Update changelog

Replaced with custom test DSL that avoids System.exit

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,29 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+<!-- A clear and concise description of what the bug is. -->
+
+**Version**
+<!-- What versions of the following libraries are you using? -->
+- `sop-java`:
+- `pgpainless-core`:
+- `bouncycastle`: 
+
+**To Reproduce**
+<!-- Steps to reproduce the behavior: -->
+```
+Example Code Block
+```
+
+**Expected behavior**
+<!-- A clear and concise description of what you expected to happen. -->
+
+**Additional context**
+<!-- Add any other context about the problem here. -->

.reuse/dep5

@@ -17,4 +17,13 @@ License: Apache-2.0
 # Woodpecker build files
 Files: .woodpecker/*
 Copyright: 2022 the original author or authors.
-License: Apache-2.0
+License: Apache-2.0
+
+Files: external-sop/src/main/resources/sop/testsuite/external/*
+Copyright: 2023 the original author or authors
+License: Apache-2.0
+
+# Github Issue Templates
+Files: .github/ISSUE_TEMPLATE/*
+Copyright: 2024 the original author or authors
+License: Apache-2.0

.woodpecker/.build.yml

@@ -1,12 +0,0 @@
-pipeline:
-  run:
-    image: gradle:7.5-jdk8
-    commands:
-      - git checkout $CI_COMMIT_BRANCH
-      # Code works
-      - gradle test
-      # Code is clean
-      - gradle check javadocAll
-      # Code has coverage
-      - gradle jacocoRootReport coveralls
-    secrets: [COVERALLS_REPO_TOKEN]

.woodpecker/build.yml

@@ -0,0 +1,17 @@
+steps:
+  run:
+    image: gradle:7.6-jdk11-jammy
+    commands:
+      # Install Sequoia-SOP
+      - apt update && apt install --yes sqop
+      # Checkout code
+      - git checkout $CI_COMMIT_BRANCH
+      # Prepare CI
+      - cp external-sop/src/main/resources/sop/testsuite/external/config.json.ci external-sop/src/main/resources/sop/testsuite/external/config.json
+      # Code works
+      - gradle test
+      # Code is clean
+      - gradle check javadocAll
+      # Code has coverage
+      - gradle jacocoRootReport coveralls
+    secrets: [coveralls_repo_token]

.woodpecker/reuse.yml

@@ -1,6 +1,6 @@
 # Code is licensed properly
 # See https://reuse.software/
-pipeline:
+steps:
   reuse:
     image: fsfe/reuse:latest
     commands:

CHANGELOG.md

@@ -6,6 +6,84 @@ SPDX-License-Identifier: Apache-2.0
 
 # Changelog
 
+## 10.0.1-SNAPSHOT
+- Remove `label()` option from `Armor` operation
+
+## 10.0.0
+- Update implementation to [SOP Specification revision 10](https://www.ietf.org/archive/id/draft-dkg-openpgp-stateless-cli-10.html).
+  - Throw `BadData` when passing KEYS where CERTS are expected
+  - Introduce `sopv` interface subset with revision `1.0`
+  - Add `sop version --sopv`
+
+## 8.0.1
+- `decrypt`: Do not throw `NoSignature` exception (exit code 3) if `--verify-with` is provided, but `VERIFICATIONS` is empty.
+
+## 8.0.0
+- Rewrote `sop-java` in Kotlin
+- Rewrote `sop-java-picocli` in Kotlin
+- Rewrote `external-sop` in Kotlin
+- Update implementation to [SOP Specification revision 08](https://www.ietf.org/archive/id/draft-dkg-openpgp-stateless-cli-08.html).
+  - Add `--no-armor` option to `revoke-key` and `change-key-password` subcommands
+  - `armor`: Deprecate `--label` option in `sop-java` and remove in `sop-java-picocli`
+  - `encrypt`: Add `--session-key-out` option
+- Slight API changes:
+  - `sop.encrypt().plaintext()` now returns a `ReadyWithResult<EncryptionResult>` instead of `Ready`.
+  - `EncryptionResult` is a new result type, that provides access to the session key of an encrypted message
+  - Change `ArmorLabel` values into lowercase
+  - Change `EncryptAs` values into lowercase
+  - Change `SignAs` values into lowercase
+
+## 7.0.0
+- Update implementation to [SOP Specification revision 07](https://www.ietf.org/archive/id/draft-dkg-openpgp-stateless-cli-07.html).
+  - Add support for new `revoke-key` subcommand
+  - Add support for new `change-key-password` subcommand
+  - Add support for new `--signing-only` option of `generate-key` subcommand
+- Add `dearmor.data(String)` utility method
+- Fix typos in, and improve i18n of CLI help pages
+
+## 6.1.0
+- `listProfiles()`: Add shortcut methods `generateKey()` and `encrypt()`
+- Add DSL for testing `Verification` results
+- `Verification`
+  - Return `Optional<SignatureMode>` for `getSignatureMode()`
+  - Return `Optional<String>` for `getDescription()`
+- `Profile`
+  - Add support for profiles without description
+  - Return `Optional<String>` for `getDescription()`
+  - Add `parse(String)` method for parsing profile lines
+- `sop-java`: Add dependency on `com.google.code.findbugs:jsr305` for `@Nullable`, `@Nonnull` annotations
+- `UTCUtil`: `parseUTCDate()` is now `@Nonnull` and throws a `ParseException` for invalid inputs
+- `UTF8Util`: `decodeUTF8()` now throws `CharacterCodingException` instead of `SOPGPException.PasswordNotHumanReadable`
+- `external-sop`: Properly map error codes to new exception types (ported from `5.0.1`):
+  - `UNSUPPORTED_PROFILE`
+  - `INCOMPATIBLE_OPTIONS`
+
+## 5.0.1
+- `external-sop`: Properly map error codes to new exception types:
+  - `UNSUPPORTED_PROFILE`
+  - `INCOMPATIBLE_OPTIONS`
+
+## 6.0.0
+- Update implementation to [SOP Specification revision 06](https://www.ietf.org/archive/id/draft-dkg-openpgp-stateless-cli-06.html).
+  - Add option `--profile=XYZ` to `encrypt` subcommand
+  - Add option `--sop-spec` to `version` subcommand
+  - `Version`: Add different getters for specification-related values
+
+## 5.0.0
+- Update implementation to [SOP Specification revision 05](https://www.ietf.org/archive/id/draft-dkg-openpgp-stateless-cli-05.html).
+  - Add the concept of profiles
+  - Add `list-profiles` subcommand
+  - Add option `--profile=XYZ` to `generate-key` subcommand
+  - `Verification` objects can now optionally indicate the type of the signature (`mode:text` or `mode:binary`)
+  - `Verification` objects can now contain an optional description of the signature
+  - `inline-sign` now throws an error if incompatible options `--as=clearsigned` and `--no-armor` are used
+
+## 4.1.1
+- Restructure test suite to allow simultaneous testing of multiple backends
+- Fix IOException in `sop sign` due to premature stream closing
+- Allow for downstream implementations of `sop-java` to reuse the test suite
+  - Check out Javadoc of `sop-java/src/testFixtures/java/sop/testsuite/SOPInstanceFactory` for details
+
 ## 4.1.0
 - Add module `external-sop`
   - This module implements the `sop-java` interfaces and allows the use of an external SOP binary

README.md

@@ -7,7 +7,7 @@ SPDX-License-Identifier: Apache-2.0
 # SOP for Java
 
 [![status-badge](https://ci.codeberg.org/api/badges/PGPainless/sop-java/status.svg)](https://ci.codeberg.org/PGPainless/sop-java)
-[![Spec Revision: 4](https://img.shields.io/badge/Spec%20Revision-4-blue)](https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/04/)
+[![Spec Revision: 10](https://img.shields.io/badge/Spec%20Revision-10-blue)](https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/10/)
 [![Coverage Status](https://coveralls.io/repos/github/pgpainless/sop-java/badge.svg?branch=main)](https://coveralls.io/github/pgpainless/sop-java?branch=main)
 [![REUSE status](https://api.reuse.software/badge/github.com/pgpainless/sop-java)](https://api.reuse.software/info/github.com/pgpainless/sop-java)
 
@@ -25,6 +25,8 @@ The repository contains the following modules:
 * [sop-java](/sop-java) defines a set of Java interfaces describing the Stateless OpenPGP Protocol.
 * [sop-java-picocli](/sop-java-picocli) contains a wrapper application that transforms the `sop-java` API into a command line application
 compatible with the SOP-CLI specification.
+* [external-sop](/external-sop) contains an API implementation that can be used to forward API calls to a SOP executable,
+allowing to delegate the implementation logic to an arbitrary SOP CLI implementation.
 
 ## Known Implementations
 (Please expand!)

build.gradle

@@ -19,6 +19,8 @@ buildscript {
 
 plugins {
     id 'ru.vyarus.animalsniffer' version '1.5.3'
+    id 'org.jetbrains.kotlin.jvm' version "1.8.10"
+    id 'com.diffplug.spotless' version '6.22.0' apply false
 }
 
 apply from: 'version.gradle'
@@ -29,6 +31,8 @@ allprojects {
     apply plugin: 'eclipse'
     apply plugin: 'jacoco'
     apply plugin: 'checkstyle'
+    apply plugin: 'kotlin'
+    apply plugin: 'com.diffplug.spotless'
 
     // For non-cli modules enable android api compatibility check
     if (it.name.equals('sop-java')) {
@@ -53,6 +57,12 @@ allprojects {
         toolVersion = '8.18'
     }
 
+    spotless {
+        kotlin {
+            ktfmt().dropboxStyle()
+        }
+    }
+
     group 'org.pgpainless'
     description = "Stateless OpenPGP Protocol API for Java"
     version = shortVersion
@@ -69,6 +79,13 @@ allprojects {
         reproducibleFileOrder = true
     }
 
+    // Compatibility of default implementations in kotlin interfaces with Java implementations.
+    tasks.withType(org.jetbrains.kotlin.gradle.tasks.KotlinCompile).configureEach {
+        kotlinOptions {
+            freeCompilerArgs += ["-Xjvm-default=all-compatibility"]
+        }
+    }
+
     project.ext {
         rootConfigDir = new File(rootDir, 'config')
         gitCommit = getGitCommit()

external-sop/README.md

@@ -23,6 +23,8 @@ SOP sop = new ExternalSOP("/usr/bin/example-sop");
 
 This SOP object can now be used as usual (see [here](../sop-java/README.md)).
 
+Keep in mind the license of the external SOP binary when integrating one with your project!
+
 Some SOP binaries might require additional configuration, e.g. a Java based SOP might need to know which JAVA_HOME to use.
 For this purpose, additional environment variables can be passed in using a `Properties` object:
 
