Initial commit

sop-java-picocli/src/main/java/sop/cli/picocli/DateParser.java

@@ -0,0 +1,33 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli;
+
+import java.util.Date;
+
+import sop.util.UTCUtil;
+
+public class DateParser {
+
+    public static final Date BEGINNING_OF_TIME = new Date(0);
+    public static final Date END_OF_TIME = new Date(8640000000000000L);
+
+    public static Date parseNotAfter(String notAfter) {
+        Date date = notAfter.equals("now") ? new Date() : notAfter.equals("-") ? END_OF_TIME : UTCUtil.parseUTCDate(notAfter);
+        if (date == null) {
+            Print.errln("Invalid date string supplied as value of --not-after.");
+            System.exit(1);
+        }
+        return date;
+    }
+
+    public static Date parseNotBefore(String notBefore) {
+        Date date = notBefore.equals("now") ? new Date() : notBefore.equals("-") ? BEGINNING_OF_TIME : UTCUtil.parseUTCDate(notBefore);
+        if (date == null) {
+            Print.errln("Invalid date string supplied as value of --not-before.");
+            System.exit(1);
+        }
+        return date;
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/FileUtil.java

@@ -0,0 +1,98 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+
+import sop.exception.SOPGPException;
+
+public class FileUtil {
+
+    private static final String ERROR_AMBIGUOUS = "File name '%s' is ambiguous. File with the same name exists on the filesystem.";
+    private static final String ERROR_ENV_FOUND = "Environment variable '%s' not set.";
+    private static final String ERROR_OUTPUT_EXISTS = "Output file '%s' already exists.";
+    private static final String ERROR_INPUT_NOT_EXIST = "File '%s' does not exist.";
+    private static final String ERROR_CANNOT_CREATE_FILE = "Output file '%s' cannot be created: %s";
+
+    public static final String PRFX_ENV = "@ENV:";
+    public static final String PRFX_FD = "@FD:";
+
+    private static EnvironmentVariableResolver envResolver = System::getenv;
+
+    public static void setEnvironmentVariableResolver(EnvironmentVariableResolver envResolver) {
+        if (envResolver == null) {
+            throw new NullPointerException("Variable envResolver cannot be null.");
+        }
+        FileUtil.envResolver = envResolver;
+    }
+
+    public interface EnvironmentVariableResolver {
+        /**
+         * Resolve the value of the given environment variable.
+         * Return null if the variable is not present.
+         *
+         * @param name name of the variable
+         * @return variable value or null
+         */
+        String resolveEnvironmentVariable(String name);
+    }
+
+    public static File getFile(String fileName) {
+        if (fileName == null) {
+            throw new NullPointerException("File name cannot be null.");
+        }
+
+        if (fileName.startsWith(PRFX_ENV)) {
+
+            if (new File(fileName).exists()) {
+                throw new SOPGPException.AmbiguousInput(String.format(ERROR_AMBIGUOUS, fileName));
+            }
+
+            String envName = fileName.substring(PRFX_ENV.length());
+            String envValue = envResolver.resolveEnvironmentVariable(envName);
+            if (envValue == null) {
+                throw new IllegalArgumentException(String.format(ERROR_ENV_FOUND, envName));
+            }
+            return new File(envValue);
+        } else if (fileName.startsWith(PRFX_FD)) {
+
+            if (new File(fileName).exists()) {
+                throw new SOPGPException.AmbiguousInput(String.format(ERROR_AMBIGUOUS, fileName));
+            }
+
+            throw new IllegalArgumentException("File descriptors not supported.");
+        }
+
+        return new File(fileName);
+    }
+
+    public static FileInputStream getFileInputStream(String fileName) {
+        File file = getFile(fileName);
+        try {
+            FileInputStream inputStream = new FileInputStream(file);
+            return inputStream;
+        } catch (FileNotFoundException e) {
+            throw new SOPGPException.MissingInput(String.format(ERROR_INPUT_NOT_EXIST, fileName), e);
+        }
+    }
+
+    public static File createNewFileOrThrow(File file) throws IOException {
+        if (file == null) {
+            throw new NullPointerException("File cannot be null.");
+        }
+
+        try {
+            if (!file.createNewFile()) {
+                throw new SOPGPException.OutputExists(String.format(ERROR_OUTPUT_EXISTS, file.getAbsolutePath()));
+            }
+        } catch (IOException e) {
+            throw new IOException(String.format(ERROR_CANNOT_CREATE_FILE, file.getAbsolutePath(), e.getMessage()));
+        }
+        return file;
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/Print.java

@@ -0,0 +1,26 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli;
+
+public class Print {
+
+    public static void errln(String string) {
+        // CHECKSTYLE:OFF
+        System.err.println(string);
+        // CHECKSTYLE:ON
+    }
+
+    public static void trace(Throwable e) {
+        // CHECKSTYLE:OFF
+        e.printStackTrace();
+        // CHECKSTYLE:ON
+    }
+
+    public static void outln(String string) {
+        // CHECKSTYLE:OFF
+        System.out.println(string);
+        // CHECKSTYLE:ON
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/SOPExceptionExitCodeMapper.java

