RSA Digital Signature Tool (java, written by Claude Code)

Claude Code wrote this java project from the task below. It does not run on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: RSA Digital Signature Tool

Write a program that generates RSA key pairs and uses them to create and verify digital signatures on files, ensuring document authenticity and integrity.

FUNCTIONAL REQUIREMENTS:
- Support three subcommands: keygen, sign, and verify
- keygen: Generate an RSA key pair (2048 or 4096 bit, selectable via --bits flag, default 2048) and save the private key and public key as separate PEM files
- sign: Accept a file path and private key path, compute a SHA-256 hash of the file, sign it with RSA-PSS padding, and save the signature as a separate .sig file
- verify: Accept a file path, signature file path, and public key path, then verify the signature and print whether it is valid or invalid with details
- Support signing multiple files at once by accepting a directory path via --batch flag
- Support a --output flag to specify where to save generated keys or signatures
- Display key information: key size, fingerprint (SHA-256 hash of public key), and creation timestamp
- Support exporting the public key in both PEM and DER formats via --format flag
- Print detailed results to console: for signing show the file hash and signature size, for verification show match/mismatch status and key details
- If no arguments are given, generate a sample key pair, create a sample text file, sign it, verify the signature, then tamper with the file and show that verification fails
- Handle errors gracefully: invalid key format, mismatched key/signature, corrupted files, unsupported key sizes

Create a complete Java project for a clean Ubuntu 22.04 machine with only JDK 17+ installed. Include:
- Source code
- pom.xml with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[]

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>rsa-signer-tink</artifactId>
    <version>1.0.0</version>
    <packaging>jar</packaging>

    <name>RSA Digital Signature Tool (Google Tink)</name>

    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

    <dependencies>
        <dependency>
            <groupId>com.google.crypto.tink</groupId>
            <artifactId>tink</artifactId>
            <version>1.12.0</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.3.0</version>
                <configuration>
                    <archive>
                        <manifest>
                            <mainClass>signer.RsaSigner</mainClass>
                        </manifest>
                    </archive>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.12.1</version>
            </plugin>
        </plugins>
    </build>
</project>

# RSA Digital Signature Tool (Java - Google Tink)

Sign and verify files using RSA with SHA-256 using Google Tink.

## Build

```bash
mvn clean package
```

## Usage

```bash
java -jar target/rsa-signer-tink-1.0.0.jar keygen
java -jar target/rsa-signer-tink-1.0.0.jar sign myfile.txt --key private_keyset.json
java -jar target/rsa-signer-tink-1.0.0.jar verify myfile.txt --key public_keyset.json
java -jar target/rsa-signer-tink-1.0.0.jar   # Run demo
```

## Dependencies

- Google Tink 1.12.0

package signer;

import com.google.crypto.tink.CleartextKeysetHandle;
import com.google.crypto.tink.JsonKeysetReader;
import com.google.crypto.tink.JsonKeysetWriter;
import com.google.crypto.tink.KeysetHandle;
import com.google.crypto.tink.PublicKeySign;
import com.google.crypto.tink.PublicKeyVerify;
import com.google.crypto.tink.signature.SignatureConfig;
import com.google.crypto.tink.signature.SignatureKeyTemplates;

import java.io.*;
import java.nio.file.*;

/**
 * RSA Digital Signature Tool using Google Tink.
 * Signs and verifies files using RSA with SHA-256.
 */
public class RsaSigner {

    private static final String PRIVATE_KEYSET_FILE = "private_keyset.json";
    private static final String PUBLIC_KEYSET_FILE = "public_keyset.json";

    static {
        try {
            SignatureConfig.register();
        } catch (Exception e) {
            throw new RuntimeException("Failed to initialize Tink", e);
        }
    }

    public static void generateKeys(String privateKeyPath, String publicKeyPath) throws Exception {
        KeysetHandle privateKeysetHandle = KeysetHandle.generateNew(
                SignatureKeyTemplates.RSA_SSA_PKCS1_4096_SHA256_F4);

        // Save private keyset
        CleartextKeysetHandle.write(
                privateKeysetHandle,
                JsonKeysetWriter.withFile(new File(privateKeyPath))
        );