@@ -50,3 +52,8 @@ ExternalSOP.TempDirProvider provider = new ExternalSOP.TempDirProvider() {
 };
 SOP sop = new ExternalSOP("/usr/bin/example-sop", provider);
 ```
+
+## Testing
+The `external-sop` module comes with a growing test suite, which tests SOP binaries against the expectations of the SOP specification.  
+To configure one or multiple backends for use with the test suite, just provide a custom `config.json` file in `src/main/resources/sop/external`.
+An example configuration file with the required file format is available as `config.json.example`.

external-sop/build.gradle

@@ -14,20 +14,30 @@ repositories {
 
 dependencies {
     testImplementation "org.junit.jupiter:junit-jupiter-api:$junitVersion"
+    testImplementation "org.junit.jupiter:junit-jupiter-params:$junitVersion"
     testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine:$junitVersion"
 
     api project(":sop-java")
-
     api "org.slf4j:slf4j-api:$slf4jVersion"
     testImplementation "ch.qos.logback:logback-classic:$logbackVersion"
 
-    // Compare version strings
-    implementation 'org.apache.maven:maven-artifact:3.6.3'
-    
     // @Nonnull, @Nullable...
     implementation "com.google.code.findbugs:jsr305:$jsrVersion"
+
+    // The ExternalTestSubjectFactory reads json config file to find configured SOP binaries...
+    testImplementation "com.google.code.gson:gson:$gsonVersion"
+    // ...and extends TestSubjectFactory
+    testImplementation(testFixtures(project(":sop-java")))
 }
 
 test {
+    // Inject configured external SOP instances using our custom TestSubjectFactory
+    environment("test.implementation", "sop.testsuite.external.ExternalSOPInstanceFactory")
+
     useJUnitPlatform()
-}
+
+    // since we test external backends which we might not control,
+    //  we ignore test failures in this module
+    ignoreFailures = true
+}
+

external-sop/src/main/java/sop/external/ExternalSOP.java

@@ -1,357 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import sop.Ready;
-import sop.SOP;
-import sop.exception.SOPGPException;
-import sop.external.operation.ArmorExternal;
-import sop.external.operation.DearmorExternal;
-import sop.external.operation.DecryptExternal;
-import sop.external.operation.DetachedSignExternal;
-import sop.external.operation.DetachedVerifyExternal;
-import sop.external.operation.EncryptExternal;
-import sop.external.operation.ExtractCertExternal;
-import sop.external.operation.GenerateKeyExternal;
-import sop.external.operation.InlineDetachExternal;
-import sop.external.operation.InlineSignExternal;
-import sop.external.operation.InlineVerifyExternal;
-import sop.external.operation.VersionExternal;
-import sop.operation.Armor;
-import sop.operation.Dearmor;
-import sop.operation.Decrypt;
-import sop.operation.DetachedSign;
-import sop.operation.DetachedVerify;
-import sop.operation.Encrypt;
-import sop.operation.ExtractCert;
-import sop.operation.GenerateKey;
-import sop.operation.InlineDetach;
-import sop.operation.InlineSign;
-import sop.operation.InlineVerify;
-import sop.operation.Version;
-
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.nio.file.Files;
-import java.nio.file.attribute.FileAttribute;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-public class ExternalSOP implements SOP {
-
-    private final String binaryName;
-    private final Properties properties;
-    private final TempDirProvider tempDirProvider;
-
-    public ExternalSOP(String binaryName) {
-        this(binaryName, new Properties());
-    }
-
-    public ExternalSOP(String binaryName, Properties properties) {
-        this(binaryName, properties, defaultTempDirProvider());
-    }
-
-    public ExternalSOP(String binaryName, TempDirProvider tempDirProvider) {
-        this(binaryName, new Properties(), tempDirProvider);
-    }
-
-    public ExternalSOP(String binaryName, Properties properties, TempDirProvider tempDirProvider) {
-        this.binaryName = binaryName;
-        this.properties = properties;
-        this.tempDirProvider = tempDirProvider;
-    }
-
-    @Override
-    public Version version() {
-        return new VersionExternal(binaryName, properties);
-    }
-
-    @Override
-    public GenerateKey generateKey() {
-        return new GenerateKeyExternal(binaryName, properties);
-    }
-
-    @Override
-    public ExtractCert extractCert() {
-        return new ExtractCertExternal(binaryName, properties);
-    }
-
-    @Override
-    public DetachedSign detachedSign() {
-        return new DetachedSignExternal(binaryName, properties, tempDirProvider);
-    }
-
-    @Override
-    public InlineSign inlineSign() {
-        return new InlineSignExternal(binaryName, properties);
-    }
-
-    @Override
-    public DetachedVerify detachedVerify() {
-        return new DetachedVerifyExternal(binaryName, properties);
-    }
-
-    @Override
-    public InlineVerify inlineVerify() {
-        return new InlineVerifyExternal(binaryName, properties, tempDirProvider);
-    }
-
-    @Override
-    public InlineDetach inlineDetach() {
-        return new InlineDetachExternal(binaryName, properties, tempDirProvider);
-    }
-
-    @Override
-    public Encrypt encrypt() {
-        return new EncryptExternal(binaryName, properties);
-    }
-
-    @Override
-    public Decrypt decrypt() {
-        return new DecryptExternal(binaryName, properties, tempDirProvider);
-    }
-
-    @Override
-    public Armor armor() {
-        return new ArmorExternal(binaryName, properties);
-    }
-
-    @Override
-    public Dearmor dearmor() {
-        return new DearmorExternal(binaryName, properties);
-    }
-
-    public static void finish(Process process) throws IOException {
-        try {
-            mapExitCodeOrException(process);
-        } catch (SOPGPException e) {
-            InputStream errIn = process.getErrorStream();
-            ByteArrayOutputStream errOut = new ByteArrayOutputStream();
-            byte[] buf = new byte[512];
-            int r;
-            while ((r = errIn.read(buf)) > 0) {
-                errOut.write(buf, 0, r);
-            }
-
-            e.initCause(new IOException(errOut.toString()));
-            throw e;
-        }
-        catch (InterruptedException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    private static void mapExitCodeOrException(Process process) throws InterruptedException, IOException {
-        int exitCode = process.waitFor();
-
-        if (exitCode == 0) {
-            return;
-        }
-
-        InputStream errIn = process.getErrorStream();
-        ByteArrayOutputStream errOut = new ByteArrayOutputStream();
-        byte[] buf = new byte[512];
-        int r;
-        while ((r = errIn.read(buf)) > 0) {
-            errOut.write(buf, 0, r);
-        }
-
-        String errorMessage = errOut.toString();
-
-        switch (exitCode) {
-            case SOPGPException.NoSignature.EXIT_CODE:
-                throw new SOPGPException.NoSignature("External SOP backend reported error NoSignature (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.UnsupportedAsymmetricAlgo.EXIT_CODE:
-                throw new UnsupportedOperationException("External SOP backend reported error UnsupportedAsymmetricAlgo (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.CertCannotEncrypt.EXIT_CODE:
-                throw new SOPGPException.CertCannotEncrypt("External SOP backend reported error CertCannotEncrypt (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.MissingArg.EXIT_CODE:
-                throw new SOPGPException.MissingArg("External SOP backend reported error MissingArg (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.IncompleteVerification.EXIT_CODE:
-                throw new SOPGPException.IncompleteVerification("External SOP backend reported error IncompleteVerification (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.CannotDecrypt.EXIT_CODE:
-                throw new SOPGPException.CannotDecrypt("External SOP backend reported error CannotDecrypt (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.PasswordNotHumanReadable.EXIT_CODE:
-                throw new SOPGPException.PasswordNotHumanReadable("External SOP backend reported error PasswordNotHumanReadable (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.UnsupportedOption.EXIT_CODE:
-                throw new SOPGPException.UnsupportedOption("External SOP backend reported error UnsupportedOption (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.BadData.EXIT_CODE:
-                throw new SOPGPException.BadData("External SOP backend reported error BadData (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.ExpectedText.EXIT_CODE:
-                throw new SOPGPException.ExpectedText("External SOP backend reported error ExpectedText (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.OutputExists.EXIT_CODE:
-                throw new SOPGPException.OutputExists("External SOP backend reported error OutputExists (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.MissingInput.EXIT_CODE:
-                throw new SOPGPException.MissingInput("External SOP backend reported error MissingInput (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.KeyIsProtected.EXIT_CODE:
-                throw new SOPGPException.KeyIsProtected("External SOP backend reported error KeyIsProtected (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.UnsupportedSubcommand.EXIT_CODE:
-                throw new SOPGPException.UnsupportedSubcommand("External SOP backend reported error UnsupportedSubcommand (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.UnsupportedSpecialPrefix.EXIT_CODE:
-                throw new SOPGPException.UnsupportedSpecialPrefix("External SOP backend reported error UnsupportedSpecialPrefix (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.AmbiguousInput.EXIT_CODE:
-                throw new SOPGPException.AmbiguousInput("External SOP backend reported error AmbiguousInput (" +
-                        exitCode + "):\n" + errorMessage);
-
-            case SOPGPException.KeyCannotSign.EXIT_CODE:
-                throw new SOPGPException.KeyCannotSign("External SOP backend reported error KeyCannotSign (" +
-                        exitCode + "):\n" + errorMessage);
-
-            default:
-                throw new RuntimeException("External SOP backend reported unknown exit code (" +
-                        exitCode + "):\n" + errorMessage);
-        }
-    }
-
-    public static List<String> propertiesToEnv(Properties properties) {
-        List<String> env = new ArrayList<>();
-        for (Object key : properties.keySet()) {
-            env.add(key + "=" + properties.get(key));
-        }
-        return env;
-    }
-
-    public static String readFully(InputStream inputStream) throws IOException {
-        ByteArrayOutputStream bOut = new ByteArrayOutputStream();
-        byte[] buf = new byte[4096];
-        int r;
-        while ((r = inputStream.read(buf)) > 0) {
-            bOut.write(buf, 0, r);
-        }
-        return bOut.toString();
-    }
-
-    public static Ready ready(Runtime runtime, List<String> commandList, List<String> envList) {
-        String[] command = commandList.toArray(new String[0]);
-        String[] env = envList.toArray(new String[0]);
-
-        try {
-            Process process = runtime.exec(command, env);
-            InputStream stdIn = process.getInputStream();
-
-            return new Ready() {
-                @Override
-                public void writeTo(OutputStream outputStream) throws IOException {
-                    byte[] buf = new byte[4096];
-                    int r;
-                    while ((r = stdIn.read(buf)) >= 0) {
-                        outputStream.write(buf, 0, r);
-                    }
-
-                    outputStream.flush();
-                    outputStream.close();
-                    ExternalSOP.finish(process);
-                }
-            };
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    public static Ready ready(Runtime runtime, List<String> commandList, List<String> envList, InputStream standardIn) {
-        String[] command = commandList.toArray(new String[0]);
-        String[] env = envList.toArray(new String[0]);
-        try {
-            Process process = runtime.exec(command, env);
-            OutputStream processOut = process.getOutputStream();
-            InputStream processIn = process.getInputStream();
-
-            return new Ready() {
-                @Override
-                public void writeTo(OutputStream outputStream) throws IOException {
-                    byte[] buf = new byte[4096];
-                    int r;
-                    while ((r = standardIn.read(buf)) > 0) {
-                        processOut.write(buf, 0, r);
-                    }
-                    standardIn.close();
-
-                    try {
-                        processOut.flush();
-                        processOut.close();
-                    } catch (IOException e) {
-                        // ignore
-                    }
-
-                    while ((r = processIn.read(buf)) > 0) {
-                        outputStream.write(buf, 0 , r);
-                    }
-                    processIn.close();
-
-                    outputStream.flush();
-                    outputStream.close();
-
-                    finish(process);
-                }
-            };
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    /**
-     * This interface can be used to provide a directory in which external SOP binaries can temporarily store
-     * additional results of OpenPGP operations such that the binding classes can parse them out from there.
-     * Unfortunately, on Java you cannot open {@link java.io.FileDescriptor FileDescriptors} arbitrarily, so we
-     * have to rely on temporary files to pass results.
-     * An example:
-     * <pre>sop decrypt</pre> can emit signature verifications via <pre>--verify-out=/path/to/tempfile</pre>.
-     * {@link DecryptExternal} will then parse the temp file to make the result available to consumers.
-     * Temporary files are deleted after being read, yet creating temp files for sensitive information on disk
-     * might pose a security risk. Use with care!
-     */
-    public interface TempDirProvider {
-        File provideTempDirectory() throws IOException;
-    }
-
-    /**
-     * Default implementation of the {@link TempDirProvider} which stores temporary files in the systems temp dir
-     * ({@link Files#createTempDirectory(String, FileAttribute[])}).
-     *
-     * @return default implementation
-     */
-    public static TempDirProvider defaultTempDirProvider() {
-        return new TempDirProvider() {
-            @Override
-            public File provideTempDirectory() throws IOException {
-                return Files.createTempDirectory("ext-sop").toFile();
-            }
-        };
-    }
-}

external-sop/src/main/java/sop/external/operation/ArmorExternal.java

@@ -1,40 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.Ready;
-import sop.enums.ArmorLabel;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.Armor;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.Properties;
-import java.util.List;
-
-public class ArmorExternal implements Armor {
-
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    public ArmorExternal(String binary, Properties environment) {
-        commandList.add(binary);
-        commandList.add("armor");
-        envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public Armor label(ArmorLabel label) throws SOPGPException.UnsupportedOption {
-        commandList.add("--label=" + label);
-        return this;
-    }
-
-    @Override
-    public Ready data(InputStream data) throws SOPGPException.BadData, IOException {
-        return ExternalSOP.ready(Runtime.getRuntime(), commandList, envList, data);
-    }
-}

external-sop/src/main/java/sop/external/operation/DearmorExternal.java

@@ -1,33 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.Ready;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.Dearmor;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-public class DearmorExternal implements Dearmor {
-
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    public DearmorExternal(String binary, Properties environment) {
-        commandList.add(binary);
-        commandList.add("dearmor");
-        envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public Ready data(InputStream data) throws SOPGPException.BadData, IOException {
-        return ExternalSOP.ready(Runtime.getRuntime(), commandList, envList, data);
-    }
-}

external-sop/src/main/java/sop/external/operation/DecryptExternal.java

@@ -1,173 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.DecryptionResult;
-import sop.ReadyWithResult;
-import sop.SessionKey;
-import sop.Verification;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.Decrypt;
-import sop.util.UTCUtil;
-
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.OutputStream;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-import java.util.Properties;
-
-public class DecryptExternal implements Decrypt {
-
-    private final ExternalSOP.TempDirProvider tempDirProvider;
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    private int verifyWithCounter = 0;
-    private int withSessionKeyCounter = 0;
-    private int withPasswordCounter = 0;
-    private int keyCounter = 0;
-    private int withKeyPasswordCounter = 0;
-
-    public DecryptExternal(String binary, Properties environment, ExternalSOP.TempDirProvider tempDirProvider) {
-        this.tempDirProvider = tempDirProvider;
-        this.commandList.add(binary);
-        this.commandList.add("decrypt");
-        this.envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public Decrypt verifyNotBefore(Date timestamp)
-            throws SOPGPException.UnsupportedOption {
-        this.commandList.add("--verify-not-before=" + UTCUtil.formatUTCDate(timestamp));
-        return this;
-    }
-
-    @Override
-    public Decrypt verifyNotAfter(Date timestamp)
-            throws SOPGPException.UnsupportedOption {
-        this.commandList.add("--verify-not-after=" + UTCUtil.formatUTCDate(timestamp));
-        return this;
-    }
-
-    @Override
-    public Decrypt verifyWithCert(InputStream cert)
-            throws SOPGPException.BadData, SOPGPException.UnsupportedAsymmetricAlgo, IOException {
-        String envVar = "VERIFY_WITH_" + verifyWithCounter++;
-        commandList.add("--verify-with=@ENV:" + envVar);
-        envList.add(envVar + "=" + ExternalSOP.readFully(cert));
-        return this;
-    }
-
-    @Override
-    public Decrypt withSessionKey(SessionKey sessionKey)
-            throws SOPGPException.UnsupportedOption {
-        String envVar = "SESSION_KEY_" + withSessionKeyCounter++;
-        commandList.add("--with-session-key=@ENV:" + envVar);
-        envList.add(envVar + "=" + sessionKey);
-        return this;
-    }
-
-    @Override
-    public Decrypt withPassword(String password)
-            throws SOPGPException.PasswordNotHumanReadable, SOPGPException.UnsupportedOption {
-        String envVar = "PASSWORD_" + withPasswordCounter++;
-        commandList.add("--with-password=@ENV:" + envVar);
-        envList.add(envVar + "=" + password);
-        return this;
-    }
-
-    @Override
-    public Decrypt withKey(InputStream key)
-            throws SOPGPException.BadData, SOPGPException.UnsupportedAsymmetricAlgo, IOException {
-        String envVar = "KEY_" + keyCounter++;
-        commandList.add("@ENV:" + envVar);
-        envList.add(envVar + "=" + ExternalSOP.readFully(key));
-        return this;
-    }
-
-    @Override
-    public Decrypt withKeyPassword(byte[] password)
-            throws SOPGPException.UnsupportedOption, SOPGPException.PasswordNotHumanReadable {
-        String envVar = "KEY_PASSWORD_" + withKeyPasswordCounter++;
-        commandList.add("--with-key-password=@ENV:" + envVar);
-        envList.add(envVar + "=" + new String(password));
-        return this;
-    }
-
-    @Override
-    public ReadyWithResult<DecryptionResult> ciphertext(InputStream ciphertext)
-            throws SOPGPException.BadData, SOPGPException.MissingArg, SOPGPException.CannotDecrypt,
-            SOPGPException.KeyIsProtected, IOException {
-        File tempDir = tempDirProvider.provideTempDirectory();
-
-        File sessionKeyOut = new File(tempDir, "session-key-out");
-        sessionKeyOut.delete();
-        commandList.add("--session-key-out=" + sessionKeyOut.getAbsolutePath());
-
-        File verifyOut = new File(tempDir, "verifications-out");
-        verifyOut.delete();
-        if (verifyWithCounter != 0) {
-            commandList.add("--verify-out=" + verifyOut.getAbsolutePath());
-        }
-
-        String[] command = commandList.toArray(new String[0]);
-        String[] env = envList.toArray(new String[0]);
-        try {
-            Process process = Runtime.getRuntime().exec(command, env);
-            OutputStream processOut = process.getOutputStream();
-            InputStream processIn = process.getInputStream();
-
-            return new ReadyWithResult<DecryptionResult>() {
-                @Override
-                public DecryptionResult writeTo(OutputStream outputStream) throws IOException {
-                    byte[] buf = new byte[4096];
-                    int r;
-                    while ((r = ciphertext.read(buf)) > 0) {
-                        processOut.write(buf, 0, r);
-                    }
-
-                    ciphertext.close();
-                    processOut.close();
-
-                    while ((r = processIn.read(buf)) > 0) {
-                        outputStream.write(buf, 0 , r);
-                    }
-
-                    processIn.close();
-                    outputStream.close();
-
-                    ExternalSOP.finish(process);
-
-                    FileInputStream sessionKeyOutIn = new FileInputStream(sessionKeyOut);
-                    String line = ExternalSOP.readFully(sessionKeyOutIn);
-                    SessionKey sessionKey = SessionKey.fromString(line.trim());
-                    sessionKeyOutIn.close();
-                    sessionKeyOut.delete();
-
-                    List<Verification> verifications = new ArrayList<>();
-                    if (verifyWithCounter != 0) {
-                        FileInputStream verifyOutIn = new FileInputStream(verifyOut);
-                        BufferedReader reader = new BufferedReader(new InputStreamReader(verifyOutIn));
-                        while ((line = reader.readLine()) != null) {
-                            verifications.add(Verification.fromString(line.trim()));
-                        }
-                        reader.close();
-                    }
-
-                    return new DecryptionResult(sessionKey, verifications);
-                }
-            };
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

external-sop/src/main/java/sop/external/operation/DetachedSignExternal.java

@@ -1,126 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.MicAlg;
-import sop.ReadyWithResult;
-import sop.SigningResult;
-import sop.enums.SignAs;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.DetachedSign;
-
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.OutputStream;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-public class DetachedSignExternal implements DetachedSign {
-
-    private final ExternalSOP.TempDirProvider tempDirProvider;
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    private int withKeyPasswordCounter = 0;
-    private int keyCounter = 0;
-
-    public DetachedSignExternal(String binary, Properties properties, ExternalSOP.TempDirProvider tempDirProvider) {
-        this.tempDirProvider = tempDirProvider;
-        commandList.add(binary);
-        commandList.add("sign");
-        envList = ExternalSOP.propertiesToEnv(properties);
-    }
-
-    @Override
-    public DetachedSign noArmor() {
-        commandList.add("--no-armor");
-        return this;
-    }
-
-    @Override
-    public DetachedSign key(InputStream key) throws SOPGPException.KeyCannotSign, SOPGPException.BadData, SOPGPException.UnsupportedAsymmetricAlgo, IOException {
-        String envVar = "KEY_" + keyCounter++;
-        commandList.add("@ENV:" + envVar);
-        envList.add(envVar + "=" + ExternalSOP.readFully(key));
-        return this;
-    }
-
-    @Override
-    public DetachedSign withKeyPassword(byte[] password) throws SOPGPException.UnsupportedOption, SOPGPException.PasswordNotHumanReadable {
-        String envVar = "WITH_KEY_PASSWORD_" + withKeyPasswordCounter++;
-        commandList.add("--with-key-password=@ENV:" + envVar);
-        envList.add(envVar + "=" + new String(password));
-        return this;
-    }
-
-    @Override
-    public DetachedSign mode(SignAs mode) throws SOPGPException.UnsupportedOption {
-        commandList.add("--as=" + mode);
-        return this;
-    }
-
-    @Override
-    public ReadyWithResult<SigningResult> data(InputStream data)
-            throws IOException, SOPGPException.KeyIsProtected, SOPGPException.ExpectedText {
-
-        File tempDir = tempDirProvider.provideTempDirectory();
-        File micAlgOut = new File(tempDir, "micAlgOut");
-        micAlgOut.delete();
-        commandList.add("--micalg-out=" + micAlgOut.getAbsolutePath());
-
-        String[] command = commandList.toArray(new String[0]);
-        String[] env = envList.toArray(new String[0]);
-        try {
-            Process process = Runtime.getRuntime().exec(command, env);
-            OutputStream processOut = process.getOutputStream();
-            InputStream processIn = process.getInputStream();
-
-            return new ReadyWithResult<SigningResult>() {
-                @Override
-                public SigningResult writeTo(OutputStream outputStream) throws IOException {
-                    byte[] buf = new byte[4096];
-                    int r;
-                    while ((r = data.read(buf)) > 0) {
-                        processOut.write(buf, 0, r);
-                    }
-
-                    data.close();
-                    processOut.close();
-
-                    while ((r = processIn.read(buf)) > 0) {
-                        outputStream.write(buf, 0 , r);
-                    }
-
-                    processIn.close();
-                    outputStream.close();
-
-                    ExternalSOP.finish(process);
-
-                    SigningResult.Builder builder = SigningResult.builder();
-                    if (micAlgOut.exists()) {
-                        BufferedReader reader = new BufferedReader(new InputStreamReader(new FileInputStream(micAlgOut)));
-                        String line = reader.readLine();
-                        if (line != null && !line.trim().isEmpty()) {
-                            MicAlg micAlg = new MicAlg(line.trim());
-                            builder.setMicAlg(micAlg);
-                        }
-                        reader.close();
-                        micAlgOut.delete();
-                    }
-
-                    return builder.build();
-                }
-            };
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

external-sop/src/main/java/sop/external/operation/DetachedVerifyExternal.java

@@ -1,108 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.Verification;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.DetachedVerify;
-import sop.operation.VerifySignatures;
-import sop.util.UTCUtil;
-
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.OutputStream;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Properties;
-import java.util.Set;
-
-public class DetachedVerifyExternal implements DetachedVerify {
-
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    private Set<InputStream> certs = new HashSet<>();
-    private InputStream signatures;
-    private int certCounter = 0;
-
-    public DetachedVerifyExternal(String binary, Properties environment) {
-        commandList.add(binary);
-        commandList.add("verify");
-        envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public DetachedVerify notBefore(Date timestamp) throws SOPGPException.UnsupportedOption {
-        commandList.add("--not-before=" + UTCUtil.formatUTCDate(timestamp));
-        return this;
-    }
-
-    @Override
-    public DetachedVerify notAfter(Date timestamp) throws SOPGPException.UnsupportedOption {
-        commandList.add("--not-after=" + UTCUtil.formatUTCDate(timestamp));
-        return this;
-    }
-
-    @Override
-    public DetachedVerify cert(InputStream cert) throws SOPGPException.BadData, IOException {
-        this.certs.add(cert);
-        return this;
-    }
-
-    @Override
-    public VerifySignatures signatures(InputStream signatures) throws SOPGPException.BadData, IOException {
-        this.signatures = signatures;
-        return this;
-    }
-
-    @Override
-    public List<Verification> data(InputStream data) throws IOException, SOPGPException.NoSignature, SOPGPException.BadData {
-        commandList.add("@ENV:SIGNATURE");
-        envList.add("SIGNATURE=" + ExternalSOP.readFully(signatures));
-
-        for (InputStream cert : certs) {
-            String envVar = "CERT_" + certCounter++;
-            commandList.add("@ENV:" + envVar);
-            envList.add(envVar + "=" + ExternalSOP.readFully(cert));
-        }
-
-        String[] command = commandList.toArray(new String[0]);
-        String[] env = envList.toArray(new String[0]);
-
-        try {
-            Process process = Runtime.getRuntime().exec(command, env);
-            OutputStream processOut = process.getOutputStream();
-            InputStream processIn = process.getInputStream();
-
-                    byte[] buf = new byte[4096];
-                    int r;
-                    while ((r = data.read(buf)) > 0) {
-                        processOut.write(buf, 0, r);
-                    }
-
-                    data.close();
-                    processOut.close();
-
-                    BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(processIn));
-                    List<Verification> verifications = new ArrayList<>();
-
-                    String line = null;
-                    while ((line = bufferedReader.readLine()) != null) {
-                        verifications.add(Verification.fromString(line));
-                    }
-
-                    ExternalSOP.finish(process);
-
-                    return verifications;
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

external-sop/src/main/java/sop/external/operation/EncryptExternal.java

@@ -1,90 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.Ready;
-import sop.enums.EncryptAs;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.Encrypt;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-public class EncryptExternal implements Encrypt {
-
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-    private int SIGN_WITH_COUNTER = 0;
-    private int KEY_PASSWORD_COUNTER = 0;
-    private int PASSWORD_COUNTER = 0;
-    private int CERT_COUNTER = 0;
-
-    public EncryptExternal(String binary, Properties environment) {
-        this.commandList.add(binary);
-        this.commandList.add("encrypt");
-        this.envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public Encrypt noArmor() {
-        this.commandList.add("--no-armor");
-        return this;
-    }
-
-    @Override
-    public Encrypt mode(EncryptAs mode)
-            throws SOPGPException.UnsupportedOption {
-        this.commandList.add("--as=" + mode);
-        return this;
-    }
-
-    @Override
-    public Encrypt signWith(InputStream key)
-            throws SOPGPException.KeyCannotSign, SOPGPException.UnsupportedAsymmetricAlgo, SOPGPException.BadData,
-            IOException {
-        String envVar = "SIGN_WITH_" + SIGN_WITH_COUNTER++;
-        commandList.add("--sign-with=@ENV:" + envVar);
-        envList.add(envVar + "=" + ExternalSOP.readFully(key));
-        return this;
-    }
-
-    @Override
-    public Encrypt withKeyPassword(byte[] password)
-            throws SOPGPException.PasswordNotHumanReadable, SOPGPException.UnsupportedOption {
-        String envVar = "KEY_PASSWORD_" + KEY_PASSWORD_COUNTER++;
-        commandList.add("--with-key-password=@ENV:" + envVar);
-        envList.add(envVar + "=" + new String(password));
-        return this;
-    }
-
-    @Override
-    public Encrypt withPassword(String password)
-            throws SOPGPException.PasswordNotHumanReadable, SOPGPException.UnsupportedOption {
-        String envVar = "PASSWORD_" + PASSWORD_COUNTER++;
-        commandList.add("--with-password=@ENV:" + envVar);
-        envList.add(envVar + "=" + password);
-        return this;
-    }
-
-    @Override
-    public Encrypt withCert(InputStream cert)
-            throws SOPGPException.CertCannotEncrypt, SOPGPException.UnsupportedAsymmetricAlgo, SOPGPException.BadData,
-            IOException {
-        String envVar = "CERT_" + CERT_COUNTER++;
-        commandList.add("@ENV:" + envVar);
-        envList.add(envVar + "=" + ExternalSOP.readFully(cert));
-        return this;
-    }
-
-    @Override
-    public Ready plaintext(InputStream plaintext)
-            throws IOException, SOPGPException.KeyIsProtected {
-        return ExternalSOP.ready(Runtime.getRuntime(), commandList, envList, plaintext);
-    }
-}

external-sop/src/main/java/sop/external/operation/ExtractCertExternal.java

@@ -1,38 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.Ready;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.ExtractCert;
-
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-public class ExtractCertExternal implements ExtractCert {
-
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    public ExtractCertExternal(String binary, Properties properties) {
-        this.commandList.add(binary);
-        this.commandList.add("extract-cert");
-        this.envList = ExternalSOP.propertiesToEnv(properties);
-    }
-
-    @Override
-    public ExtractCert noArmor() {
-        this.commandList.add("--no-armor");
-        return this;
-    }
-
-    @Override
-    public Ready key(InputStream keyInputStream) throws SOPGPException.BadData {
-        return ExternalSOP.ready(Runtime.getRuntime(), commandList, envList, keyInputStream);
-    }
-}

external-sop/src/main/java/sop/external/operation/GenerateKeyExternal.java

@@ -1,56 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.Ready;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.GenerateKey;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-public class GenerateKeyExternal implements GenerateKey {
-
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    private int keyPasswordCounter = 0;
-
-    public GenerateKeyExternal(String binary, Properties environment) {
-        this.commandList.add(binary);
-        this.commandList.add("generate-key");
-        this.envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public GenerateKey noArmor() {
-        this.commandList.add("--no-armor");
-        return this;
-    }
-
-    @Override
-    public GenerateKey userId(String userId) {
-        this.commandList.add(userId);
-        return this;
-    }
-
-    @Override
-    public GenerateKey withKeyPassword(String password)
-            throws SOPGPException.PasswordNotHumanReadable, SOPGPException.UnsupportedOption {
-        this.commandList.add("--with-key-password=@ENV:KEY_PASSWORD_" + keyPasswordCounter);
-        this.envList.add("KEY_PASSWORD_" + keyPasswordCounter + "=" + password);
