fix: update bundled trust store to Google's current root certificates

google-api-client/src/test/java/com/google/api/client/googleapis/GoogleUtilsTest.java

@@ -16,7 +16,15 @@
 
 import static org.junit.Assert.assertNotEquals;
 
+import com.google.api.client.util.SecurityUtils;
 import java.security.KeyStore;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
 import java.util.regex.Matcher;
 import junit.framework.TestCase;
 
@@ -66,6 +74,65 @@ public void testGetCertificateTrustStore_IsCached() throws Exception {
     assertSame("Trust store should be cached", trustStore1, trustStore2);
   }
 
+  public void testGetBundledKeystore_containsOnlyTrustedCaCertificates() throws Exception {
+    KeyStore bundled = GoogleUtils.getBundledKeystore();
+
+    assertTrue("Bundled keystore should not be empty", bundled.size() > 0);
+    for (String alias : Collections.list(bundled.aliases())) {
+      assertTrue(
+          alias + " should be a trusted certificate entry", bundled.isCertificateEntry(alias));
+      X509Certificate certificate = (X509Certificate) bundled.getCertificate(alias);
+      assertTrue(alias + " should be a CA certificate", certificate.getBasicConstraints() >= 0);
+    }
+  }
+
+  public void testGetBundledKeystore_containsGoogleTrustServicesRoots() throws Exception {
+    List<String> subjects = getBundledCertificateSubjects();
+
+    for (String root : new String[] {"GTS Root R1", "GTS Root R2", "GTS Root R3", "GTS Root R4"}) {
+      assertTrue(
+          "Bundled keystore should contain " + root,
+          subjects.contains("CN=" + root + ",O=Google Trust Services LLC,C=US"));
+    }
+  }
+
+  public void testGetBundledKeystore_doesNotContainAaaCertificateServices() throws Exception {
+    for (String subject : getBundledCertificateSubjects()) {
+      assertFalse(
+          "Bundled keystore should not contain " + subject,
+          subject.contains("CN=AAA Certificate Services"));
+    }
+  }
+
+  public void testBundledJksKeystore_containsSameCertificatesAsBundledKeystore() throws Exception {
+    // This library doesn't read google.jks, but some applications load it directly this way.
+    KeyStore jks = SecurityUtils.getJavaKeyStore();
+    SecurityUtils.loadKeyStore(
+        jks,
+        GoogleUtils.class.getResourceAsStream("google.jks"),
+        GoogleUtils.BUNDLED_KEYSTORE_PASSWORD);
+
+    assertEquals(getCertificates(GoogleUtils.getBundledKeystore()), getCertificates(jks));
+  }
+
+  private static Set<Certificate> getCertificates(KeyStore keyStore) throws Exception {
+    Set<Certificate> certificates = new HashSet<>();
+    for (String alias : Collections.list(keyStore.aliases())) {
+      certificates.add(keyStore.getCertificate(alias));
+    }
+    return certificates;
+  }
+
+  private static List<String> getBundledCertificateSubjects() throws Exception {
+    KeyStore bundled = GoogleUtils.getBundledKeystore();
+    List<String> subjects = new ArrayList<>();
+    for (String alias : Collections.list(bundled.aliases())) {
+      X509Certificate certificate = (X509Certificate) bundled.getCertificate(alias);
+      subjects.add(certificate.getSubjectX500Principal().getName());
+    }
+    return subjects;
+  }
+
   public void testVersionMatcher() {
     String version = "1.30.3";
     Matcher matcher = GoogleUtils.VERSION_PATTERN.matcher(version);