[BUG] DefaultConfigurationController.initializeSecuritySettings writes the keystore unnecessarily

[jonbartels]

Describe the bug

connect/server/src/com/mirth/connect/server/controllers/DefaultConfigurationController.java

Line 1154 in 0974c6a

public void initializeSecuritySettings() {

The keystore file is opened, checked for existing keypairs, has new keypairs generated if needed, then it is ALWAYS rewritten on line

connect/server/src/com/mirth/connect/server/controllers/DefaultConfigurationController.java

Line 1208 in 0974c6a

keyStore.store(fos, keyStorePassword);

. This rewrite happens even if no changes to the keystore were needed.

To Reproduce

1. Create a keystore.jks with a self-signed cert as the mirthconnect alias
2. Note the mtime of the file
3. Launch MC
4. Observe the mtime has changed

Expected behavior
If the keystore DOES NOT need any keypairs generated or added, it should not be written.

Actual behavior
If keystore.jks is not actually changed by Mirth Connect, it should never be written to.

Workaround(s)
No practical workarounds. Maybe a plugin could override the ConfigurationController implementation?

Additional context
This is important for security best-practices - If MC didn't needlessly write to the keystore then the file could be set read-only by the filesystem.

Many modern deployments will load the keystore from a secrets-store (Hashicorp Vault, Docker, k8s secrets, etc.) and loading it read-only is better for those systems.

[jonbartels]

I am playing with this at https://github.com/jonbartels/connect/tree/5467-keytore-avoid-writes

I don't even know if it compiles yet.