		pgpPublicKeyRingCollection.iterator().forEachRemaining(keyring -> collectKeys(keyring, collector));
+	}
+
+	private static void collectKeys(PGPPublicKeyRing pgpPublicKeyRing, Consumer<PGPPublicKey> collector) {
+		pgpPublicKeyRing.getPublicKeys().forEachRemaining(collector::accept);
+	}
+
+	private String getCompositeSignatures(String signature1, String signature2) throws IOException, PGPException {
+		switch (pgpAction) {
+			case DISCARD: {
+				return null;
+			}
+			case KEEP: {
+				if (signature1 != null) {
+					return signature1;
+				}
+				break;
+			}
+			case REPLACE: {
+				if (signature2 != null) {
+					return signature2;
+				}
+				break;
+			}
+			case MERGE: {
+			}
+		}
+
+		if (signature1 == null) {
+
+			return signature2;
+		}
+
+		if (signature2 == null) {
+			return signature1;
+		}
+
+		Map<String, PGPSignature> signatures = new LinkedHashMap<>();
+		for (String signature : new String[] { signature1, signature2 }) {
+			try (InputStream in = new ArmoredInputStream(
+					new ByteArrayInputStream(signature.getBytes(StandardCharsets.US_ASCII)))) {
+				PGPObjectFactory pgpFactory = new BcPGPObjectFactory(in);
+				Object o = pgpFactory.nextObject();
+				PGPSignatureList signatureList = new PGPSignatureList(new PGPSignature[0]);
+				if (o instanceof PGPCompressedData) {
+					PGPCompressedData pgpCompressData = (PGPCompressedData) o;
+					pgpFactory = new BcPGPObjectFactory(pgpCompressData.getDataStream());
+					signatureList = (PGPSignatureList) pgpFactory.nextObject();
+				} else if (o instanceof PGPSignatureList) {
+					signatureList = (PGPSignatureList) o;
+				}
+				for (Iterator<PGPSignature> it = signatureList.iterator(); it.hasNext();) {
+					PGPSignature s = it.next();
+					signatures.put(PGPPublicKeyService.toHex(s.getEncoded()), s);
+				}
+			}
+		}
+
+		ByteArrayOutputStream out = new ByteArrayOutputStream();
+		try (ArmoredOutputStream aOut = new ArmoredOutputStream(out)) {
+			BCPGOutputStream bOut = new BCPGOutputStream(aOut);
+			for (PGPSignature pgpSignature : signatures.values()) {
+				pgpSignature.encode(bOut);
+			}
+		}
+
+		String result = new String(out.toByteArray(), StandardCharsets.US_ASCII).replace("\r\n", "\n")
+				.replaceAll("(-----BEGIN [^-]+-----)\nVersion: [^\n]*", "$1").trim();
+		return result;
+	}
+}
diff --git a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/ValidationSetVerifier.java b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/ValidationSetVerifier.java
index 16bb1e2bb..f26d3d408 100644
--- a/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/ValidationSetVerifier.java
+++ b/plugins/org.eclipse.cbi.p2repo.aggregator.engine/src/org/eclipse/cbi/p2repo/aggregator/engine/ValidationSetVerifier.java
@@ -644,7 +644,8 @@ IInstallableUnit resolvePartialIU(IInstallableUnit iu, SubMonitor subMon) throws
 			IArtifactKey key = artifacts.iterator().next();
 			ArrayList<String> errors = new ArrayList<String>();
 			ExecutorService executor = Executors.newSingleThreadExecutor();
-			MirrorGenerator.mirror(executor, artifacts, null, sourceAr, tempAr, getBuilder().getTransport(),
+			MirrorGenerator.mirror(executor, artifacts, null, sourceAr, tempAr, getBuilder().isSignerFingerprints(),
+					getBuilder().getTransport(),
 					PackedStrategy.UNPACK_AS_SIBLING, errors, subMon.newChild(1));
 			executor.shutdownNow();
 			int numErrors = errors.size();
diff --git a/plugins/org.eclipse.cbi.p2repo.cli/src/org/eclipse/cbi/p2repo/cli/Headless.java b/plugins/org.eclipse.cbi.p2repo.cli/src/org/eclipse/cbi/p2repo/cli/Headless.java
index 64d3b2c74..26f288cc0 100644
--- a/plugins/org.eclipse.cbi.p2repo.cli/src/org/eclipse/cbi/p2repo/cli/Headless.java
+++ b/plugins/org.eclipse.cbi.p2repo.cli/src/org/eclipse/cbi/p2repo/cli/Headless.java
@@ -83,7 +83,7 @@ private static IConfigurationElement[] getCommandConfigurations() {
 
 	public static int run(String args[], boolean verbose) throws Exception {
 		try {
-			if(args.length == 0 || !args[0].matches("^(?i:[a-z_])+$"))
+			if (args.length == 0 || !args[0].matches("^(?i:[a-z_][-a-z_]+)$"))
 				throw new CliException("No command was specified");
 
 			AbstractCommand command = getCommand(args[0]);