@@ -0,0 +1,34 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli;
+
+import picocli.CommandLine;
+import sop.exception.SOPGPException;
+
+public class SOPExceptionExitCodeMapper implements CommandLine.IExitCodeExceptionMapper {
+
+    @Override
+    public int getExitCode(Throwable exception) {
+        if (exception instanceof SOPGPException) {
+            return ((SOPGPException) exception).getExitCode();
+        }
+        if (exception instanceof CommandLine.UnmatchedArgumentException) {
+            CommandLine.UnmatchedArgumentException ex = (CommandLine.UnmatchedArgumentException) exception;
+            // Unmatched option of subcommand (eg. `generate-key -k`)
+            if (ex.isUnknownOption()) {
+                return SOPGPException.UnsupportedOption.EXIT_CODE;
+            }
+            // Unmatched subcommand
+            return SOPGPException.UnsupportedSubcommand.EXIT_CODE;
+        }
+        // Invalid option (eg. `--label Invalid`)
+        if (exception instanceof CommandLine.ParameterException) {
+            return SOPGPException.UnsupportedOption.EXIT_CODE;
+        }
+
+        // Others, like IOException etc.
+        return 1;
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/SOPExecutionExceptionHandler.java

@@ -0,0 +1,26 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli;
+
+import picocli.CommandLine;
+
+public class SOPExecutionExceptionHandler implements CommandLine.IExecutionExceptionHandler {
+
+    @Override
+    public int handleExecutionException(Exception ex, CommandLine commandLine, CommandLine.ParseResult parseResult) {
+        int exitCode = commandLine.getExitCodeExceptionMapper() != null ?
+                commandLine.getExitCodeExceptionMapper().getExitCode(ex) :
+                commandLine.getCommandSpec().exitCodeOnExecutionException();
+        CommandLine.Help.ColorScheme colorScheme = commandLine.getColorScheme();
+        // CHECKSTYLE:OFF
+        if (ex.getMessage() != null) {
+            commandLine.getErr().println(colorScheme.errorText(ex.getMessage()));
+        }
+        ex.printStackTrace(commandLine.getErr());
+        // CHECKSTYLE:ON
+
+        return exitCode;
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/SopCLI.java

@@ -0,0 +1,68 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli;
+
+import picocli.CommandLine;
+import sop.SOP;
+import sop.cli.picocli.commands.ArmorCmd;
+import sop.cli.picocli.commands.DearmorCmd;
+import sop.cli.picocli.commands.DecryptCmd;
+import sop.cli.picocli.commands.DetachInbandSignatureAndMessageCmd;
+import sop.cli.picocli.commands.EncryptCmd;
+import sop.cli.picocli.commands.ExtractCertCmd;
+import sop.cli.picocli.commands.GenerateKeyCmd;
+import sop.cli.picocli.commands.SignCmd;
+import sop.cli.picocli.commands.VerifyCmd;
+import sop.cli.picocli.commands.VersionCmd;
+
+@CommandLine.Command(
+        exitCodeOnInvalidInput = 69,
+        subcommands = {
+                CommandLine.HelpCommand.class,
+                ArmorCmd.class,
+                DearmorCmd.class,
+                DecryptCmd.class,
+                DetachInbandSignatureAndMessageCmd.class,
+                EncryptCmd.class,
+                ExtractCertCmd.class,
+                GenerateKeyCmd.class,
+                SignCmd.class,
+                VerifyCmd.class,
+                VersionCmd.class
+        }
+)
+public class SopCLI {
+    // Singleton
+    static SOP SOP_INSTANCE;
+
+    public static String EXECUTABLE_NAME = "sop";
+
+    public static void main(String[] args) {
+        int exitCode = execute(args);
+        if (exitCode != 0) {
+            System.exit(exitCode);
+        }
+    }
+
+    public static int execute(String[] args) {
+        return new CommandLine(SopCLI.class)
+                .setCommandName(EXECUTABLE_NAME)
+                .setExecutionExceptionHandler(new SOPExecutionExceptionHandler())
+                .setExitCodeExceptionMapper(new SOPExceptionExitCodeMapper())
+                .setCaseInsensitiveEnumValuesAllowed(true)
+                .execute(args);
+    }
+
+    public static SOP getSop() {
+        if (SOP_INSTANCE == null) {
+            throw new IllegalStateException("No SOP backend set.");
+        }
+        return SOP_INSTANCE;
+    }
+
+    public static void setSopInstance(SOP instance) {
+        SOP_INSTANCE = instance;
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/ArmorCmd.java

@@ -0,0 +1,54 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.IOException;
+
+import picocli.CommandLine;
+import sop.Ready;
+import sop.cli.picocli.Print;
+import sop.cli.picocli.SopCLI;
+import sop.enums.ArmorLabel;
+import sop.exception.SOPGPException;
+import sop.operation.Armor;
+
+@CommandLine.Command(name = "armor",
+        description = "Add ASCII Armor to standard input",
+        exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
+public class ArmorCmd implements Runnable {
+
+    @CommandLine.Option(names = {"--label"}, description = "Label to be used in the header and tail of the armoring.", paramLabel = "{auto|sig|key|cert|message}")
+    ArmorLabel label;
+
+    @Override
+    public void run() {
+        Armor armor = SopCLI.getSop().armor();
+        if (armor == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'armor' not implemented.");
+        }
+
+        if (label != null) {
+            try {
+                armor.label(label);
+            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+                Print.errln("Armor labels not supported.");
+                System.exit(unsupportedOption.getExitCode());
+            }
+        }
+
+        try {
+            Ready ready = armor.data(System.in);
+            ready.writeTo(System.out);
+        } catch (SOPGPException.BadData badData) {
+            Print.errln("Bad data.");
+            Print.trace(badData);
+            System.exit(badData.getExitCode());
+        } catch (IOException e) {
+            Print.errln("IO Error.");
+            Print.trace(e);
+            System.exit(1);
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/DearmorCmd.java

