static {

SharedSecrets.setJavaSecuritySignatureAccess(

new JavaSecuritySignatureAccess() {

@Override

public void initVerify(Signature s, PublicKey publicKey,

AlgorithmParameterSpec params)

throws InvalidKeyException,

InvalidAlgorithmParameterException {

s.initVerify(publicKey, params);

}

@Override

public void initVerify(Signature s,

java.security.cert.Certificate certificate,

AlgorithmParameterSpec params)

throws InvalidKeyException,

InvalidAlgorithmParameterException {

s.initVerify(certificate, params);

}

@Override

public void initSign(Signature s, PrivateKey privateKey,

AlgorithmParameterSpec params, SecureRandom random)

throws InvalidKeyException,

InvalidAlgorithmParameterException {

s.initSign(privateKey, params, random);

}

});

}

private static final Debug debug =

Debug.getInstance("jca", "Signature");

private static final Debug pdebug =

Debug.getInstance("provider", "Provider");

private static final boolean skipDebug =

Debug.isOn("engine=") && !Debug.isOn("signature");

/*

private String algorithm;

// The provider

Provider provider;

/**

protected static final int UNINITIALIZED = 0;

/**

protected static final int SIGN = 2;

/**

protected static final int VERIFY = 3;

/**

protected int state = UNINITIALIZED;

/**

protected Signature(String algorithm) {

this.algorithm = algorithm;

}

/**

public static Signature getInstance(String algorithm)

throws NoSuchAlgorithmException {

Objects.requireNonNull(algorithm, "null algorithm name");

if (!CryptoAlgorithmConstraints.permits("Signature", algorithm)) {

throw new NoSuchAlgorithmException(algorithm + " is disabled");

}

Iterator<Service> t = GetInstance.getServices("Signature", algorithm);

if (!t.hasNext()) {

throw new NoSuchAlgorithmException

(algorithm + " Signature not available");

}

// try services until we find an Spi or a working Signature subclass

NoSuchAlgorithmException failure;

do {

Service s = t.next();

if (isSpi(s)) { // delayed provider selection

return new Delegate(s, t, algorithm);

} else {

// must be a subclass of Signature, disable dynamic selection

try {

Instance instance =

GetInstance.getInstance(s, SignatureSpi.class);

return getInstance(instance, algorithm);

} catch (NoSuchAlgorithmException e) {

failure = e;

}

}

} while (t.hasNext());

throw failure;

}

private static Signature getInstance(Instance instance, String algorithm) {

Signature sig;

if (instance.impl instanceof Signature) {

sig = (Signature)instance.impl;

sig.algorithm = algorithm;

} else {

SignatureSpi spi = (SignatureSpi)instance.impl;

sig = Delegate.of(spi, algorithm);

}

sig.provider = instance.provider;

return sig;

}

private static final Map<String,Boolean> signatureInfo;

static {

signatureInfo = new ConcurrentHashMap<>();

// pre-initialize with values for our SignatureSpi implementations

signatureInfo.put("sun.security.provider.DSA$RawDSA", true);

signatureInfo.put("sun.security.provider.DSA$SHA1withDSA", true);

signatureInfo.put("sun.security.rsa.RSASignature$MD2withRSA", true);

signatureInfo.put("sun.security.rsa.RSASignature$MD5withRSA", true);

signatureInfo.put("sun.security.rsa.RSASignature$SHA1withRSA", true);

signatureInfo.put("sun.security.rsa.RSASignature$SHA256withRSA", true);

signatureInfo.put("sun.security.rsa.RSASignature$SHA384withRSA", true);

signatureInfo.put("sun.security.rsa.RSASignature$SHA512withRSA", true);

signatureInfo.put("sun.security.rsa.RSAPSSSignature", true);

signatureInfo.put("sun.security.pkcs11.P11Signature", true);

}

private static boolean isSpi(Service s) {

String className = s.getClassName();

Boolean result = signatureInfo.get(className);

if (result == null) {

try {

Object instance = s.newInstance(null);

