HMAC File Integrity Checker (java, written by Claude Code)

Claude Code wrote this java project from the task below. It installed and ran on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: HMAC File Integrity Checker

Write a program that computes and verifies HMAC-based integrity checksums for files and directories, creating a manifest of checksums that can later be used to detect unauthorized modifications.

FUNCTIONAL REQUIREMENTS:
- Accept a file or directory path, a secret key, and a mode (generate or verify) as command-line arguments
- Support multiple hash algorithms selectable via --algorithm flag: SHA-256 (default), SHA-384, SHA-512, SHA3-256
- generate mode: Compute HMAC for each file and save a manifest file containing file paths, HMAC values, file sizes, and timestamps
- verify mode: Read the manifest, recompute HMACs, and report which files are unchanged, modified, added (present but not in manifest), or missing (in manifest but deleted)
- For directories, recursively process all files and support --exclude flag with glob patterns to skip files (e.g., --exclude "*.log,*.tmp")
- Support a --output flag for the manifest file path (default: integrity_manifest.json)
- Print a colored summary to console showing verification results: passed files in green, modified in red, missing in yellow, new files in blue
- Compute a master HMAC over the entire manifest to detect tampering of the manifest file itself
- Support incremental updates: when generating with an existing manifest, only recompute HMACs for files whose modification time has changed via --incremental flag
- If no arguments are given, generate sample files in a temporary directory, create an integrity manifest, modify one file, delete another, add a new file, then run verification to demonstrate all detection capabilities
- Handle binary and text files correctly, permission errors gracefully

Create a complete Java project for a clean Ubuntu 22.04 machine with only JDK 17+ installed. Include:
- Source code
- pom.xml with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[]

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>hmac-checker</artifactId>
    <version>1.0.0</version>
    <packaging>jar</packaging>

    <name>HMAC File Integrity Checker</name>
    <description>HMAC-SHA256 file integrity checker using built-in javax.crypto</description>

    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.3.0</version>
                <configuration>
                    <archive>
                        <manifest>
                            <mainClass>hmacchecker.HmacChecker</mainClass>
                        </manifest>
                    </archive>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.12.1</version>
            </plugin>
        </plugins>
    </build>
</project>

# HMAC File Integrity Checker (Java - javax.crypto.Mac)

Compute and verify HMAC-SHA256 checksums using Java's built-in javax.crypto.Mac.

## Build

```bash
mvn clean package
```

## Usage

```bash
java -jar target/hmac-checker-1.0.0.jar compute ./mydir --key mysecret
java -jar target/hmac-checker-1.0.0.jar verify --manifest manifest.txt --key mysecret
java -jar target/hmac-checker-1.0.0.jar   # Run demo
```

## Dependencies

- Java 11+ (no external dependencies)

package hmacchecker;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.io.*;
import java.nio.file.*;
import java.security.MessageDigest;
import java.util.*;
import java.util.stream.*;

/**
 * HMAC File Integrity Checker using javax.crypto.Mac (built-in).
 * Computes and verifies HMAC-SHA256 checksums for files/directories.
 */
public class HmacChecker {

    private static final String HMAC_ALGORITHM = "HmacSHA256";

    public static String computeHmac(String filePath, byte[] key) throws Exception {
        Mac mac = Mac.getInstance(HMAC_ALGORITHM);
        SecretKeySpec keySpec = new SecretKeySpec(key, HMAC_ALGORITHM);
        mac.init(keySpec);

        try (InputStream is = new FileInputStream(filePath)) {
            byte[] buffer = new byte[8192];
            int bytesRead;
            while ((bytesRead = is.read(buffer)) != -1) {
                mac.update(buffer, 0, bytesRead);
            }
        }

        byte[] hmacBytes = mac.doFinal();
        return bytesToHex(hmacBytes);
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }

    public static List<String> scanFiles(String target) throws IOException {
        Path path = Paths.get(target);
        if (Files.isRegularFile(path)) {
            return Collections.singletonList(target);
        } else if (Files.isDirectory(path)) {
            try (Stream<Path> walk = Files.walk(path)) {
                return walk.filter(Files::isRegularFile)
                           .map(p -> p.toString().replace("\\", "/"))
                           .sorted()
                           .collect(Collectors.toList());
            }
        }
        throw new IllegalArgumentException("Not a file or directory: " + target);
    }

    public static void computeManifest(String target, String key, String manifestPath) throws Exception {
        byte[] keyBytes = key.getBytes("UTF-8");
        List<String> files = scanFiles(target);
        Map<String, String> manifest = new LinkedHashMap<>();

        for (String filePath : files) {
            String relPath = Paths.get("").toAbsolutePath().relativize(Paths.get(filePath).toAbsolutePath())
                                  .toString().replace("\\", "/");
            String hmacVal = computeHmac(filePath, keyBytes);
            manifest.put(relPath, hmacVal);
            System.out.println("  " + hmacVal + "  " + relPath);
        }

        // Write manifest as simple key=value format
        try (PrintWriter writer = new PrintWriter(new FileWriter(manifestPath))) {
            for (Map.Entry<String, String> entry : manifest.entrySet()) {
                writer.println(entry.getValue() + "  " + entry.getKey());
            }
        }

        System.out.println("\nManifest written to " + manifestPath + " (" + manifest.size() + " files)");
    }

    public static boolean verifyManifest(String manifestPath, String key) throws Exception {
        byte[] keyBytes = key.getBytes("UTF-8");
        Map<String, String> manifest = new LinkedHashMap<>();

        try (BufferedReader reader = new BufferedReader(new FileReader(manifestPath))) {
            String line;
            while ((line = reader.readLine()) != null) {
                line = line.trim();
                if (line.isEmpty()) continue;
                int sep = line.indexOf("  ");
                if (sep == -1) continue;
                String hmacVal = line.substring(0, sep);
                String filePath = line.substring(sep + 2);
                manifest.put(filePath, hmacVal);
            }
        }

        int passed = 0, failed = 0, missing = 0;

        for (Map.Entry<String, String> entry : manifest.entrySet()) {
            String filePath = entry.getKey();
            String expectedHmac = entry.getValue();

            if (!Files.exists(Paths.get(filePath))) {
                System.out.println("  MISSING  " + filePath);
                missing++;
                continue;
            }

            String actualHmac = computeHmac(filePath, keyBytes);
            if (MessageDigest.isEqual(actualHmac.getBytes(), expectedHmac.getBytes())) {
                System.out.println("  OK       " + filePath);
                passed++;
            } else {
                System.out.println("  FAILED   " + filePath);
                failed++;
            }
        }

        System.out.println("\nResults: " + passed + " OK, " + failed + " FAILED, " + missing + " MISSING");
        return failed == 0 && missing == 0;
    }

    private static void demo() throws Exception {
        System.out.println("=== HMAC File Integrity Checker Demo ===\n");

        String demoDir = "demo_files";
        String manifestPath = "demo_manifest.txt";
        String secretKey = "my-secret-key-for-demo";

        Files.createDirectories(Paths.get(demoDir));
        for (int i = 1; i <= 3; i++) {
            Files.write(Paths.get(demoDir, "file" + i + ".txt"),
                    ("This is sample file " + i + " for HMAC integrity checking.\n").getBytes());
        }
        System.out.println("1. Created sample files in " + demoDir + "/\n");

        System.out.println("2. Computing HMAC-SHA256 manifest...");
        computeManifest(demoDir, secretKey, manifestPath);

        System.out.println("\n3. Verifying manifest...");
        verifyManifest(manifestPath, secretKey);

        System.out.println("\n4. Tampering with a file...");
        Files.write(Paths.get(demoDir, "file2.txt"), "This file has been tampered with!\n".getBytes());
        verifyManifest(manifestPath, secretKey);

        // Cleanup
        try (Stream<Path> walk = Files.walk(Paths.get(demoDir))) {
            walk.sorted(Comparator.reverseOrder()).map(Path::toFile).forEach(File::delete);
        }
        Files.deleteIfExists(Paths.get(manifestPath));
        System.out.println("\n5. Cleaned up demo files.");
    }

    public static void main(String[] args) throws Exception {
        if (args.length == 0) { demo(); return; }

        String command = args[0];
        switch (command) {
            case "compute": {
                String target = args[1], key = null, manifest = "manifest.txt";
                for (int i = 2; i < args.length; i++) {
                    switch (args[i]) {
                        case "--key": key = args[++i]; break;
                        case "--manifest": manifest = args[++i]; break;
                    }
                }
                if (key == null) { System.err.println("--key is required"); System.exit(1); }
                computeManifest(target, key, manifest);
                break;
            }
            case "verify": {
                String key = null, manifest = "manifest.txt";
                for (int i = 1; i < args.length; i++) {
                    switch (args[i]) {
                        case "--key": key = args[++i]; break;
                        case "--manifest": manifest = args[++i]; break;
                    }
                }
                if (key == null) { System.err.println("--key is required"); System.exit(1); }
                System.exit(verifyManifest(manifest, key) ? 0 : 1);
                break;
            }
            default:
                System.err.println("Unknown command: " + command);
                System.err.println("Usage: HmacChecker [compute|verify]");
                System.exit(1);
        }
    }
}