{"action":"created","comment":{"url":"https://api.github.com/repos/spotify/helios/pulls/comments/43172915","id":43172915,"diff_hunk":"@@ -0,0 +1,131 @@\n+/*\n+ * Copyright (c) 2015 Spotify AB.\n+ *\n+ * Licensed under the Apache License, Version 2.0 (the \"License\");\n+ * you may not use this file except in compliance with the License.\n+ * You may obtain a copy of the License at\n+ *\n+ *   http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing,\n+ * software distributed under the License is distributed on an\n+ * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n+ * KIND, either express or implied.  See the License for the\n+ * specific language governing permissions and limitations\n+ * under the License.\n+ */\n+\n+package com.spotify.helios.client.tls;\n+\n+import com.google.common.base.Throwables;\n+import com.google.common.collect.Lists;\n+\n+import com.spotify.sshagentproxy.Identity;\n+\n+import org.bouncycastle.cert.X509CertificateHolder;\n+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;\n+import org.bouncycastle.crypto.tls.Certificate;\n+import org.bouncycastle.crypto.tls.CertificateRequest;\n+import org.bouncycastle.crypto.tls.DefaultTlsClient;\n+import org.bouncycastle.crypto.tls.HashAlgorithm;\n+import org.bouncycastle.crypto.tls.SignatureAlgorithm;\n+import org.bouncycastle.crypto.tls.SignatureAndHashAlgorithm;\n+import org.bouncycastle.crypto.tls.TlsAuthentication;\n+import org.bouncycastle.crypto.tls.TlsCredentials;\n+import org.bouncycastle.crypto.tls.TlsSignerCredentials;\n+\n+import java.io.IOException;\n+import java.security.cert.CertificateException;\n+import java.security.cert.X509Certificate;\n+import java.util.List;\n+\n+/**\n+ * A {@link org.bouncycastle.crypto.tls.TlsClient} that uses an SSH agent identity for client\n+ * authentication. An X509 certificate is generated based on the SSH agent identity, and the\n+ * handshake record is sent to the local SSH agent to be signed.\n+ */\n+class SshAgentTlsClient extends DefaultTlsClient {\n+\n+  private static final SignatureAndHashAlgorithm ALGO = new SignatureAndHashAlgorithm(\n+      HashAlgorithm.sha1, SignatureAlgorithm.rsa);\n+\n+  private final String username;\n+  private final Identity identity;\n+  private final RecordingTlsClientProtocol protocol;\n+\n+  private X509Certificate[] serverCertificates;\n+\n+  public SshAgentTlsClient(final String username, final Identity identity,\n+                           final RecordingTlsClientProtocol protocol) {\n+    super();\n+    this.username = username;\n+    this.identity = identity;\n+    this.protocol = protocol;\n+  }\n+\n+  public RecordingTlsClientProtocol getProtocol() {\n+    return protocol;\n+  }\n+\n+  public X509Certificate[] getServerCertificates() {\n+    return serverCertificates;\n+  }\n+\n+  @Override\n+  public TlsAuthentication getAuthentication() throws IOException {\n+    return new SshAgentTlsAuthentication();\n+  }\n+\n+  private class SshAgentTlsAuthentication implements TlsAuthentication {\n+\n+    private final Certificate certificate;\n+\n+    public SshAgentTlsAuthentication() {\n+      certificate = X509CertificateFactory.get(username, identity);\n+    }\n+\n+    @Override\n+    public void notifyServerCertificate(final Certificate serverCertificate)\n+        throws IOException {\n+      final JcaX509CertificateConverter converter =\n+          new JcaX509CertificateConverter().setProvider(\"BC\");\n+\n+      final List<X509Certificate> x509Certs = Lists.newArrayList();\n+      try {\n+        for (final org.bouncycastle.asn1.x509.Certificate cert :\n+            serverCertificate.getCertificateList()) {\n+          x509Certs.add(converter.getCertificate(new X509CertificateHolder(cert)));\n+        }\n+      } catch (CertificateException e) {\n+        throw Throwables.propagate(e);","path":"helios-client/src/main/java/com/spotify/helios/client/tls/SshAgentTlsClient.java","position":100,"original_position":100,"commit_id":"ceb70a8e75a1cd8c52b21080467a32ad74940cb6","original_commit_id":"ceb70a8e75a1cd8c52b21080467a32ad74940cb6","user":{"login":"mattnworb","id":113840,"avatar_url":"https://avatars.githubusercontent.com/u/113840?v=3","gravatar_id":"","url":"https://api.github.com/users/mattnworb","html_url":"https://github.com/mattnworb","followers_url":"https://api.github.com/users/mattnworb/followers","following_url":"https://api.github.com/users/mattnworb/following{/other_user}","gists_url":"https://api.github.com/users/mattnworb/gists{/gist_id}","starred_url":"https://api.github.com/users/mattnworb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattnworb/subscriptions","organizations_url":"https://api.github.com/users/mattnworb/orgs","repos_url":"https://api.github.com/users/mattnworb/repos","events_url":"https://api.github.com/users/mattnworb/events{/privacy}","received_events_url":"https://api.github.com/users/mattnworb/received_events","type":"User","site_admin":false},"body":"since