// Signature extends SignatureSpi

// so it is a "real" Spi if it is an

// instance of SignatureSpi but not Signature

boolean r = (instance instanceof SignatureSpi)

&& (!(instance instanceof Signature));

if ((debug != null) && (!r)) {

debug.println("Not a SignatureSpi " + className);

debug.println("Delayed provider selection may not be "

+ "available for algorithm " + s.getAlgorithm());

}

result = Boolean.valueOf(r);

signatureInfo.put(className, result);

} catch (Exception e) {

// something is wrong, assume not an SPI

return false;

}

}

return result.booleanValue();

}

/**

public static Signature getInstance(String algorithm, String provider)

throws NoSuchAlgorithmException, NoSuchProviderException {

Objects.requireNonNull(algorithm, "null algorithm name");

if (!CryptoAlgorithmConstraints.permits("Signature", algorithm)) {

throw new NoSuchAlgorithmException(algorithm + " is disabled");

}

Instance instance = GetInstance.getInstance

("Signature", SignatureSpi.class, algorithm, provider);

return getInstance(instance, algorithm);

}

/**

public static Signature getInstance(String algorithm, Provider provider)

throws NoSuchAlgorithmException {

Objects.requireNonNull(algorithm, "null algorithm name");

if (!CryptoAlgorithmConstraints.permits("Signature", algorithm)) {

throw new NoSuchAlgorithmException(algorithm + " is disabled");

}

Instance instance = GetInstance.getInstance

("Signature", SignatureSpi.class, algorithm, provider);

return getInstance(instance, algorithm);

}

/**

public final Provider getProvider() {

chooseFirstProvider();

return this.provider;

}

private String getProviderName() {

return (provider == null) ? "(no provider)" : provider.getName();

}

void chooseFirstProvider() {

// empty, overridden in Delegate

}

/**

public final void initVerify(PublicKey publicKey)

throws InvalidKeyException {

engineInitVerify(publicKey);

state = VERIFY;

if (!skipDebug && pdebug != null) {

pdebug.println("Signature." + algorithm +

" verification algorithm from: " + getProviderName());

}

}

/**

final void initVerify(PublicKey publicKey, AlgorithmParameterSpec params)

throws InvalidKeyException, InvalidAlgorithmParameterException {

engineInitVerify(publicKey, params);

state = VERIFY;

if (!skipDebug && pdebug != null) {

pdebug.println("Signature." + algorithm +

" verification algorithm from: " + getProviderName());

}

}

private static PublicKey getPublicKeyFromCert(Certificate cert)

throws InvalidKeyException {

// If the certificate is of type X509Certificate,

// we should check whether it has a Key Usage

// extension marked as critical.

//if (cert instanceof java.security.cert.X509Certificate) {

if (cert instanceof X509Certificate xcert) {

// Check whether the cert has a key usage extension

// marked as a critical extension.

// The OID for KeyUsage extension is 2.5.29.15.

Set<String> critSet = xcert.getCriticalExtensionOIDs();

if (critSet != null && !critSet.isEmpty()

&& critSet.contains(KnownOIDs.KeyUsage.value())) {

boolean[] keyUsageInfo = xcert.getKeyUsage();

// keyUsageInfo[0] is for digitalSignature.

if ((keyUsageInfo != null) && (!keyUsageInfo[0]))

throw new InvalidKeyException("Wrong key usage");

}

}

return cert.getPublicKey();

}

/**

public final void initVerify(Certificate certificate)

throws InvalidKeyException {

engineInitVerify(getPublicKeyFromCert(certificate));

state = VERIFY;

if (!skipDebug && pdebug != null) {

pdebug.println("Signature." + algorithm +

" verification algorithm from: " + getProviderName());

}

}

/**

final void initVerify(Certificate certificate,

AlgorithmParameterSpec params)

throws InvalidKeyException, InvalidAlgorithmParameterException {

engineInitVerify(getPublicKeyFromCert(certificate), params);

state = VERIFY;

if (!skipDebug && pdebug != null) {

pdebug.println("Signature." + algorithm +

" verification algorithm from: " + getProviderName());