@@ -0,0 +1,42 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.IOException;
+
+import picocli.CommandLine;
+import sop.cli.picocli.Print;
+import sop.cli.picocli.SopCLI;
+import sop.exception.SOPGPException;
+import sop.operation.Dearmor;
+
+@CommandLine.Command(name = "dearmor",
+        description = "Remove ASCII Armor from standard input",
+        exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
+public class DearmorCmd implements Runnable {
+
+    @Override
+    public void run() {
+        Dearmor dearmor = SopCLI.getSop().dearmor();
+        if (dearmor == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'dearmor' not implemented.");
+        }
+
+        try {
+            SopCLI.getSop()
+                    .dearmor()
+                    .data(System.in)
+                    .writeTo(System.out);
+        } catch (SOPGPException.BadData e) {
+            Print.errln("Bad data.");
+            Print.trace(e);
+            System.exit(e.getExitCode());
+        } catch (IOException e) {
+            Print.errln("IO Error.");
+            Print.trace(e);
+            System.exit(1);
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/DecryptCmd.java

@@ -0,0 +1,240 @@
+// SPDX-FileCopyrightText: 2020 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.regex.Pattern;
+
+import picocli.CommandLine;
+import sop.DecryptionResult;
+import sop.ReadyWithResult;
+import sop.SessionKey;
+import sop.Verification;
+import sop.cli.picocli.DateParser;
+import sop.cli.picocli.FileUtil;
+import sop.cli.picocli.SopCLI;
+import sop.exception.SOPGPException;
+import sop.operation.Decrypt;
+import sop.util.HexUtil;
+
+@CommandLine.Command(name = "decrypt",
+        description = "Decrypt a message from standard input",
+        exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
+public class DecryptCmd implements Runnable {
+
+    private static final String SESSION_KEY_OUT = "--session-key-out";
+    private static final String VERIFY_OUT = "--verify-out";
+
+    private static final String ERROR_UNSUPPORTED_OPTION = "Option '%s' is not supported.";
+    private static final String ERROR_FILE_NOT_EXIST = "File '%s' does not exist.";
+    private static final String ERROR_OUTPUT_OF_OPTION_EXISTS = "Target %s of option %s already exists.";
+
+    @CommandLine.Option(
+            names = {SESSION_KEY_OUT},
+            description = "Can be used to learn the session key on successful decryption",
+            paramLabel = "SESSIONKEY")
+    File sessionKeyOut;
+
+    @CommandLine.Option(
+            names = {"--with-session-key"},
+            description = "Enables decryption of the \"CIPHERTEXT\" using the session key directly against the \"SEIPD\" packet",
+            paramLabel = "SESSIONKEY")
+    List<String> withSessionKey = new ArrayList<>();
+
+    @CommandLine.Option(
+            names = {"--with-password"},
+            description = "Enables decryption based on any \"SKESK\" packets in the \"CIPHERTEXT\"",
+            paramLabel = "PASSWORD")
+    List<String> withPassword = new ArrayList<>();
+
+    @CommandLine.Option(names = {VERIFY_OUT},
+            description = "Produces signature verification status to the designated file",
+            paramLabel = "VERIFICATIONS")
+    File verifyOut;
+
+    @CommandLine.Option(names = {"--verify-with"},
+            description = "Certificates whose signatures would be acceptable for signatures over this message",
+            paramLabel = "CERT")
+    List<File> certs = new ArrayList<>();
+
+    @CommandLine.Option(names = {"--not-before"},
+            description = "ISO-8601 formatted UTC date (eg. '2020-11-23T16:35Z)\n" +
+                    "Reject signatures with a creation date not in range.\n" +
+                    "Defaults to beginning of time (\"-\").",
+            paramLabel = "DATE")
+    String notBefore = "-";
+
+    @CommandLine.Option(names = {"--not-after"},
+            description = "ISO-8601 formatted UTC date (eg. '2020-11-23T16:35Z)\n" +
+                    "Reject signatures with a creation date not in range.\n" +
+                    "Defaults to current system time (\"now\").\n" +
+                    "Accepts special value \"-\" for end of time.",
+            paramLabel = "DATE")
+    String notAfter = "now";
+
+    @CommandLine.Parameters(index = "0..*",
+            description = "Secret keys to attempt decryption with",
+            paramLabel = "KEY")
+    List<File> keys = new ArrayList<>();
+
+    @Override
+    public void run() {
+        throwIfOutputExists(verifyOut, VERIFY_OUT);
+        throwIfOutputExists(sessionKeyOut, SESSION_KEY_OUT);
+
+        Decrypt decrypt = SopCLI.getSop().decrypt();
+        if (decrypt == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'decrypt' not implemented.");
+        }
+
+        setNotAfter(notAfter, decrypt);
+        setNotBefore(notBefore, decrypt);
+        setWithPasswords(withPassword, decrypt);
+        setWithSessionKeys(withSessionKey, decrypt);
+        setVerifyWith(certs, decrypt);
+        setDecryptWith(keys, decrypt);
+
+        if (verifyOut != null && certs.isEmpty()) {
+            String errorMessage = "Option %s is requested, but no option %s was provided.";
+            throw new SOPGPException.IncompleteVerification(String.format(errorMessage, VERIFY_OUT, "--verify-with"));
+        }
+
+        try {
+            ReadyWithResult<DecryptionResult> ready = decrypt.ciphertext(System.in);
+            DecryptionResult result = ready.writeTo(System.out);
+            writeSessionKeyOut(result);
+            writeVerifyOut(result);
+        } catch (SOPGPException.BadData badData) {
+            throw new SOPGPException.BadData("No valid OpenPGP message found on Standard Input.", badData);