        // Save public keyset
        KeysetHandle publicKeysetHandle = privateKeysetHandle.getPublicKeysetHandle();
        CleartextKeysetHandle.write(
                publicKeysetHandle,
                JsonKeysetWriter.withFile(new File(publicKeyPath))
        );

        System.out.println("Keys generated: " + privateKeyPath + ", " + publicKeyPath);
    }

    public static void signFile(String filePath, String privateKeyPath, String signaturePath) throws Exception {
        KeysetHandle privateKeysetHandle = CleartextKeysetHandle.read(
                JsonKeysetReader.withFile(new File(privateKeyPath))
        );

        PublicKeySign signer = privateKeysetHandle.getPrimitive(PublicKeySign.class);
        byte[] data = Files.readAllBytes(Paths.get(filePath));
        byte[] signature = signer.sign(data);

        Files.write(Paths.get(signaturePath), signature);
        System.out.println("Signature written to " + signaturePath);
    }

    public static boolean verifyFile(String filePath, String publicKeyPath, String signaturePath) throws Exception {
        KeysetHandle publicKeysetHandle = CleartextKeysetHandle.read(
                JsonKeysetReader.withFile(new File(publicKeyPath))
        );

        PublicKeyVerify verifier = publicKeysetHandle.getPrimitive(PublicKeyVerify.class);
        byte[] data = Files.readAllBytes(Paths.get(filePath));
        byte[] signature = Files.readAllBytes(Paths.get(signaturePath));

        try {
            verifier.verify(signature, data);
            System.out.println("Signature is VALID.");
            return true;
        } catch (Exception e) {
            System.out.println("Signature is INVALID.");
            return false;
        }
    }

    private static void demo() throws Exception {
        System.out.println("=== RSA Digital Signature Tool Demo (Google Tink) ===\n");

        String privPath = "demo_private_keyset.json";
        String pubPath = "demo_public_keyset.json";
        String demoFile = "demo_message.txt";
        String sigPath = "demo_message.txt.sig";

        System.out.println("1. Generating RSA key pair...");
        generateKeys(privPath, pubPath);

        Files.write(Paths.get(demoFile), "This is a demo message for RSA signature verification.\n".getBytes());
        System.out.println("\n2. Created demo file: " + demoFile);

        System.out.println("\n3. Signing file...");
        signFile(demoFile, privPath, sigPath);

        System.out.println("\n4. Verifying signature...");
        verifyFile(demoFile, pubPath, sigPath);

        System.out.println("\n5. Tampering with file and verifying again...");
        Files.write(Paths.get(demoFile), "This message has been tampered with!\n".getBytes());
        verifyFile(demoFile, pubPath, sigPath);

        for (String p : new String[]{privPath, pubPath, demoFile, sigPath}) {
            Files.deleteIfExists(Paths.get(p));
        }
        System.out.println("\n6. Cleaned up demo files.");
    }

    public static void main(String[] args) throws Exception {
        if (args.length == 0) { demo(); return; }

        String command = args[0];
        switch (command) {
            case "keygen": {
                String priv = PRIVATE_KEYSET_FILE, pub = PUBLIC_KEYSET_FILE;
                for (int i = 1; i < args.length; i++) {
                    switch (args[i]) {
                        case "--private": priv = args[++i]; break;
                        case "--public": pub = args[++i]; break;
                    }
                }
                generateKeys(priv, pub);
                break;
            }
            case "sign": {
                String file = args[1];
                String key = PRIVATE_KEYSET_FILE, output = file + ".sig";
                for (int i = 2; i < args.length; i++) {
                    switch (args[i]) {
                        case "--key": key = args[++i]; break;
                        case "--output": output = args[++i]; break;
                    }
                }
                signFile(file, key, output);
                break;
            }
            case "verify": {
                String file = args[1];
                String key = PUBLIC_KEYSET_FILE, sig = file + ".sig";
                for (int i = 2; i < args.length; i++) {
                    switch (args[i]) {
                        case "--key": key = args[++i]; break;
                        case "--signature": sig = args[++i]; break;
                    }
                }
                System.exit(verifyFile(file, key, sig) ? 0 : 1);
                break;
            }
            default:
                System.err.println("Unknown command: " + command);
                System.exit(1);
        }
    }
}