the interface has `throws IOException` should probably package any exception as that type","created_at":"2015-10-27T19:22:39Z","updated_at":"2015-10-27T19:22:39Z","html_url":"https://github.com/spotify/helios/pull/717#discussion_r43172915","pull_request_url":"https://api.github.com/repos/spotify/helios/pulls/717","_links":{"self":{"href":"https://api.github.com/repos/spotify/helios/pulls/comments/43172915"},"html":{"href":"https://github.com/spotify/helios/pull/717#discussion_r43172915"},"pull_request":{"href":"https://api.github.com/repos/spotify/helios/pulls/717"}}},"pull_request":{"url":"https://api.github.com/repos/spotify/helios/pulls/717","id":48916061,"html_url":"https://github.com/spotify/helios/pull/717","diff_url":"https://github.com/spotify/helios/pull/717.diff","patch_url":"https://github.com/spotify/helios/pull/717.patch","issue_url":"https://api.github.com/repos/spotify/helios/issues/717","number":717,"state":"open","locked":false,"title":"client: Use ssh-agent identity for TLS client auth","user":{"login":"rohansingh","id":615175,"avatar_url":"https://avatars.githubusercontent.com/u/615175?v=3","gravatar_id":"","url":"https://api.github.com/users/rohansingh","html_url":"https://github.com/rohansingh","followers_url":"https://api.github.com/users/rohansingh/followers","following_url":"https://api.github.com/users/rohansingh/following{/other_user}","gists_url":"https://api.github.com/users/rohansingh/gists{/gist_id}","starred_url":"https://api.github.com/users/rohansingh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rohansingh/subscriptions","organizations_url":"https://api.github.com/users/rohansingh/orgs","repos_url":"https://api.github.com/users/rohansingh/repos","events_url":"https://api.github.com/users/rohansingh/events{/privacy}","received_events_url":"https://api.github.com/users/rohansingh/received_events","type":"User","site_admin":false},"body":"Use the local SSH agent identity to generate a self-signed certificate for\nTLS client authentication, and sign the handshake hash with ssh-agent.\n\nThis lets the client setup a secure SSL connection and prove ownership of\nits SSH public key. It is up to the server to verify the public key against\na known-good list (like in LDAP).","created_at":"2015-10-27T18:55:55Z","updated_at":"2015-10-27T19:22:39Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e4a8bbc1fe8d182ad7c827b78ca4bbcc8755e7f5","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/spotify/helios/pulls/717/commits","review_comments_url":"https://api.github.com/repos/spotify/helios/pulls/717/comments","review_comment_url":"https://api.github.com/repos/spotify/helios/pulls/comments{/number}","comments_url":"https://api.github.com/repos/spotify/helios/issues/717/comments","statuses_url":"https://api.github.com/repos/spotify/helios/statuses/ceb70a8e75a1cd8c52b21080467a32ad74940cb6","head":{"label":"spotify:rohan/tls","ref":"rohan/tls","sha":"ceb70a8e75a1cd8c52b21080467a32ad74940cb6","user":{"login":"spotify","id":251374,"avatar_url":"https://avatars.githubusercontent.com/u/251374?v=3","gravatar_id":"","url":"https://api.github.com/users/spotify","html_url":"https://github.com/spotify","followers_url":"https://api.github.com/users/spotify/followers","following_url":"https://api.github.com/users/spotify/following{/other_user}","gists_url":"https://api.github.com/users/spotify/gists{/gist_id}","starred_url":"https://api.github.com/users/spotify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spotify/subscriptions","organizations_url":"https://api.github.com/users/spotify/orgs","repos_url":"https://api.github.com/users/spotify/repos","events_url":"https://api.github.com/users/spotify/events{/privacy}","received_events_url":"https://api.github.com/users/spotify/received_events","type":"Organization","site_admin":false},"repo":{"id":20171642,"name":"helios","full_name":"spotify/helios","owner":{"login":"spotify","id":251374,"avatar_url":"https://avatars.githubusercontent.com/u/251374?v=3","gravatar_id":"","url":"https://api.github.com/users/spotify","html_url":"https://github.com/spotify","followers_url":"https://api.github.com/users/spotify/followers","following_url":"https://api.github.com/users/spotify/following{/other_user}","gists_url":"https://api.github.com/users/spotify/gists{/gist_id}","starred_url":"https://api.github.com/users/spotify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spotify/subscriptions","organizations_url":"https://api.github.com/users/spotify/orgs","repos_url":"https://api.github.com/users/spotify/repos","events_url":"https://api.github.com/users/spotify/events{/privacy}","received_events_url":"https://api.github.com/users/spotify/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/spotify/helios","description":"Docker