+        } catch (IOException ioException) {
+            throw new RuntimeException(ioException);
+        }
+    }
+
+    private void throwIfOutputExists(File outputFile, String optionName) {
+        if (outputFile == null) {
+            return;
+        }
+
+        if (outputFile.exists()) {
+            throw new SOPGPException.OutputExists(String.format(ERROR_OUTPUT_OF_OPTION_EXISTS, outputFile.getAbsolutePath(), optionName));
+        }
+    }
+
+    private void writeVerifyOut(DecryptionResult result) throws IOException {
+        if (verifyOut != null) {
+            FileUtil.createNewFileOrThrow(verifyOut);
+            try (FileOutputStream outputStream = new FileOutputStream(verifyOut)) {
+                PrintWriter writer = new PrintWriter(outputStream);
+                for (Verification verification : result.getVerifications()) {
+                    // CHECKSTYLE:OFF
+                    writer.println(verification.toString());
+                    // CHECKSTYLE:ON
+                }
+                writer.flush();
+            }
+        }
+    }
+
+    private void writeSessionKeyOut(DecryptionResult result) throws IOException {
+        if (sessionKeyOut != null) {
+            FileUtil.createNewFileOrThrow(sessionKeyOut);
+
+            try (FileOutputStream outputStream = new FileOutputStream(sessionKeyOut)) {
+                if (!result.getSessionKey().isPresent()) {
+                    throw new SOPGPException.UnsupportedOption("Session key not extracted. Possibly the feature --session-key-out is not supported.");
+                } else {
+                    SessionKey sessionKey = result.getSessionKey().get();
+                    outputStream.write(sessionKey.getAlgorithm());
+                    outputStream.write(sessionKey.getKey());
+                }
+            }
+        }
+    }
+
+    private void setDecryptWith(List<File> keys, Decrypt decrypt) {
+        for (File key : keys) {
+            try (FileInputStream keyIn = new FileInputStream(key)) {
+                decrypt.withKey(keyIn);
+            } catch (SOPGPException.KeyIsProtected keyIsProtected) {
+                throw new SOPGPException.KeyIsProtected("Key in file " + key.getAbsolutePath() + " is password protected.", keyIsProtected);
+            } catch (SOPGPException.BadData badData) {
+                throw new SOPGPException.BadData("File " + key.getAbsolutePath() + " does not contain a private key.", badData);
+            } catch (FileNotFoundException e) {
+                throw new SOPGPException.MissingInput(String.format(ERROR_FILE_NOT_EXIST, key.getAbsolutePath()), e);
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
+    private void setVerifyWith(List<File> certs, Decrypt decrypt) {
+        for (File cert : certs) {
+            try (FileInputStream certIn = new FileInputStream(cert)) {
+                decrypt.verifyWithCert(certIn);
+            } catch (FileNotFoundException e) {
+                throw new SOPGPException.MissingInput(String.format(ERROR_FILE_NOT_EXIST, cert.getAbsolutePath()), e);
+            } catch (SOPGPException.BadData badData) {
+                throw new SOPGPException.BadData("File " + cert.getAbsolutePath() + " does not contain a valid certificate.", badData);
+            } catch (IOException ioException) {
+                throw new RuntimeException(ioException);
+            }
+        }
+    }
+
+    private void setWithSessionKeys(List<String> withSessionKey, Decrypt decrypt) {
+        Pattern sessionKeyPattern = Pattern.compile("^\\d+:[0-9A-F]+$");
+        for (String sessionKey : withSessionKey) {
+            if (!sessionKeyPattern.matcher(sessionKey).matches()) {
+                throw new IllegalArgumentException("Session keys are expected in the format 'ALGONUM:HEXKEY'.");
+            }
+            String[] split = sessionKey.split(":");
+            byte algorithm = (byte) Integer.parseInt(split[0]);
+            byte[] key = HexUtil.hexToBytes(split[1]);
+
+            try {
+                decrypt.withSessionKey(new SessionKey(algorithm, key));
+            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+                throw new SOPGPException.UnsupportedOption(String.format(ERROR_UNSUPPORTED_OPTION, "--with-session-key"), unsupportedOption);
+            }
+        }
+    }
+
+    private void setWithPasswords(List<String> withPassword, Decrypt decrypt) {
+        for (String password : withPassword) {
+            try {
+                decrypt.withPassword(password);
+            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+                throw new SOPGPException.UnsupportedOption(String.format(ERROR_UNSUPPORTED_OPTION, "--with-password"), unsupportedOption);
+            }
+        }
+    }
+
+    private void setNotAfter(String notAfter, Decrypt decrypt) {
+        Date notAfterDate = DateParser.parseNotAfter(notAfter);
+        try {
+            decrypt.verifyNotAfter(notAfterDate);
+        } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+            throw new SOPGPException.UnsupportedOption(String.format(ERROR_UNSUPPORTED_OPTION, "--not-after"), unsupportedOption);
+        }
+    }
+
+    private void setNotBefore(String notBefore, Decrypt decrypt) {
+        Date notBeforeDate = DateParser.parseNotBefore(notBefore);
+        try {
+            decrypt.verifyNotBefore(notBeforeDate);
+        } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+            throw new SOPGPException.UnsupportedOption(String.format(ERROR_UNSUPPORTED_OPTION, "--not-before"), unsupportedOption);
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/DetachInbandSignatureAndMessageCmd.java

