Maven 2.x JAR Plugin

jar:sign - Jars containing invalid remains of older signatures won't get signed

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Major Major
  • Resolution: Won't Fix
  • Affects Version/s: 2.1
  • Fix Version/s: None
  • Component/s: sign
  • Labels:
    None
  • Environment:
    Maven 2.0.4 on Windows XP
    JDK 1.5.0_08
  • Number of attachments :
    4

Description

I'm trying to ease the burden of applet deployment by integrating every dependency of that applet into the applet's .jar archive.
For this purpose I'm using the unpack goal of the dependency plugin (see attached POM).
For a particular case I had to integrate an already signed applet.

There is no way I can get the integrated jar signed using jar:sign - I always get an error from jarsigner (see attached error.log).
The problem seems to be that jarsigner is called with -verify - although I'm explicitely turning it of in plugin configuration.
When calling jarsigned from the command line without -verify it runs to completion.
When running it with -verify from the command line the same error occurs as in the maven build.

  1. Text File
    error.log
    22/Feb/07 4:37 PM
    40 kB
    Gottfried Ganßauge
  2. Text File
    jar-plugin.patch
    23/Feb/07 3:18 AM
    1 kB
    Gottfried Ganßauge
  3. File
    MJAR-67.diff
    25/Aug/07 3:46 PM
    2 kB
    Jerome Lacoste
  4. XML File
    pom.xml
    22/Feb/07 4:37 PM
    3 kB
    Gottfried Ganßauge

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Gottfried Ganßauge added a comment -

I'm attaching a patch to SIgnJarMojo which avoids the issue by ignoring exceptions thrown on the attempt to check for an already signed jar.
This passes all tests but I couldn't add a new test as I'm not sure how to provoke the error without a broken jar file at hand.

Show
Gottfried Ganßauge added a comment - I'm attaching a patch to SIgnJarMojo which avoids the issue by ignoring exceptions thrown on the attempt to check for an already signed jar. This passes all tests but I couldn't add a new test as I'm not sure how to provoke the error without a broken jar file at hand.
Hide
Permalink
Gottfried Ganßauge added a comment -

a patch generated by running "svn diff" on my changed tree

Show
Gottfried Ganßauge added a comment - a patch generated by running "svn diff" on my changed tree
Hide
Permalink
Jerome Lacoste added a comment -

> The problem seems to be that jarsigner is called with -verify - although I'm explicitely turning it of in plugin configuration.

I have a feeling that the attached patch is not enough right way to fix the issue,

The exception should be thrown by default and a user flag should be there to allow bypassing the failed check.
Also the log message should be warn instead of info. Patch coming.

Finally you could also try to remove signatures (try the webstart:unsign mojo)

Another solution was for JarSignVerifyMojo to not throw an exception when errorWhenNotSigned is true, which I didn't like much,

Show
Jerome Lacoste added a comment - > The problem seems to be that jarsigner is called with -verify - although I'm explicitely turning it of in plugin configuration. I have a feeling that the attached patch is not enough right way to fix the issue, The exception should be thrown by default and a user flag should be there to allow bypassing the failed check. Also the log message should be warn instead of info. Patch coming. Finally you could also try to remove signatures (try the webstart:unsign mojo) Another solution was for JarSignVerifyMojo to not throw an exception when errorWhenNotSigned is true, which I didn't like much,
Hide
Permalink
Jerome Lacoste added a comment -

Force the user to add a flag to bypass this issue. Failures cause by signing an already signed jar should not go unnoticed.

So the exception is thrown by default and a user flag is added to allow bypassing the failed check.
Finally the log message is a warning instead of info.

Show
Jerome Lacoste added a comment - Force the user to add a flag to bypass this issue. Failures cause by signing an already signed jar should not go unnoticed. So the exception is thrown by default and a user flag is added to allow bypassing the failed check. Finally the log message is a warning instead of info.
Hide
Permalink
Benjamin Bentmann added a comment -

The jarsigner related goals in this plugin will be deprecated, please use the dedicated maven-jarsigner-plugin instead.

Show
Benjamin Bentmann added a comment - The jarsigner related goals in this plugin will be deprecated, please use the dedicated maven-jarsigner-plugin instead.

People

  • Assignee:
    Benjamin Bentmann
    Reporter:
    Gottfried Ganßauge
Vote (1)
Watch (2)

Dates

  • Created:
    Updated:
    Resolved: