Help with sign jar files

[carlosspohr]

Hi there,

Yes, I know this library doesn't not support JAR files, but I got stuck after we bought a new Code Sign EV certificate in token format, and this one was installed on Google HSM/KMS platform.

Searching in web, all content about signature of applications points to this library, and I really don't know what I can do to solve this.

On older format, I had a simple Ant task to sign all my jars, like this:

<target name="task.sign.jars">
    <signjar 
        alias="my-alias" 
        keystore="my-keystore.jks" 
        keypass="123456" 
        storepass="123456"
        tsaurl="http://timestamp.digicert.com"
        lazy="true">
        <path>
            <fileset dir="${deploy.dir}/jars/" includes="**/*.jar" />
        </path>
    </signjar>
</target>

I tried to do the same using your library, but I got an error about unsupported file format:

jsign --storetype GOOGLECLOUD --storepass <api-access-token> --keystore <ks_name> --alias <alias> --certfile public-key.pem app.jar

Could anyone help me or suggest some content so I can sign my jar files?

Or is there a Jenkins plugin that does this?

Or, is it possible to create a new JKS to continue to use the ant task above?

What I have:

• Code Sign EV certificate;
• This code is already installed on Google HSM/KMS;
• API access token generated;
• A public key in PEM format for this certificate;

[ebourg]

You can no longer use a JKS keystore, EV certificates are either cloud based or provided on a hardware token.

Jsign doesn't support jar files, so you can't use the CLI syntax. However Jsign also provides an API that could be useful in this case:

• The SigningServiceJcaProvider class could be modified to work with the jarsigner providerclass parameter.
• The KeyStoreBuilder class could be combined with jdk.security.jarsigner.JarSigner to sign a jar file programmatically.

[carlosspohr]

Hi @ebourg ,

Thanks for your reply.

Do you know someone that implemented this?

[ebourg]

I have implemented a provider that can be used with jarsigner, could you give it a try? Just build the latest version from the Git repository and run this (with Java 11 or higher):

jarsigner -J-cp -Jjsign-5.1-SNAPSHOT.jar -J--add-modules -Jjava.sql \
           -providerClass net.jsign.jca.JsignJcaProvider \
           -providerArg <ks_name> \
           -keystore NONE \
           -storetype GOOGLECLOUD \
           -storepass <api-access-token> \
           -keypass <keypass> \
           -certchain public-key.pem \
           app.jar <alias>

[carlosspohr]

Hi @ebourg , sorry for late response.

Sure I will test it!

[carlosspohr]

Hi @ebourg,

I builded your project and ran a test to sign with this command:

jdk-21/bin/jarsigner -J-cp -Jjsign-5.1-SNAPSHOT.jar \
           -providerClass net.jsign.jca.JsignJcaProvider \
           -providerArg EVCodeSigning \
           -keystore NONE \
           -storetype GOOGLECLOUD \
           -storepass $(gcloud auth print-access-token) \
           -keypass 123123123 \
           -certchain my_pen_ltda.pem \
           /mnt/d/SWAPersistency.jar JacadCsKey

And I got this exception about 404 from Google URL:

jarsigner error: java.lang.RuntimeException: java.security.KeyStoreException: java.io.IOException: HTTP Error 404 - Not Found (https://cloudkms.googleapis.com/v1/EVCodeSigning/cryptoKeys)

As additional information:

• JVM 21;
• Ubuntu as linux system inside Windows 11;
• PEM file from vendor of ev certificate;
• 'EVCodeSigning' and 'JacadCsKey' are from this project on Google Cloud: "projects/certificado-jacad/locations/global/keyRings/EVCodeSigning"

Is there something I did wrong or may have a bug?

How I can help you (and me) to validate this sign function ?

[ebourg]

You forgot this parameter after the classpath: -J--add-modules -Jjava.sql

[ebourg]

Also the alias should be the name and the version of the key, not the name of the keyring. The command should look like this:

jdk-21/bin/jarsigner -J-cp -Jjsign-5.1-SNAPSHOT.jar -J--add-modules -Jjava.sql \
           -providerClass net.jsign.jca.JsignJcaProvider \
           -providerArg "projects/certificado-jacad/locations/global/keyRings/EVCodeSigning" \
           -keystore NONE \
           -storetype GOOGLECLOUD \
           -storepass $(gcloud auth print-access-token) \
           -certchain jacad_ltda.pem \
           /mnt/d/SWAPersistency.jar alias/cryptoKeyVersions/1

[carlosspohr]

@ebourg ,

As your project is widely known about application sign, what do you think add this new feature to the official docs?

[ebourg]

Yes I've added a section about the JCA provider and jarsigner to the documentation:

https://ebourg.github.io/jsign/#jca-provider

[carlosspohr]

Very nice!

I did a workaround using jdk21 just for sign, because I didn't know about support for jdk8.

Thanks @ebourg !

[ebourg]

It should work with Java 8 too, the syntax is slightly different:

jdk-8/bin/jarsigner -J-cp -Jjsign-5.1-SNAPSHOT.jar:jdk-8/lib/tools.jar \
           -providerClass net.jsign.jca.JsignJcaProvider \
           -providerArg "projects/certificado-jacad/locations/global/keyRings/EVCodeSigning" \
           -keystore NONE \
           -storetype GOOGLECLOUD \
           -storepass $(gcloud auth print-access-token) \
           -certchain jacad_ltda.pem \
           /mnt/d/SWAPersistency.jar JacadCsKey/cryptoKeyVersions/1:RSA