@@ -0,0 +1,59 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+
+import picocli.CommandLine;
+import sop.Signatures;
+import sop.cli.picocli.SopCLI;
+import sop.exception.SOPGPException;
+import sop.operation.DetachInbandSignatureAndMessage;
+
+@CommandLine.Command(name = "detach-inband-signature-and-message",
+        description = "Split a clearsigned message",
+        exitCodeOnInvalidInput = SOPGPException.UnsupportedOption.EXIT_CODE)
+public class DetachInbandSignatureAndMessageCmd implements Runnable {
+
+    @CommandLine.Option(
+            names = {"--signatures-out"},
+            description = "Destination to which a detached signatures block will be written",
+            paramLabel = "SIGNATURES")
+    File signaturesOut;
+
+    @CommandLine.Option(names = "--no-armor",
+            description = "ASCII armor the output",
+            negatable = true)
+    boolean armor = true;
+
+    @Override
+    public void run() {
+        DetachInbandSignatureAndMessage detach = SopCLI.getSop().detachInbandSignatureAndMessage();
+        if (detach == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'detach-inband-signature-and-message' not implemented.");
+        }
+
+        if (signaturesOut == null) {
+            throw new SOPGPException.MissingArg("--signatures-out is required.");
+        }
+
+        if (!armor) {
+            detach.noArmor();
+        }
+
+        try {
+            Signatures signatures = detach
+                    .message(System.in).writeTo(System.out);
+            if (!signaturesOut.createNewFile()) {
+                throw new SOPGPException.OutputExists("Destination of --signatures-out already exists.");
+            }
+            signatures.writeTo(new FileOutputStream(signaturesOut));
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/EncryptCmd.java

@@ -0,0 +1,123 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import picocli.CommandLine;
+import sop.Ready;
+import sop.cli.picocli.SopCLI;
+import sop.enums.EncryptAs;
+import sop.exception.SOPGPException;
+import sop.operation.Encrypt;
+
+@CommandLine.Command(name = "encrypt",
+        description = "Encrypt a message from standard input",
+        exitCodeOnInvalidInput = 37)
+public class EncryptCmd implements Runnable {
+
+    @CommandLine.Option(names = "--no-armor",
+            description = "ASCII armor the output",
+            negatable = true)
+    boolean armor = true;
+
+    @CommandLine.Option(names = {"--as"},
+            description = "Type of the input data. Defaults to 'binary'",
+            paramLabel = "{binary|text|mime}")
+    EncryptAs type;
+
+    @CommandLine.Option(names = "--with-password",
+            description = "Encrypt the message with a password",
+            paramLabel = "PASSWORD")
+    List<String> withPassword = new ArrayList<>();
+
+    @CommandLine.Option(names = "--sign-with",
+            description = "Sign the output with a private key",
+            paramLabel = "KEY")
+    List<File> signWith = new ArrayList<>();
+
+    @CommandLine.Parameters(description = "Certificates the message gets encrypted to",
+            index = "0..*",
+            paramLabel = "CERTS")
+    List<File> certs = new ArrayList<>();
+
+    @Override
+    public void run() {
+        Encrypt encrypt = SopCLI.getSop().encrypt();
+        if (encrypt == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'encrypt' not implemented.");
+        }
+
+        if (type != null) {
+            try {
+                encrypt.mode(type);
+            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+                throw new SOPGPException.UnsupportedOption("Unsupported option '--as'.", unsupportedOption);
+            }
+        }
+
+        if (withPassword.isEmpty() && certs.isEmpty()) {
+            throw new SOPGPException.MissingArg("At least one password or cert file required for encryption.");
+        }
+
+        for (String password : withPassword) {
+            try {
+                encrypt.withPassword(password);
+            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+                throw new SOPGPException.UnsupportedOption("Unsupported option '--with-password'.", unsupportedOption);
+            }
+        }
+
+        for (File keyFile : signWith) {
+            try (FileInputStream keyIn = new FileInputStream(keyFile)) {
+                encrypt.signWith(keyIn);
+            } catch (FileNotFoundException e) {
+                throw new SOPGPException.MissingInput("Key file " + keyFile.getAbsolutePath() + " not found.", e);
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            } catch (SOPGPException.KeyIsProtected keyIsProtected) {
+                throw new SOPGPException.KeyIsProtected("Key from " + keyFile.getAbsolutePath() + " is password protected.", keyIsProtected);
+            } catch (SOPGPException.UnsupportedAsymmetricAlgo unsupportedAsymmetricAlgo) {
+                throw new SOPGPException.UnsupportedAsymmetricAlgo("Key from " + keyFile.getAbsolutePath() + " has unsupported asymmetric algorithm.", unsupportedAsymmetricAlgo);
+            } catch (SOPGPException.KeyCannotSign keyCannotSign) {
+                throw new SOPGPException.KeyCannotSign("Key from " + keyFile.getAbsolutePath() + " cannot sign.", keyCannotSign);
+            } catch (SOPGPException.BadData badData) {
+                throw new SOPGPException.BadData("Key file " + keyFile.getAbsolutePath() + " does not contain a valid OpenPGP private key.", badData);
+            }
+        }
+
+        for (File certFile : certs) {
+            try (FileInputStream certIn = new FileInputStream(certFile)) {
+                encrypt.withCert(certIn);
+            } catch (FileNotFoundException e) {
+                throw new SOPGPException.MissingInput("Certificate file " + certFile.getAbsolutePath() + " not found.", e);
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            } catch (SOPGPException.UnsupportedAsymmetricAlgo unsupportedAsymmetricAlgo) {
+                throw new SOPGPException.UnsupportedAsymmetricAlgo("Certificate from " + certFile.getAbsolutePath() + " has unsupported asymmetric algorithm.", unsupportedAsymmetricAlgo);
+            } catch (SOPGPException.CertCannotEncrypt certCannotEncrypt) {
+                throw new SOPGPException.CertCannotEncrypt("Certificate from " + certFile.getAbsolutePath() + " is not capable of encryption.", certCannotEncrypt);
+            } catch (SOPGPException.BadData badData) {
+                throw new SOPGPException.BadData("Certificate file " + certFile.getAbsolutePath() + " does not contain a valid OpenPGP certificate.", badData);
+            }
+        }
+
+        if (!armor) {
+            encrypt.noArmor();
+        }
+
+        try {
+            Ready ready = encrypt.plaintext(System.in);
+            ready.writeTo(System.out);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/ExtractCertCmd.java