-        keyPasswordCounter++;
-
-        return this;
-    }
-
-    @Override
-    public Ready generate()
-            throws SOPGPException.MissingArg, SOPGPException.UnsupportedAsymmetricAlgo {
-        return ExternalSOP.ready(Runtime.getRuntime(), commandList, envList);
-    }
-}

external-sop/src/main/java/sop/external/operation/InlineDetachExternal.java

@@ -1,100 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.ReadyWithResult;
-import sop.Signatures;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.InlineDetach;
-
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-public class InlineDetachExternal implements InlineDetach {
-
-    private final ExternalSOP.TempDirProvider tempDirProvider;
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    public InlineDetachExternal(String binary, Properties environment, ExternalSOP.TempDirProvider tempDirProvider) {
-        this.tempDirProvider = tempDirProvider;
-        commandList.add(binary);
-        commandList.add("inline-detach");
-        envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public InlineDetach noArmor() {
-        commandList.add("--no-armor");
-        return this;
-    }
-
-    @Override
-    public ReadyWithResult<Signatures> message(InputStream messageInputStream) throws IOException, SOPGPException.BadData {
-        File tempDir = tempDirProvider.provideTempDirectory();
-
-        File signaturesOut = new File(tempDir, "signatures");
-        signaturesOut.delete();
-        commandList.add("--signatures-out=" + signaturesOut.getAbsolutePath());
-
-        String[] command = commandList.toArray(new String[0]);
-        String[] env = envList.toArray(new String[0]);
-
-        try {
-            Process process = Runtime.getRuntime().exec(command, env);
-            OutputStream processOut = process.getOutputStream();
-            InputStream processIn = process.getInputStream();
-
-            return new ReadyWithResult<Signatures>() {
-                @Override
-                public Signatures writeTo(OutputStream outputStream) throws IOException {
-                    byte[] buf = new byte[4096];
-                    int r;
-                    while ((r = messageInputStream.read(buf)) > 0) {
-                        processOut.write(buf, 0, r);
-                    }
-
-                    messageInputStream.close();
-                    processOut.close();
-
-                    while ((r = processIn.read(buf)) > 0) {
-                        outputStream.write(buf, 0 , r);
-                    }
-
-                    processIn.close();
-                    outputStream.close();
-
-                    ExternalSOP.finish(process);
-
-                    FileInputStream signaturesOutIn = new FileInputStream(signaturesOut);
-                    ByteArrayOutputStream signaturesBuffer = new ByteArrayOutputStream();
-                    while ((r = signaturesOutIn.read(buf)) > 0) {
-                        signaturesBuffer.write(buf, 0, r);
-                    }
-                    signaturesOutIn.close();
-                    signaturesOut.delete();
-
-                    final byte[] sigBytes = signaturesBuffer.toByteArray();
-                    return new Signatures() {
-                        @Override
-                        public void writeTo(OutputStream signatureOutputStream) throws IOException {
-                            signatureOutputStream.write(sigBytes);
-                        }
-                    };
-                }
-            };
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

external-sop/src/main/java/sop/external/operation/InlineSignExternal.java

@@ -1,65 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.Ready;
-import sop.enums.InlineSignAs;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.InlineSign;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-public class InlineSignExternal implements InlineSign {
-
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    private int keyCounter = 0;
-    private int withKeyPasswordCounter = 0;
-
-    public InlineSignExternal(String binary, Properties environment) {
-        commandList.add(binary);
-        commandList.add("inline-sign");
-        envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public InlineSign noArmor() {
-        commandList.add("--no-armor");
-        return this;
-    }
-
-    @Override
-    public InlineSign key(InputStream key) throws SOPGPException.KeyCannotSign, SOPGPException.BadData, SOPGPException.UnsupportedAsymmetricAlgo, IOException {
-        String envVar = "KEY_" + keyCounter++;
-        commandList.add("@ENV:" + envVar);
-        envList.add(envVar + "=" + ExternalSOP.readFully(key));
-        return this;
-    }
-
-    @Override
-    public InlineSign withKeyPassword(byte[] password) throws SOPGPException.UnsupportedOption, SOPGPException.PasswordNotHumanReadable {
-        String envVar = "WITH_KEY_PASSWORD_" + withKeyPasswordCounter++;
-        commandList.add("--with-key-password=@ENV:" + envVar);
-        envList.add(envVar + "=" + new String(password));
-        return this;
-    }
-
-    @Override
-    public InlineSign mode(InlineSignAs mode) throws SOPGPException.UnsupportedOption {
-        commandList.add("--as=" + mode);
-        return this;
-    }
-
-    @Override
-    public Ready data(InputStream data) throws IOException, SOPGPException.KeyIsProtected, SOPGPException.ExpectedText {
-        return ExternalSOP.ready(Runtime.getRuntime(), commandList, envList, data);
-    }
-}

external-sop/src/main/java/sop/external/operation/InlineVerifyExternal.java

@@ -1,114 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.ReadyWithResult;
-import sop.Verification;
-import sop.exception.SOPGPException;
-import sop.external.ExternalSOP;
-import sop.operation.InlineVerify;
-import sop.util.UTCUtil;
-
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.OutputStream;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-import java.util.Properties;
-
-public class InlineVerifyExternal implements InlineVerify {
-
-    private final ExternalSOP.TempDirProvider tempDirProvider;
-    private final List<String> commandList = new ArrayList<>();
-    private final List<String> envList;
-
-    private int certCounter = 0;
-
-    public InlineVerifyExternal(String binary, Properties environment, ExternalSOP.TempDirProvider tempDirProvider) {
-        this.tempDirProvider = tempDirProvider;
-        commandList.add(binary);
-        commandList.add("inline-verify");
-        envList = ExternalSOP.propertiesToEnv(environment);
-    }
-
-    @Override
-    public InlineVerify notBefore(Date timestamp) throws SOPGPException.UnsupportedOption {
-        commandList.add("--not-before=" + UTCUtil.formatUTCDate(timestamp));
-        return this;
-    }
-
-    @Override
-    public InlineVerify notAfter(Date timestamp) throws SOPGPException.UnsupportedOption {
-        commandList.add("--not-after=" + UTCUtil.formatUTCDate(timestamp));
-        return this;
-    }
-
-    @Override
-    public InlineVerify cert(InputStream cert) throws SOPGPException.BadData, IOException {
-        String envVar = "CERT_" + certCounter++;
-        commandList.add("@ENV:" + envVar);
-        envList.add(envVar + "=" + ExternalSOP.readFully(cert));
-        return this;
-    }
-
-    @Override
-    public ReadyWithResult<List<Verification>> data(InputStream data) throws IOException, SOPGPException.NoSignature, SOPGPException.BadData {
-        File tempDir = tempDirProvider.provideTempDirectory();
-
-        File verificationsOut = new File(tempDir, "verifications-out");
-        verificationsOut.delete();
-        commandList.add("--verifications-out=" + verificationsOut.getAbsolutePath());
-
-        String[] command = commandList.toArray(new String[0]);
-        String[] env = envList.toArray(new String[0]);
-
-        try {
-            Process process = Runtime.getRuntime().exec(command, env);
-            OutputStream processOut = process.getOutputStream();
-            InputStream processIn = process.getInputStream();
-
-            return new ReadyWithResult<List<Verification>>() {
-                @Override
-                public List<Verification> writeTo(OutputStream outputStream) throws IOException, SOPGPException.NoSignature {
-                    byte[] buf = new byte[4096];
-                    int r;
-                    while ((r = data.read(buf)) > 0) {
-                        processOut.write(buf, 0, r);
-                    }
-
-                    data.close();
-                    processOut.close();
-
-
-                    while ((r = processIn.read(buf)) > 0) {
-                        outputStream.write(buf, 0 , r);
-                    }
-
-                    processIn.close();
-                    outputStream.close();
-
-                    ExternalSOP.finish(process);
-
-                    FileInputStream verificationsOutIn = new FileInputStream(verificationsOut);
-                    BufferedReader reader = new BufferedReader(new InputStreamReader(verificationsOutIn));
-                    List<Verification> verificationList = new ArrayList<>();
-                    String line;
-                    while ((line = reader.readLine()) != null) {
-                        verificationList.add(Verification.fromString(line.trim()));
-                    }
-
-                    return verificationList;
-                }
-            };
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

external-sop/src/main/java/sop/external/operation/VersionExternal.java

@@ -1,99 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external.operation;
-
-import sop.external.ExternalSOP;
-import sop.operation.Version;
-
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.util.Properties;
-
-public class VersionExternal implements Version {
-
-    private final Runtime runtime = Runtime.getRuntime();
-    private final String binary;
-    private final Properties environment;
-
-    public VersionExternal(String binaryName, Properties environment) {
-        this.binary = binaryName;
-        this.environment = environment;
-    }
-
-    @Override
-    public String getName() {
-        String[] command = new String[] {binary, "version"};
-        String[] env = ExternalSOP.propertiesToEnv(environment).toArray(new String[0]);
-        try {
-            Process process = runtime.exec(command, env);
-            BufferedReader stdInput = new BufferedReader(new InputStreamReader(process.getInputStream()));
-            String line = stdInput.readLine().trim();
-            ExternalSOP.finish(process);
-            if (line.contains(" ")) {
-                return line.substring(0, line.lastIndexOf(" "));
-            }
-            return line;
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    @Override
-    public String getVersion() {
-        String[] command = new String[] {binary, "version"};
-        String[] env = ExternalSOP.propertiesToEnv(environment).toArray(new String[0]);
-        try {
-            Process process = runtime.exec(command, env);
-            BufferedReader stdInput = new BufferedReader(new InputStreamReader(process.getInputStream()));
-            String line = stdInput.readLine().trim();
-            ExternalSOP.finish(process);
-            if (line.contains(" ")) {
-                return line.substring(line.lastIndexOf(" ") + 1);
-            }
-            return line;
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    @Override
-    public String getBackendVersion() {
-        String[] command = new String[] {binary, "version", "--backend"};
-        String[] env = ExternalSOP.propertiesToEnv(environment).toArray(new String[0]);
-        try {
-            Process process = runtime.exec(command, env);
-            BufferedReader stdInput = new BufferedReader(new InputStreamReader(process.getInputStream()));
-            StringBuilder sb = new StringBuilder();
-            String line;
-            while ((line = stdInput.readLine()) != null) {
-                sb.append(line).append('\n');
-            }
-            ExternalSOP.finish(process);
-            return sb.toString();
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    @Override
-    public String getExtendedVersion() {
-        String[] command = new String[] {binary, "version", "--extended"};
-        String[] env = ExternalSOP.propertiesToEnv(environment).toArray(new String[0]);
-        try {
-            Process process = runtime.exec(command, env);
-            BufferedReader stdInput = new BufferedReader(new InputStreamReader(process.getInputStream()));
-            StringBuilder sb = new StringBuilder();
-            String line;
-            while ((line = stdInput.readLine()) != null) {
-                sb.append(line).append('\n');
-            }
-            ExternalSOP.finish(process);
-            return sb.toString();
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

external-sop/src/main/java/sop/external/package-info.java

@@ -1,8 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-/**
- * Implementation of sop-java which delegates execution to a binary implementing the SOP command line interface.
- */
-package sop.external;

external-sop/src/main/kotlin/sop/external/ExternalSOP.kt

@@ -0,0 +1,318 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external
+
+import java.io.*
+import java.nio.file.Files
+import java.util.*
+import javax.annotation.Nonnull
+import sop.Ready
+import sop.SOP
+import sop.exception.SOPGPException.*
+import sop.external.ExternalSOP.TempDirProvider
+import sop.external.operation.*
+import sop.operation.*
+
+/**
+ * Implementation of the [SOP] API using an external SOP binary.
+ *
+ * Instantiate an [ExternalSOP] object for the given binary and the given [TempDirProvider] using
+ * empty environment variables.
+ *
+ * @param binaryName name / path of the SOP binary
+ * @param tempDirProvider custom tempDirProvider
+ */
+class ExternalSOP(
+    private val binaryName: String,
+    private val properties: Properties = Properties(),
+    private val tempDirProvider: TempDirProvider = defaultTempDirProvider()
+) : SOP {
+
+    constructor(
+        binaryName: String,
+        properties: Properties
+    ) : this(binaryName, properties, defaultTempDirProvider())
+
+    override fun version(): Version = VersionExternal(binaryName, properties)
+
+    override fun generateKey(): GenerateKey = GenerateKeyExternal(binaryName, properties)
+
+    override fun extractCert(): ExtractCert = ExtractCertExternal(binaryName, properties)
+
+    override fun detachedSign(): DetachedSign =
+        DetachedSignExternal(binaryName, properties, tempDirProvider)
+
+    override fun inlineSign(): InlineSign = InlineSignExternal(binaryName, properties)
+
+    override fun detachedVerify(): DetachedVerify = DetachedVerifyExternal(binaryName, properties)
+
+    override fun inlineVerify(): InlineVerify =
+        InlineVerifyExternal(binaryName, properties, tempDirProvider)
+
+    override fun inlineDetach(): InlineDetach =
+        InlineDetachExternal(binaryName, properties, tempDirProvider)
+
+    override fun encrypt(): Encrypt = EncryptExternal(binaryName, properties, tempDirProvider)
+
+    override fun decrypt(): Decrypt = DecryptExternal(binaryName, properties, tempDirProvider)
+
+    override fun armor(): Armor = ArmorExternal(binaryName, properties)
+
+    override fun dearmor(): Dearmor = DearmorExternal(binaryName, properties)
+
+    override fun listProfiles(): ListProfiles = ListProfilesExternal(binaryName, properties)
+
+    override fun revokeKey(): RevokeKey = RevokeKeyExternal(binaryName, properties)
+
+    override fun changeKeyPassword(): ChangeKeyPassword =
+        ChangeKeyPasswordExternal(binaryName, properties)
+
+    /**
+     * This interface can be used to provide a directory in which external SOP binaries can
+     * temporarily store additional results of OpenPGP operations such that the binding classes can
+     * parse them out from there. Unfortunately, on Java you cannot open
+     * [FileDescriptors][java.io.FileDescriptor] arbitrarily, so we have to rely on temporary files
+     * to pass results. An example: `sop decrypt` can emit signature verifications via
+     * `--verify-out=/path/to/tempfile`. [DecryptExternal] will then parse the temp file to make the
+     * result available to consumers. Temporary files are deleted after being read, yet creating
+     * temp files for sensitive information on disk might pose a security risk. Use with care!
+     */
+    fun interface TempDirProvider {
+
+        @Throws(IOException::class) fun provideTempDirectory(): File
+    }
+
+    companion object {
+
+        @JvmStatic
+        @Throws(IOException::class)
+        fun finish(process: Process) {
+            try {
+                mapExitCodeOrException(process)
+            } catch (e: InterruptedException) {
+                throw RuntimeException(e)
+            }
+        }
+
+        @JvmStatic
+        @Throws(InterruptedException::class, IOException::class)
+        private fun mapExitCodeOrException(process: Process) {
+            // wait for process termination
+            val exitCode = process.waitFor()
+
+            if (exitCode == 0) {
+                // we're good, bye
+                return
+            }
+
+            // Read error message
+            val errIn = process.errorStream
+            val errorMessage = readString(errIn)
+
+            when (exitCode) {
+                NoSignature.EXIT_CODE ->
+                    throw NoSignature(
+                        "External SOP backend reported error NoSignature ($exitCode):\n$errorMessage")
+                UnsupportedAsymmetricAlgo.EXIT_CODE ->
+                    throw UnsupportedOperationException(
+                        "External SOP backend reported error UnsupportedAsymmetricAlgo ($exitCode):\n$errorMessage")
+                CertCannotEncrypt.EXIT_CODE ->
+                    throw CertCannotEncrypt(
+                        "External SOP backend reported error CertCannotEncrypt ($exitCode):\n$errorMessage")
+                MissingArg.EXIT_CODE ->
+                    throw MissingArg(
+                        "External SOP backend reported error MissingArg ($exitCode):\n$errorMessage")
+                IncompleteVerification.EXIT_CODE ->
+                    throw IncompleteVerification(
+                        "External SOP backend reported error IncompleteVerification ($exitCode):\n$errorMessage")
+                CannotDecrypt.EXIT_CODE ->
+                    throw CannotDecrypt(
+                        "External SOP backend reported error CannotDecrypt ($exitCode):\n$errorMessage")
+                PasswordNotHumanReadable.EXIT_CODE ->
+                    throw PasswordNotHumanReadable(
+                        "External SOP backend reported error PasswordNotHumanReadable ($exitCode):\n$errorMessage")
+                UnsupportedOption.EXIT_CODE ->
+                    throw UnsupportedOption(
+                        "External SOP backend reported error UnsupportedOption ($exitCode):\n$errorMessage")
+                BadData.EXIT_CODE ->
+                    throw BadData(
+                        "External SOP backend reported error BadData ($exitCode):\n$errorMessage")
+                ExpectedText.EXIT_CODE ->
+                    throw ExpectedText(
+                        "External SOP backend reported error ExpectedText ($exitCode):\n$errorMessage")
+                OutputExists.EXIT_CODE ->
+                    throw OutputExists(
+                        "External SOP backend reported error OutputExists ($exitCode):\n$errorMessage")
+                MissingInput.EXIT_CODE ->
+                    throw MissingInput(
+                        "External SOP backend reported error MissingInput ($exitCode):\n$errorMessage")
+                KeyIsProtected.EXIT_CODE ->
+                    throw KeyIsProtected(
+                        "External SOP backend reported error KeyIsProtected ($exitCode):\n$errorMessage")
+                UnsupportedSubcommand.EXIT_CODE ->
+                    throw UnsupportedSubcommand(
+                        "External SOP backend reported error UnsupportedSubcommand ($exitCode):\n$errorMessage")
+                UnsupportedSpecialPrefix.EXIT_CODE ->
+                    throw UnsupportedSpecialPrefix(
+                        "External SOP backend reported error UnsupportedSpecialPrefix ($exitCode):\n$errorMessage")
+                AmbiguousInput.EXIT_CODE ->
+                    throw AmbiguousInput(
+                        "External SOP backend reported error AmbiguousInput ($exitCode):\n$errorMessage")
+                KeyCannotSign.EXIT_CODE ->
+                    throw KeyCannotSign(
+                        "External SOP backend reported error KeyCannotSign ($exitCode):\n$errorMessage")
+                IncompatibleOptions.EXIT_CODE ->
+                    throw IncompatibleOptions(
+                        "External SOP backend reported error IncompatibleOptions ($exitCode):\n$errorMessage")
+                UnsupportedProfile.EXIT_CODE ->
+                    throw UnsupportedProfile(
+                        "External SOP backend reported error UnsupportedProfile ($exitCode):\n$errorMessage")
+
+                // Did you forget to add a case for a new exception type?
+                else ->
+                    throw RuntimeException(
+                        "External SOP backend reported unknown exit code ($exitCode):\n$errorMessage")
+            }
+        }
+
+        /**
+         * Return all key-value pairs from the given [Properties] object as a list with items of the
+         * form `key=value`.
+         *
+         * @param properties properties
+         * @return list of key=value strings
+         */
+        @JvmStatic
+        fun propertiesToEnv(properties: Properties): List<String> =
+            properties.map { "${it.key}=${it.value}" }
+
+        /**
+         * Read the contents of the [InputStream] and return them as a [String].
+         *
+         * @param inputStream input stream
+         * @return string
+         * @throws IOException in case of an IO error
+         */
+        @JvmStatic
+        @Throws(IOException::class)
+        fun readString(inputStream: InputStream): String {
+            val bOut = ByteArrayOutputStream()
+            val buf = ByteArray(4096)
+            var r: Int
+            while (inputStream.read(buf).also { r = it } > 0) {
+                bOut.write(buf, 0, r)
+            }
+            return bOut.toString()
+        }
+
+        /**
+         * Execute the given command on the given [Runtime] with the given list of environment
+         * variables. This command does not transform any input data, and instead is purely a
+         * producer.
+         *
+         * @param runtime runtime
+         * @param commandList command
+         * @param envList environment variables
+         * @return ready to read the result from
+         */
+        @JvmStatic
+        fun executeProducingOperation(
+            runtime: Runtime,
+            commandList: List<String>,
+            envList: List<String>
+        ): Ready {
+            try {
+                val process = runtime.exec(commandList.toTypedArray(), envList.toTypedArray())
+                val stdIn = process.inputStream
+
+                return object : Ready() {
+                    @Throws(IOException::class)
+                    override fun writeTo(@Nonnull outputStream: OutputStream) {
+                        val buf = ByteArray(4096)
+                        var r: Int
+                        while (stdIn.read(buf).also { r = it } >= 0) {
+                            outputStream.write(buf, 0, r)
+                        }
+                        outputStream.flush()
+                        outputStream.close()
+                        finish(process)
+                    }
+                }
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            }
+        }
+
+        /**
+         * Execute the given command on the given runtime using the given environment variables. The
+         * given input stream provides input for the process. This command is a transformation,
+         * meaning it is given input data and transforms it into output data.
+         *
+         * @param runtime runtime
+         * @param commandList command
+         * @param envList environment variables
+         * @param standardIn stream of input data for the process
+         * @return ready to read the result from
+         */
+        @JvmStatic
+        fun executeTransformingOperation(
+            runtime: Runtime,
+            commandList: List<String>,
+            envList: List<String>,
+            standardIn: InputStream
+        ): Ready {
+            try {
+                val process = runtime.exec(commandList.toTypedArray(), envList.toTypedArray())
+                val processOut = process.outputStream
+                val processIn = process.inputStream
+
+                return object : Ready() {
+                    override fun writeTo(outputStream: OutputStream) {
+                        val buf = ByteArray(4096)
+                        var r: Int
+                        while (standardIn.read(buf).also { r = it } > 0) {
+                            processOut.write(buf, 0, r)
+                        }
+                        standardIn.close()
+
+                        try {
+                            processOut.flush()
+                            processOut.close()
+                        } catch (e: IOException) {
+                            // Perhaps the stream is already closed, in which case we ignore the
+                            // exception.
+                            if ("Stream closed" != e.message) {
+                                throw e
+                            }
+                        }
+
+                        while (processIn.read(buf).also { r = it } > 0) {
+                            outputStream.write(buf, 0, r)
+                        }
+                        processIn.close()
+
+                        outputStream.flush()
+                        outputStream.close()
+
+                        finish(process)
+                    }
+                }
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            }
+        }
+
+        /**
+         * Default implementation of the [TempDirProvider] which stores temporary files in the
+         * systems temp dir ([Files.createTempDirectory]).
+         *
+         * @return default implementation
+         */
+        @JvmStatic
+        fun defaultTempDirProvider(): TempDirProvider {
+            return TempDirProvider { Files.createTempDirectory("ext-sop").toFile() }
+        }
+    }
+}

external-sop/src/main/kotlin/sop/external/ExternalSOPV.kt

@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: 2024 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external
+
+import java.nio.file.Files
+import java.util.*
+import sop.SOPV
+import sop.external.ExternalSOP.TempDirProvider
+import sop.external.operation.DetachedVerifyExternal
+import sop.external.operation.InlineVerifyExternal
+import sop.external.operation.VersionExternal
+import sop.operation.DetachedVerify
+import sop.operation.InlineVerify
+import sop.operation.Version
+
+/**
+ * Implementation of the [SOPV] API subset using an external sopv/sop binary.
+ *
+ * Instantiate an [ExternalSOPV] object for the given binary and the given [TempDirProvider] using
+ * empty environment variables.
+ *
+ * @param binaryName name / path of the sopv binary
+ * @param tempDirProvider custom tempDirProvider
+ */
+class ExternalSOPV(
+    private val binaryName: String,
+    private val properties: Properties = Properties(),
+    private val tempDirProvider: TempDirProvider = defaultTempDirProvider()
+) : SOPV {
+
+    override fun version(): Version = VersionExternal(binaryName, properties)
+
+    override fun detachedVerify(): DetachedVerify = DetachedVerifyExternal(binaryName, properties)
+
+    override fun inlineVerify(): InlineVerify =
+        InlineVerifyExternal(binaryName, properties, tempDirProvider)
+
+    companion object {
+
+        /**
+         * Default implementation of the [TempDirProvider] which stores temporary files in the
+         * systems temp dir ([Files.createTempDirectory]).
+         *
+         * @return default implementation
+         */
+        @JvmStatic
+        fun defaultTempDirProvider(): TempDirProvider {
+            return TempDirProvider { Files.createTempDirectory("ext-sopv").toFile() }
+        }
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/ArmorExternal.kt

@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.InputStream
+import java.util.Properties
+import sop.Ready
+import sop.exception.SOPGPException
+import sop.external.ExternalSOP
+import sop.operation.Armor
+
+/** Implementation of the [Armor] operation using an external SOP binary. */
+class ArmorExternal(binary: String, environment: Properties) : Armor {
+
+    private val commandList: MutableList<String> = mutableListOf(binary, "armor")
+    private val envList: List<String> = ExternalSOP.propertiesToEnv(environment)
+
+    @Throws(SOPGPException.BadData::class)
+    override fun data(data: InputStream): Ready =
+        ExternalSOP.executeTransformingOperation(Runtime.getRuntime(), commandList, envList, data)
+}

external-sop/src/main/kotlin/sop/external/operation/ChangeKeyPasswordExternal.kt

@@ -0,0 +1,37 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.InputStream
+import java.util.Properties
+import sop.Ready
+import sop.external.ExternalSOP
+import sop.operation.ChangeKeyPassword
+
+/** Implementation of the [ChangeKeyPassword] operation using an external SOP binary. */
+class ChangeKeyPasswordExternal(binary: String, environment: Properties) : ChangeKeyPassword {
+
+    private val commandList: MutableList<String> = mutableListOf(binary, "change-key-password")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var keyPasswordCounter = 0
+
+    override fun noArmor(): ChangeKeyPassword = apply { commandList.add("--no-armor") }
+
+    override fun oldKeyPassphrase(oldPassphrase: String): ChangeKeyPassword = apply {
+        commandList.add("--old-key-password=@ENV:KEY_PASSWORD_$keyPasswordCounter")
+        envList.add("KEY_PASSWORD_$keyPasswordCounter=$oldPassphrase")
+        keyPasswordCounter += 1
+    }
+
+    override fun newKeyPassphrase(newPassphrase: String): ChangeKeyPassword = apply {
+        commandList.add("--new-key-password=@ENV:KEY_PASSWORD_$keyPasswordCounter")
+        envList.add("KEY_PASSWORD_$keyPasswordCounter=$newPassphrase")
+        keyPasswordCounter += 1
+    }
+
+    override fun keys(keys: InputStream): Ready =
+        ExternalSOP.executeTransformingOperation(Runtime.getRuntime(), commandList, envList, keys)
+}

external-sop/src/main/kotlin/sop/external/operation/DearmorExternal.kt

@@ -0,0 +1,20 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.InputStream
+import java.util.Properties
+import sop.Ready
+import sop.external.ExternalSOP
+import sop.operation.Dearmor
+
+/** Implementation of the [Dearmor] operation using an external SOP binary. */
+class DearmorExternal(binary: String, environment: Properties) : Dearmor {
+    private val commandList = listOf(binary, "dearmor")
+    private val envList = ExternalSOP.propertiesToEnv(environment)
+
+    override fun data(data: InputStream): Ready =
+        ExternalSOP.executeTransformingOperation(Runtime.getRuntime(), commandList, envList, data)
+}

external-sop/src/main/kotlin/sop/external/operation/DecryptExternal.kt

@@ -0,0 +1,133 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.*
+import java.util.*
+import sop.DecryptionResult
+import sop.ReadyWithResult
+import sop.SessionKey
+import sop.Verification
+import sop.external.ExternalSOP
+import sop.external.ExternalSOP.Companion.finish
+import sop.external.ExternalSOP.Companion.readString
+import sop.operation.Decrypt
+import sop.util.UTCUtil
+
+/** Implementation of the [Decrypt] operation using an external SOP binary. */
+class DecryptExternal(
+    binary: String,
+    environment: Properties,
+    private val tempDirProvider: ExternalSOP.TempDirProvider
+) : Decrypt {
+
+    private val commandList = mutableListOf(binary, "decrypt")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var argCounter = 0
+    private var requireVerification = false
+
+    override fun verifyNotBefore(timestamp: Date): Decrypt = apply {
+        commandList.add("--verify-not-before=${UTCUtil.formatUTCDate(timestamp)}")
+    }
+
+    override fun verifyNotAfter(timestamp: Date): Decrypt = apply {
+        commandList.add("--verify-not-after=${UTCUtil.formatUTCDate(timestamp)}")
+    }
+
+    override fun verifyWithCert(cert: InputStream): Decrypt = apply {
+        commandList.add("--verify-with=@ENV:VERIFY_WITH_$argCounter")
+        envList.add("VERIFY_WITH_$argCounter=${readString(cert)}")
+        argCounter += 1
+        requireVerification = true
+    }
+
+    override fun withSessionKey(sessionKey: SessionKey): Decrypt = apply {
+        commandList.add("--with-session-key=@ENV:SESSION_KEY_$argCounter")
+        envList.add("SESSION_KEY_$argCounter=$sessionKey")
+        argCounter += 1
+    }
+
+    override fun withPassword(password: String): Decrypt = apply {
+        commandList.add("--with-password=@ENV:PASSWORD_$argCounter")
+        envList.add("PASSWORD_$argCounter=$password")
+        argCounter += 1
+    }
+
+    override fun withKey(key: InputStream): Decrypt = apply {
+        commandList.add("@ENV:KEY_$argCounter")
+        envList.add("KEY_$argCounter=${readString(key)}")
+        argCounter += 1
+    }
+
+    override fun withKeyPassword(password: ByteArray): Decrypt = apply {
+        commandList.add("--with-key-password=@ENV:KEY_PASSWORD_$argCounter")
+        envList.add("KEY_PASSWORD_$argCounter=${String(password)}")
+        argCounter += 1
+    }
+
+    override fun ciphertext(ciphertext: InputStream): ReadyWithResult<DecryptionResult> {
+        val tempDir = tempDirProvider.provideTempDirectory()
+
+        val sessionKeyOut = File(tempDir, "session-key-out")
+        sessionKeyOut.delete()
+        commandList.add("--session-key-out=${sessionKeyOut.absolutePath}")
+
+        val verifyOut = File(tempDir, "verifications-out")
+        verifyOut.delete()
+        if (requireVerification) {
+            commandList.add("--verify-out=${verifyOut.absolutePath}")
+        }
+
+        try {
+            val process =
+                Runtime.getRuntime().exec(commandList.toTypedArray(), envList.toTypedArray())
+            val processOut = process.outputStream
+            val processIn = process.inputStream
+
+            return object : ReadyWithResult<DecryptionResult>() {
+                override fun writeTo(outputStream: OutputStream): DecryptionResult {
+                    val buf = ByteArray(4096)
+                    var r: Int
+                    while (ciphertext.read(buf).also { r = it } > 0) {
+                        processOut.write(buf, 0, r)
+                    }
+
+                    ciphertext.close()
+                    processOut.close()
+
+                    while (processIn.read(buf).also { r = it } > 0) {
+                        outputStream.write(buf, 0, r)
+                    }
+
+                    processIn.close()
+                    outputStream.close()
+
+                    finish(process)
+
+                    val sessionKeyOutIn = FileInputStream(sessionKeyOut)