}

}

/**

public final void initSign(PrivateKey privateKey)

throws InvalidKeyException {

engineInitSign(privateKey);

state = SIGN;

if (!skipDebug && pdebug != null) {

pdebug.println("Signature." + algorithm +

" signing algorithm from: " + getProviderName());

}

}

/**

public final void initSign(PrivateKey privateKey, SecureRandom random)

throws InvalidKeyException {

engineInitSign(privateKey, random);

state = SIGN;

if (!skipDebug && pdebug != null) {

pdebug.println("Signature." + algorithm +

" signing algorithm from: " + getProviderName());

}

}

/**

final void initSign(PrivateKey privateKey,

AlgorithmParameterSpec params, SecureRandom random)

throws InvalidKeyException, InvalidAlgorithmParameterException {

engineInitSign(privateKey, params, random);

state = SIGN;

if (!skipDebug && pdebug != null) {

pdebug.println("Signature." + algorithm +

" signing algorithm from: " + getProviderName());

}

}

/**

public final byte[] sign() throws SignatureException {

if (state == SIGN) {

return engineSign();

}

throw new SignatureException("object not initialized for " +

"signing");

}

/**

public final int sign(byte[] outbuf, int offset, int len)

throws SignatureException {

if (outbuf == null) {

throw new IllegalArgumentException("No output buffer given");

}

if (offset < 0 || len < 0) {

throw new IllegalArgumentException("offset or len is less than 0");

}

if (outbuf.length - offset < len) {

throw new IllegalArgumentException

("Output buffer too small for specified offset and length");

}

if (state != SIGN) {

throw new SignatureException("object not initialized for " +

"signing");

}

return engineSign(outbuf, offset, len);

}

/**

public final boolean verify(byte[] signature) throws SignatureException {

if (state == VERIFY) {

return engineVerify(signature);

}

throw new SignatureException("object not initialized for " +

"verification");

}

/**

public final boolean verify(byte[] signature, int offset, int length)

throws SignatureException {

if (state == VERIFY) {

if (signature == null) {

throw new IllegalArgumentException("signature is null");

}

if (offset < 0 || length < 0) {

throw new IllegalArgumentException

("offset or length is less than 0");

}

if (signature.length - offset < length) {

throw new IllegalArgumentException

("signature too small for specified offset and length");

}

return engineVerify(signature, offset, length);

}

throw new SignatureException("object not initialized for " +

"verification");

}

/**

public final void update(byte b) throws SignatureException {

if (state == VERIFY || state == SIGN) {

engineUpdate(b);

} else {

throw new SignatureException("object not initialized for "

+ "signature or verification");

}

}

/**

public final void update(byte[] data) throws SignatureException {

update(data, 0, data.length);

}

/**

public final void update(byte[] data, int off, int len)

throws SignatureException {

if (state == SIGN || state == VERIFY) {

if (data == null) {

throw new IllegalArgumentException("data is null");

}

if (off < 0 || len < 0) {

throw new IllegalArgumentException("off or len is less than 0");

}

if (data.length - off < len) {

throw new IllegalArgumentException

("data too small for specified offset and length");

}

engineUpdate(data, off, len);

} else {

throw new SignatureException("object not initialized for "

+ "signature or verification");

}

}

/**

public final void update(ByteBuffer data) throws SignatureException {

if ((state != SIGN) && (state != VERIFY)) {

throw new SignatureException("object not initialized for "

+ "signature or verification");

}

if (data == null) {

throw new NullPointerException();

}

engineUpdate(data);

}

/**

public final String getAlgorithm() {

return this.algorithm;

}

/**

public String toString() {

String initState = switch (state) {

case UNINITIALIZED -> "<not initialized>";

case VERIFY -> "<initialized for verifying>";

case SIGN -> "<initialized for signing>";

default -> "";

};

return "Signature object: " + getAlgorithm() + initState;

}

/**

@Deprecated

public final void setParameter(String param, Object value)

throws InvalidParameterException {

engineSetParameter(param, value);

}

/**

public final void setParameter(AlgorithmParameterSpec params)

throws InvalidAlgorithmParameterException {

engineSetParameter(params);

}

/**