@@ -0,0 +1,45 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.IOException;
+
+import picocli.CommandLine;
+import sop.Ready;
+import sop.cli.picocli.SopCLI;
+import sop.exception.SOPGPException;
+import sop.operation.ExtractCert;
+
+@CommandLine.Command(name = "extract-cert",
+        description = "Extract a public key certificate from a secret key from standard input",
+        exitCodeOnInvalidInput = 37)
+public class ExtractCertCmd implements Runnable {
+
+    @CommandLine.Option(names = "--no-armor",
+            description = "ASCII armor the output",
+            negatable = true)
+    boolean armor = true;
+
+    @Override
+    public void run() {
+        ExtractCert extractCert = SopCLI.getSop().extractCert();
+        if (extractCert == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'extract-cert' not implemented.");
+        }
+
+        if (!armor) {
+            extractCert.noArmor();
+        }
+
+        try {
+            Ready ready = extractCert.key(System.in);
+            ready.writeTo(System.out);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        } catch (SOPGPException.BadData badData) {
+            throw new SOPGPException.BadData("Standard Input does not contain valid OpenPGP private key material.", badData);
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/GenerateKeyCmd.java

@@ -0,0 +1,63 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import picocli.CommandLine;
+import sop.Ready;
+import sop.cli.picocli.Print;
+import sop.cli.picocli.SopCLI;
+import sop.exception.SOPGPException;
+import sop.operation.GenerateKey;
+
+@CommandLine.Command(name = "generate-key",
+        description = "Generate a secret key",
+        exitCodeOnInvalidInput = 37)
+public class GenerateKeyCmd implements Runnable {
+
+    @CommandLine.Option(names = "--no-armor",
+            description = "ASCII armor the output",
+            negatable = true)
+    boolean armor = true;
+
+    @CommandLine.Parameters(description = "User-ID, eg. \"Alice <alice@example.com>\"")
+    List<String> userId = new ArrayList<>();
+
+    @Override
+    public void run() {
+        GenerateKey generateKey = SopCLI.getSop().generateKey();
+        if (generateKey == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'generate-key' not implemented.");
+        }
+
+        for (String userId : userId) {
+            generateKey.userId(userId);
+        }
+
+        if (!armor) {
+            generateKey.noArmor();
+        }
+
+        try {
+            Ready ready = generateKey.generate();
+            ready.writeTo(System.out);
+        } catch (SOPGPException.MissingArg missingArg) {
+            Print.errln("Missing argument.");
+            Print.trace(missingArg);
+            System.exit(missingArg.getExitCode());
+        } catch (SOPGPException.UnsupportedAsymmetricAlgo unsupportedAsymmetricAlgo) {
+            Print.errln("Unsupported asymmetric algorithm.");
+            Print.trace(unsupportedAsymmetricAlgo);
+            System.exit(unsupportedAsymmetricAlgo.getExitCode());
+        } catch (IOException e) {
+            Print.errln("IO Error.");
+            Print.trace(e);
+            System.exit(1);
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/SignCmd.java