+                    var line = readString(sessionKeyOutIn)
+                    val sessionKey = SessionKey.fromString(line.trim { it <= ' ' })
+                    sessionKeyOutIn.close()
+                    sessionKeyOut.delete()
+
+                    val verifications: MutableList<Verification> = ArrayList()
+                    if (requireVerification) {
+                        val verifyOutIn = FileInputStream(verifyOut)
+                        val reader = BufferedReader(InputStreamReader(verifyOutIn))
+                        while (reader.readLine().also { line = it } != null) {
+                            verifications.add(Verification.fromString(line.trim()))
+                        }
+                        reader.close()
+                    }
+
+                    return DecryptionResult(sessionKey, verifications)
+                }
+            }
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/DetachedSignExternal.kt

@@ -0,0 +1,104 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.*
+import java.util.*
+import sop.MicAlg
+import sop.ReadyWithResult
+import sop.SigningResult
+import sop.SigningResult.Companion.builder
+import sop.enums.SignAs
+import sop.external.ExternalSOP
+import sop.external.ExternalSOP.Companion.finish
+import sop.operation.DetachedSign
+
+/** Implementation of the [DetachedSign] operation using an external SOP binary. */
+class DetachedSignExternal(
+    binary: String,
+    environment: Properties,
+    private val tempDirProvider: ExternalSOP.TempDirProvider
+) : DetachedSign {
+
+    private val commandList = mutableListOf(binary, "sign")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var argCounter = 0
+
+    override fun mode(mode: SignAs): DetachedSign = apply { commandList.add("--as=$mode") }
+
+    override fun data(data: InputStream): ReadyWithResult<SigningResult> {
+        val tempDir = tempDirProvider.provideTempDirectory()
+        val micAlgOut = File(tempDir, "micAlgOut")
+        micAlgOut.delete()
+        commandList.add("--micalg-out=${micAlgOut.absolutePath}")
+
+        try {
+            val process =
+                Runtime.getRuntime().exec(commandList.toTypedArray(), envList.toTypedArray())
+            val processOut = process.outputStream
+            val processIn = process.inputStream
+
+            return object : ReadyWithResult<SigningResult>() {
+                override fun writeTo(outputStream: OutputStream): SigningResult {
+                    val buf = ByteArray(4096)
+                    var r: Int
+                    while (data.read(buf).also { r = it } > 0) {
+                        processOut.write(buf, 0, r)
+                    }
+
+                    data.close()
+                    try {
+                        processOut.close()
+                    } catch (e: IOException) {
+                        // Ignore Stream closed
+                        if ("Stream closed" != e.message) {
+                            throw e
+                        }
+                    }
+
+                    while (processIn.read(buf).also { r = it } > 0) {
+                        outputStream.write(buf, 0, r)
+                    }
+
+                    processIn.close()
+                    outputStream.close()
+
+                    finish(process)
+
+                    val builder = builder()
+                    if (micAlgOut.exists()) {
+                        val reader = BufferedReader(InputStreamReader(FileInputStream(micAlgOut)))
+                        val line = reader.readLine()
+                        if (line != null && line.isNotBlank()) {
+                            val micAlg = MicAlg(line.trim())
+                            builder.setMicAlg(micAlg)
+                        }
+                        reader.close()
+                        micAlgOut.delete()
+                    }
+
+                    return builder.build()
+                }
+            }
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+
+    override fun noArmor(): DetachedSign = apply { commandList.add("--no-armor") }
+
+    override fun key(key: InputStream): DetachedSign = apply {
+        commandList.add("@ENV:KEY_$argCounter")
+        envList.add("KEY_$argCounter=${ExternalSOP.readString(key)}")
+        argCounter += 1
+    }
+
+    override fun withKeyPassword(password: ByteArray): DetachedSign = apply {
+        commandList.add("--with-key-password=@ENV:WITH_KEY_PASSWORD_$argCounter")
+        envList.add("WITH_KEY_PASSWORD_$argCounter=${String(password)}")
+        argCounter += 1
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/DetachedVerifyExternal.kt

@@ -0,0 +1,90 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.BufferedReader
+import java.io.IOException
+import java.io.InputStream
+import java.io.InputStreamReader
+import java.util.*
+import sop.Verification
+import sop.Verification.Companion.fromString
+import sop.exception.SOPGPException
+import sop.external.ExternalSOP
+import sop.external.ExternalSOP.Companion.finish
+import sop.operation.DetachedVerify
+import sop.operation.VerifySignatures
+import sop.util.UTCUtil
+
+/** Implementation of the [DetachedVerify] operation using an external SOP binary. */
+class DetachedVerifyExternal(binary: String, environment: Properties) : DetachedVerify {
+
+    private val commandList = mutableListOf(binary, "verify")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var signatures: InputStream? = null
+    private val certs: MutableSet<InputStream> = mutableSetOf()
+    private var argCounter = 0
+
+    override fun signatures(signatures: InputStream): VerifySignatures = apply {
+        this.signatures = signatures
+    }
+
+    override fun notBefore(timestamp: Date): DetachedVerify = apply {
+        commandList.add("--not-before=${UTCUtil.formatUTCDate(timestamp)}")
+    }
+
+    override fun notAfter(timestamp: Date): DetachedVerify = apply {
+        commandList.add("--not-after=${UTCUtil.formatUTCDate(timestamp)}")
+    }
+
+    override fun cert(cert: InputStream): DetachedVerify = apply { this.certs.add(cert) }
+
+    override fun data(data: InputStream): List<Verification> {
+        // Signature
+        if (signatures == null) {
+            throw SOPGPException.MissingArg("Missing argument: signatures cannot be null.")
+        }
+        commandList.add("@ENV:SIGNATURE")
+        envList.add("SIGNATURE=${ExternalSOP.readString(signatures!!)}")
+
+        // Certs
+        for (cert in certs) {
+            commandList.add("@ENV:CERT_$argCounter")
+            envList.add("CERT_$argCounter=${ExternalSOP.readString(cert)}")
+            argCounter += 1
+        }
+
+        try {
+            val process =
+                Runtime.getRuntime().exec(commandList.toTypedArray(), envList.toTypedArray())
+            val processOut = process.outputStream
+            val processIn = process.inputStream
+
+            val buf = ByteArray(4096)
+            var r: Int
+            while (data.read(buf).also { r = it } > 0) {
+                processOut.write(buf, 0, r)
+            }
+
+            data.close()
+            processOut.close()
+
+            val bufferedReader = BufferedReader(InputStreamReader(processIn))
+            val verifications: MutableList<Verification> = ArrayList()
+
+            var line: String?
+            while (bufferedReader.readLine().also { line = it } != null) {
+                verifications.add(fromString(line!!))
+            }
+
+            finish(process)
+
+            return verifications
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/EncryptExternal.kt

@@ -0,0 +1,111 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.File
+import java.io.FileInputStream
+import java.io.IOException
+import java.io.InputStream
+import java.io.OutputStream
+import java.util.*
+import sop.EncryptionResult
+import sop.ReadyWithResult
+import sop.SessionKey.Companion.fromString
+import sop.enums.EncryptAs
+import sop.external.ExternalSOP
+import sop.external.ExternalSOP.Companion.finish
+import sop.external.ExternalSOP.Companion.readString
+import sop.operation.Encrypt
+
+/** Implementation of the [Encrypt] operation using an external SOP binary. */
+class EncryptExternal(
+    binary: String,
+    environment: Properties,
+    private val tempDirProvider: ExternalSOP.TempDirProvider
+) : Encrypt {
+
+    private val commandList = mutableListOf(binary, "encrypt")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var argCounter = 0
+
+    override fun noArmor(): Encrypt = apply { commandList.add("--no-armor") }
+
+    override fun mode(mode: EncryptAs): Encrypt = apply { commandList.add("--as=$mode") }
+
+    override fun signWith(key: InputStream): Encrypt = apply {
+        commandList.add("--sign-with@ENV:SIGN_WITH_$argCounter")
+        envList.add("SIGN_WITH_$argCounter=${ExternalSOP.readString(key)}")
+        argCounter += 1
+    }
+
+    override fun withKeyPassword(password: ByteArray): Encrypt = apply {
+        commandList.add("--with-key-password=@ENV:KEY_PASSWORD_$argCounter")
+        envList.add("KEY_PASSWORD_$argCounter=${String(password)}")
+        argCounter += 1
+    }
+
+    override fun withPassword(password: String): Encrypt = apply {
+        commandList.add("--with-password=@ENV:PASSWORD_$argCounter")
+        envList.add("PASSWORD_$argCounter=$password")
+        argCounter += 1
+    }
+
+    override fun withCert(cert: InputStream): Encrypt = apply {
+        commandList.add("@ENV:CERT_$argCounter")
+        envList.add("CERT_$argCounter=${readString(cert)}")
+        argCounter += 1
+    }
+
+    override fun profile(profileName: String): Encrypt = apply {
+        commandList.add("--profile=$profileName")
+    }
+
+    override fun plaintext(plaintext: InputStream): ReadyWithResult<EncryptionResult> {
+        val tempDir = tempDirProvider.provideTempDirectory()
+
+        val sessionKeyOut = File(tempDir, "session-key-out")
+        sessionKeyOut.delete()
+        commandList.add("--session-key-out=${sessionKeyOut.absolutePath}")
+        try {
+            val process =
+                Runtime.getRuntime().exec(commandList.toTypedArray(), envList.toTypedArray())
+            val processOut = process.outputStream
+            val processIn = process.inputStream
+
+            return object : ReadyWithResult<EncryptionResult>() {
+                override fun writeTo(outputStream: OutputStream): EncryptionResult {
+                    val buf = ByteArray(4096)
+                    var r: Int
+                    while (plaintext.read(buf).also { r = it } > 0) {
+                        processOut.write(buf, 0, r)
+                    }
+
+                    plaintext.close()
+                    processOut.close()
+
+                    while (processIn.read(buf).also { r = it } > 0) {
+                        outputStream.write(buf, 0, r)
+                    }
+
+                    processIn.close()
+                    outputStream.close()
+
+                    finish(process)
+
+                    val sessionKeyOutIn = FileInputStream(sessionKeyOut)
+                    val line = readString(sessionKeyOutIn)
+                    val sessionKey = fromString(line.trim())
+                    sessionKeyOutIn.close()
+                    sessionKeyOut.delete()
+
+                    return EncryptionResult(sessionKey)
+                }
+            }
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/ExtractCertExternal.kt

@@ -0,0 +1,24 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.InputStream
+import java.util.Properties
+import sop.Ready
+import sop.external.ExternalSOP
+import sop.operation.ExtractCert
+
+/** Implementation of the [ExtractCert] operation using an external SOP binary. */
+class ExtractCertExternal(binary: String, environment: Properties) : ExtractCert {
+
+    private val commandList = mutableListOf(binary, "extract-cert")
+    private val envList = ExternalSOP.propertiesToEnv(environment)
+
+    override fun noArmor(): ExtractCert = apply { commandList.add("--no-armor") }
+
+    override fun key(keyInputStream: InputStream): Ready =
+        ExternalSOP.executeTransformingOperation(
+            Runtime.getRuntime(), commandList, envList, keyInputStream)
+}

external-sop/src/main/kotlin/sop/external/operation/GenerateKeyExternal.kt

@@ -0,0 +1,38 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.util.Properties
+import sop.Ready
+import sop.external.ExternalSOP
+import sop.operation.GenerateKey
+
+/** Implementation of the [GenerateKey] operation using an external SOP binary. */
+class GenerateKeyExternal(binary: String, environment: Properties) : GenerateKey {
+
+    private val commandList = mutableListOf(binary, "generate-key")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var argCounter = 0
+
+    override fun noArmor(): GenerateKey = apply { commandList.add("--no-armor") }
+
+    override fun userId(userId: String): GenerateKey = apply { commandList.add(userId) }
+
+    override fun withKeyPassword(password: String): GenerateKey = apply {
+        commandList.add("--with-key-password=@ENV:KEY_PASSWORD_$argCounter")
+        envList.add("KEY_PASSWORD_$argCounter=$password")
+        argCounter += 1
+    }
+
+    override fun profile(profile: String): GenerateKey = apply {
+        commandList.add("--profile=$profile")
+    }
+
+    override fun signingOnly(): GenerateKey = apply { commandList.add("--signing-only") }
+
+    override fun generate(): Ready =
+        ExternalSOP.executeProducingOperation(Runtime.getRuntime(), commandList, envList)
+}

external-sop/src/main/kotlin/sop/external/operation/InlineDetachExternal.kt

@@ -0,0 +1,82 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.*
+import java.util.*
+import sop.ReadyWithResult
+import sop.Signatures
+import sop.external.ExternalSOP
+import sop.external.ExternalSOP.Companion.finish
+import sop.operation.InlineDetach
+
+/** Implementation of the [InlineDetach] operation using an external SOP binary. */
+class InlineDetachExternal(
+    binary: String,
+    environment: Properties,
+    private val tempDirProvider: ExternalSOP.TempDirProvider
+) : InlineDetach {
+
+    private val commandList = mutableListOf(binary, "inline-detach")
+    private val envList = ExternalSOP.propertiesToEnv(environment)
+
+    override fun noArmor(): InlineDetach = apply { commandList.add("--no-armor") }
+
+    override fun message(messageInputStream: InputStream): ReadyWithResult<Signatures> {
+        val tempDir = tempDirProvider.provideTempDirectory()
+
+        val signaturesOut = File(tempDir, "signatures")
+        signaturesOut.delete()
+        commandList.add("--signatures-out=${signaturesOut.absolutePath}")
+
+        try {
+            val process =
+                Runtime.getRuntime().exec(commandList.toTypedArray(), envList.toTypedArray())
+            val processOut = process.outputStream
+            val processIn = process.inputStream
+
+            return object : ReadyWithResult<Signatures>() {
+                override fun writeTo(outputStream: OutputStream): Signatures {
+                    val buf = ByteArray(4096)
+                    var r: Int
+                    while (messageInputStream.read(buf).also { r = it } > 0) {
+                        processOut.write(buf, 0, r)
+                    }
+
+                    messageInputStream.close()
+                    processOut.close()
+
+                    while (processIn.read(buf).also { r = it } > 0) {
+                        outputStream.write(buf, 0, r)
+                    }
+
+                    processIn.close()
+                    outputStream.close()
+
+                    finish(process)
+
+                    val signaturesOutIn = FileInputStream(signaturesOut)
+                    val signaturesBuffer = ByteArrayOutputStream()
+                    while (signaturesOutIn.read(buf).also { r = it } > 0) {
+                        signaturesBuffer.write(buf, 0, r)
+                    }
+                    signaturesOutIn.close()
+                    signaturesOut.delete()
+
+                    val sigBytes = signaturesBuffer.toByteArray()
+
+                    return object : Signatures() {
+                        @Throws(IOException::class)
+                        override fun writeTo(outputStream: OutputStream) {
+                            outputStream.write(sigBytes)
+                        }
+                    }
+                }
+            }
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/InlineSignExternal.kt

@@ -0,0 +1,40 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.InputStream
+import java.util.Properties
+import sop.Ready
+import sop.enums.InlineSignAs
+import sop.external.ExternalSOP
+import sop.operation.InlineSign
+
+/** Implementation of the [InlineSign] operation using an external SOP binary. */
+class InlineSignExternal(binary: String, environment: Properties) : InlineSign {
+
+    private val commandList = mutableListOf(binary, "inline-sign")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var argCounter = 0
+
+    override fun mode(mode: InlineSignAs): InlineSign = apply { commandList.add("--as=$mode") }
+
+    override fun data(data: InputStream): Ready =
+        ExternalSOP.executeTransformingOperation(Runtime.getRuntime(), commandList, envList, data)
+
+    override fun noArmor(): InlineSign = apply { commandList.add("--no-armor") }
+
+    override fun key(key: InputStream): InlineSign = apply {
+        commandList.add("@ENV:KEY_$argCounter")
+        envList.add("KEY_$argCounter=${ExternalSOP.readString(key)}")
+        argCounter += 1
+    }
+
+    override fun withKeyPassword(password: ByteArray): InlineSign = apply {
+        commandList.add("--with-key-password=@ENV:WITH_KEY_PASSWORD_$argCounter")
+        envList.add("WITH_KEY_PASSWORD_$argCounter=${String(password)}")
+        argCounter += 1
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/InlineVerifyExternal.kt

@@ -0,0 +1,91 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.*
+import java.util.*
+import sop.ReadyWithResult
+import sop.Verification
+import sop.Verification.Companion.fromString
+import sop.external.ExternalSOP
+import sop.external.ExternalSOP.Companion.finish
+import sop.operation.InlineVerify
+import sop.util.UTCUtil
+
+/** Implementation of the [InlineVerify] operation using an external SOP binary. */
+class InlineVerifyExternal(
+    binary: String,
+    environment: Properties,
+    private val tempDirProvider: ExternalSOP.TempDirProvider
+) : InlineVerify {
+
+    private val commandList = mutableListOf(binary, "inline-verify")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var argCounter = 0
+
+    override fun data(data: InputStream): ReadyWithResult<List<Verification>> {
+        val tempDir = tempDirProvider.provideTempDirectory()
+
+        val verificationsOut = File(tempDir, "verifications-out")
+        verificationsOut.delete()
+        commandList.add("--verifications-out=${verificationsOut.absolutePath}")
+
+        try {
+            val process =
+                Runtime.getRuntime().exec(commandList.toTypedArray(), envList.toTypedArray())
+            val processOut = process.outputStream
+            val processIn = process.inputStream
+
+            return object : ReadyWithResult<List<Verification>>() {
+                override fun writeTo(outputStream: OutputStream): List<Verification> {
+                    val buf = ByteArray(4096)
+                    var r: Int
+                    while (data.read(buf).also { r = it } > 0) {
+                        processOut.write(buf, 0, r)
+                    }
+
+                    data.close()
+                    processOut.close()
+
+                    while (processIn.read(buf).also { r = it } > 0) {
+                        outputStream.write(buf, 0, r)
+                    }
+
+                    processIn.close()
+                    outputStream.close()
+
+                    finish(process)
+
+                    val verificationsOutIn = FileInputStream(verificationsOut)
+                    val reader = BufferedReader(InputStreamReader(verificationsOutIn))
+                    val verificationList: MutableList<Verification> = mutableListOf()
+                    var line: String?
+                    while (reader.readLine().also { line = it } != null) {
+                        verificationList.add(fromString(line!!.trim()))
+                    }
+
+                    return verificationList
+                }
+            }
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+
+    override fun notBefore(timestamp: Date): InlineVerify = apply {
+        commandList.add("--not-before=${UTCUtil.formatUTCDate(timestamp)}")
+    }
+
+    override fun notAfter(timestamp: Date): InlineVerify = apply {
+        commandList.add("--not-after=${UTCUtil.formatUTCDate(timestamp)}")
+    }
+
+    override fun cert(cert: InputStream): InlineVerify = apply {
+        commandList.add("@ENV:CERT_$argCounter")
+        envList.add("CERT_$argCounter=${ExternalSOP.readString(cert)}")
+        argCounter += 1
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/ListProfilesExternal.kt

@@ -0,0 +1,36 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.IOException
+import java.util.Properties
+import sop.Profile
+import sop.external.ExternalSOP
+import sop.operation.ListProfiles
+
+/** Implementation of the [ListProfiles] operation using an external SOP binary. */
+class ListProfilesExternal(binary: String, environment: Properties) : ListProfiles {
+
+    private val commandList = mutableListOf(binary, "list-profiles")
+    private val envList = ExternalSOP.propertiesToEnv(environment)
+
+    override fun subcommand(command: String): List<Profile> {
+        return try {
+            String(
+                    ExternalSOP.executeProducingOperation(
+                            Runtime.getRuntime(), commandList.plus(command), envList)
+                        .bytes)
+                .let { toProfiles(it) }
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+
+    companion object {
+        @JvmStatic
+        private fun toProfiles(output: String): List<Profile> =
+            output.split("\n").filter { it.isNotBlank() }.map { Profile.parse(it) }
+    }
+}

external-sop/src/main/kotlin/sop/external/operation/RevokeKeyExternal.kt

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.InputStream
+import java.util.Properties
+import sop.Ready
+import sop.external.ExternalSOP
+import sop.operation.RevokeKey
+
+/** Implementation of the [RevokeKey] operation using an external SOP binary. */
+class RevokeKeyExternal(binary: String, environment: Properties) : RevokeKey {
+
+    private val commandList = mutableListOf(binary, "revoke-key")
+    private val envList = ExternalSOP.propertiesToEnv(environment).toMutableList()
+
+    private var argCount = 0
+
+    override fun noArmor(): RevokeKey = apply { commandList.add("--no-armor") }
+
+    override fun withKeyPassword(password: ByteArray): RevokeKey = apply {
+        commandList.add("--with-key-password=@ENV:KEY_PASSWORD_$argCount")
+        envList.add("KEY_PASSWORD_$argCount=${String(password)}")
+        argCount += 1
+    }
+
+    override fun keys(keys: InputStream): Ready =
+        ExternalSOP.executeTransformingOperation(Runtime.getRuntime(), commandList, envList, keys)
+}

external-sop/src/main/kotlin/sop/external/operation/VersionExternal.kt

@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.external.operation
+
+import java.io.IOException
+import java.util.Properties
+import sop.external.ExternalSOP
+import sop.operation.Version
+
+/** Implementation of the [Version] operation using an external SOP binary. */
+class VersionExternal(binary: String, environment: Properties) : Version {
+
+    private val commandList = listOf(binary, "version")
+    private val envList = ExternalSOP.propertiesToEnv(environment)
+
+    override fun getName(): String {
+        val info = executeForLine(commandList)
+        return if (info.contains(" ")) {
+            info.substring(0, info.lastIndexOf(" "))
+        } else {
+            info
+        }
+    }
+
+    override fun getVersion(): String {
+        val info = executeForLine(commandList)
+        return if (info.contains(" ")) {
+            info.substring(info.lastIndexOf(" ") + 1)
+        } else {
+            info
+        }
+    }
+
+    override fun getBackendVersion(): String {
+        return executeForLines(commandList.plus("--backend"))
+    }
+
+    override fun getExtendedVersion(): String {
+        return executeForLines(commandList.plus("--extended"))
+    }
+
+    override fun getSopSpecRevisionNumber(): Int {
+        val revision = getSopSpecVersion()
+        val firstLine =
+            if (revision.contains("\n")) {
+                revision.substring(0, revision.indexOf("\n"))
+            } else {
+                revision
+            }
+
+        if (!firstLine.contains("-")) {
+            return -1
+        }
+        return Integer.parseInt(firstLine.substring(firstLine.lastIndexOf("-") + 1))
+    }
+
+    override fun isSopSpecImplementationIncomplete(): Boolean {
+        return getSopSpecVersion().startsWith("~")
+    }
+
+    override fun getSopSpecImplementationRemarks(): String? {
+        val revision = getSopSpecVersion()
+        if (revision.contains("\n")) {
+            revision.substring(revision.indexOf("\n")).trim().takeIf { it.isNotBlank() }
+        }
+        return null
+    }
+
+    override fun getSopVVersion(): String {
+        return executeForLines(commandList.plus("--sopv"))
+    }
+
+    override fun getSopSpecVersion(): String {
+        return executeForLines(commandList.plus("--sop-spec"))
+    }
+
+    private fun executeForLine(commandList: List<String>): String {
+        return try {
+            val process =
+                Runtime.getRuntime().exec(commandList.toTypedArray(), envList.toTypedArray())
+            val result = process.inputStream.bufferedReader().readLine()
+            ExternalSOP.finish(process)
+            result.trim()
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+
+    private fun executeForLines(commandList: List<String>): String {
+        return try {
+            val process =
+                Runtime.getRuntime().exec(commandList.toTypedArray(), envList.toTypedArray())
+            val result = process.inputStream.bufferedReader().readLines().joinToString("\n")
+            ExternalSOP.finish(process)
+            result.trim()
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

external-sop/src/main/resources/sop/external/backend.properties

@@ -1,7 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Paul Schaub <info@pgpainless.org>
-#
-# SPDX-License-Identifier: CC0-1.0
-
-## Do not change this file. To overwrite the SOP backend used during testing,
-##  simply create a file 'backend.local.properties' in this directory and override sop.backend in there.
-sop.backend=/path/to/backend

external-sop/src/main/resources/sop/testsuite/external/.gitignore

@@ -2,5 +2,4 @@
 #
 # SPDX-License-Identifier: CC0-1.0
 
-backend.local.properties
-backend.env
+config.json

external-sop/src/main/resources/sop/testsuite/external/config.json.ci

@@ -0,0 +1,8 @@
+{
+    "backends": [
+        {
+            "name": "Sequoia-SOP",
+            "sop": "/usr/bin/sqop"
+        }
+    ]
+}

external-sop/src/main/resources/sop/testsuite/external/config.json.example

@@ -0,0 +1,17 @@
+{
+    "backends": [
+        {
+            "name": "Example-SOP",
+            "sop": "/usr/bin/example-sop"
+        },
+        {
+            "name": "Awesome-SOP",
+            "sop": "/usr/local/bin/awesome-sop",
+            "env": [
+                {
+                    "key": "myEnvironmentVariable", "value": "FooBar"
+                }
+            ]
+        }
+    ]
+}

external-sop/src/test/java/sop/external/AbstractExternalSOPTest.java

@@ -1,151 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.apache.maven.artifact.versioning.ComparableVersion;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import sop.SOP;
-
-import java.io.File;
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.Properties;
-
-import static org.junit.jupiter.api.Assumptions.assumeFalse;
-
-public abstract class AbstractExternalSOPTest {
-
-    private static final Logger LOGGER = LoggerFactory.getLogger(AbstractExternalSOPTest.class);
-
-    private final SOP sop;
-
-    public AbstractExternalSOPTest() {
-        String backend = readSopBackendFromProperties();
-        Properties environment = readBackendEnvironment();
-        sop = new ExternalSOP(backend, environment);
-    }
-
-    /**
-     * Return the SOP backend.
-     *
-     * @return SOP backend
-     */
-    public SOP getSop() {
-        return sop;
-    }
-
-    /**
-     * Return <pre>true</pre> iff the specified SOP backend binary is available and accessible.
-     *
-     * @return true if external SOP backend is usable
-     */
-    public static boolean isExternalSopInstalled() {
-        String binary = readSopBackendFromProperties();
-        if (binary == null) {
-            return false;
-        }
-        return new File(binary).exists();
-    }
-
-    public enum Is {
-        le("<"),
-        leq("<="),
-        eq("=="),
-        geq(">="),
-        ge(">"),
-        ;
-
-        private final String display;
-
-        Is(String display) {
-            this.display = display;
-        }
-
-        public String toDisplay() {
-            return display;
-        }
-    }
-
-    /**
-     * Ignore a test if the tested binary version matches a version criterion.
-     * Example:
-     * If the installed version of example-sop is 0.1.3, <pre>ignoreIf("example-sop", Is.le, "0.1.4")</pre> will
-     * make the test be ignored.
-     * <pre>ignoreIf("example-sop", Is.eq, "0.1.3")</pre> will skip the test as well.
-     * <pre>ignoreIf("another-sop", Is.gt, "0.0.0")</pre> will not skip the test, since the binary name does not match.
-     *
-     * @param name name of the binary
-     * @param is relation of the version
-     * @param version the reference version
-     */
-    public void ignoreIf(String name, Is is, String version) {
-        String actualName = getSop().version().getName();
-        String actualVersion = getSop().version().getVersion();
-
-        if (!name.matches(actualName)) {
-            // Name mismatch, do not ignore
-            return;
-        }
-
-        ComparableVersion reference = new ComparableVersion(version);
-        ComparableVersion actual = new ComparableVersion(actualVersion);
-
-        int res = actual.compareTo(reference);
-        String msg = "Skip since installed " + name + " " + actual + " " + is.toDisplay() + " " + reference;
-        switch (is) {
-            case le:
-                assumeFalse(res < 0, msg);
-                break;
-            case leq:
-                assumeFalse(res <= 0, msg);
-            case eq:
-                assumeFalse(res == 0, msg);
-                break;
-            case geq:
-                assumeFalse(res >= 0, msg);
-                break;
-            case ge:
-                assumeFalse(res > 0, msg);
-                break;
-        }
-    }
-
-    private static String readSopBackendFromProperties() {
-        Properties properties = new Properties();
-        try {
-            InputStream resourceIn = AbstractExternalSOPTest.class.getResourceAsStream("backend.local.properties");
-            if (resourceIn == null) {
-                LOGGER.info("Could not find backend.local.properties file. Try backend.properties instead.");
-                resourceIn = AbstractExternalSOPTest.class.getResourceAsStream("backend.properties");
-            }
-            if (resourceIn == null) {
-                throw new FileNotFoundException("Could not find backend.properties file.");
-            }
-
-            properties.load(resourceIn);
-            String backend = properties.getProperty("sop.backend");
-            return backend;
-        } catch (IOException e) {
-            return null;
-        }
-    }
-
-    protected static Properties readBackendEnvironment() {
-        Properties properties = new Properties();
-        try {
-            InputStream resourceIn = AbstractExternalSOPTest.class.getResourceAsStream("backend.env");
-            if (resourceIn == null) {
-                LOGGER.info("Could not read backend.env file.");
-            } else {
-                properties.load(resourceIn);
-            }
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-        return properties;
-    }
-}

external-sop/src/test/java/sop/external/ExternalArmorDearmorRoundTripTest.java

@@ -1,222 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.EnabledIf;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static sop.external.JUtils.arrayStartsWith;
-import static sop.external.JUtils.assertArrayStartsWith;
-import static sop.external.JUtils.assertAsciiArmorEquals;
-
-@EnabledIf("sop.external.AbstractExternalSOPTest#isExternalSopInstalled")
-public class ExternalArmorDearmorRoundTripTest extends AbstractExternalSOPTest {
-
-    private static final String BEGIN_PGP_PRIVATE_KEY_BLOCK = "-----BEGIN PGP PRIVATE KEY BLOCK-----\n";
-    private static final byte[] BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES = BEGIN_PGP_PRIVATE_KEY_BLOCK.getBytes(StandardCharsets.UTF_8);
-    private static final String BEGIN_PGP_PUBLIC_KEY_BLOCK = "-----BEGIN PGP PUBLIC KEY BLOCK-----\n";
-    private static final byte[] BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES = BEGIN_PGP_PUBLIC_KEY_BLOCK.getBytes(StandardCharsets.UTF_8);
-    private static final String BEGIN_PGP_MESSAGE = "-----BEGIN PGP MESSAGE-----\n";
-    private static final byte[] BEGIN_PGP_MESSAGE_BYTES = BEGIN_PGP_MESSAGE.getBytes(StandardCharsets.UTF_8);
-    private static final String BEGIN_PGP_SIGNATURE = "-----BEGIN PGP SIGNATURE-----\n";
-    private static final byte[] BEGIN_PGP_SIGNATURE_BYTES = BEGIN_PGP_SIGNATURE.getBytes(StandardCharsets.UTF_8);
-
-    @Test
-    public void dearmorArmorAliceKey() throws IOException {
-        byte[] aliceKey = TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8);
-
-        byte[] dearmored = getSop().dearmor()
-                .data(aliceKey)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(dearmored, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES));
-
-        byte[] armored = getSop().armor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayStartsWith(armored, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES);
-        assertAsciiArmorEquals(aliceKey, armored);
-    }
-
-    @Test
-    public void dearmorArmorAliceCert() throws IOException {
-        byte[] aliceCert = TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8);
-
-        byte[] dearmored = getSop().dearmor()
-                .data(aliceCert)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(dearmored, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES));
-
-        byte[] armored = getSop().armor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayStartsWith(armored, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES);
-        assertAsciiArmorEquals(aliceCert, armored);
-    }
-
-    @Test
-    public void dearmorArmorBobKey() throws IOException {
-        byte[] bobKey = TestKeys.BOB_KEY.getBytes(StandardCharsets.UTF_8);
-
-        byte[] dearmored = getSop().dearmor()
-                .data(bobKey)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(dearmored, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES));