container orchestration platform","fork":false,"url":"https://api.github.com/repos/spotify/helios","forks_url":"https://api.github.com/repos/spotify/helios/forks","keys_url":"https://api.github.com/repos/spotify/helios/keys{/key_id}","collaborators_url":"https://api.github.com/repos/spotify/helios/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/spotify/helios/teams","hooks_url":"https://api.github.com/repos/spotify/helios/hooks","issue_events_url":"https://api.github.com/repos/spotify/helios/issues/events{/number}","events_url":"https://api.github.com/repos/spotify/helios/events","assignees_url":"https://api.github.com/repos/spotify/helios/assignees{/user}","branches_url":"https://api.github.com/repos/spotify/helios/branches{/branch}","tags_url":"https://api.github.com/repos/spotify/helios/tags","blobs_url":"https://api.github.com/repos/spotify/helios/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/spotify/helios/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/spotify/helios/git/refs{/sha}","trees_url":"https://api.github.com/repos/spotify/helios/git/trees{/sha}","statuses_url":"https://api.github.com/repos/spotify/helios/statuses/{sha}","languages_url":"https://api.github.com/repos/spotify/helios/languages","stargazers_url":"https://api.github.com/repos/spotify/helios/stargazers","contributors_url":"https://api.github.com/repos/spotify/helios/contributors","subscribers_url":"https://api.github.com/repos/spotify/helios/subscribers","subscription_url":"https://api.github.com/repos/spotify/helios/subscription","commits_url":"https://api.github.com/repos/spotify/helios/commits{/sha}","git_commits_url":"https://api.github.com/repos/spotify/helios/git/commits{/sha}","comments_url":"https://api.github.com/repos/spotify/helios/comments{/number}","issue_comment_url":"https://api.github.com/repos/spotify/helios/issues/comments{/number}","contents_url":"https://api.github.com/repos/spotify/helios/contents/{+path}","compare_url":"https://api.github.com/repos/spotify/helios/compare/{base}...{head}","merges_url":"https://api.github.com/repos/spotify/helios/merges","archive_url":"https://api.github.com/repos/spotify/helios/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/spotify/helios/downloads","issues_url":"https://api.github.com/repos/spotify/helios/issues{/number}","pulls_url":"https://api.github.com/repos/spotify/helios/pulls{/number}","milestones_url":"https://api.github.com/repos/spotify/helios/milestones{/number}","notifications_url":"https://api.github.com/repos/spotify/helios/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/spotify/helios/labels{/name}","releases_url":"https://api.github.com/repos/spotify/helios/releases{/id}","created_at":"2014-05-26T02:29:06Z","updated_at":"2015-10-27T16:19:11Z","pushed_at":"2015-10-27T19:16:46Z","git_url":"git://github.com/spotify/helios.git","ssh_url":"git@github.com:spotify/helios.git","clone_url":"https://github.com/spotify/helios.git","svn_url":"https://github.com/spotify/helios","homepage":null,"size":12985,"stargazers_count":1089,"watchers_count":1089,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":79,"mirror_url":null,"open_issues_count":29,"forks":79,"open_issues":29,"watchers":1089,"default_branch":"master"}},"base":{"label":"spotify:master","ref":"master","sha":"b2d0628773737e200e7355d760b1fbe9715853a9","user":{"login":"spotify","id":251374,"avatar_url":"https://avatars.githubusercontent.com/u/251374?v=3","gravatar_id":"","url":"https://api.github.com/users/spotify","html_url":"https://github.com/spotify","followers_url":"https://api.github.com/users/spotify/followers","following_url":"https://api.github.com/users/spotify/following{/other_user}","gists_url":"https://api.github.com/users/spotify/gists{/gist_id}","starred_url":"https://api.github.com/users/spotify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spotify/subscriptions","organizations_url":"https://api.github.com/users/spotify/orgs","repos_url":"https://api.github.com/users/spotify/repos","events_url":"https://api.github.com/users/spotify/events{/privacy}","received_events_url":"https://api.github.com/users/spotify/received_events","type":"Organization","site_admin":false},"repo":{"id":20171642,"name":"helios","full_name":"spotify/helios","owner":{"login":"spotify","id":251374,"avatar_url":"https://avatars.githubusercontent.com/u/251374?v=3","gravatar_id":"","url":"https://api.github.com/users/spotify","html_url":"https://github.com/spotify","followers_url":"https://api.github.com/users/spotify/followers","following_url":"https://api.github.com/users/spotify/following{/other_user}","gists_url":"https://api.github.com/users/spotify/gists{/gist_id}","starred_url":"https://api.github.com/users/spotify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spotify/subscriptions","organizations_url":"https://api.github.com/users/spotify/orgs","repos_url":"https://api.github.com/users/spotify/repos","events_url":"https://api.github.com/users/spotify/events{/privacy}","received_events_url":"https://api.github.com/users/spotify/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/spotify/helios","description":"Docker container orchestration platform","fork":false,"url":"https://api.github.com/repos/spotify/helios","forks_url":"https://api.github.com/repos/spotify/helios/forks","keys_url":"https://api.github.com/repos/spotify/helios/keys{/key_id}","collaborators_url":"https://api.github.com/repos/spotify/helios/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/spotify/helios/teams","hooks_url":"https://api.github.com/repos/spotify/helios/hooks","issue_events_url":"https://api.github.com/repos/spotify/helios/issues/events{/number}","events_url":"https://api.github.com/repos/spotify/helios/events","assignees_url":"https://api.github.com/repos/spotify/helios/assignees{/user}","branches_url":"https://api.github.com/repos/spotify/helios/branches{/branch}","tags_url":"https://api.github.com/repos/spotify/helios/tags","blobs_url":"https://api.github.com/repos/spotify/helios/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/spotify/helios/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/spotify/helios/git/refs{/sha}","trees_url":"https://api.github.com/repos/spotify/helios/git/trees{/sha}","statuses_url":"https://api.github.com/repos/spotify/helios/statuses/{sha}","languages_url":"https://api.github.com/repos/spotify/helios/languages","stargazers_url":"https://api.github.com/repos/spotify/helios/stargazers","contributors_url":"https://api.github.com/repos/spotify/helios/contributors","subscribers_url":"https://api.github.com/repos/spotify/helios/subscribers","subscription_url":"https://api.github.com/repos/spotify/helios/subscription","commits_url":"https://api.github.com/repos/spotify/helios/commits{/sha}","git_commits_url":"https://api.github.com/repos/spotify/helios/git/commits{/sha}","comments_url":"https://api.github.com/repos/spotify/helios/comments{/number}","issue_comment_url":"https://api.github.com/repos/spotify/helios/issues/comments{/number}","contents_url":"https://api.github.com/repos/spotify/helios/contents/{+path}","compare_url":"https://api.github.com/repos/spotify/helios/compare/{base}...{head}","merges_url":"https://api.github.com/repos/spotify/helios/merges","archive_url":"https://api.github.com/repos/spotify/helios/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/spotify/helios/downloads","issues_url":"https://api.github.com/repos/spotify/helios/issues{/number}","pulls_url":"https://api.github.com/repos/spotify/helios/pulls{/number}","milestones_url":"https://api.github.com/repos/spotify/helios/milestones{/number}","notifications_url":"https://api.github.com/repos/spotify/helios/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/spotify/helios/labels{/name}","releases_url":"https://api.github.com/repos/spotify/helios/releases{/id}","created_at":"2014-05-26T02:29:06Z","updated_at":"2015-10-27T16:19:11Z","pushed_at":"2015-10-27T19:16:46Z","git_url":"git://github.com/spotify/helios.git","ssh_url":"git@github.com:spotify/helios.git","clone_url":"https://github.com/spotify/helios.git","svn_url":"https://github.com/spotify/helios","homepage":null,"size":12985,"stargazers_count":1089,"watchers_count":1089,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":79,"mirror_url":null,"open_issues_count":29,"forks":79,"open_issues":29,"watchers":1089,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/spotify/helios/pulls/717"},"html":{"href":"https://github.com/spotify/helios/pull/717"},"issue":{"href":"https://api.github.com/repos/spotify/helios/issues/717"},"comments":{"href":"https://api.github.com/repos/spotify/helios/issues/717/comments"},"review_comments":{"href":"https://api.github.com/repos/spotify/helios/pulls/717/comments"},"review_comment":{"href":"https://api.github.com/repos/spotify/helios/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/spotify/helios/pulls/717/commits"},"statuses":{"href":"https://api.github.com/repos/spotify/helios/statuses/ceb70a8e75a1cd8c52b21080467a32ad74940cb6"}}}}