@@ -0,0 +1,121 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import picocli.CommandLine;
+import sop.MicAlg;
+import sop.ReadyWithResult;
+import sop.SigningResult;
+import sop.cli.picocli.Print;
+import sop.cli.picocli.SopCLI;
+import sop.enums.SignAs;
+import sop.exception.SOPGPException;
+import sop.operation.Sign;
+
+@CommandLine.Command(name = "sign",
+        description = "Create a detached signature on the data from standard input",
+        exitCodeOnInvalidInput = 37)
+public class SignCmd implements Runnable {
+
+    @CommandLine.Option(names = "--no-armor",
+            description = "ASCII armor the output",
+            negatable = true)
+    boolean armor = true;
+
+    @CommandLine.Option(names = "--as", description = "Defaults to 'binary'. If '--as=text' and the input data is not valid UTF-8, sign fails with return code 53.",
+            paramLabel = "{binary|text}")
+    SignAs type;
+
+    @CommandLine.Parameters(description = "Secret keys used for signing",
+            paramLabel = "KEYS")
+    List<File> secretKeyFile = new ArrayList<>();
+
+    @CommandLine.Option(names = "--micalg-out", description = "Emits the digest algorithm used to the specified file in a way that can be used to populate the micalg parameter for the PGP/MIME Content-Type (RFC3156)",
+            paramLabel = "MICALG")
+    File micAlgOut;
+
+    @Override
+    public void run() {
+        Sign sign = SopCLI.getSop().sign();
+        if (sign == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'sign' not implemented.");
+        }
+
+        if (type != null) {
+            try {
+                sign.mode(type);
+            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+                Print.errln("Unsupported option '--as'");
+                Print.trace(unsupportedOption);
+                System.exit(unsupportedOption.getExitCode());
+            }
+        }
+
+        if (micAlgOut != null && micAlgOut.exists()) {
+            throw new SOPGPException.OutputExists(String.format("Target %s of option %s already exists.", micAlgOut.getAbsolutePath(), "--micalg-out"));
+        }
+
+        if (secretKeyFile.isEmpty()) {
+            Print.errln("Missing required parameter 'KEYS'.");
+            System.exit(19);
+        }
+
+        for (File keyFile : secretKeyFile) {
+            try (FileInputStream keyIn = new FileInputStream(keyFile)) {
+                sign.key(keyIn);
+            } catch (FileNotFoundException e) {
+                Print.errln("File " + keyFile.getAbsolutePath() + " does not exist.");
+                Print.trace(e);
+                System.exit(1);
+            } catch (IOException e) {
+                Print.errln("Cannot access file " + keyFile.getAbsolutePath());
+                Print.trace(e);
+                System.exit(1);
+            } catch (SOPGPException.KeyIsProtected e) {
+                Print.errln("Key " + keyFile.getName() + " is password protected.");
+                Print.trace(e);
+                System.exit(1);
+            } catch (SOPGPException.BadData badData) {
+                Print.errln("Bad data in key file " + keyFile.getAbsolutePath() + ":");
+                Print.trace(badData);
+                System.exit(badData.getExitCode());
+            }
+        }
+
+        if (!armor) {
+            sign.noArmor();
+        }
+
+        try {
+            ReadyWithResult<SigningResult> ready = sign.data(System.in);
+            SigningResult result = ready.writeTo(System.out);
+
+            MicAlg micAlg = result.getMicAlg();
+            if (micAlgOut != null) {
+                // Write micalg out
+                micAlgOut.createNewFile();
+                FileOutputStream micAlgOutStream = new FileOutputStream(micAlgOut);
+                micAlg.writeTo(micAlgOutStream);
+                micAlgOutStream.close();
+            }
+        } catch (IOException e) {
+            Print.errln("IO Error.");
+            Print.trace(e);
+            System.exit(1);
+        } catch (SOPGPException.ExpectedText expectedText) {
+            Print.errln("Expected text input, but got binary data.");
+            Print.trace(expectedText);
+            System.exit(expectedText.getExitCode());
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/VerifyCmd.java