-
-        byte[] armored = getSop().armor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayStartsWith(armored, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES);
-        assertAsciiArmorEquals(bobKey, armored);
-    }
-
-    @Test
-    public void dearmorArmorBobCert() throws IOException {
-        byte[] bobCert = TestKeys.BOB_CERT.getBytes(StandardCharsets.UTF_8);
-
-        byte[] dearmored = getSop().dearmor()
-                .data(bobCert)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(dearmored, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES));
-
-        byte[] armored = getSop().armor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayStartsWith(armored, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES);
-        assertAsciiArmorEquals(bobCert, armored);
-    }
-
-    @Test
-    public void dearmorArmorCarolKey() throws IOException {
-        byte[] carolKey = TestKeys.CAROL_KEY.getBytes(StandardCharsets.UTF_8);
-
-        byte[] dearmored = getSop().dearmor()
-                .data(carolKey)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(dearmored, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES));
-
-        byte[] armored = getSop().armor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayStartsWith(armored, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES);
-        assertAsciiArmorEquals(carolKey, armored);
-    }
-
-    @Test
-    public void dearmorArmorCarolCert() throws IOException {
-        byte[] carolCert = TestKeys.CAROL_CERT.getBytes(StandardCharsets.UTF_8);
-
-        byte[] dearmored = getSop().dearmor()
-                .data(carolCert)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(dearmored, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES));
-
-        byte[] armored = getSop().armor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayStartsWith(armored, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES);
-        assertAsciiArmorEquals(carolCert, armored);
-    }
-
-    @Test
-    public void dearmorArmorMessage() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // falsely reports Invalid Data Type
-        byte[] message = ("-----BEGIN PGP MESSAGE-----\n" +
-                "\n" +
-                "wV4DR2b2udXyHrYSAQdAMZy9Iqb1IxszjI3v+TsfK//0lnJ9PKHDqVAB5ohp+RMw\n" +
-                "8fmuL3phS9uISFT/DrizC8ALJhMqw5R+lLB/RvTTA/qS6tN5dRyL+YLFU3/N0CRF\n" +
-                "0j8BtQEsMmRo60LzUq/OBI0dFjwFq1efpfOGkpRYkuIzndCjBEgnLUkrHzUc1uD9\n" +
-                "CePQFpprprnGEzpE3flQLUc=\n" +
-                "=ZiFR\n" +
-                "-----END PGP MESSAGE-----\n").getBytes(StandardCharsets.UTF_8);
-        byte[] dearmored = getSop().dearmor()
-                .data(message)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(dearmored, BEGIN_PGP_MESSAGE_BYTES));
-
-        byte[] armored = getSop().armor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayStartsWith(armored, BEGIN_PGP_MESSAGE_BYTES);
-        assertAsciiArmorEquals(message, armored);
-    }
-
-    @Test
-    public void dearmorArmorSignature() throws IOException {
-        byte[] signature = ("-----BEGIN PGP SIGNATURE-----\n" +
-                "\n" +
-                "wr0EABYKAG8FgmPBdRAJEPIxVQxPR+OORxQAAAAAAB4AIHNhbHRAbm90YXRpb25z\n" +
-                "LnNlcXVvaWEtcGdwLm9yZ2un17fF3C46Adgzp0mU4RG8Txy/T/zOBcBw/NYaLGrQ\n" +
-                "FiEE64W7X6M6deFelE5j8jFVDE9H444AAMiEAP9LBQWLo4oP5IrFZPuSUQSPsUxB\n" +
-                "c+Qu1raXDKzS/8Q9IAD+LnHIjRHcqNPobNHXF/saXIYXeZR+LJKszTJozzwqdQE=\n" +
-                "=GHvQ\n" +
-                "-----END PGP SIGNATURE-----\n").getBytes(StandardCharsets.UTF_8);
-
-        byte[] dearmored = getSop().dearmor()
-                .data(signature)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(dearmored, BEGIN_PGP_SIGNATURE_BYTES));
-
-        byte[] armored = getSop().armor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayStartsWith(armored, BEGIN_PGP_SIGNATURE_BYTES);
-        assertAsciiArmorEquals(signature, armored);
-    }
-
-    @Test
-    public void testDearmoringTwiceIsIdempotent() throws IOException {
-        ignoreIf("sqop", Is.eq, "0.27.2"); // IO error because: EOF
-
-        byte[] dearmored = getSop().dearmor()
-                .data(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .getBytes();
-
-        byte[] dearmoredAgain = getSop().dearmor()
-                .data(dearmored)
-                .getBytes();
-
-        assertArrayEquals(dearmored, dearmoredAgain);
-    }
-
-    @Test
-    public void testArmoringTwiceIsIdempotent() throws IOException {
-        byte[] armored = ("-----BEGIN PGP SIGNATURE-----\n" +
-                "\n" +
-                "wr0EABYKAG8FgmPBdRAJEPIxVQxPR+OORxQAAAAAAB4AIHNhbHRAbm90YXRpb25z\n" +
-                "LnNlcXVvaWEtcGdwLm9yZ2un17fF3C46Adgzp0mU4RG8Txy/T/zOBcBw/NYaLGrQ\n" +
-                "FiEE64W7X6M6deFelE5j8jFVDE9H444AAMiEAP9LBQWLo4oP5IrFZPuSUQSPsUxB\n" +
-                "c+Qu1raXDKzS/8Q9IAD+LnHIjRHcqNPobNHXF/saXIYXeZR+LJKszTJozzwqdQE=\n" +
-                "=GHvQ\n" +
-                "-----END PGP SIGNATURE-----\n").getBytes(StandardCharsets.UTF_8);
-
-        byte[] armoredAgain = getSop().armor()
-                .data(armored)
-                .getBytes();
-
-        assertAsciiArmorEquals(armored, armoredAgain);
-    }
-
-}

external-sop/src/test/java/sop/external/ExternalDetachedSignVerifyRoundTripTest.java

@@ -1,169 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.EnabledIf;
-import sop.Verification;
-import sop.enums.SignAs;
-import sop.exception.SOPGPException;
-import sop.util.UTCUtil;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.Date;
-import java.util.List;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static sop.external.JUtils.assertArrayStartsWith;
-
-@EnabledIf("sop.external.AbstractExternalSOPTest#isExternalSopInstalled")
-public class ExternalDetachedSignVerifyRoundTripTest extends AbstractExternalSOPTest {
-
-    private static final String BEGIN_PGP_SIGNATURE = "-----BEGIN PGP SIGNATURE-----\n";
-    private static final byte[] BEGIN_PGP_SIGNATURE_BYTES = BEGIN_PGP_SIGNATURE.getBytes(StandardCharsets.UTF_8);
-
-    @Test
-    public void signVerifyWithAliceKey() throws IOException {
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-
-        byte[] signature = getSop().detachedSign()
-                .key(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .data(message)
-                .toByteArrayAndResult()
-                .getBytes();
-
-        List<Verification> verificationList = getSop().detachedVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .signatures(signature)
-                .data(message);
-
-        assertFalse(verificationList.isEmpty());
-        assertTrue(verificationList.get(0).toString().contains("EB85BB5FA33A75E15E944E63F231550C4F47E38E EB85BB5FA33A75E15E944E63F231550C4F47E38E"));
-    }
-
-    @Test
-    public void signVerifyTextModeWithAliceKey() throws IOException {
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-
-        byte[] signature = getSop().detachedSign()
-                .key(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .mode(SignAs.Text)
-                .data(message)
-                .toByteArrayAndResult()
-                .getBytes();
-
-        List<Verification> verificationList = getSop().detachedVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .signatures(signature)
-                .data(message);
-
-        assertFalse(verificationList.isEmpty());
-        assertTrue(verificationList.get(0).toString().contains("EB85BB5FA33A75E15E944E63F231550C4F47E38E EB85BB5FA33A75E15E944E63F231550C4F47E38E"));
-    }
-
-    @Test
-    public void signVerifyWithFreshEncryptedKey() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // --with-key-password not supported
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] keyPassword = "sw0rdf1sh".getBytes(StandardCharsets.UTF_8);
-        byte[] key = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .withKeyPassword(keyPassword)
-                .generate()
-                .getBytes();
-
-        byte[] cert = getSop().extractCert()
-                .key(key)
-                .getBytes();
-
-        byte[] signature = getSop().detachedSign()
-                .key(key)
-                .withKeyPassword(keyPassword)
-                .data(message)
-                .toByteArrayAndResult()
-                .getBytes();
-
-        assertArrayStartsWith(signature, BEGIN_PGP_SIGNATURE_BYTES);
-
-        List<Verification> verificationList = getSop().detachedVerify()
-                .cert(cert)
-                .signatures(signature)
-                .data(message);
-
-        assertFalse(verificationList.isEmpty());
-    }
-
-    @Test
-    public void signArmorVerifyWithBobKey() throws IOException {
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-
-        byte[] signature = getSop().detachedSign()
-                .key(TestKeys.BOB_KEY.getBytes(StandardCharsets.UTF_8))
-                .noArmor()
-                .data(message)
-                .toByteArrayAndResult()
-                .getBytes();
-
-        byte[] armored = getSop().armor()
-                .data(signature)
-                .getBytes();
-
-        List<Verification> verificationList = getSop().detachedVerify()
-                .cert(TestKeys.BOB_CERT.getBytes(StandardCharsets.UTF_8))
-                .signatures(armored)
-                .data(message);
-
-        assertFalse(verificationList.isEmpty());
-        assertTrue(verificationList.get(0).toString().contains("D1A66E1A23B182C9980F788CFBFCC82A015E7330 D1A66E1A23B182C9980F788CFBFCC82A015E7330"));
-    }
-
-    @Test
-    public void verifyNotAfterThrowsNoSignature() {
-        ignoreIf("sqop", Is.leq, "0.27.2"); // returns 1 instead of 3 (NO_SIGNATURE)
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] signature = ("-----BEGIN PGP SIGNATURE-----\n" +
-                "\n" +
-                "iHUEABYKACcFAmPBjZUJEPIxVQxPR+OOFiEE64W7X6M6deFelE5j8jFVDE9H444A\n" +
-                "ADI/AQC6Bux6WpGYf7HO+QPV/D5iIrqZt9xPLgfUVoNJBmMZZwD+Ib+tn5pSyWUw\n" +
-                "0K1UgT5roym9Fln8U5W8R03TSbfNiwE=\n" +
-                "=bxPN\n" +
-                "-----END PGP SIGNATURE-----").getBytes(StandardCharsets.UTF_8);
-        Date signatureDate = UTCUtil.parseUTCDate("2023-01-13T16:57:57Z");
-        Date beforeSignature = new Date(signatureDate.getTime() - 1000); // 1 sec before sig
-
-        assertThrows(SOPGPException.NoSignature.class, () -> getSop().detachedVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .notAfter(beforeSignature)
-                .signatures(signature)
-                .data(message));
-    }
-
-    @Test
-    public void verifyNotBeforeThrowsNoSignature() {
-        ignoreIf("sqop", Is.leq, "0.27.2"); // returns 1 instead of 3 (NO_SIGNATURE)
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] signature = ("-----BEGIN PGP SIGNATURE-----\n" +
-                "\n" +
-                "iHUEABYKACcFAmPBjZUJEPIxVQxPR+OOFiEE64W7X6M6deFelE5j8jFVDE9H444A\n" +
-                "ADI/AQC6Bux6WpGYf7HO+QPV/D5iIrqZt9xPLgfUVoNJBmMZZwD+Ib+tn5pSyWUw\n" +
-                "0K1UgT5roym9Fln8U5W8R03TSbfNiwE=\n" +
-                "=bxPN\n" +
-                "-----END PGP SIGNATURE-----").getBytes(StandardCharsets.UTF_8);
-        Date signatureDate = UTCUtil.parseUTCDate("2023-01-13T16:57:57Z");
-        Date afterSignature = new Date(signatureDate.getTime() + 1000); // 1 sec after sig
-
-        assertThrows(SOPGPException.NoSignature.class, () -> getSop().detachedVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .notBefore(afterSignature)
-                .signatures(signature)
-                .data(message));
-    }
-}

external-sop/src/test/java/sop/external/ExternalEncryptDecryptRoundTripTest.java

@@ -1,281 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.EnabledIf;
-import sop.ByteArrayAndResult;
-import sop.DecryptionResult;
-import sop.Verification;
-import sop.enums.EncryptAs;
-import sop.exception.SOPGPException;
-import sop.util.UTCUtil;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.Date;
-import java.util.List;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-@EnabledIf("sop.external.AbstractExternalSOPTest#isExternalSopInstalled")
-public class ExternalEncryptDecryptRoundTripTest extends AbstractExternalSOPTest {
-
-    @Test
-    public void encryptDecryptRoundTripPasswordTest() throws IOException {
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] ciphertext = getSop().encrypt()
-                .withPassword("sw0rdf1sh")
-                .plaintext(message)
-                .getBytes();
-
-        byte[] plaintext = getSop().decrypt()
-                .withPassword("sw0rdf1sh")
-                .ciphertext(ciphertext)
-                .toByteArrayAndResult()
-                .getBytes();
-
-        assertArrayEquals(message, plaintext);
-    }
-
-    @Test
-    public void encryptDecryptRoundTripAliceTest() throws IOException {
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] ciphertext = getSop().encrypt()
-                .withCert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .plaintext(message)
-                .getBytes();
-
-        ByteArrayAndResult<DecryptionResult> bytesAndResult = getSop().decrypt()
-                .withKey(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .ciphertext(ciphertext)
-                .toByteArrayAndResult();
-
-        byte[] plaintext = bytesAndResult.getBytes();
-        assertArrayEquals(message, plaintext);
-
-        DecryptionResult result = bytesAndResult.getResult();
-        assertNotNull(result.getSessionKey().get());
-    }
-
-    @Test
-    public void encryptDecryptRoundTripBobTest() throws IOException {
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] ciphertext = getSop().encrypt()
-                .withCert(TestKeys.BOB_CERT.getBytes(StandardCharsets.UTF_8))
-                .plaintext(message)
-                .getBytes();
-
-        byte[] plaintext = getSop().decrypt()
-                .withKey(TestKeys.BOB_KEY.getBytes(StandardCharsets.UTF_8))
-                .ciphertext(ciphertext)
-                .toByteArrayAndResult()
-                .getBytes();
-
-        assertArrayEquals(message, plaintext);
-    }
-
-    @Test
-    public void encryptDecryptRoundTripCarolTest() throws IOException {
-        ignoreIf("sqop", Is.geq, "0.0.0"); // sqop reports cert not encryption capable
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] ciphertext = getSop().encrypt()
-                .withCert(TestKeys.CAROL_CERT.getBytes(StandardCharsets.UTF_8))
-                .plaintext(message)
-                .getBytes();
-
-        byte[] plaintext = getSop().decrypt()
-                .withKey(TestKeys.CAROL_KEY.getBytes(StandardCharsets.UTF_8))
-                .ciphertext(ciphertext)
-                .toByteArrayAndResult()
-                .getBytes();
-
-        assertArrayEquals(message, plaintext);
-    }
-
-    @Test
-    public void encryptNoArmorThenArmorThenDecryptRoundTrip() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // Invalid data type
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] ciphertext = getSop().encrypt()
-                .withCert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .noArmor()
-                .plaintext(message)
-                .getBytes();
-
-        byte[] armored = getSop().armor()
-                .data(ciphertext)
-                .getBytes();
-
-        ByteArrayAndResult<DecryptionResult> bytesAndResult = getSop().decrypt()
-                .withKey(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .ciphertext(armored)
-                .toByteArrayAndResult();
-
-        byte[] plaintext = bytesAndResult.getBytes();
-        assertArrayEquals(message, plaintext);
-    }
-
-    @Test
-    public void encryptSignDecryptVerifyRoundTripAliceTest() throws IOException {
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] ciphertext = getSop().encrypt()
-                .withCert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .signWith(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .plaintext(message)
-                .getBytes();
-
-        ByteArrayAndResult<DecryptionResult> bytesAndResult = getSop().decrypt()
-                .withKey(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .verifyWithCert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .ciphertext(ciphertext)
-                .toByteArrayAndResult();
-
-        byte[] plaintext = bytesAndResult.getBytes();
-        assertArrayEquals(message, plaintext);
-
-        DecryptionResult result = bytesAndResult.getResult();
-        assertNotNull(result.getSessionKey().get());
-        List<Verification> verificationList = result.getVerifications();
-        assertEquals(1, verificationList.size());
-        assertTrue(verificationList.get(0).toString().contains("EB85BB5FA33A75E15E944E63F231550C4F47E38E EB85BB5FA33A75E15E944E63F231550C4F47E38E"));
-    }
-
-    @Test
-    public void encryptSignAsTextDecryptVerifyRoundTripAliceTest() throws IOException {
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] ciphertext = getSop().encrypt()
-                .withCert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .signWith(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .mode(EncryptAs.Text)
-                .plaintext(message)
-                .getBytes();
-
-        ByteArrayAndResult<DecryptionResult> bytesAndResult = getSop().decrypt()
-                .withKey(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .verifyWithCert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .ciphertext(ciphertext)
-                .toByteArrayAndResult();
-
-        byte[] plaintext = bytesAndResult.getBytes();
-        assertArrayEquals(message, plaintext);
-
-        DecryptionResult result = bytesAndResult.getResult();
-        assertNotNull(result.getSessionKey().get());
-        List<Verification> verificationList = result.getVerifications();
-        assertEquals(1, verificationList.size());
-        assertTrue(verificationList.get(0).toString().contains("EB85BB5FA33A75E15E944E63F231550C4F47E38E EB85BB5FA33A75E15E944E63F231550C4F47E38E"));
-    }
-
-    @Test
-    public void encryptSignDecryptVerifyRoundTripWithFreshEncryptedKeyTest() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1");
-
-        byte[] keyPassword = "sw0rdf1sh".getBytes(StandardCharsets.UTF_8);
-        byte[] key = getSop().generateKey()
-                .withKeyPassword(keyPassword)
-                .userId("Alice <alice@openpgp.org>")
-                .generate()
-                .getBytes();
-        byte[] cert = getSop().extractCert()
-                .key(key)
-                .getBytes();
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] ciphertext = getSop().encrypt()
-                .withCert(cert)
-                .signWith(key)
-                .withKeyPassword(keyPassword)
-                .plaintext(message)
-                .getBytes();
-
-        ByteArrayAndResult<DecryptionResult> bytesAndResult = getSop().decrypt()
-                .withKey(key)
-                .withKeyPassword(keyPassword)
-                .verifyWithCert(cert)
-                .ciphertext(ciphertext)
-                .toByteArrayAndResult();
-
-        assertFalse(bytesAndResult.getResult().getVerifications().isEmpty());
-        assertArrayEquals(message, bytesAndResult.getBytes());
-    }
-
-    @Test
-    public void decryptVerifyNotAfterTest() {
-        ignoreIf("PGPainless-SOP", Is.le, "1.4.2"); // does not recognize --verify-not-after
-        ignoreIf("sqop", Is.leq, "0.27.2"); // does not throw NoSignature
-
-        byte[] message = ("-----BEGIN PGP MESSAGE-----\n" +
-                "\n" +
-                "wV4DR2b2udXyHrYSAQdAwlOwwyxFDJta5+H9abgSj8jum9v7etUc9usdrElESmow\n" +
-                "2Hka48AFVfOezYh0OFn9R8+DMcpuE+e4nw3XnnX5nKs/j3AC2IW6zRHUkRcF3ZCq\n" +
-                "0sBNAfjnTYCMjuBmqdcCLzaZT4Hadnpg6neP1UecT/jP14maGfv8nwt0IDGR0Bik\n" +
-                "0WC/UJLpWyJ/6TgRrA5hNfANVnfiFBzIiThiVBRWPT2StHr2cOAvFxQK4Uk07rK9\n" +
-                "9aTUak8FpML+QA83U8I3qOk4QbzGVBP+IDJ+AKmvDz+0V+9kUhKp+8vyXsBmo9c3\n" +
-                "SAXjhFSiPQkU7ORsc6gQHL9+KPOU+W2poPK87H3cmaGiusnXMeLXLIUbkBUJTswd\n" +
-                "JNrA2yAkTTFP9QabsdcdTGoeYamq1c29kHF3GOTTcEqXw4WWXngcF7Kbcf435kkL\n" +
-                "4iSJnCaxTPftKUxmiGqMqLef7ICVnq/lz3HrH1VD54s=\n" +
-                "=Ebi3\n" +
-                "-----END PGP MESSAGE-----").getBytes(StandardCharsets.UTF_8);
-        Date signatureDate = UTCUtil.parseUTCDate("2023-01-13T16:09:32Z");
-
-        Date beforeSignature = new Date(signatureDate.getTime() - 1000); // 1 sec before signing date
-
-        assertThrows(SOPGPException.NoSignature.class, () -> {
-            ByteArrayAndResult<DecryptionResult> bytesAndResult = getSop().decrypt()
-                    .withKey(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                    .verifyWithCert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                    .verifyNotAfter(beforeSignature)
-                    .ciphertext(message)
-                    .toByteArrayAndResult();
-
-            if (bytesAndResult.getResult().getVerifications().isEmpty()) {
-                throw new SOPGPException.NoSignature("No verifiable signature found.");
-            }
-        });
-    }
-
-    @Test
-    public void decryptVerifyNotBeforeTest() {
-        ignoreIf("PGPainless-SOP", Is.le, "1.4.2"); // does not recognize --verify-not-after
-        ignoreIf("sqop", Is.leq, "0.27.2"); // does not throw NoSignature
-
-        byte[] message = ("-----BEGIN PGP MESSAGE-----\n" +
-                "\n" +
-                "wV4DR2b2udXyHrYSAQdAwlOwwyxFDJta5+H9abgSj8jum9v7etUc9usdrElESmow\n" +
-                "2Hka48AFVfOezYh0OFn9R8+DMcpuE+e4nw3XnnX5nKs/j3AC2IW6zRHUkRcF3ZCq\n" +
-                "0sBNAfjnTYCMjuBmqdcCLzaZT4Hadnpg6neP1UecT/jP14maGfv8nwt0IDGR0Bik\n" +
-                "0WC/UJLpWyJ/6TgRrA5hNfANVnfiFBzIiThiVBRWPT2StHr2cOAvFxQK4Uk07rK9\n" +
-                "9aTUak8FpML+QA83U8I3qOk4QbzGVBP+IDJ+AKmvDz+0V+9kUhKp+8vyXsBmo9c3\n" +
-                "SAXjhFSiPQkU7ORsc6gQHL9+KPOU+W2poPK87H3cmaGiusnXMeLXLIUbkBUJTswd\n" +
-                "JNrA2yAkTTFP9QabsdcdTGoeYamq1c29kHF3GOTTcEqXw4WWXngcF7Kbcf435kkL\n" +
-                "4iSJnCaxTPftKUxmiGqMqLef7ICVnq/lz3HrH1VD54s=\n" +
-                "=Ebi3\n" +
-                "-----END PGP MESSAGE-----").getBytes(StandardCharsets.UTF_8);
-        Date signatureDate = UTCUtil.parseUTCDate("2023-01-13T16:09:32Z");
-
-        Date afterSignature = new Date(signatureDate.getTime() + 1000); // 1 sec after signing date
-
-        assertThrows(SOPGPException.NoSignature.class, () -> {
-            ByteArrayAndResult<DecryptionResult> bytesAndResult = getSop().decrypt()
-                    .withKey(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                    .verifyWithCert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                    .verifyNotBefore(afterSignature)
-                    .ciphertext(message)
-                    .toByteArrayAndResult();
-
-            if (bytesAndResult.getResult().getVerifications().isEmpty()) {
-                throw new SOPGPException.NoSignature("No verifiable signature found.");
-            }
-        });
-    }
-}

external-sop/src/test/java/sop/external/ExternalExtractCertTest.java

@@ -1,80 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.EnabledIf;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static sop.external.JUtils.arrayStartsWith;
-import static sop.external.JUtils.assertArrayStartsWith;
-
-@EnabledIf("sop.external.AbstractExternalSOPTest#isExternalSopInstalled")
-public class ExternalExtractCertTest extends AbstractExternalSOPTest {
-
-    private static final String BEGIN_PGP_PUBLIC_KEY_BLOCK = "-----BEGIN PGP PUBLIC KEY BLOCK-----\n";
-    private static final byte[] BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES = BEGIN_PGP_PUBLIC_KEY_BLOCK.getBytes(StandardCharsets.UTF_8);
-
-    @Test
-    public void extractArmoredCertFromArmoredKeyTest() throws IOException {
-        InputStream keyIn = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .generate()
-                .getInputStream();
-
-        byte[] cert = getSop().extractCert().key(keyIn).getBytes();
-        assertArrayStartsWith(cert, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES);
-    }
-
-    @Test
-    public void extractUnarmoredCertFromArmoredKeyTest() throws IOException {
-        InputStream keyIn = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .generate()
-                .getInputStream();
-
-        byte[] cert = getSop().extractCert()
-                .noArmor()
-                .key(keyIn)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(cert, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES));
-    }
-
-    @Test
-    public void extractArmoredCertFromUnarmoredKeyTest() throws IOException {
-        InputStream keyIn = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .noArmor()
-                .generate()
-                .getInputStream();
-
-        byte[] cert = getSop().extractCert()
-                .key(keyIn)
-                .getBytes();
-
-        assertArrayStartsWith(cert, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES);
-    }
-
-    @Test
-    public void extractUnarmoredCertFromUnarmoredKeyTest() throws IOException {
-        InputStream keyIn = getSop().generateKey()
-                .noArmor()
-                .userId("Alice <alice@openpgp.org>")
-                .generate()
-                .getInputStream();
-
-        byte[] cert = getSop().extractCert()
-                .noArmor()
-                .key(keyIn)
-                .getBytes();
-
-        assertFalse(arrayStartsWith(cert, BEGIN_PGP_PUBLIC_KEY_BLOCK_BYTES));
-    }
-}

external-sop/src/test/java/sop/external/ExternalGenerateKeyTest.java

@@ -1,97 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.EnabledIf;
-
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.nio.charset.StandardCharsets;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static sop.external.JUtils.assertArrayStartsWith;
-
-@EnabledIf("sop.external.AbstractExternalSOPTest#isExternalSopInstalled")
-public class ExternalGenerateKeyTest extends AbstractExternalSOPTest {
-
-    private static final Charset UTF8 = StandardCharsets.UTF_8;
-    private static final String BEGIN_PGP_PRIVATE_KEY_BLOCK = "-----BEGIN PGP PRIVATE KEY BLOCK-----\n";
-    byte[] BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES = BEGIN_PGP_PRIVATE_KEY_BLOCK.getBytes(UTF8);
-
-    @Test
-    public void generateKeyTest() throws IOException {
-        byte[] key = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .generate()
-                .getBytes();
-
-        assertArrayStartsWith(key, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES);
-    }
-
-    @Test
-    public void generateKeyNoArmor() throws IOException {
-        byte[] key = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .noArmor()
-                .generate()
-                .getBytes();
-
-        assertFalse(JUtils.arrayStartsWith(key, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES));
-    }
-
-    @Test
-    public void generateKeyWithMultipleUserIdsTest() throws IOException {
-        byte[] key = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .userId("Bob <bob@openpgp.org>")
-                .generate()
-                .getBytes();
-
-        assertArrayStartsWith(key, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES);
-    }
-
-    @Test
-    public void generateKeyWithoutUserIdTest() throws IOException {
-        ignoreIf("pgpainless-cli", Is.le, "1.3.15");
-
-        byte[] key = getSop().generateKey()
-                .generate()
-                .getBytes();
-
-        assertArrayStartsWith(key, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES);
-    }
-
-    @Test
-    public void generateKeyWithPasswordTest() throws IOException {
-        ignoreIf("sqop", Is.le, "0.27.0");
-        ignoreIf("pgpainless-cli", Is.le, "1.3.0");
-
-        byte[] key = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .withKeyPassword("sw0rdf1sh")
-                .generate()
-                .getBytes();
-
-        assertArrayStartsWith(key, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES);
-    }
-
-    @Test
-    public void generateKeyWithMultipleUserIdsAndPassword() throws IOException {
-        ignoreIf("sqop", Is.le, "0.27.0");
-        ignoreIf("PGPainless-SOP", Is.le, "1.3.15");
-        ignoreIf("PGPainless-SOP", Is.eq, "1.4.0");
-        ignoreIf("PGPainless-SOP", Is.eq, "1.4.1");
-
-        byte[] key = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .userId("Bob <bob@openpgp.org>")
-                .withKeyPassword("sw0rdf1sh")
-                .generate()
-                .getBytes();
-
-        assertArrayStartsWith(key, BEGIN_PGP_PRIVATE_KEY_BLOCK_BYTES);
-    }
-}

external-sop/src/test/java/sop/external/ExternalInlineSignDetachVerifyRoundTripTest.java

@@ -1,91 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.EnabledIf;
-import sop.ByteArrayAndResult;
-import sop.Signatures;
-import sop.Verification;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.List;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static sop.external.JUtils.arrayStartsWith;
-import static sop.external.JUtils.assertArrayStartsWith;
-
-@EnabledIf("sop.external.AbstractExternalSOPTest#isExternalSopInstalled")
-public class ExternalInlineSignDetachVerifyRoundTripTest extends AbstractExternalSOPTest {
-
-    private static final byte[] BEGIN_PGP_SIGNATURE = "-----BEGIN PGP SIGNATURE-----\n".getBytes(StandardCharsets.UTF_8);
-
-    @Test
-    public void inlineSignThenDetachThenDetachedVerifyTest() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // inline-sign not supported
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-
-        byte[] inlineSigned = getSop().inlineSign()
-                .key(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .data(message)
-                .getBytes();
-
-        ByteArrayAndResult<Signatures> bytesAndResult = getSop().inlineDetach()
-                .message(inlineSigned)
-                .toByteArrayAndResult();
-
-        byte[] plaintext = bytesAndResult.getBytes();
-        assertArrayEquals(message, plaintext);
-
-        byte[] signatures = bytesAndResult.getResult()
-                .getBytes();
-
-        List<Verification> verifications = getSop().detachedVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .signatures(signatures)
-                .data(plaintext);
-
-        assertFalse(verifications.isEmpty());
-    }
-
-    @Test
-    public void inlineSignThenDetachNoArmorThenArmorThenDetachedVerifyTest() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // inline-sign not supported
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-
-        byte[] inlineSigned = getSop().inlineSign()
-                .key(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .data(message)
-                .getBytes();
-
-        ByteArrayAndResult<Signatures> bytesAndResult = getSop().inlineDetach()
-                .noArmor()
-                .message(inlineSigned)
-                .toByteArrayAndResult();
-
-        byte[] plaintext = bytesAndResult.getBytes();
-        assertArrayEquals(message, plaintext);
-
-        byte[] signatures = bytesAndResult.getResult()
-                .getBytes();
-        assertFalse(arrayStartsWith(signatures, BEGIN_PGP_SIGNATURE));
-
-        byte[] armored = getSop().armor()
-                .data(signatures)
-                .getBytes();
-        assertArrayStartsWith(armored, BEGIN_PGP_SIGNATURE);
-
-        List<Verification> verifications = getSop().detachedVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .signatures(armored)
-                .data(plaintext);
-
-        assertFalse(verifications.isEmpty());
-    }
-}

external-sop/src/test/java/sop/external/ExternalInlineSignVerifyTest.java

@@ -1,175 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.EnabledIf;
-import sop.ByteArrayAndResult;
-import sop.Verification;
-import sop.enums.InlineSignAs;
-import sop.exception.SOPGPException;
-import sop.util.UTCUtil;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.Date;
-import java.util.List;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-@EnabledIf("sop.external.AbstractExternalSOPTest#isExternalSopInstalled")
-public class ExternalInlineSignVerifyTest extends AbstractExternalSOPTest {
-
-    private static final String BEGIN_PGP_MESSAGE = "-----BEGIN PGP MESSAGE-----\n";
-    private static final byte[] BEGIN_PGP_MESSAGE_BYTES = BEGIN_PGP_MESSAGE.getBytes(StandardCharsets.UTF_8);
-    private static final String BEGIN_PGP_SIGNED_MESSAGE = "-----BEGIN PGP SIGNED MESSAGE-----\n";
-    private static final byte[] BEGIN_PGP_SIGNED_MESSAGE_BYTES = BEGIN_PGP_SIGNED_MESSAGE.getBytes(StandardCharsets.UTF_8);
-
-    @Test
-    public void inlineSignVerifyAlice() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // inline-sign not supported
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-
-        byte[] inlineSigned = getSop().inlineSign()
-                .key(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .data(message)
-                .getBytes();
-
-        JUtils.assertArrayStartsWith(inlineSigned, BEGIN_PGP_MESSAGE_BYTES);
-
-        ByteArrayAndResult<List<Verification>> bytesAndResult = getSop().inlineVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .data(inlineSigned)
-                .toByteArrayAndResult();
-
-        assertArrayEquals(message, bytesAndResult.getBytes());
-        assertFalse(bytesAndResult.getResult().isEmpty());
-    }
-
-    @Test
-    public void inlineSignVerifyAliceNoArmor() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // inline-sign not supported
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-
-        byte[] inlineSigned = getSop().inlineSign()
-                .key(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .noArmor()
-                .data(message)
-                .getBytes();
-
-        assertFalse(JUtils.arrayStartsWith(inlineSigned, BEGIN_PGP_MESSAGE_BYTES));
-
-        ByteArrayAndResult<List<Verification>> bytesAndResult = getSop().inlineVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .data(inlineSigned)
-                .toByteArrayAndResult();
-
-        assertArrayEquals(message, bytesAndResult.getBytes());
-        assertFalse(bytesAndResult.getResult().isEmpty());
-    }
-
-    @Test
-    public void clearsignVerifyAlice() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // inline-sign not supported
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-
-        byte[] clearsigned = getSop().inlineSign()
-                .key(TestKeys.ALICE_KEY.getBytes(StandardCharsets.UTF_8))
-                .mode(InlineSignAs.clearsigned)
-                .data(message)
-                .getBytes();
-
-        JUtils.assertArrayStartsWith(clearsigned, BEGIN_PGP_SIGNED_MESSAGE_BYTES);
-
-        ByteArrayAndResult<List<Verification>> bytesAndResult = getSop().inlineVerify()
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .data(clearsigned)
-                .toByteArrayAndResult();
-
-        assertArrayEquals(message, bytesAndResult.getBytes());
-        assertFalse(bytesAndResult.getResult().isEmpty());
-    }
-
-    @Test
-    public void assertNotBeforeThrowsNoSignature() {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // inline-sign not supported
