added GraalVM native image executable build

rbcs-client/src/main/kotlin/net/woggioni/rbcs/client/Client.kt

@@ -37,6 +37,7 @@ import io.netty.util.concurrent.Future
 import io.netty.util.concurrent.GenericFutureListener
 import net.woggioni.rbcs.api.CacheValueMetadata
 import net.woggioni.rbcs.client.impl.Parser
+import net.woggioni.rbcs.common.RBCS.loadKeystore
 import net.woggioni.rbcs.common.Xml
 import net.woggioni.rbcs.common.createLogger
 import net.woggioni.rbcs.common.debug
@@ -54,6 +55,8 @@ import java.util.concurrent.CompletableFuture
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.TimeoutException
 import java.util.concurrent.atomic.AtomicInteger
+import javax.net.ssl.TrustManagerFactory
+import javax.net.ssl.X509TrustManager
 import kotlin.random.Random
 import io.netty.util.concurrent.Future as NettyFuture
 
@@ -63,7 +66,7 @@ class RemoteBuildCacheClient(private val profile: Configuration.Profile) : AutoC
     }
 
     private val group: NioEventLoopGroup
-    private var sslContext: SslContext
+    private val sslContext: SslContext
     private val pool: ChannelPool
 
     data class Configuration(
@@ -78,6 +81,13 @@ class RemoteBuildCacheClient(private val profile: Configuration.Profile) : AutoC
             data class BasicAuthenticationCredentials(val username: String, val password: String) : Authentication()
         }
 
+        class TrustStore (
+            var file: Path?,
+            var password: String?,
+            var checkCertificateStatus: Boolean = false,
+            var verifyServerCertificate: Boolean = true,
+        )
+
         class RetryPolicy(
             val maxAttempts: Int,
             val initialDelayMillis: Long,
@@ -100,6 +110,7 @@ class RemoteBuildCacheClient(private val profile: Configuration.Profile) : AutoC
             val maxConnections: Int,
             val compressionEnabled: Boolean,
             val retryPolicy: RetryPolicy?,
+            val tlsTruststore : TrustStore?
         )
 
         companion object {
@@ -115,10 +126,33 @@ class RemoteBuildCacheClient(private val profile: Configuration.Profile) : AutoC
         group = NioEventLoopGroup()
         sslContext = SslContextBuilder.forClient().also { builder ->
             (profile.authentication as? Configuration.Authentication.TlsClientAuthenticationCredentials)?.let { tlsClientAuthenticationCredentials ->
-                builder.keyManager(
-                    tlsClientAuthenticationCredentials.key,
-                    *tlsClientAuthenticationCredentials.certificateChain
-                )
+                builder.apply {
+                    keyManager(
+                        tlsClientAuthenticationCredentials.key,
+                        *tlsClientAuthenticationCredentials.certificateChain
+                    )
+                    profile.tlsTruststore?.let { trustStore ->
+                        if(!trustStore.verifyServerCertificate) {
+                            trustManager(object : X509TrustManager {
+                                override fun checkClientTrusted(certChain: Array<out X509Certificate>, p1: String?) {
+                                }
+
+                                override fun checkServerTrusted(certChain: Array<out X509Certificate>, p1: String?) {
+                                }
+
+                                override fun getAcceptedIssuers() = null
+                            })
+                        } else {
+                            trustStore.file?.let {
+                                val ts = loadKeystore(it, trustStore.password)
+                                val trustManagerFactory: TrustManagerFactory =
+                                    TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
+                                trustManagerFactory.init(ts)
+                                trustManager(trustManagerFactory)
+                            }
+                        }
+                    }
+                }
             }
         }.build()
 

rbcs-client/src/main/kotlin/net/woggioni/rbcs/client/impl/Parser.kt

@@ -31,6 +31,7 @@ object Parser {
                     var authentication: RemoteBuildCacheClient.Configuration.Authentication? = null
                     var retryPolicy: RemoteBuildCacheClient.Configuration.RetryPolicy? = null
                     var connection : RemoteBuildCacheClient.Configuration.Connection? = null
+                    var trustStore : RemoteBuildCacheClient.Configuration.TrustStore? = null
                     for (gchild in child.asIterable()) {
                         when (gchild.localName) {
                             "tls-client-auth" -> {
@@ -108,6 +109,17 @@ object Parser {
                                     writeIdleTimeout,
                                 )
                             }
+
+                            "tls-trust-store" -> {
+                                val file = gchild.renderAttribute("file")
+                                    ?.let(Path::of)
+                                val password = gchild.renderAttribute("password")
+                                val checkCertificateStatus = gchild.renderAttribute("check-certificate-status")
+                                    ?.let(String::toBoolean) ?: false
+                                val verifyServerCertificate = gchild.renderAttribute("verify-server-certificate")
+                                    ?.let(String::toBoolean) ?: true
+                                trustStore = RemoteBuildCacheClient.Configuration.TrustStore(file, password, checkCertificateStatus, verifyServerCertificate)
+                            }
                         }
                     }
                     val maxConnections = child.renderAttribute("max-connections")
@@ -126,7 +138,8 @@ object Parser {
                         connectionTimeout,
                         maxConnections,
                         compressionEnabled,
-                        retryPolicy
+                        retryPolicy,
+                        trustStore
                     )
                 }
             }

rbcs-client/src/main/resources/net/woggioni/rbcs/client/schema/rbcs-client.xsd

@@ -21,6 +21,7 @@
             </xs:choice>
             <xs:element name="connection" type="rbcs-client:connectionType" minOccurs="0" />
             <xs:element name="retry-policy" type="rbcs-client:retryType" minOccurs="0"/>
+            <xs:element name="tls-trust-store" type="rbcs-client:trustStoreType" minOccurs="0"/>
         </xs:sequence>
         <xs:attribute name="name" type="xs:token" use="required"/>
         <xs:attribute name="base-url" type="xs:anyURI" use="required"/>
@@ -57,4 +58,34 @@
         <xs:attribute name="exp" type="xs:double" default="2.0"/>
     </xs:complexType>
 
+    <xs:complexType name="trustStoreType">
+        <xs:attribute name="file" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    Path to the trustore file
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="password" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    Trustore file password
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="check-certificate-status" type="xs:boolean">
+            <xs:annotation>
+                <xs:documentation>
+                    Whether or not check the certificate validity using CRL/OCSP
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="verify-server-certificate" type="xs:boolean" use="optional" default="true">
+            <xs:annotation>
+                <xs:documentation>
+                    If false, the client will blindly trust the provided server certificate
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
 </xs:schema>

rbcs-client/src/test/resources/net/woggioni/rbcs/client/test/rbcs-client.xml

@@ -9,6 +9,8 @@
                 key-store-password="password"
                 key-alias="woggioni@c962475fa38"
                 key-password="key-password"/>
+        <connection write-idle-timeout="PT60S" read-idle-timeout="PT60S" write-timeout="PT0S" read-timeout="PT0S" idle-timeout="PT30S" />
+        <tls-trust-store file="file.pfx" password="password" check-certificate-status="false" verify-server-certificate="true"/>
     </profile>
     <profile name="profile2" base-url="https://rbcs2.example.com/">
         <basic-auth user="user" password="password"/>