@@ -0,0 +1,136 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import picocli.CommandLine;
+import sop.Verification;
+import sop.cli.picocli.DateParser;
+import sop.cli.picocli.Print;
+import sop.cli.picocli.SopCLI;
+import sop.exception.SOPGPException;
+import sop.operation.Verify;
+
+@CommandLine.Command(name = "verify",
+        description = "Verify a detached signature over the data from standard input",
+        exitCodeOnInvalidInput = 37)
+public class VerifyCmd implements Runnable {
+
+    @CommandLine.Parameters(index = "0",
+            description = "Detached signature",
+            paramLabel = "SIGNATURE")
+    File signature;
+
+    @CommandLine.Parameters(index = "1..*",
+            arity = "1..*",
+            description = "Public key certificates",
+            paramLabel = "CERT")
+    List<File> certificates = new ArrayList<>();
+
+    @CommandLine.Option(names = {"--not-before"},
+            description = "ISO-8601 formatted UTC date (eg. '2020-11-23T16:35Z)\n" +
+                    "Reject signatures with a creation date not in range.\n" +
+                    "Defaults to beginning of time (\"-\").",
+            paramLabel = "DATE")
+    String notBefore = "-";
+
+    @CommandLine.Option(names = {"--not-after"},
+            description = "ISO-8601 formatted UTC date (eg. '2020-11-23T16:35Z)\n" +
+                    "Reject signatures with a creation date not in range.\n" +
+                    "Defaults to current system time (\"now\").\n" +
+                    "Accepts special value \"-\" for end of time.",
+            paramLabel = "DATE")
+    String notAfter = "now";
+
+    @Override
+    public void run() {
+        Verify verify = SopCLI.getSop().verify();
+        if (verify == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'verify' not implemented.");
+        }
+
+        if (notAfter != null) {
+            try {
+                verify.notAfter(DateParser.parseNotAfter(notAfter));
+            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+                Print.errln("Unsupported option '--not-after'.");
+                Print.trace(unsupportedOption);
+                System.exit(unsupportedOption.getExitCode());
+            }
+        }
+        if (notBefore != null) {
+            try {
+                verify.notBefore(DateParser.parseNotBefore(notBefore));
+            } catch (SOPGPException.UnsupportedOption unsupportedOption) {
+                Print.errln("Unsupported option '--not-before'.");
+                Print.trace(unsupportedOption);
+                System.exit(unsupportedOption.getExitCode());
+            }
+        }
+
+        for (File certFile : certificates) {
+            try (FileInputStream certIn = new FileInputStream(certFile)) {
+                verify.cert(certIn);
+            } catch (FileNotFoundException fileNotFoundException) {
+                Print.errln("Certificate file " + certFile.getAbsolutePath() + " not found.");
+
+                Print.trace(fileNotFoundException);
+                System.exit(1);
+            } catch (IOException ioException) {
+                Print.errln("IO Error.");
+                Print.trace(ioException);
+                System.exit(1);
+            } catch (SOPGPException.BadData badData) {
+                Print.errln("Certificate file " + certFile.getAbsolutePath() + " appears to not contain a valid OpenPGP certificate.");
+                Print.trace(badData);
+                System.exit(badData.getExitCode());
+            }
+        }
+
+        if (signature != null) {
+            try (FileInputStream sigIn = new FileInputStream(signature)) {
+                verify.signatures(sigIn);
+            } catch (FileNotFoundException e) {
+                Print.errln("Signature file " + signature.getAbsolutePath() + " does not exist.");
+                Print.trace(e);
+                System.exit(1);
+            } catch (IOException e) {
+                Print.errln("IO Error.");
+                Print.trace(e);
+                System.exit(1);
+            } catch (SOPGPException.BadData badData) {
+                Print.errln("File " + signature.getAbsolutePath() + " does not contain a valid OpenPGP signature.");
+                Print.trace(badData);
+                System.exit(badData.getExitCode());
+            }
+        }
+
+        List<Verification> verifications = null;
+        try {
+            verifications = verify.data(System.in);
+        } catch (SOPGPException.NoSignature e) {
+            Print.errln("No verifiable signature found.");
+            Print.trace(e);
+            System.exit(e.getExitCode());
+        } catch (IOException ioException) {
+            Print.errln("IO Error.");
+            Print.trace(ioException);
+            System.exit(1);
+        } catch (SOPGPException.BadData badData) {
+            Print.errln("Standard Input appears not to contain a valid OpenPGP message.");
+            Print.trace(badData);
+            System.exit(badData.getExitCode());
+        }
+        for (Verification verification : verifications) {
+            Print.outln(verification.toString());
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/VersionCmd.java

@@ -0,0 +1,52 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package sop.cli.picocli.commands;
+
+import picocli.CommandLine;
+import sop.cli.picocli.Print;
+import sop.cli.picocli.SopCLI;
+import sop.exception.SOPGPException;
+import sop.operation.Version;
+
+@CommandLine.Command(name = "version", description = "Display version information about the tool",
+        exitCodeOnInvalidInput = 37)
+public class VersionCmd implements Runnable {
+
+    @CommandLine.ArgGroup()
+    Exclusive exclusive;
+
+    static class Exclusive {
+        @CommandLine.Option(names = "--extended", description = "Print an extended version string.")
+        boolean extended;
+
+        @CommandLine.Option(names = "--backend", description = "Print information about the cryptographic backend.")
+        boolean backend;
+    }
+
+
+
+    @Override
+    public void run() {
+        Version version = SopCLI.getSop().version();
+        if (version == null) {
+            throw new SOPGPException.UnsupportedSubcommand("Command 'version' not implemented.");
+        }
+
+        if (exclusive == null) {
+            Print.outln(version.getName() + " " + version.getVersion());
+            return;
+        }
+
+        if (exclusive.extended) {
+            Print.outln(version.getExtendedVersion());
+            return;
+        }
+
+        if (exclusive.backend) {
+            Print.outln(version.getBackendVersion());
+            return;
+        }
+    }
+}

sop-java-picocli/src/main/java/sop/cli/picocli/commands/package-info.java

@@ -0,0 +1,8 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Subcommands of the PGPainless SOP.
+ */
+package sop.cli.picocli.commands;

sop-java-picocli/src/main/java/sop/cli/picocli/package-info.java

@@ -0,0 +1,8 @@
+// SPDX-FileCopyrightText: 2021 Paul Schaub <vanitasvitae@fsfe.org>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Implementation of the Stateless OpenPGP Command Line Interface using Picocli.
+ */
+package sop.cli.picocli;