-        ignoreIf("sqop", Is.leq, "0.27.2"); // returns 1 instead of 3 (NO_SIGNATURE)
-
-        byte[] message = ("-----BEGIN PGP MESSAGE-----\n" +
-                "\n" +
-                "owGbwMvMwCX2yTCUx9/9cR/jaZEkBhDwSM3JyddRCM8vyklR5OooZWEQ42JQZ2VK\n" +
-                "PjjpPacATLmYIsvr1t3xi61KH8ZN8UuGCTMwpPcw/E9jS+vcvPu2gmp4jcRbcSNP\n" +
-                "FYmW8hmLJdUVrdt1V8w6GM/IMEvN0tP339sNGX4swq8T5p62q3jUfLjpstmcI6Ie\n" +
-                "sfcfswMA\n" +
-                "=RDAo\n" +
-                "-----END PGP MESSAGE-----").getBytes(StandardCharsets.UTF_8);
-        Date signatureDate = UTCUtil.parseUTCDate("2023-01-13T17:20:47Z");
-        Date afterSignature = new Date(signatureDate.getTime() + 1000); // 1 sec before sig
-
-        assertThrows(SOPGPException.NoSignature.class, () -> getSop().inlineVerify()
-                .notBefore(afterSignature)
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .data(message)
-                .toByteArrayAndResult());
-    }
-
-    @Test
-    public void assertNotAfterThrowsNoSignature() {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // inline-sign not supported
-        ignoreIf("sqop", Is.leq, "0.27.2"); // returns 1 instead of 3 (NO_SIGNATURE)
-
-        byte[] message = ("-----BEGIN PGP MESSAGE-----\n" +
-                "\n" +
-                "owGbwMvMwCX2yTCUx9/9cR/jaZEkBhDwSM3JyddRCM8vyklR5OooZWEQ42JQZ2VK\n" +
-                "PjjpPacATLmYIsvr1t3xi61KH8ZN8UuGCTMwpPcw/E9jS+vcvPu2gmp4jcRbcSNP\n" +
-                "FYmW8hmLJdUVrdt1V8w6GM/IMEvN0tP339sNGX4swq8T5p62q3jUfLjpstmcI6Ie\n" +
-                "sfcfswMA\n" +
-                "=RDAo\n" +
-                "-----END PGP MESSAGE-----").getBytes(StandardCharsets.UTF_8);
-        Date signatureDate = UTCUtil.parseUTCDate("2023-01-13T17:20:47Z");
-        Date beforeSignature = new Date(signatureDate.getTime() - 1000); // 1 sec before sig
-
-        assertThrows(SOPGPException.NoSignature.class, () -> getSop().inlineVerify()
-                .notAfter(beforeSignature)
-                .cert(TestKeys.ALICE_CERT.getBytes(StandardCharsets.UTF_8))
-                .data(message)
-                .toByteArrayAndResult());
-    }
-
-    @Test
-    public void signVerifyWithPasswordProtectedKey() throws IOException {
-        ignoreIf("sqop", Is.leq, "0.26.1"); // inline-sign not supported
-
-        byte[] message = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);
-        byte[] keyPassword = "sw0rdf1sh".getBytes(StandardCharsets.UTF_8);
-        byte[] key = getSop().generateKey()
-                .userId("Alice <alice@openpgp.org>")
-                .withKeyPassword(keyPassword)
-                .generate()
-                .getBytes();
-        byte[] cert = getSop().extractCert()
-                .key(key)
-                .getBytes();
-
-        byte[] inlineSigned = getSop().inlineSign()
-                .withKeyPassword(keyPassword)
-                .key(key)
-                .mode(InlineSignAs.binary)
-                .data(message)
-                .getBytes();
-
-        assertFalse(getSop().inlineVerify()
-                .cert(cert)
-                .data(inlineSigned)
-                .toByteArrayAndResult()
-                .getResult()
-                .isEmpty());
-    }
-}

external-sop/src/test/java/sop/external/ExternalVersionTest.java

@@ -1,42 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.condition.EnabledIf;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-@EnabledIf("sop.external.AbstractExternalSOPTest#isExternalSopInstalled")
-public class ExternalVersionTest extends AbstractExternalSOPTest {
-
-    @Test
-    public void versionNameTest() {
-        String name = getSop().version().getName();
-        assertNotNull(name);
-        assertFalse(name.isEmpty());
-    }
-
-    @Test
-    public void versionVersionTest() {
-        String version = getSop().version().getVersion();
-        assertTrue(version.matches("\\d+(\\.\\d+)*\\S*"));
-    }
-
-    @Test
-    public void backendVersionTest() {
-        String backend = getSop().version().getBackendVersion();
-        assertFalse(backend.isEmpty());
-    }
-
-    @Test
-    public void extendedVersionTest() {
-        String extended = getSop().version().getExtendedVersion();
-        assertFalse(extended.isEmpty());
-    }
-
-}

external-sop/src/test/java/sop/external/JUtils.java

@@ -1,72 +0,0 @@
-// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.external;
-
-import java.nio.charset.StandardCharsets;
-import java.util.Arrays;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.fail;
-
-public class JUtils {
-
-    public static boolean arrayStartsWith(byte[] array, byte[] start) {
-        return arrayStartsWith(array, start, 0);
-    }
-
-    public static boolean arrayStartsWith(byte[] array, byte[] start, int offset) {
-        if (offset < 0) {
-            throw new IllegalArgumentException("Offset cannot be negative");
-        }
-
-        if (start.length + offset > array.length) {
-            return false;
-        }
-
-        for (int i = 0; i < start.length; i++) {
-            if (array[offset + i] != start[i]) {
-                return false;
-            }
-        }
-        return true;
-    }
-
-    public static void assertArrayStartsWith(byte[] array, byte[] start) {
-        if (!arrayStartsWith(array, start)) {
-            byte[] actual = new byte[Math.min(start.length, array.length)];
-            System.arraycopy(array, 0, actual, 0, actual.length);
-            fail("Array does not start with expected bytes.\n" +
-                    "Expected: <" + Arrays.toString(start) + ">\n" +
-                    "Actual: <" + Arrays.toString(actual) + ">");
-        }
-    }
-
-    public static void assertArrayStartsWith(byte[] array, byte[] start, int offset) {
-        if (!arrayStartsWith(array, start, offset)) {
-            byte[] actual = new byte[Math.min(start.length, array.length - offset)];
-            System.arraycopy(array, offset, actual, 0, actual.length);
-            fail("Array does not start with expected bytes at offset " + offset + ".\n" +
-                    "Expected: <" + Arrays.toString(start) + ">\n" +
-                    "Actual: <" + Arrays.toString(actual) + ">");
-        }
-    }
-
-    public static void assertAsciiArmorEquals(byte[] first, byte[] second) {
-        byte[] firstCleaned = removeArmorHeaders(first);
-        byte[] secondCleaned = removeArmorHeaders(second);
-
-        assertArrayEquals(firstCleaned, secondCleaned);
-    }
-
-    public static byte[] removeArmorHeaders(byte[] armor) {
-        String string = new String(armor, StandardCharsets.UTF_8);
-        string = string.replaceAll("Comment: .+\\R", "")
-                .replaceAll("Version: .+\\R", "")
-                .replaceAll("MessageID: .+\\R", "")
-                .replaceAll("Hash: .+\\R", "")
-                .replaceAll("Charset: .+\\R", "");
-        return string.getBytes(StandardCharsets.UTF_8);
-    }
-}

external-sop/src/test/java/sop/testsuite/external/ExternalSOPInstanceFactory.java

@@ -0,0 +1,80 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external;
+
+import com.google.gson.Gson;
+import sop.SOP;
+import sop.external.ExternalSOP;
+import sop.testsuite.SOPInstanceFactory;
+
+import java.io.File;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+
+/**
+ * This implementation of {@link SOPInstanceFactory} reads the JSON file at
+ * <pre>external-sop/src/main/resources/sop/testsuite/external/config.json</pre>
+ * to determine configured external test backends.
+ */
+public class ExternalSOPInstanceFactory extends SOPInstanceFactory {
+
+    @Override
+    public Map<String, SOP> provideSOPInstances() {
+        Map<String, SOP> backends = new HashMap<>();
+        TestSuite suite = readConfiguration();
+        if (suite != null && !suite.backends.isEmpty()) {
+            for (TestSubject subject : suite.backends) {
+                if (!new File(subject.sop).exists()) {
+                    continue;
+                }
+
+                Properties env = new Properties();
+                if (subject.env != null) {
+                    for (Var var : subject.env) {
+                        env.put(var.key, var.value);
+                    }
+                }
+
+                SOP sop = new ExternalSOP(subject.sop, env);
+                backends.put(subject.name, sop);
+            }
+        }
+        return backends;
+    }
+
+
+    public static TestSuite readConfiguration() {
+        Gson gson = new Gson();
+        InputStream inputStream = ExternalSOPInstanceFactory.class.getResourceAsStream("config.json");
+        if (inputStream == null) {
+            return null;
+        }
+
+        InputStreamReader reader = new InputStreamReader(inputStream);
+        return gson.fromJson(reader, TestSuite.class);
+    }
+
+
+    // JSON DTOs
+
+    public static class TestSuite {
+        List<TestSubject> backends;
+    }
+
+    public static class TestSubject {
+        String name;
+        String sop;
+        List<Var> env;
+    }
+
+    public static class Var {
+        String key;
+        String value;
+    }
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalArmorDearmorTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.ArmorDearmorTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalArmorDearmorTest extends ArmorDearmorTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalDecryptWithSessionKeyTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.DecryptWithSessionKeyTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalDecryptWithSessionKeyTest extends DecryptWithSessionKeyTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalDetachedSignDetachedVerifyTest.java

@@ -0,0 +1,12 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.DetachedSignDetachedVerifyTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalDetachedSignDetachedVerifyTest extends DetachedSignDetachedVerifyTest {
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalEncryptDecryptTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.EncryptDecryptTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalEncryptDecryptTest extends EncryptDecryptTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalExtractCertTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.ExtractCertTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalExtractCertTest extends ExtractCertTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalGenerateKeyTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.GenerateKeyTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalGenerateKeyTest extends GenerateKeyTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalInlineSignInlineDetachDetachedVerifyTest.java

@@ -0,0 +1,14 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.InlineSignInlineDetachDetachedVerifyTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalInlineSignInlineDetachDetachedVerifyTest
+        extends InlineSignInlineDetachDetachedVerifyTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalInlineSignInlineVerifyTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.InlineSignInlineVerifyTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalInlineSignInlineVerifyTest extends InlineSignInlineVerifyTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalListProfilesTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.ListProfilesTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalListProfilesTest extends ListProfilesTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalRevokeKeyTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.RevokeKeyTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalRevokeKeyTest extends RevokeKeyTest {
+
+}

external-sop/src/test/java/sop/testsuite/external/operation/ExternalVersionTest.java

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.testsuite.external.operation;
+
+import org.junit.jupiter.api.condition.EnabledIf;
+import sop.testsuite.operation.VersionTest;
+
+@EnabledIf("sop.testsuite.operation.AbstractSOPTest#hasBackends")
+public class ExternalVersionTest extends VersionTest {
+
+}

sop-java-picocli/build.gradle

@@ -12,15 +12,12 @@ dependencies {
     testImplementation "org.junit.jupiter:junit-jupiter-api:$junitVersion"
     testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine:$junitVersion"
 
-    // Testing Exit Codes in JUnit
-    // https://todd.ginsberg.com/post/testing-system-exit/
-    testImplementation "com.ginsberg:junit5-system-exit:$junitSysExitVersion"
-
     // Mocking Components
     testImplementation "org.mockito:mockito-core:$mockitoVersion"
 
     // SOP
     implementation(project(":sop-java"))
+    testImplementation(testFixtures(project(":sop-java")))
 
     // CLI
     implementation "info.picocli:picocli:$picocliVersion"
@@ -38,6 +35,7 @@ application {
 
 jar {
     dependsOn(":sop-java:jar")
+    duplicatesStrategy(DuplicatesStrategy.EXCLUDE)
 
     manifest {
         attributes 'Main-Class': "$mainClassName"

sop-java-picocli/src/main/java/sop/cli/picocli/Print.java

@@ -1,14 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli;
-
-public class Print {
-
-    public static void outln(String string) {
-        // CHECKSTYLE:OFF
-        System.out.println(string);
-        // CHECKSTYLE:ON
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/SOPExceptionExitCodeMapper.java

@@ -1,34 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli;
-
-import picocli.CommandLine;
-import sop.exception.SOPGPException;
-
-public class SOPExceptionExitCodeMapper implements CommandLine.IExitCodeExceptionMapper {
-
-    @Override
-    public int getExitCode(Throwable exception) {
-        if (exception instanceof SOPGPException) {
-            return ((SOPGPException) exception).getExitCode();
-        }
-        if (exception instanceof CommandLine.UnmatchedArgumentException) {
-            CommandLine.UnmatchedArgumentException ex = (CommandLine.UnmatchedArgumentException) exception;
-            // Unmatched option of subcommand (eg. `generate-key -k`)
-            if (ex.isUnknownOption()) {
-                return SOPGPException.UnsupportedOption.EXIT_CODE;
-            }
-            // Unmatched subcommand
-            return SOPGPException.UnsupportedSubcommand.EXIT_CODE;
-        }
-        // Invalid option (eg. `--label Invalid`)
-        if (exception instanceof CommandLine.ParameterException) {
-            return SOPGPException.UnsupportedOption.EXIT_CODE;
-        }
-
-        // Others, like IOException etc.
-        return 1;
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/SOPExecutionExceptionHandler.java

@@ -1,33 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli;
-
-import picocli.CommandLine;
-
-public class SOPExecutionExceptionHandler implements CommandLine.IExecutionExceptionHandler {
-
-    @Override
-    public int handleExecutionException(Exception ex, CommandLine commandLine, CommandLine.ParseResult parseResult) {
-
-        int exitCode = commandLine.getExitCodeExceptionMapper() != null ?
-                commandLine.getExitCodeExceptionMapper().getExitCode(ex) :
-                commandLine.getCommandSpec().exitCodeOnExecutionException();
-
-        CommandLine.Help.ColorScheme colorScheme = commandLine.getColorScheme();
-        // CHECKSTYLE:OFF
-        if (ex.getMessage() != null) {
-            commandLine.getErr().println(colorScheme.errorText(ex.getMessage()));
-        } else {
-            commandLine.getErr().println(ex.getClass().getName());
-        }
-
-        if (SopCLI.stacktrace) {
-            ex.printStackTrace(commandLine.getErr());
-        }
-        // CHECKSTYLE:ON
-
-        return exitCode;
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/SopCLI.java

@@ -1,117 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli;
-
-import picocli.AutoComplete;
-import picocli.CommandLine;
-import sop.SOP;
-import sop.cli.picocli.commands.ArmorCmd;
-import sop.cli.picocli.commands.DearmorCmd;
-import sop.cli.picocli.commands.DecryptCmd;
-import sop.cli.picocli.commands.InlineDetachCmd;
-import sop.cli.picocli.commands.EncryptCmd;
-import sop.cli.picocli.commands.ExtractCertCmd;
-import sop.cli.picocli.commands.GenerateKeyCmd;
-import sop.cli.picocli.commands.InlineSignCmd;
-import sop.cli.picocli.commands.InlineVerifyCmd;
-import sop.cli.picocli.commands.SignCmd;
-import sop.cli.picocli.commands.VerifyCmd;
-import sop.cli.picocli.commands.VersionCmd;
-
-import java.util.List;
-import java.util.Locale;
-import java.util.ResourceBundle;
-
-@CommandLine.Command(
-        name = "sop",
-        resourceBundle = "msg_sop",
-        exitCodeOnInvalidInput = 69,
-        subcommands = {
-                CommandLine.HelpCommand.class,
-                ArmorCmd.class,
-                DearmorCmd.class,
-                DecryptCmd.class,
-                InlineDetachCmd.class,
-                EncryptCmd.class,
-                ExtractCertCmd.class,
-                GenerateKeyCmd.class,
-                SignCmd.class,
-                VerifyCmd.class,
-                InlineSignCmd.class,
-                InlineVerifyCmd.class,
-                VersionCmd.class,
-                AutoComplete.GenerateCompletion.class
-        }
-)
-public class SopCLI {
-    // Singleton
-    static SOP SOP_INSTANCE;
-    static ResourceBundle cliMsg = ResourceBundle.getBundle("msg_sop");
-
-    public static String EXECUTABLE_NAME = "sop";
-
-    @CommandLine.Option(names = {"--stacktrace"},
-            scope = CommandLine.ScopeType.INHERIT)
-    static boolean stacktrace;
-
-    public static void main(String[] args) {
-        int exitCode = execute(args);
-        if (exitCode != 0) {
-            System.exit(exitCode);
-        }
-    }
-
-    public static int execute(String[] args) {
-
-        // Set locale
-        new CommandLine(new InitLocale()).parseArgs(args);
-
-        // get error message bundle
-        cliMsg = ResourceBundle.getBundle("msg_sop");
-
-        // Prepare CLI
-        CommandLine cmd = new CommandLine(SopCLI.class);
-
-        // explicitly set help command resource bundle
-        cmd.getSubcommands().get("help").setResourceBundle(ResourceBundle.getBundle("msg_help"));
-
-        // Hide generate-completion command
-        cmd.getSubcommands().get("generate-completion").getCommandSpec().usageMessage().hidden(true);
-
-        cmd.setCommandName(EXECUTABLE_NAME)
-                .setExecutionExceptionHandler(new SOPExecutionExceptionHandler())
-                .setExitCodeExceptionMapper(new SOPExceptionExitCodeMapper())
-                .setCaseInsensitiveEnumValuesAllowed(true);
-
-        return cmd.execute(args);
-    }
-
-    public static SOP getSop() {
-        if (SOP_INSTANCE == null) {
-            String errorMsg = cliMsg.getString("sop.error.runtime.no_backend_set");
-            throw new IllegalStateException(errorMsg);
-        }
-        return SOP_INSTANCE;
-    }
-
-    public static void setSopInstance(SOP instance) {
-        SOP_INSTANCE = instance;
-    }
-}
-
-/**
- * Control the locale.
- *
- * @see <a href="https://picocli.info/#_controlling_the_locale">Picocli Readme</a>
- */
-class InitLocale {
-    @CommandLine.Option(names = { "-l", "--locale" }, descriptionKey = "sop.locale")
-    void setLocale(String locale) {
-        Locale.setDefault(new Locale(locale));
-    }
-
-    @CommandLine.Unmatched
-    List<String> remainder; // ignore any other parameters and options in the first parsing phase
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/AbstractSopCmd.java

@@ -1,260 +0,0 @@
-// SPDX-FileCopyrightText: 2022 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import sop.exception.SOPGPException;
-import sop.util.UTCUtil;
-import sop.util.UTF8Util;
-
-import javax.annotation.Nonnull;
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.util.Collection;
-import java.util.Date;
-import java.util.Locale;
-import java.util.ResourceBundle;
-import java.util.regex.Pattern;
-
-public abstract class AbstractSopCmd implements Runnable {
-
-    public interface EnvironmentVariableResolver {
-        /**
-         * Resolve the value of the given environment variable.
-         * Return null if the variable is not present.
-         *
-         * @param name name of the variable
-         * @return variable value or null
-         */
-        String resolveEnvironmentVariable(String name);
-    }
-
-    public static final String PRFX_ENV = "@ENV:";
-    public static final String PRFX_FD = "@FD:";
-    public static final Date BEGINNING_OF_TIME = new Date(0);
-    public static final Date END_OF_TIME = new Date(8640000000000000L);
-
-    public static final Pattern PATTERN_FD = Pattern.compile("^\\d{1,20}$");
-
-    protected final ResourceBundle messages;
-    protected EnvironmentVariableResolver envResolver = System::getenv;
-
-    public AbstractSopCmd() {
-        this(Locale.getDefault());
-    }
-
-    public AbstractSopCmd(@Nonnull Locale locale) {
-        messages = ResourceBundle.getBundle("msg_sop", locale);
-    }
-
-    void throwIfOutputExists(String output) {
-        if (output == null) {
-            return;
-        }
-
-        File outputFile = new File(output);
-        if (outputFile.exists()) {
-            String errorMsg = getMsg("sop.error.indirect_data_type.output_file_already_exists", outputFile.getAbsolutePath());
-            throw new SOPGPException.OutputExists(errorMsg);
-        }
-    }
-
-    public String getMsg(String key) {
-        return messages.getString(key);
-    }
-
-    public String getMsg(String key, String arg1) {
-        return String.format(messages.getString(key), arg1);
-    }
-
-    public String getMsg(String key, String arg1, String arg2) {
-        return String.format(messages.getString(key), arg1, arg2);
-    }
-
-    void throwIfMissingArg(Object arg, String argName) {
-        if (arg == null) {
-            String errorMsg = getMsg("sop.error.usage.argument_required", argName);
-            throw new SOPGPException.MissingArg(errorMsg);
-        }
-    }
-
-    void throwIfEmptyParameters(Collection<?> arg, String parmName) {
-        if (arg.isEmpty()) {
-            String errorMsg = getMsg("sop.error.usage.parameter_required", parmName);
-            throw new SOPGPException.MissingArg(errorMsg);
-        }
-    }
-
-    <T> T throwIfUnsupportedSubcommand(T subcommand, String subcommandName) {
-        if (subcommand == null) {
-            String errorMsg = getMsg("sop.error.feature_support.subcommand_not_supported", subcommandName);
-            throw new SOPGPException.UnsupportedSubcommand(errorMsg);
-        }
-        return subcommand;
-    }
-
-    void setEnvironmentVariableResolver(EnvironmentVariableResolver envResolver) {
-        if (envResolver == null) {
-            throw new NullPointerException("Variable envResolver cannot be null.");
-        }
-        this.envResolver = envResolver;
-    }
-
-    public InputStream getInput(String indirectInput) throws IOException {
-        if (indirectInput == null) {
-            throw new IllegalArgumentException("Input cannot not be null.");
-        }
-
-        String trimmed = indirectInput.trim();
-        if (trimmed.isEmpty()) {
-            throw new IllegalArgumentException("Input cannot be blank.");
-        }
-
-        if (trimmed.startsWith(PRFX_ENV)) {
-            if (new File(trimmed).exists()) {
-                String errorMsg = getMsg("sop.error.indirect_data_type.ambiguous_filename", trimmed);
-                throw new SOPGPException.AmbiguousInput(errorMsg);
-            }
-
-            String envName = trimmed.substring(PRFX_ENV.length());
-            String envValue = envResolver.resolveEnvironmentVariable(envName);
-            if (envValue == null) {
-                String errorMsg = getMsg("sop.error.indirect_data_type.environment_variable_not_set", envName);
-                throw new IllegalArgumentException(errorMsg);
-            }
-
-            if (envValue.trim().isEmpty()) {
-                String errorMsg = getMsg("sop.error.indirect_data_type.environment_variable_empty", envName);
-                throw new IllegalArgumentException(errorMsg);
-            }
-
-            return new ByteArrayInputStream(envValue.getBytes("UTF8"));
-
-        } else if (trimmed.startsWith(PRFX_FD)) {
-
-            if (new File(trimmed).exists()) {
-                String errorMsg = getMsg("sop.error.indirect_data_type.ambiguous_filename", trimmed);
-                throw new SOPGPException.AmbiguousInput(errorMsg);
-            }
-
-            File fdFile = fileDescriptorFromString(trimmed);
-            try {
-                FileInputStream fileIn = new FileInputStream(fdFile);
-                return fileIn;
-            } catch (FileNotFoundException e) {
-                String errorMsg = getMsg("sop.error.indirect_data_type.file_descriptor_not_found", fdFile.getAbsolutePath());
-                throw new IOException(errorMsg, e);
-            }
-        } else {
-            File file = new File(trimmed);
-            if (!file.exists()) {
-                String errorMsg = getMsg("sop.error.indirect_data_type.input_file_does_not_exist", file.getAbsolutePath());
-                throw new SOPGPException.MissingInput(errorMsg);
-            }
-
-            if (!file.isFile()) {
-                String errorMsg = getMsg("sop.error.indirect_data_type.input_not_a_file", file.getAbsolutePath());
-                throw new SOPGPException.MissingInput(errorMsg);
-            }
-
-            return new FileInputStream(file);
-        }
-    }
-
-    public OutputStream getOutput(String indirectOutput) throws IOException {
-        if (indirectOutput == null) {
-            throw new IllegalArgumentException("Output cannot be null.");
-        }
-
-        String trimmed = indirectOutput.trim();
-        if (trimmed.isEmpty()) {
-            throw new IllegalArgumentException("Output cannot be blank.");
-        }
-
-        // @ENV not allowed for output
-        if (trimmed.startsWith(PRFX_ENV)) {
-            String errorMsg = getMsg("sop.error.indirect_data_type.illegal_use_of_env_designator");
-            throw new SOPGPException.UnsupportedSpecialPrefix(errorMsg);
-        }
-
-        // File Descriptor
-        if (trimmed.startsWith(PRFX_FD)) {
-            File fdFile = fileDescriptorFromString(trimmed);
-            try {
-                FileOutputStream fout = new FileOutputStream(fdFile);
-                return fout;
-            } catch (FileNotFoundException e) {
-                String errorMsg = getMsg("sop.error.indirect_data_type.file_descriptor_not_found", fdFile.getAbsolutePath());
-                throw new IOException(errorMsg, e);
-            }
-        }
-
-        File file = new File(trimmed);
-        if (file.exists()) {
-            String errorMsg = getMsg("sop.error.indirect_data_type.output_file_already_exists", file.getAbsolutePath());
-            throw new SOPGPException.OutputExists(errorMsg);
-        }
-
-        if (!file.createNewFile()) {
-            String errorMsg = getMsg("sop.error.indirect_data_type.output_file_cannot_be_created", file.getAbsolutePath());
-            throw new IOException(errorMsg);
-        }
-
-        return new FileOutputStream(file);
-    }
-
-    public File fileDescriptorFromString(String fdString) {
-        File fdDir = new File("/dev/fd/");
-        if (!fdDir.exists()) {
-            String errorMsg = getMsg("sop.error.indirect_data_type.designator_fd_not_supported");
-            throw new SOPGPException.UnsupportedSpecialPrefix(errorMsg);
-        }
-        String fdNumber = fdString.substring(PRFX_FD.length());
-        if (!PATTERN_FD.matcher(fdNumber).matches()) {
-            throw new IllegalArgumentException("File descriptor must be a positive number.");
-        }
-        File descriptor = new File(fdDir, fdNumber);
-        return descriptor;
-    }
-
-    public static String stringFromInputStream(InputStream inputStream) throws IOException {
-        try {
-            ByteArrayOutputStream byteOut = new ByteArrayOutputStream();
-            byte[] buf = new byte[4096]; int read;
-            while ((read = inputStream.read(buf)) != -1) {
-                byteOut.write(buf, 0, read);
-            }
-            // TODO: For decrypt operations we MUST accept non-UTF8 passwords
-            return UTF8Util.decodeUTF8(byteOut.toByteArray());
-        } finally {
-            inputStream.close();
-        }
-    }
-
-    public Date parseNotAfter(String notAfter) {
-        Date date = notAfter.equals("now") ? new Date() : notAfter.equals("-") ? END_OF_TIME : UTCUtil.parseUTCDate(notAfter);
-        if (date == null) {
-            String errorMsg = getMsg("sop.error.input.malformed_not_after");
-            throw new IllegalArgumentException(errorMsg);
-        }
-        return date;
-    }
-
-    public Date parseNotBefore(String notBefore) {
-        Date date = notBefore.equals("now") ? new Date() : notBefore.equals("-") ? BEGINNING_OF_TIME : UTCUtil.parseUTCDate(notBefore);
-        if (date == null) {
-            String errorMsg = getMsg("sop.error.input.malformed_not_before");
-            throw new IllegalArgumentException(errorMsg);
-        }
-        return date;
-    }
-
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/ArmorCmd.java

@@ -1,50 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.Ready;
-import sop.cli.picocli.SopCLI;
-import sop.enums.ArmorLabel;
-import sop.exception.SOPGPException;
-import sop.operation.Armor;
-
-import java.io.IOException;
-
-@CommandLine.Command(name = "armor",
-        resourceBundle = "msg_armor",
-        exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
-public class ArmorCmd extends AbstractSopCmd {
-
-    @CommandLine.Option(names = {"--label"},
-            paramLabel = "{auto|sig|key|cert|message}")
-    ArmorLabel label;
-
-    @Override
-    public void run() {
-        Armor armor = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().armor(),
-        "armor");
-
-        if (label != null) {
-            try {
-                armor.label(label);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--label");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-
-        try {
-            Ready ready = armor.data(System.in);
-            ready.writeTo(System.out);
-        } catch (SOPGPException.BadData badData) {
-            String errorMsg = getMsg("sop.error.input.stdin_not_openpgp_data");
-            throw new SOPGPException.BadData(errorMsg, badData);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/DearmorCmd.java

@@ -1,47 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.cli.picocli.SopCLI;
-import sop.exception.SOPGPException;
-import sop.operation.Dearmor;
-
-import java.io.IOException;
-
-@CommandLine.Command(name = "dearmor",
-        resourceBundle = "msg_dearmor",
-        exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
-public class DearmorCmd extends AbstractSopCmd {
-
-    @Override
-    public void run() {
-        Dearmor dearmor = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().dearmor(), "dearmor");
-
-        try {
-            dearmor.data(System.in)
-                    .writeTo(System.out);
-        } catch (SOPGPException.BadData e) {
-            String errorMsg = getMsg("sop.error.input.stdin_not_openpgp_data");
-            throw new SOPGPException.BadData(errorMsg, e);
-        } catch (IOException e) {
-            String msg = e.getMessage();
-            if (msg == null) {
-                throw new RuntimeException(e);
-            }
-
-            String errorMsg = getMsg("sop.error.input.stdin_not_openpgp_data");
-            if (msg.equals("invalid armor") ||
-                    msg.equals("invalid armor header") ||
-                    msg.equals("inconsistent line endings in headers") ||
-                    msg.startsWith("unable to decode base64 data")) {
-                throw new SOPGPException.BadData(errorMsg, e);
-            }
-
-            throw new RuntimeException(e);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/DecryptCmd.java

@@ -1,255 +0,0 @@
-// SPDX-FileCopyrightText: 2020 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.DecryptionResult;
-import sop.ReadyWithResult;
-import sop.SessionKey;
-import sop.Verification;
-import sop.cli.picocli.SopCLI;
-import sop.exception.SOPGPException;
-import sop.operation.Decrypt;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.io.PrintWriter;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-
-@CommandLine.Command(name = "decrypt",
-        resourceBundle = "msg_decrypt",
-        exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
-public class DecryptCmd extends AbstractSopCmd {
-
-    private static final String OPT_SESSION_KEY_OUT = "--session-key-out";
-    private static final String OPT_WITH_SESSION_KEY = "--with-session-key";
-    private static final String OPT_WITH_PASSWORD = "--with-password";
-    private static final String OPT_WITH_KEY_PASSWORD = "--with-key-password";
-    private static final String OPT_VERIFICATIONS_OUT = "--verifications-out"; // see SOP-05
-    private static final String OPT_VERIFY_WITH = "--verify-with";
-    private static final String OPT_NOT_BEFORE = "--verify-not-before";
-    private static final String OPT_NOT_AFTER = "--verify-not-after";
-
-
-    @CommandLine.Option(
-            names = {OPT_SESSION_KEY_OUT},
-            paramLabel = "SESSIONKEY")
-    String sessionKeyOut;
-
-    @CommandLine.Option(
-            names = {OPT_WITH_SESSION_KEY},
-            paramLabel = "SESSIONKEY")
-    List<String> withSessionKey = new ArrayList<>();
-
-    @CommandLine.Option(
-            names = {OPT_WITH_PASSWORD},
-            paramLabel = "PASSWORD")
-    List<String> withPassword = new ArrayList<>();
-
-    @CommandLine.Option(names = {OPT_VERIFICATIONS_OUT, "--verify-out"}, // TODO: Remove --verify-out at some point
-            paramLabel = "VERIFICATIONS")
-    String verifyOut;
-
-    @CommandLine.Option(names = {OPT_VERIFY_WITH},
-            paramLabel = "CERT")
-    List<String> certs = new ArrayList<>();
-
-    @CommandLine.Option(names = {OPT_NOT_BEFORE},
-            paramLabel = "DATE")
-    String notBefore = "-";
-
-    @CommandLine.Option(names = {OPT_NOT_AFTER},
-            paramLabel = "DATE")
-    String notAfter = "now";
-
-    @CommandLine.Parameters(index = "0..*",
-            paramLabel = "KEY")
-    List<String> keys = new ArrayList<>();
-
-    @CommandLine.Option(names = {OPT_WITH_KEY_PASSWORD},
-            paramLabel = "PASSWORD")
-    List<String> withKeyPassword = new ArrayList<>();
-
-    @Override
-    public void run() {
-        Decrypt decrypt = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().decrypt(), "decrypt");
-
-        throwIfOutputExists(verifyOut);
-        throwIfOutputExists(sessionKeyOut);
-
-        setNotAfter(notAfter, decrypt);
-        setNotBefore(notBefore, decrypt);
-        setWithPasswords(withPassword, decrypt);
-        setWithSessionKeys(withSessionKey, decrypt);
-        setWithKeyPassword(withKeyPassword, decrypt);
-        setVerifyWith(certs, decrypt);
-        setDecryptWith(keys, decrypt);
-
-        if (verifyOut != null && certs.isEmpty()) {
-            String errorMsg = getMsg("sop.error.usage.option_requires_other_option", OPT_VERIFICATIONS_OUT, OPT_VERIFY_WITH);
-            throw new SOPGPException.IncompleteVerification(errorMsg);
-        }
-
-        try {
-            ReadyWithResult<DecryptionResult> ready = decrypt.ciphertext(System.in);
-            DecryptionResult result = ready.writeTo(System.out);
-            writeSessionKeyOut(result);
-            writeVerifyOut(result);
-
-        } catch (SOPGPException.BadData badData) {
-            String errorMsg = getMsg("sop.error.input.stdin_not_a_message");
-            throw new SOPGPException.BadData(errorMsg, badData);
-        } catch (SOPGPException.CannotDecrypt e) {
-            String errorMsg = getMsg("sop.error.runtime.cannot_decrypt_message");
-            throw new SOPGPException.CannotDecrypt(errorMsg, e);
-        } catch (IOException ioException) {
-            throw new RuntimeException(ioException);
-        }
-    }
-
-    private void writeVerifyOut(DecryptionResult result) throws IOException {
-        if (verifyOut != null) {
-            if (result.getVerifications().isEmpty()) {
-                String errorMsg = getMsg("sop.error.runtime.no_verifiable_signature_found");
-                throw new SOPGPException.NoSignature(errorMsg);
-            }
-
-            try (OutputStream fileOut = getOutput(verifyOut)) {
-                PrintWriter writer = new PrintWriter(fileOut);
-                for (Verification verification : result.getVerifications()) {
-                    // CHECKSTYLE:OFF
-                    writer.println(verification.toString());
-                    // CHECKSTYLE:ON
-                }
-                writer.flush();
-            }
-        }
-    }
-
-    private void writeSessionKeyOut(DecryptionResult result) throws IOException {
-        if (sessionKeyOut == null) {
-            return;
-        }
-        try (OutputStream outputStream = getOutput(sessionKeyOut)) {
-            if (!result.getSessionKey().isPresent()) {
-                String errorMsg = getMsg("sop.error.runtime.no_session_key_extracted");
-                throw new SOPGPException.UnsupportedOption(String.format(errorMsg, OPT_SESSION_KEY_OUT));
-            }
-            SessionKey sessionKey = result.getSessionKey().get();
-            PrintWriter writer = new PrintWriter(outputStream);
-            // CHECKSTYLE:OFF
-            writer.println(sessionKey.toString());
-            // CHECKSTYLE:ON
-            writer.flush();
-        }
-    }
-
-    private void setDecryptWith(List<String> keys, Decrypt decrypt) {
-        for (String key : keys) {
-            try (InputStream keyIn = getInput(key)) {
-                decrypt.withKey(keyIn);
-            } catch (SOPGPException.KeyIsProtected keyIsProtected) {
-                String errorMsg = getMsg("sop.error.runtime.cannot_unlock_key", key);
-                throw new SOPGPException.KeyIsProtected(errorMsg, keyIsProtected);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_private_key", key);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-    }
-
-    private void setVerifyWith(List<String> certs, Decrypt decrypt) {
-        for (String cert : certs) {
-            try (InputStream certIn = getInput(cert)) {
-                decrypt.verifyWithCert(certIn);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_certificate", cert);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            } catch (IOException ioException) {
-                throw new RuntimeException(ioException);
-            }
-        }
-    }
-
-    private void setWithSessionKeys(List<String> withSessionKey, Decrypt decrypt) {
-        for (String sessionKeyFile : withSessionKey) {
-            String sessionKeyString;
-            try {
-                sessionKeyString = stringFromInputStream(getInput(sessionKeyFile));
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-            SessionKey sessionKey;
-            try {
-                sessionKey = SessionKey.fromString(sessionKeyString);
-            } catch (IllegalArgumentException e) {
-                String errorMsg = getMsg("sop.error.input.malformed_session_key");
-                throw new IllegalArgumentException(errorMsg, e);
-            }
-            try {
-                decrypt.withSessionKey(sessionKey);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", OPT_WITH_SESSION_KEY);
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-    }
-
-    private void setWithPasswords(List<String> withPassword, Decrypt decrypt) {
-        for (String passwordFile : withPassword) {
-            try {
-                String password = stringFromInputStream(getInput(passwordFile));
-                decrypt.withPassword(password);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", OPT_WITH_PASSWORD);
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-    }
-
-    private void setWithKeyPassword(List<String> withKeyPassword, Decrypt decrypt) {
-        for (String passwordFile : withKeyPassword) {
-            try {
-                String password = stringFromInputStream(getInput(passwordFile));
-                decrypt.withKeyPassword(password);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", OPT_WITH_KEY_PASSWORD);
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-    }
-
-    private void setNotAfter(String notAfter, Decrypt decrypt) {
-        Date notAfterDate = parseNotAfter(notAfter);
-        try {
-            decrypt.verifyNotAfter(notAfterDate);
-        } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-            String errorMsg = getMsg("sop.error.feature_support.option_not_supported", OPT_NOT_AFTER);
-            throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-        }
-    }
-
-    private void setNotBefore(String notBefore, Decrypt decrypt) {
-        Date notBeforeDate = parseNotBefore(notBefore);
-        try {
-            decrypt.verifyNotBefore(notBeforeDate);
-        } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-            String errorMsg = getMsg("sop.error.feature_support.option_not_supported", OPT_NOT_BEFORE);
-            throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/EncryptCmd.java

@@ -1,141 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.Ready;
-import sop.cli.picocli.SopCLI;
-import sop.enums.EncryptAs;
-import sop.exception.SOPGPException;
-import sop.operation.Encrypt;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.List;
-
-@CommandLine.Command(name = "encrypt",
-        resourceBundle = "msg_encrypt",
-        exitCodeOnInvalidInput = 37)
-public class EncryptCmd extends AbstractSopCmd {
-
-    @CommandLine.Option(names = "--no-armor",
-            negatable = true)
-    boolean armor = true;
-
-    @CommandLine.Option(names = {"--as"},
-            paramLabel = "{binary|text}")
-    EncryptAs type;
-
-    @CommandLine.Option(names = "--with-password",
-            paramLabel = "PASSWORD")
-    List<String> withPassword = new ArrayList<>();
-
-    @CommandLine.Option(names = "--sign-with",
-            paramLabel = "KEY")
-    List<String> signWith = new ArrayList<>();
-
-    @CommandLine.Option(names = "--with-key-password",
-            paramLabel = "PASSWORD")
-    List<String> withKeyPassword = new ArrayList<>();
-
-    @CommandLine.Parameters(index = "0..*",
-            paramLabel = "CERTS")
-    List<String> certs = new ArrayList<>();
-
-    @Override
-    public void run() {
-        Encrypt encrypt = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().encrypt(), "encrypt");
-
-        if (type != null) {
-            try {
-                encrypt.mode(type);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--as");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-
-        if (withPassword.isEmpty() && certs.isEmpty()) {
-            String errorMsg = getMsg("sop.error.usage.password_or_cert_required");
-            throw new SOPGPException.MissingArg(errorMsg);
-        }
-
-        for (String passwordFileName : withPassword) {
-            try {
-                String password = stringFromInputStream(getInput(passwordFileName));
-                encrypt.withPassword(password);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--with-password");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-
-        for (String passwordFileName : withKeyPassword) {
-            try {
-                String password = stringFromInputStream(getInput(passwordFileName));
-                encrypt.withKeyPassword(password);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--with-key-password");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-
-        for (String keyInput : signWith) {
-            try (InputStream keyIn = getInput(keyInput)) {
-                encrypt.signWith(keyIn);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            } catch (SOPGPException.KeyIsProtected keyIsProtected) {
-                String errorMsg = getMsg("sop.error.runtime.cannot_unlock_key", keyInput);
-                throw new SOPGPException.KeyIsProtected(errorMsg, keyIsProtected);
-            } catch (SOPGPException.UnsupportedAsymmetricAlgo unsupportedAsymmetricAlgo) {
-                String errorMsg = getMsg("sop.error.runtime.key_uses_unsupported_asymmetric_algorithm", keyInput);
-                throw new SOPGPException.UnsupportedAsymmetricAlgo(errorMsg, unsupportedAsymmetricAlgo);
-            } catch (SOPGPException.KeyCannotSign keyCannotSign) {
-                String errorMsg = getMsg("sop.error.runtime.key_cannot_sign", keyInput);
-                throw new SOPGPException.KeyCannotSign(errorMsg, keyCannotSign);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_private_key", keyInput);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            }
-        }
-
-        for (String certInput : certs) {
-            try (InputStream certIn = getInput(certInput)) {
-                encrypt.withCert(certIn);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            } catch (SOPGPException.UnsupportedAsymmetricAlgo unsupportedAsymmetricAlgo) {
-                String errorMsg = getMsg("sop.error.runtime.cert_uses_unsupported_asymmetric_algorithm", certInput);
-                throw new SOPGPException.UnsupportedAsymmetricAlgo(errorMsg, unsupportedAsymmetricAlgo);
-            } catch (SOPGPException.CertCannotEncrypt certCannotEncrypt) {
-                String errorMsg = getMsg("sop.error.runtime.cert_cannot_encrypt", certInput);
-                throw new SOPGPException.CertCannotEncrypt(errorMsg, certCannotEncrypt);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_certificate", certInput);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            }
-        }
-
-        if (!armor) {
-            encrypt.noArmor();
-        }
-
-        try {
-            Ready ready = encrypt.plaintext(System.in);
-            ready.writeTo(System.out);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/ExtractCertCmd.java

@@ -1,43 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import java.io.IOException;
-
-import picocli.CommandLine;
-import sop.Ready;
-import sop.cli.picocli.SopCLI;
-import sop.exception.SOPGPException;
-import sop.operation.ExtractCert;
-
-@CommandLine.Command(name = "extract-cert",
-        resourceBundle = "msg_extract-cert",
-        exitCodeOnInvalidInput = 37)
-public class ExtractCertCmd extends AbstractSopCmd {
-
-    @CommandLine.Option(names = "--no-armor",
-            negatable = true)
-    boolean armor = true;
-
-    @Override
-    public void run() {
-        ExtractCert extractCert = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().extractCert(), "extract-cert");
-
-        if (!armor) {
-            extractCert.noArmor();
-        }
-
-        try {
-            Ready ready = extractCert.key(System.in);
-            ready.writeTo(System.out);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        } catch (SOPGPException.BadData badData) {
-            String errorMsg = getMsg("sop.error.input.stdin_not_a_private_key");
-            throw new SOPGPException.BadData(errorMsg, badData);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/GenerateKeyCmd.java

@@ -1,65 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.Ready;
-import sop.cli.picocli.SopCLI;
-import sop.exception.SOPGPException;
-import sop.operation.GenerateKey;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-@CommandLine.Command(name = "generate-key",
-        resourceBundle = "msg_generate-key",
-        exitCodeOnInvalidInput = 37)
-public class GenerateKeyCmd extends AbstractSopCmd {
-
-    @CommandLine.Option(names = "--no-armor",
-            negatable = true)
-    boolean armor = true;
-
-    @CommandLine.Parameters(paramLabel = "USERID")
-    List<String> userId = new ArrayList<>();
-
-    @CommandLine.Option(names = "--with-key-password",
-            paramLabel = "PASSWORD")
-    String withKeyPassword;
-
-    @Override
-    public void run() {
-        GenerateKey generateKey = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().generateKey(), "generate-key");
-
-        for (String userId : userId) {
-            generateKey.userId(userId);
-        }
-
-        if (!armor) {
-            generateKey.noArmor();
-        }
-
-        if (withKeyPassword != null) {
-            try {
-                String password = stringFromInputStream(getInput(withKeyPassword));
-                generateKey.withKeyPassword(password);
-            } catch (SOPGPException.UnsupportedOption e) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--with-key-password");
-                throw new SOPGPException.UnsupportedOption(errorMsg, e);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-
-        try {
-            Ready ready = generateKey.generate();
-            ready.writeTo(System.out);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/InlineDetachCmd.java

@@ -1,50 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.Signatures;
-import sop.cli.picocli.SopCLI;
-import sop.exception.SOPGPException;
-import sop.operation.InlineDetach;
-
-import java.io.IOException;
-import java.io.OutputStream;
-
-@CommandLine.Command(name = "inline-detach",
-        resourceBundle = "msg_inline-detach",
-        exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
-public class InlineDetachCmd extends AbstractSopCmd {
-
-    @CommandLine.Option(
-            names = {"--signatures-out"},
-            paramLabel = "SIGNATURES")
-    String signaturesOut;
-
-    @CommandLine.Option(names = "--no-armor",
-            negatable = true)
-    boolean armor = true;
-
-    @Override
-    public void run() {
-        InlineDetach inlineDetach = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().inlineDetach(), "inline-detach");
-
-        throwIfOutputExists(signaturesOut);
-        throwIfMissingArg(signaturesOut, "--signatures-out");
-
-        if (!armor) {
-            inlineDetach.noArmor();
-        }
-
-        try (OutputStream outputStream = getOutput(signaturesOut)) {
-            Signatures signatures = inlineDetach
-                    .message(System.in).writeTo(System.out);
-            signatures.writeTo(outputStream);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/InlineSignCmd.java

@@ -1,95 +0,0 @@
-// SPDX-FileCopyrightText: 2022 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.Ready;
-import sop.cli.picocli.SopCLI;
-import sop.enums.InlineSignAs;
-import sop.exception.SOPGPException;
-import sop.operation.InlineSign;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.List;
-
-@CommandLine.Command(name = "inline-sign",
-        resourceBundle = "msg_inline-sign",
-        exitCodeOnInvalidInput = 37)
-public class InlineSignCmd extends AbstractSopCmd {
-
-    @CommandLine.Option(names = "--no-armor",
-            negatable = true)
-    boolean armor = true;
-
-    @CommandLine.Option(names = "--as",
-            paramLabel = "{binary|text|clearsigned}")
-    InlineSignAs type;
-
-    @CommandLine.Parameters(paramLabel = "KEYS")
-    List<String> secretKeyFile = new ArrayList<>();
-
-    @CommandLine.Option(names = "--with-key-password",
-            paramLabel = "PASSWORD")
-    List<String> withKeyPassword = new ArrayList<>();
-
-    @Override
-    public void run() {
-        InlineSign inlineSign = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().inlineSign(), "inline-sign");
-
-        if (type != null) {
-            try {
-                inlineSign.mode(type);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--as");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-
-        if (secretKeyFile.isEmpty()) {
-            String errorMsg = getMsg("sop.error.usage.parameter_required", "KEYS");
-            throw new SOPGPException.MissingArg(errorMsg);
-        }
-
-        for (String passwordFile : withKeyPassword) {
-            try {
-                String password = stringFromInputStream(getInput(passwordFile));
-                inlineSign.withKeyPassword(password);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--with-key-password");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-
-        for (String keyInput : secretKeyFile) {
-            try (InputStream keyIn = getInput(keyInput)) {
-                inlineSign.key(keyIn);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            } catch (SOPGPException.KeyIsProtected e) {
-                String errorMsg = getMsg("sop.error.runtime.cannot_unlock_key", keyInput);
-                throw new SOPGPException.KeyIsProtected(errorMsg, e);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_private_key", keyInput);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            }
-        }
-
-        if (!armor) {
-            inlineSign.noArmor();
-        }
-
-        try {
-            Ready ready = inlineSign.data(System.in);
-            ready.writeTo(System.out);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/InlineVerifyCmd.java

@@ -1,108 +0,0 @@
-// SPDX-FileCopyrightText: 2022 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.ReadyWithResult;
-import sop.Verification;
-import sop.cli.picocli.SopCLI;
-import sop.exception.SOPGPException;
-import sop.operation.InlineVerify;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.io.PrintWriter;
-import java.util.ArrayList;
-import java.util.List;
-
-@CommandLine.Command(name = "inline-verify",
-        resourceBundle = "msg_inline-verify",
-        exitCodeOnInvalidInput = 37)
-public class InlineVerifyCmd extends AbstractSopCmd {
-
-    @CommandLine.Parameters(arity = "0..*",
-            paramLabel = "CERT")
-    List<String> certificates = new ArrayList<>();
-
-    @CommandLine.Option(names = {"--not-before"},
-            paramLabel = "DATE")
-    String notBefore = "-";
-
-    @CommandLine.Option(names = {"--not-after"},
-            paramLabel = "DATE")
-    String notAfter = "now";
-
-    @CommandLine.Option(names = "--verifications-out")
-    String verificationsOut;
-
-    @Override
-    public void run() {
-        InlineVerify inlineVerify = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().inlineVerify(), "inline-verify");
-
-        throwIfOutputExists(verificationsOut);
-
-        if (notAfter != null) {
-            try {
-                inlineVerify.notAfter(parseNotAfter(notAfter));
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--not-after");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-        if (notBefore != null) {
-            try {
-                inlineVerify.notBefore(parseNotBefore(notBefore));
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--not-before");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-
-        for (String certInput : certificates) {
-            try (InputStream certIn = getInput(certInput)) {
-                inlineVerify.cert(certIn);
-            } catch (IOException ioException) {
-                throw new RuntimeException(ioException);
-            } catch (SOPGPException.UnsupportedAsymmetricAlgo unsupportedAsymmetricAlgo) {
-                String errorMsg = getMsg("sop.error.runtime.cert_uses_unsupported_asymmetric_algorithm", certInput);
-                throw new SOPGPException.UnsupportedAsymmetricAlgo(errorMsg, unsupportedAsymmetricAlgo);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_certificate", certInput);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            }
-        }
-
-        List<Verification> verifications = null;
-        try {
-            ReadyWithResult<List<Verification>> ready = inlineVerify.data(System.in);
-            verifications = ready.writeTo(System.out);
-        } catch (SOPGPException.NoSignature e) {
-            String errorMsg = getMsg("sop.error.runtime.no_verifiable_signature_found");
-            throw new SOPGPException.NoSignature(errorMsg, e);
-        } catch (IOException ioException) {
-            throw new RuntimeException(ioException);
-        } catch (SOPGPException.BadData badData) {
-            String errorMsg = getMsg("sop.error.input.stdin_not_a_message");
-            throw new SOPGPException.BadData(errorMsg, badData);
-        }
-
-        if (verificationsOut != null) {
-            try (OutputStream outputStream = getOutput(verificationsOut)) {
-                PrintWriter pw = new PrintWriter(outputStream);
-                for (Verification verification : verifications) {
-                    // CHECKSTYLE:OFF
-                    pw.println(verification);
-                    // CHECKSTYLE:ON
-                }
-                pw.flush();
-                pw.close();
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/SignCmd.java

@@ -1,108 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.MicAlg;
-import sop.ReadyWithResult;
-import sop.SigningResult;
-import sop.cli.picocli.SopCLI;
-import sop.enums.SignAs;
-import sop.exception.SOPGPException;
-import sop.operation.DetachedSign;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.util.ArrayList;
-import java.util.List;
-
-@CommandLine.Command(name = "sign",
-        resourceBundle = "msg_detached-sign",
-        exitCodeOnInvalidInput = 37)
-public class SignCmd extends AbstractSopCmd {
-
-    @CommandLine.Option(names = "--no-armor",
-            negatable = true)
-    boolean armor = true;
-
-    @CommandLine.Option(names = "--as",
-            paramLabel = "{binary|text}")
-    SignAs type;
-
-    @CommandLine.Parameters(paramLabel = "KEYS")
-    List<String> secretKeyFile = new ArrayList<>();
-
-    @CommandLine.Option(names = "--with-key-password",
-            paramLabel = "PASSWORD")
-    List<String> withKeyPassword = new ArrayList<>();
-
-    @CommandLine.Option(names = "--micalg-out",
-            paramLabel = "MICALG")
-    String micAlgOut;
-
-    @Override
-    public void run() {
-        DetachedSign detachedSign = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().detachedSign(), "sign");
-
-        throwIfOutputExists(micAlgOut);
-        throwIfEmptyParameters(secretKeyFile, "KEYS");
-
-        if (type != null) {
-            try {
-                detachedSign.mode(type);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--as");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-
-        for (String passwordFile : withKeyPassword) {
-            try {
-                String password = stringFromInputStream(getInput(passwordFile));
-                detachedSign.withKeyPassword(password);
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--with-key-password");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-
-        for (String keyInput : secretKeyFile) {
-            try (InputStream keyIn = getInput(keyInput)) {
-                detachedSign.key(keyIn);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            } catch (SOPGPException.KeyIsProtected keyIsProtected) {
-                String errorMsg = getMsg("sop.error.runtime.cannot_unlock_key", keyInput);
-                throw new SOPGPException.KeyIsProtected(errorMsg, keyIsProtected);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_private_key", keyInput);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            }
-        }
-
-        if (!armor) {
-            detachedSign.noArmor();
-        }
-
-        try {
-            ReadyWithResult<SigningResult> ready = detachedSign.data(System.in);
-            SigningResult result = ready.writeTo(System.out);
-
-            MicAlg micAlg = result.getMicAlg();
-            if (micAlgOut != null) {
-                // Write micalg out
-                OutputStream outputStream = getOutput(micAlgOut);
-                micAlg.writeTo(outputStream);
-                outputStream.close();
-            }
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/VerifyCmd.java

@@ -1,102 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.Verification;
-import sop.cli.picocli.Print;
-import sop.cli.picocli.SopCLI;
-import sop.exception.SOPGPException;
-import sop.operation.DetachedVerify;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.List;
-
-@CommandLine.Command(name = "verify",
-        resourceBundle = "msg_detached-verify",
-        exitCodeOnInvalidInput = 37)
-public class VerifyCmd extends AbstractSopCmd {
-
-    @CommandLine.Parameters(index = "0",
-            paramLabel = "SIGNATURE")
-    String signature;
-
-    @CommandLine.Parameters(index = "1..*",
-            arity = "1..*",
-            paramLabel = "CERT")
-    List<String> certificates = new ArrayList<>();
-
-    @CommandLine.Option(names = {"--not-before"},
-            paramLabel = "DATE")
-    String notBefore = "-";
-
-    @CommandLine.Option(names = {"--not-after"},
-            paramLabel = "DATE")
-    String notAfter = "now";
-
-    @Override
-    public void run() {
-        DetachedVerify detachedVerify = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().detachedVerify(), "verify");
-
-        if (notAfter != null) {
-            try {
-                detachedVerify.notAfter(parseNotAfter(notAfter));
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--not-after");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-        if (notBefore != null) {
-            try {
-                detachedVerify.notBefore(parseNotBefore(notBefore));
-            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
-                String errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--not-before");
-                throw new SOPGPException.UnsupportedOption(errorMsg, unsupportedOption);
-            }
-        }
-
-        for (String certInput : certificates) {
-            try (InputStream certIn = getInput(certInput)) {
-                detachedVerify.cert(certIn);
-            } catch (IOException ioException) {
-                throw new RuntimeException(ioException);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_certificate", certInput);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            }
-        }
-
-        if (signature != null) {
-            try (InputStream sigIn = getInput(signature)) {
-                detachedVerify.signatures(sigIn);
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            } catch (SOPGPException.BadData badData) {
-                String errorMsg = getMsg("sop.error.input.not_a_signature", signature);
-                throw new SOPGPException.BadData(errorMsg, badData);
-            }
-        }
-
-        List<Verification> verifications;
-        try {
-            verifications = detachedVerify.data(System.in);
-        } catch (SOPGPException.NoSignature e) {
-            String errorMsg = getMsg("sop.error.runtime.no_verifiable_signature_found");
-            throw new SOPGPException.NoSignature(errorMsg, e);
-        } catch (IOException ioException) {
-            throw new RuntimeException(ioException);
-        } catch (SOPGPException.BadData badData) {
-            String errorMsg = getMsg("sop.error.input.stdin_not_a_message");
-            throw new SOPGPException.BadData(errorMsg, badData);
-        }
-
-        for (Verification verification : verifications) {
-            Print.outln(verification.toString());
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/VersionCmd.java

@@ -1,49 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sop.cli.picocli.commands;
-
-import picocli.CommandLine;
-import sop.cli.picocli.Print;
-import sop.cli.picocli.SopCLI;
-import sop.operation.Version;
-
-@CommandLine.Command(name = "version", resourceBundle = "msg_version",
-        exitCodeOnInvalidInput = 37)
-public class VersionCmd extends AbstractSopCmd {
-
-    @CommandLine.ArgGroup()
-    Exclusive exclusive;
-
-    static class Exclusive {
-        @CommandLine.Option(names = "--extended")
-        boolean extended;
-
-        @CommandLine.Option(names = "--backend")
-        boolean backend;
-    }
-
-
-
-    @Override
-    public void run() {
-        Version version = throwIfUnsupportedSubcommand(
-                SopCLI.getSop().version(), "version");
-
-        if (exclusive == null) {
-            Print.outln(version.getName() + " " + version.getVersion());
-            return;
-        }
-
-        if (exclusive.extended) {
-            Print.outln(version.getExtendedVersion());
-            return;
-        }
-
-        if (exclusive.backend) {
-            Print.outln(version.getBackendVersion());
-            return;
-        }
-    }
-}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/package-info.java

@@ -1,8 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-/**
- * Subcommands of the PGPainless SOP.
- */
-package sop.cli.picocli.commands;

sop-java-picocli/src/main/java/sop/cli/picocli/package-info.java

@@ -1,8 +0,0 @@
-// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
-//
-// SPDX-License-Identifier: Apache-2.0
-
-/**
- * Implementation of the Stateless OpenPGP Command Line Interface using Picocli.
- */
-package sop.cli.picocli;

sop-java-picocli/src/main/kotlin/sop/cli/picocli/SOPExceptionExitCodeMapper.kt

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli
+
+import picocli.CommandLine.*
+import sop.exception.SOPGPException
+
+class SOPExceptionExitCodeMapper : IExitCodeExceptionMapper {
+
+    override fun getExitCode(exception: Throwable): Int =
+        if (exception is SOPGPException) {
+            // SOPGPExceptions have well-defined exit code
+            exception.getExitCode()
+        } else if (exception is UnmatchedArgumentException) {
+            if (exception.isUnknownOption) {
+                // Unmatched option of subcommand (e.g. `generate-key --unknown`)
+                SOPGPException.UnsupportedOption.EXIT_CODE
+            } else {
+                // Unmatched subcommand
+                SOPGPException.UnsupportedSubcommand.EXIT_CODE
+            }
+        } else if (exception is ParameterException) {
+            // Invalid option (e.g. `--as invalid`)
+            SOPGPException.UnsupportedOption.EXIT_CODE
+        } else {
+            // Others, like IOException etc.
+            1
+        }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/SOPExecutionExceptionHandler.kt

@@ -0,0 +1,34 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli
+
+import picocli.CommandLine
+import picocli.CommandLine.IExecutionExceptionHandler
+
+class SOPExecutionExceptionHandler : IExecutionExceptionHandler {
+    override fun handleExecutionException(
+        ex: Exception,
+        commandLine: CommandLine,
+        parseResult: CommandLine.ParseResult
+    ): Int {
+        val exitCode =
+            if (commandLine.exitCodeExceptionMapper != null)
+                commandLine.exitCodeExceptionMapper.getExitCode(ex)
+            else commandLine.commandSpec.exitCodeOnExecutionException()
+
+        val colorScheme = commandLine.colorScheme
+        if (ex.message != null) {
+            commandLine.getErr().println(colorScheme.errorText(ex.message))
+        } else {
+            commandLine.getErr().println(ex.javaClass.getName())
+        }
+
+        if (SopCLI.stacktrace) {
+            ex.printStackTrace(commandLine.getErr())
+        }
+
+        return exitCode
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/SopCLI.kt

@@ -0,0 +1,113 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli
+
+import java.util.*
+import kotlin.system.exitProcess
+import picocli.AutoComplete.GenerateCompletion
+import picocli.CommandLine
+import picocli.CommandLine.*
+import sop.SOP
+import sop.cli.picocli.commands.*
+import sop.exception.SOPGPException
+
+@Command(
+    name = "sop",
+    resourceBundle = "msg_sop",
+    exitCodeOnInvalidInput = SOPGPException.UnsupportedSubcommand.EXIT_CODE,
+    subcommands =
+        [
+            // Meta subcommands
+            VersionCmd::class,
+            ListProfilesCmd::class,
+            // Key and certificate management
+            GenerateKeyCmd::class,
+            ChangeKeyPasswordCmd::class,
+            RevokeKeyCmd::class,
+            ExtractCertCmd::class,
+            // Messaging subcommands
+            SignCmd::class,
+            VerifyCmd::class,
+            EncryptCmd::class,
+            DecryptCmd::class,
+            InlineDetachCmd::class,
+            InlineSignCmd::class,
+            InlineVerifyCmd::class,
+            // Transport
+            ArmorCmd::class,
+            DearmorCmd::class,
+            // misc
+            HelpCommand::class,
+            GenerateCompletion::class])
+class SopCLI {
+
+    companion object {
+        @JvmStatic private var sopInstance: SOP? = null
+
+        @JvmStatic
+        fun getSop(): SOP =
+            checkNotNull(sopInstance) { cliMsg.getString("sop.error.runtime.no_backend_set") }
+
+        @JvmStatic
+        fun setSopInstance(sop: SOP?) {
+            sopInstance = sop
+        }
+
+        @JvmField var cliMsg: ResourceBundle = ResourceBundle.getBundle("msg_sop")
+
+        @JvmField var EXECUTABLE_NAME = "sop"
+
+        @JvmField
+        @Option(names = ["--stacktrace"], scope = CommandLine.ScopeType.INHERIT)
+        var stacktrace = false
+
+        @JvmStatic
+        fun main(vararg args: String) {
+            val exitCode = execute(*args)
+            if (exitCode != 0) {
+                exitProcess(exitCode)
+            }
+        }
+
+        @JvmStatic
+        fun execute(vararg args: String): Int {
+            // Set locale
+            CommandLine(InitLocale()).parseArgs(*args)
+
+            // Re-set bundle with updated locale
+            cliMsg = ResourceBundle.getBundle("msg_sop")
+
+            return CommandLine(SopCLI::class.java)
+                .apply {
+                    // explicitly set help command resource bundle
+                    subcommands["help"]?.setResourceBundle(ResourceBundle.getBundle("msg_help"))
+                    // Hide generate-completion command
+                    subcommands["generate-completion"]?.commandSpec?.usageMessage()?.hidden(true)
+                    // overwrite executable name
+                    commandName = EXECUTABLE_NAME
+                    // setup exception handling
+                    executionExceptionHandler = SOPExecutionExceptionHandler()
+                    exitCodeExceptionMapper = SOPExceptionExitCodeMapper()
+                    isCaseInsensitiveEnumValuesAllowed = true
+                }
+                .execute(*args)
+        }
+    }
+
+    /**
+     * Control the locale.
+     *
+     * @see <a href="https://picocli.info/#_controlling_the_locale">Picocli Readme</a>
+     */
+    @Command
+    class InitLocale {
+        @Option(names = ["-l", "--locale"], descriptionKey = "sop.locale")
+        fun setLocale(locale: String) = Locale.setDefault(Locale(locale))
+
+        @Unmatched
+        var remainder: MutableList<String> =
+            mutableListOf() // ignore any other parameters and options in the first parsing phase
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/SopVCLI.kt

@@ -0,0 +1,98 @@
+// SPDX-FileCopyrightText: 2024 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli
+
+import java.util.*
+import kotlin.system.exitProcess
+import picocli.AutoComplete
+import picocli.CommandLine
+import sop.SOPV
+import sop.cli.picocli.commands.*
+import sop.exception.SOPGPException
+
+@CommandLine.Command(
+    name = "sopv",
+    resourceBundle = "msg_sop",
+    exitCodeOnInvalidInput = SOPGPException.UnsupportedSubcommand.EXIT_CODE,
+    subcommands =
+        [
+            // Meta subcommands
+            VersionCmd::class,
+            // signature verification subcommands
+            VerifyCmd::class,
+            InlineVerifyCmd::class,
+            // misc
+            CommandLine.HelpCommand::class,
+            AutoComplete.GenerateCompletion::class])
+class SopVCLI {
+
+    companion object {
+        @JvmStatic private var sopvInstance: SOPV? = null
+
+        @JvmStatic
+        fun getSopV(): SOPV =
+            checkNotNull(sopvInstance) { cliMsg.getString("sop.error.runtime.no_backend_set") }
+
+        @JvmStatic
+        fun setSopVInstance(sopv: SOPV?) {
+            sopvInstance = sopv
+        }
+
+        @JvmField var cliMsg: ResourceBundle = ResourceBundle.getBundle("msg_sop")
+
+        @JvmField var EXECUTABLE_NAME = "sopv"
+
+        @JvmField
+        @CommandLine.Option(names = ["--stacktrace"], scope = CommandLine.ScopeType.INHERIT)
+        var stacktrace = false
+
+        @JvmStatic
+        fun main(vararg args: String) {
+            val exitCode = execute(*args)
+            if (exitCode != 0) {
+                exitProcess(exitCode)
+            }
+        }
+
+        @JvmStatic
+        fun execute(vararg args: String): Int {
+            // Set locale
+            CommandLine(InitLocale()).parseArgs(*args)
+
+            // Re-set bundle with updated locale
+            cliMsg = ResourceBundle.getBundle("msg_sop")
+
+            return CommandLine(SopVCLI::class.java)
+                .apply {
+                    // explicitly set help command resource bundle
+                    subcommands["help"]?.setResourceBundle(ResourceBundle.getBundle("msg_help"))
+                    // Hide generate-completion command
+                    subcommands["generate-completion"]?.commandSpec?.usageMessage()?.hidden(true)
+                    // overwrite executable name
+                    commandName = EXECUTABLE_NAME
+                    // setup exception handling
+                    executionExceptionHandler = SOPExecutionExceptionHandler()
+                    exitCodeExceptionMapper = SOPExceptionExitCodeMapper()
+                    isCaseInsensitiveEnumValuesAllowed = true
+                }
+                .execute(*args)
+        }
+    }
+
+    /**
+     * Control the locale.
+     *
+     * @see <a href="https://picocli.info/#_controlling_the_locale">Picocli Readme</a>
+     */
+    @CommandLine.Command
+    class InitLocale {
+        @CommandLine.Option(names = ["-l", "--locale"], descriptionKey = "sop.locale")
+        fun setLocale(locale: String) = Locale.setDefault(Locale(locale))
+
+        @CommandLine.Unmatched
+        var remainder: MutableList<String> =
+            mutableListOf() // ignore any other parameters and options in the first parsing phase
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/AbstractSopCmd.kt

@@ -0,0 +1,248 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.*
+import java.text.ParseException
+import java.util.*
+import sop.cli.picocli.commands.AbstractSopCmd.EnvironmentVariableResolver
+import sop.exception.SOPGPException.*
+import sop.util.UTCUtil.Companion.parseUTCDate
+import sop.util.UTF8Util.Companion.decodeUTF8
+
+/** Abstract super class of SOP subcommands. */
+abstract class AbstractSopCmd(locale: Locale = Locale.getDefault()) : Runnable {
+
+    private val messages: ResourceBundle = ResourceBundle.getBundle("msg_sop", locale)
+    var environmentVariableResolver = EnvironmentVariableResolver { name: String ->
+        System.getenv(name)
+    }
+
+    /** Interface to modularize resolving of environment variables. */
+    fun interface EnvironmentVariableResolver {
+
+        /**
+         * Resolve the value of the given environment variable. Return null if the variable is not
+         * present.
+         *
+         * @param name name of the variable
+         * @return variable value or null
+         */
+        fun resolveEnvironmentVariable(name: String): String?
+    }
+
+    fun throwIfOutputExists(output: String?) {
+        output
+            ?.let { File(it) }
+            ?.let {
+                if (it.exists()) {
+                    val errorMsg: String =
+                        getMsg(
+                            "sop.error.indirect_data_type.output_file_already_exists",
+                            it.absolutePath)
+                    throw OutputExists(errorMsg)
+                }
+            }
+    }
+
+    fun getMsg(key: String): String = messages.getString(key)
+
+    fun getMsg(key: String, vararg args: String): String {
+        val msg = messages.getString(key)
+        return String.format(msg, *args)
+    }
+
+    fun throwIfMissingArg(arg: Any?, argName: String) {
+        if (arg == null) {
+            val errorMsg = getMsg("sop.error.usage.argument_required", argName)
+            throw MissingArg(errorMsg)
+        }
+    }
+
+    fun throwIfEmptyParameters(arg: Collection<*>, parmName: String) {
+        if (arg.isEmpty()) {
+            val errorMsg = getMsg("sop.error.usage.parameter_required", parmName)
+            throw MissingArg(errorMsg)
+        }
+    }
+
+    fun <T> throwIfUnsupportedSubcommand(subcommand: T?, subcommandName: String): T {
+        if (subcommand == null) {
+            val errorMsg =
+                getMsg("sop.error.feature_support.subcommand_not_supported", subcommandName)
+            throw UnsupportedSubcommand(errorMsg)
+        }
+        return subcommand
+    }
+
+    @Throws(IOException::class)
+    fun getInput(indirectInput: String): InputStream {
+        val trimmed = indirectInput.trim()
+        require(trimmed.isNotBlank()) { "Input cannot be blank." }
+
+        if (trimmed.startsWith(PRFX_ENV)) {
+            if (File(trimmed).exists()) {
+                val errorMsg = getMsg("sop.error.indirect_data_type.ambiguous_filename", trimmed)
+                throw AmbiguousInput(errorMsg)
+            }
+
+            val envName = trimmed.substring(PRFX_ENV.length)
+            val envValue = environmentVariableResolver.resolveEnvironmentVariable(envName)
+            requireNotNull(envValue) {
+                getMsg("sop.error.indirect_data_type.environment_variable_not_set", envName)
+            }
+
+            require(envValue.trim().isNotEmpty()) {
+                getMsg("sop.error.indirect_data_type.environment_variable_empty", envName)
+            }
+
+            return envValue.byteInputStream()
+        } else if (trimmed.startsWith(PRFX_FD)) {
+
+            if (File(trimmed).exists()) {
+                val errorMsg = getMsg("sop.error.indirect_data_type.ambiguous_filename", trimmed)
+                throw AmbiguousInput(errorMsg)
+            }
+
+            val fdFile: File = fileDescriptorFromString(trimmed)
+            return try {
+                fdFile.inputStream()
+            } catch (e: FileNotFoundException) {
+                val errorMsg =
+                    getMsg(
+                        "sop.error.indirect_data_type.file_descriptor_not_found",
+                        fdFile.absolutePath)
+                throw IOException(errorMsg, e)
+            }
+        } else {
+
+            val file = File(trimmed)
+            if (!file.exists()) {
+                val errorMsg =
+                    getMsg(
+                        "sop.error.indirect_data_type.input_file_does_not_exist", file.absolutePath)
+                throw MissingInput(errorMsg)
+            }
+            if (!file.isFile()) {
+                val errorMsg =
+                    getMsg("sop.error.indirect_data_type.input_not_a_file", file.absolutePath)
+                throw MissingInput(errorMsg)
+            }
+            return file.inputStream()
+        }
+    }
+
+    @Throws(IOException::class)
+    fun getOutput(indirectOutput: String?): OutputStream {
+        requireNotNull(indirectOutput) { "Output cannot be null." }
+        val trimmed = indirectOutput.trim()
+        require(trimmed.isNotEmpty()) { "Output cannot be blank." }
+
+        // @ENV not allowed for output
+        if (trimmed.startsWith(PRFX_ENV)) {
+            val errorMsg = getMsg("sop.error.indirect_data_type.illegal_use_of_env_designator")
+            throw UnsupportedSpecialPrefix(errorMsg)
+        }
+
+        // File Descriptor
+        if (trimmed.startsWith(PRFX_FD)) {
+            val fdFile = fileDescriptorFromString(trimmed)
+            return try {
+                fdFile.outputStream()
+            } catch (e: FileNotFoundException) {
+                val errorMsg =
+                    getMsg(
+                        "sop.error.indirect_data_type.file_descriptor_not_found",
+                        fdFile.absolutePath)
+                throw IOException(errorMsg, e)
+            }
+        }
+        val file = File(trimmed)
+        if (file.exists()) {
+            val errorMsg =
+                getMsg("sop.error.indirect_data_type.output_file_already_exists", file.absolutePath)
+            throw OutputExists(errorMsg)
+        }
+        if (!file.createNewFile()) {
+            val errorMsg =
+                getMsg(
+                    "sop.error.indirect_data_type.output_file_cannot_be_created", file.absolutePath)
+            throw IOException(errorMsg)
+        }
+        return file.outputStream()
+    }
+
+    fun fileDescriptorFromString(fdString: String): File {
+        val fdDir = File("/dev/fd/")
+        if (!fdDir.exists()) {
+            val errorMsg = getMsg("sop.error.indirect_data_type.designator_fd_not_supported")
+            throw UnsupportedSpecialPrefix(errorMsg)
+        }
+        val fdNumber = fdString.substring(PRFX_FD.length)
+        require(PATTERN_FD.matcher(fdNumber).matches()) {
+            "File descriptor must be a positive number."
+        }
+        return File(fdDir, fdNumber)
+    }
+
+    fun parseNotAfter(notAfter: String): Date {
+        return when (notAfter) {
+            "now" -> Date()
+            "-" -> END_OF_TIME
+            else ->
+                try {
+                    parseUTCDate(notAfter)
+                } catch (e: ParseException) {
+                    val errorMsg = getMsg("sop.error.input.malformed_not_after")
+                    throw IllegalArgumentException(errorMsg)
+                }
+        }
+    }
+
+    fun parseNotBefore(notBefore: String): Date {
+        return when (notBefore) {
+            "now" -> Date()
+            "-" -> DAWN_OF_TIME
+            else ->
+                try {
+                    parseUTCDate(notBefore)
+                } catch (e: ParseException) {
+                    val errorMsg = getMsg("sop.error.input.malformed_not_before")
+                    throw IllegalArgumentException(errorMsg)
+                }
+        }
+    }
+
+    companion object {
+        const val PRFX_ENV = "@ENV:"
+
+        const val PRFX_FD = "@FD:"
+
+        @JvmField val DAWN_OF_TIME = Date(0)
+
+        @JvmField
+        @Deprecated("Replace with DAWN_OF_TIME", ReplaceWith("DAWN_OF_TIME"))
+        val BEGINNING_OF_TIME = DAWN_OF_TIME
+
+        @JvmField val END_OF_TIME = Date(8640000000000000L)
+
+        @JvmField val PATTERN_FD = "^\\d{1,20}$".toPattern()
+
+        @Throws(IOException::class)
+        @JvmStatic
+        fun stringFromInputStream(inputStream: InputStream): String {
+            return inputStream.use { input ->
+                val byteOut = ByteArrayOutputStream()
+                val buf = ByteArray(4096)
+                var read: Int
+                while (input.read(buf).also { read = it } != -1) {
+                    byteOut.write(buf, 0, read)
+                }
+                // TODO: For decrypt operations we MUST accept non-UTF8 passwords
+                decodeUTF8(byteOut.toByteArray())
+            }
+        }
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/ArmorCmd.kt

@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.IOException
+import picocli.CommandLine.Command
+import sop.cli.picocli.SopCLI
+import sop.exception.SOPGPException.BadData
+import sop.exception.SOPGPException.UnsupportedOption
+
+@Command(
+    name = "armor",
+    resourceBundle = "msg_armor",
+    exitCodeOnInvalidInput = UnsupportedOption.EXIT_CODE)
+class ArmorCmd : AbstractSopCmd() {
+
+    override fun run() {
+        val armor = throwIfUnsupportedSubcommand(SopCLI.getSop().armor(), "armor")
+
+        try {
+            val ready = armor.data(System.`in`)
+            ready.writeTo(System.out)
+        } catch (badData: BadData) {
+            val errorMsg = getMsg("sop.error.input.stdin_not_openpgp_data")
+            throw BadData(errorMsg, badData)
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/ChangeKeyPasswordCmd.kt

@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.IOException
+import java.lang.RuntimeException
+import picocli.CommandLine.Command
+import picocli.CommandLine.Option
+import sop.cli.picocli.SopCLI
+import sop.exception.SOPGPException
+
+@Command(
+    name = "change-key-password",
+    resourceBundle = "msg_change-key-password",
+    exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
+class ChangeKeyPasswordCmd : AbstractSopCmd() {
+
+    @Option(names = ["--no-armor"], negatable = true) var armor: Boolean = true
+
+    @Option(names = ["--old-key-password"], paramLabel = "PASSWORD")
+    var oldKeyPasswords: List<String> = listOf()
+
+    @Option(names = ["--new-key-password"], arity = "0..1", paramLabel = "PASSWORD")
+    var newKeyPassword: String? = null
+
+    override fun run() {
+        val changeKeyPassword =
+            throwIfUnsupportedSubcommand(SopCLI.getSop().changeKeyPassword(), "change-key-password")
+
+        if (!armor) {
+            changeKeyPassword.noArmor()
+        }
+
+        oldKeyPasswords.forEach { changeKeyPassword.oldKeyPassphrase(it) }
+
+        newKeyPassword?.let { changeKeyPassword.newKeyPassphrase(it) }
+
+        try {
+            changeKeyPassword.keys(System.`in`).writeTo(System.out)
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/DearmorCmd.kt

@@ -0,0 +1,41 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.IOException
+import picocli.CommandLine.Command
+import sop.cli.picocli.SopCLI
+import sop.exception.SOPGPException
+import sop.exception.SOPGPException.BadData
+
+@Command(
+    name = "dearmor",
+    resourceBundle = "msg_dearmor",
+    exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
+class DearmorCmd : AbstractSopCmd() {
+
+    override fun run() {
+        val dearmor = throwIfUnsupportedSubcommand(SopCLI.getSop().dearmor(), "dearmor")
+
+        try {
+            dearmor.data(System.`in`).writeTo(System.out)
+        } catch (badData: BadData) {
+            val errorMsg = getMsg("sop.error.input.stdin_not_openpgp_data")
+            throw BadData(errorMsg, badData)
+        } catch (e: IOException) {
+            e.message?.let {
+                val errorMsg = getMsg("sop.error.input.stdin_not_openpgp_data")
+                if (it == "invalid armor" ||
+                    it == "invalid armor header" ||
+                    it == "inconsistent line endings in headers" ||
+                    it.startsWith("unable to decode base64 data")) {
+                    throw BadData(errorMsg, e)
+                }
+                throw RuntimeException(e)
+            }
+                ?: throw RuntimeException(e)
+        }
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/DecryptCmd.kt

@@ -0,0 +1,224 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.IOException
+import java.io.PrintWriter
+import picocli.CommandLine.*
+import sop.DecryptionResult
+import sop.SessionKey
+import sop.SessionKey.Companion.fromString
+import sop.cli.picocli.SopCLI
+import sop.exception.SOPGPException.*
+import sop.operation.Decrypt
+
+@Command(
+    name = "decrypt",
+    resourceBundle = "msg_decrypt",
+    exitCodeOnInvalidInput = UnsupportedOption.EXIT_CODE)
+class DecryptCmd : AbstractSopCmd() {
+
+    @Option(names = [OPT_SESSION_KEY_OUT], paramLabel = "SESSIONKEY")
+    var sessionKeyOut: String? = null
+
+    @Option(names = [OPT_WITH_SESSION_KEY], paramLabel = "SESSIONKEY")
+    var withSessionKey: List<String> = listOf()
+
+    @Option(names = [OPT_WITH_PASSWORD], paramLabel = "PASSWORD")
+    var withPassword: List<String> = listOf()
+
+    @Option(names = [OPT_VERIFICATIONS_OUT], paramLabel = "VERIFICATIONS")
+    var verifyOut: String? = null
+
+    @Option(names = [OPT_VERIFY_WITH], paramLabel = "CERT") var certs: List<String> = listOf()
+
+    @Option(names = [OPT_NOT_BEFORE], paramLabel = "DATE") var notBefore = "-"
+
+    @Option(names = [OPT_NOT_AFTER], paramLabel = "DATE") var notAfter = "now"
+
+    @Parameters(index = "0..*", paramLabel = "KEY") var keys: List<String> = listOf()
+
+    @Option(names = [OPT_WITH_KEY_PASSWORD], paramLabel = "PASSWORD")
+    var withKeyPassword: List<String> = listOf()
+
+    override fun run() {
+        val decrypt = throwIfUnsupportedSubcommand(SopCLI.getSop().decrypt(), "decrypt")
+
+        throwIfOutputExists(verifyOut)
+        throwIfOutputExists(sessionKeyOut)
+
+        setNotAfter(notAfter, decrypt)
+        setNotBefore(notBefore, decrypt)
+        setWithPasswords(withPassword, decrypt)
+        setWithSessionKeys(withSessionKey, decrypt)
+        setWithKeyPassword(withKeyPassword, decrypt)
+        setVerifyWith(certs, decrypt)
+        setDecryptWith(keys, decrypt)
+
+        if (verifyOut != null && certs.isEmpty()) {
+            val errorMsg =
+                getMsg(
+                    "sop.error.usage.option_requires_other_option",
+                    OPT_VERIFICATIONS_OUT,
+                    OPT_VERIFY_WITH)
+            throw IncompleteVerification(errorMsg)
+        }
+
+        try {
+            val ready = decrypt.ciphertext(System.`in`)
+            val result = ready.writeTo(System.out)
+            writeSessionKeyOut(result)
+            writeVerifyOut(result)
+        } catch (badData: BadData) {
+            val errorMsg = getMsg("sop.error.input.stdin_not_a_message")
+            throw BadData(errorMsg, badData)
+        } catch (e: CannotDecrypt) {
+            val errorMsg = getMsg("sop.error.runtime.cannot_decrypt_message")
+            throw CannotDecrypt(errorMsg, e)
+        } catch (ioException: IOException) {
+            throw RuntimeException(ioException)
+        }
+    }
+
+    @Throws(IOException::class)
+    private fun writeVerifyOut(result: DecryptionResult) {
+        verifyOut?.let {
+            getOutput(it).use { out ->
+                PrintWriter(out).use { pw ->
+                    result.verifications.forEach { verification -> pw.println(verification) }
+                }
+            }
+        }
+    }
+
+    @Throws(IOException::class)
+    private fun writeSessionKeyOut(result: DecryptionResult) {
+        sessionKeyOut?.let { fileName ->
+            getOutput(fileName).use { out ->
+                if (!result.sessionKey.isPresent) {
+                    val errorMsg = getMsg("sop.error.runtime.no_session_key_extracted")
+                    throw UnsupportedOption(String.format(errorMsg, OPT_SESSION_KEY_OUT))
+                }
+
+                PrintWriter(out).use { it.println(result.sessionKey.get()!!) }
+            }
+        }
+    }
+
+    private fun setDecryptWith(keys: List<String>, decrypt: Decrypt) {
+        for (key in keys) {
+            try {
+                getInput(key).use { decrypt.withKey(it) }
+            } catch (keyIsProtected: KeyIsProtected) {
+                val errorMsg = getMsg("sop.error.runtime.cannot_unlock_key", key)
+                throw KeyIsProtected(errorMsg, keyIsProtected)
+            } catch (badData: BadData) {
+                val errorMsg = getMsg("sop.error.input.not_a_private_key", key)
+                throw BadData(errorMsg, badData)
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            }
+        }
+    }
+
+    private fun setVerifyWith(certs: List<String>, decrypt: Decrypt) {
+        for (cert in certs) {
+            try {
+                getInput(cert).use { certIn -> decrypt.verifyWithCert(certIn) }
+            } catch (badData: BadData) {
+                val errorMsg = getMsg("sop.error.input.not_a_certificate", cert)
+                throw BadData(errorMsg, badData)
+            } catch (ioException: IOException) {
+                throw RuntimeException(ioException)
+            }
+        }
+    }
+
+    private fun setWithSessionKeys(withSessionKey: List<String>, decrypt: Decrypt) {
+        for (sessionKeyFile in withSessionKey) {
+            val sessionKeyString: String =
+                try {
+                    stringFromInputStream(getInput(sessionKeyFile))
+                } catch (e: IOException) {
+                    throw RuntimeException(e)
+                }
+            val sessionKey: SessionKey =
+                try {
+                    fromString(sessionKeyString)
+                } catch (e: IllegalArgumentException) {
+                    val errorMsg = getMsg("sop.error.input.malformed_session_key")
+                    throw IllegalArgumentException(errorMsg, e)
+                }
+            try {
+                decrypt.withSessionKey(sessionKey)
+            } catch (unsupportedOption: UnsupportedOption) {
+                val errorMsg =
+                    getMsg("sop.error.feature_support.option_not_supported", OPT_WITH_SESSION_KEY)
+                throw UnsupportedOption(errorMsg, unsupportedOption)
+            }
+        }
+    }
+
+    private fun setWithPasswords(withPassword: List<String>, decrypt: Decrypt) {
+        for (passwordFile in withPassword) {
+            try {
+                val password = stringFromInputStream(getInput(passwordFile))
+                decrypt.withPassword(password)
+            } catch (unsupportedOption: UnsupportedOption) {
+                val errorMsg =
+                    getMsg("sop.error.feature_support.option_not_supported", OPT_WITH_PASSWORD)
+                throw UnsupportedOption(errorMsg, unsupportedOption)
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            }
+        }
+    }
+
+    private fun setWithKeyPassword(withKeyPassword: List<String>, decrypt: Decrypt) {
+        for (passwordFile in withKeyPassword) {
+            try {
+                val password = stringFromInputStream(getInput(passwordFile))
+                decrypt.withKeyPassword(password)
+            } catch (unsupportedOption: UnsupportedOption) {
+                val errorMsg =
+                    getMsg("sop.error.feature_support.option_not_supported", OPT_WITH_KEY_PASSWORD)
+                throw UnsupportedOption(errorMsg, unsupportedOption)
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            }
+        }
+    }
+
+    private fun setNotAfter(notAfter: String, decrypt: Decrypt) {
+        val notAfterDate = parseNotAfter(notAfter)
+        try {
+            decrypt.verifyNotAfter(notAfterDate)
+        } catch (unsupportedOption: UnsupportedOption) {
+            val errorMsg = getMsg("sop.error.feature_support.option_not_supported", OPT_NOT_AFTER)
+            throw UnsupportedOption(errorMsg, unsupportedOption)
+        }
+    }
+
+    private fun setNotBefore(notBefore: String, decrypt: Decrypt) {
+        val notBeforeDate = parseNotBefore(notBefore)
+        try {
+            decrypt.verifyNotBefore(notBeforeDate)
+        } catch (unsupportedOption: UnsupportedOption) {
+            val errorMsg = getMsg("sop.error.feature_support.option_not_supported", OPT_NOT_BEFORE)
+            throw UnsupportedOption(errorMsg, unsupportedOption)
+        }
+    }
+
+    companion object {
+        const val OPT_SESSION_KEY_OUT = "--session-key-out"
+        const val OPT_WITH_SESSION_KEY = "--with-session-key"
+        const val OPT_WITH_PASSWORD = "--with-password"
+        const val OPT_WITH_KEY_PASSWORD = "--with-key-password"
+        const val OPT_VERIFICATIONS_OUT = "--verifications-out"
+        const val OPT_VERIFY_WITH = "--verify-with"
+        const val OPT_NOT_BEFORE = "--verify-not-before"
+        const val OPT_NOT_AFTER = "--verify-not-after"
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/EncryptCmd.kt

@@ -0,0 +1,159 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.IOException
+import java.io.PrintWriter
+import picocli.CommandLine.*
+import sop.cli.picocli.SopCLI
+import sop.enums.EncryptAs
+import sop.exception.SOPGPException.*
+
+@Command(
+    name = "encrypt",
+    resourceBundle = "msg_encrypt",
+    exitCodeOnInvalidInput = UnsupportedOption.EXIT_CODE)
+class EncryptCmd : AbstractSopCmd() {
+
+    @Option(names = ["--no-armor"], negatable = true) var armor = true
+
+    @Option(names = ["--as"], paramLabel = "{binary|text}") var type: EncryptAs? = null
+
+    @Option(names = ["--with-password"], paramLabel = "PASSWORD")
+    var withPassword: List<String> = listOf()
+
+    @Option(names = ["--sign-with"], paramLabel = "KEY") var signWith: List<String> = listOf()
+
+    @Option(names = ["--with-key-password"], paramLabel = "PASSWORD")
+    var withKeyPassword: List<String> = listOf()
+
+    @Option(names = ["--profile"], paramLabel = "PROFILE") var profile: String? = null
+
+    @Parameters(index = "0..*", paramLabel = "CERTS") var certs: List<String> = listOf()
+
+    @Option(names = ["--session-key-out"], paramLabel = "SESSIONKEY")
+    var sessionKeyOut: String? = null
+
+    override fun run() {
+        val encrypt = throwIfUnsupportedSubcommand(SopCLI.getSop().encrypt(), "encrypt")
+
+        throwIfOutputExists(sessionKeyOut)
+
+        profile?.let {
+            try {
+                encrypt.profile(it)
+            } catch (e: UnsupportedProfile) {
+                val errorMsg = getMsg("sop.error.usage.profile_not_supported", "encrypt", it)
+                throw UnsupportedProfile(errorMsg, e)
+            }
+        }
+
+        type?.let {
+            try {
+                encrypt.mode(it)
+            } catch (e: UnsupportedOption) {
+                val errorMsg = getMsg("sop.error.feature_support.option_not_supported", "--as")
+                throw UnsupportedOption(errorMsg, e)
+            }
+        }
+
+        if (withPassword.isEmpty() && certs.isEmpty()) {
+            val errorMsg = getMsg("sop.error.usage.password_or_cert_required")
+            throw MissingArg(errorMsg)
+        }
+
+        for (passwordFileName in withPassword) {
+            try {
+                val password = stringFromInputStream(getInput(passwordFileName))
+                encrypt.withPassword(password)
+            } catch (unsupportedOption: UnsupportedOption) {
+                val errorMsg =
+                    getMsg("sop.error.feature_support.option_not_supported", "--with-password")
+                throw UnsupportedOption(errorMsg, unsupportedOption)
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            }
+        }
+
+        for (passwordFileName in withKeyPassword) {
+            try {
+                val password = stringFromInputStream(getInput(passwordFileName))
+                encrypt.withKeyPassword(password)
+            } catch (unsupportedOption: UnsupportedOption) {
+                val errorMsg =
+                    getMsg("sop.error.feature_support.option_not_supported", "--with-key-password")
+                throw UnsupportedOption(errorMsg, unsupportedOption)
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            }
+        }
+
+        for (keyInput in signWith) {
+            try {
+                getInput(keyInput).use { keyIn -> encrypt.signWith(keyIn) }
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            } catch (keyIsProtected: KeyIsProtected) {
+                val errorMsg = getMsg("sop.error.runtime.cannot_unlock_key", keyInput)
+                throw KeyIsProtected(errorMsg, keyIsProtected)
+            } catch (unsupportedAsymmetricAlgo: UnsupportedAsymmetricAlgo) {
+                val errorMsg =
+                    getMsg("sop.error.runtime.key_uses_unsupported_asymmetric_algorithm", keyInput)
+                throw UnsupportedAsymmetricAlgo(errorMsg, unsupportedAsymmetricAlgo)
+            } catch (keyCannotSign: KeyCannotSign) {
+                val errorMsg = getMsg("sop.error.runtime.key_cannot_sign", keyInput)
+                throw KeyCannotSign(errorMsg, keyCannotSign)
+            } catch (badData: BadData) {
+                val errorMsg = getMsg("sop.error.input.not_a_private_key", keyInput)
+                throw BadData(errorMsg, badData)
+            }
+        }
+
+        for (certInput in certs) {
+            try {
+                getInput(certInput).use { certIn -> encrypt.withCert(certIn) }
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            } catch (unsupportedAsymmetricAlgo: UnsupportedAsymmetricAlgo) {
+                val errorMsg =
+                    getMsg(
+                        "sop.error.runtime.cert_uses_unsupported_asymmetric_algorithm", certInput)
+                throw UnsupportedAsymmetricAlgo(errorMsg, unsupportedAsymmetricAlgo)
+            } catch (certCannotEncrypt: CertCannotEncrypt) {
+                val errorMsg = getMsg("sop.error.runtime.cert_cannot_encrypt", certInput)
+                throw CertCannotEncrypt(errorMsg, certCannotEncrypt)
+            } catch (badData: BadData) {
+                val errorMsg = getMsg("sop.error.input.not_a_certificate", certInput)
+                throw BadData(errorMsg, badData)
+            }
+        }
+
+        if (!armor) {
+            encrypt.noArmor()
+        }
+
+        try {
+            val ready = encrypt.plaintext(System.`in`)
+            val result = ready.writeTo(System.out)
+
+            if (sessionKeyOut == null) {
+                return
+            }
+
+            getOutput(sessionKeyOut).use {
+                if (!result.sessionKey.isPresent) {
+                    val errorMsg = getMsg("sop.error.runtime.no_session_key_extracted")
+                    throw UnsupportedOption(String.format(errorMsg, "--session-key-out"))
+                }
+                val sessionKey = result.sessionKey.get() ?: return
+                val writer = PrintWriter(it)
+                writer.println(sessionKey)
+                writer.flush()
+            }
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/ExtractCertCmd.kt

@@ -0,0 +1,40 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.IOException
+import picocli.CommandLine.Command
+import picocli.CommandLine.Option
+import sop.cli.picocli.SopCLI
+import sop.exception.SOPGPException
+import sop.exception.SOPGPException.BadData
+
+@Command(
+    name = "extract-cert",
+    resourceBundle = "msg_extract-cert",
+    exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
+class ExtractCertCmd : AbstractSopCmd() {
+
+    @Option(names = ["--no-armor"], negatable = true) var armor = true
+
+    override fun run() {
+        val extractCert =
+            throwIfUnsupportedSubcommand(SopCLI.getSop().extractCert(), "extract-cert")
+
+        if (!armor) {
+            extractCert.noArmor()
+        }
+
+        try {
+            val ready = extractCert.key(System.`in`)
+            ready.writeTo(System.out)
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        } catch (badData: BadData) {
+            val errorMsg = getMsg("sop.error.input.stdin_not_a_private_key")
+            throw BadData(errorMsg, badData)
+        }
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/GenerateKeyCmd.kt

@@ -0,0 +1,76 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.IOException
+import picocli.CommandLine.*
+import sop.cli.picocli.SopCLI
+import sop.exception.SOPGPException.UnsupportedOption
+import sop.exception.SOPGPException.UnsupportedProfile
+
+@Command(
+    name = "generate-key",
+    resourceBundle = "msg_generate-key",
+    exitCodeOnInvalidInput = UnsupportedOption.EXIT_CODE)
+class GenerateKeyCmd : AbstractSopCmd() {
+
+    @Option(names = ["--no-armor"], negatable = true) var armor = true
+
+    @Parameters(paramLabel = "USERID") var userId: List<String> = listOf()
+
+    @Option(names = ["--with-key-password"], paramLabel = "PASSWORD")
+    var withKeyPassword: String? = null
+
+    @Option(names = ["--profile"], paramLabel = "PROFILE") var profile: String? = null
+
+    @Option(names = ["--signing-only"]) var signingOnly: Boolean = false
+
+    override fun run() {
+        val generateKey =
+            throwIfUnsupportedSubcommand(SopCLI.getSop().generateKey(), "generate-key")
+
+        profile?.let {
+            try {
+                generateKey.profile(it)
+            } catch (e: UnsupportedProfile) {
+                val errorMsg =
+                    getMsg("sop.error.usage.profile_not_supported", "generate-key", profile!!)
+                throw UnsupportedProfile(errorMsg, e)
+            }
+        }
+
+        if (signingOnly) {
+            generateKey.signingOnly()
+        }
+
+        for (userId in userId) {
+            generateKey.userId(userId)
+        }
+
+        if (!armor) {
+            generateKey.noArmor()
+        }
+
+        withKeyPassword?.let {
+            try {
+                val password = stringFromInputStream(getInput(it))
+                generateKey.withKeyPassword(password)
+            } catch (e: UnsupportedOption) {
+                val errorMsg =
+                    getMsg("sop.error.feature_support.option_not_supported", "--with-key-password")
+                throw UnsupportedOption(errorMsg, e)
+            } catch (e: IOException) {
+                throw RuntimeException(e)
+            }
+        }
+
+        try {
+            val ready = generateKey.generate()
+            ready.writeTo(System.out)
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}

sop-java-picocli/src/main/kotlin/sop/cli/picocli/commands/InlineDetachCmd.kt

@@ -0,0 +1,47 @@
+// SPDX-FileCopyrightText: 2023 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands
+
+import java.io.IOException
+import java.lang.RuntimeException
+import picocli.CommandLine.Command
+import picocli.CommandLine.Option
+import sop.cli.picocli.SopCLI
+import sop.exception.SOPGPException
+
+@Command(
+    name = "inline-detach",
+    resourceBundle = "msg_inline-detach",
+    exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
+class InlineDetachCmd : AbstractSopCmd() {
+
+    @Option(names = ["--signatures-out"], paramLabel = "SIGNATURES")
+    var signaturesOut: String? = null
+
+    @Option(names = ["--no-armor"], negatable = true) var armor: Boolean = true
+
+    override fun run() {
+        val inlineDetach =
+            throwIfUnsupportedSubcommand(SopCLI.getSop().inlineDetach(), "inline-detach")
+
+        throwIfOutputExists(signaturesOut)
+        throwIfMissingArg(signaturesOut, "--signatures-out")
+
+        if (!armor) {
+            inlineDetach.noArmor()
+        }
+
+        try {
+            getOutput(signaturesOut).use { sigOut ->
+                inlineDetach
+                    .message(System.`in`)
+                    .writeTo(System.out) // message out
+                    .writeTo(sigOut) // signatures out
+            }
+        } catch (e: IOException) {
+            throw RuntimeException(e)
+        }
+    }
+}