Maven 2.x Jar Signer Plugin

Add the option -tsa to the configuration

Details

  • Type: New Feature New Feature
  • Status: Open Open
  • Priority: Major Major
  • Resolution: Unresolved
  • Affects Version/s: 1.2
  • Fix Version/s: None
  • Labels:
    None
  • Environment:
    all
  • Testcase included:
    yes
  • Patch Submitted:
    Yes
  • Number of attachments :
    1

Description

Since JDK 5, Sun/Oracle added to the JDK jarsigner tool, the possibility to use a Timestamp authority while signing.
The option is docuemnted there :
http://download.oracle.com/javase/6/docs/technotes/tools/windows/jarsigner.html#Options

and for those interested in this feature (timestamping), some good explanation about this technology can be found there :
http://en.wikipedia.org/wiki/Trusted_timestamping

I have attached a patch that includes the addition of this argument to the command line; and a new integration test.

Applying this patch, you should be able to ask a timestamp authority to certify the date of signing, using this configuration for example :

 
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jarsigner-plugin</artifactId>
        <version>@project.version@</version>
        <configuration>
          <alias>test-01</alias>
          <keypass>key-passwd</keypass>
          <sigfile>TESTING</sigfile>
          <tsa>https://timestamp.geotrust.com/tsa</tsa>
        </configuration>
        <executions>
          <execution>
            <id>sign-jars</id>
            <goals>
              <goal>sign</goal>
            </goals>
          </execution>
          <execution>
            <id>verify-jars</id>
            <goals>
              <goal>verify</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

you can find this code in the patch integration test (timestampauthority , src/it/timestampauthority)

Working on this patch, I THOUGHT there was a workaround, playing around with the <arguments> option :

 
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jarsigner-plugin</artifactId>
        <version>@project.version@</version>
        <configuration>
          <alias>test-01</alias>
          <keypass>key-passwd</keypass>
          <sigfile>TESTING</sigfile>
          <arguments>
             <arguments>-tsa https://timestamp.geotrust.com/tsa</arguments>
          <arguments>  
        </configuration>
        <executions>
          etc...
        </executions>
      </plugin>

but it wraps this argument with quotes ("-tsa https://timestamp.geotrust.com/tsa" ) ; something the JDK jarsigner tool does not accept; so... no workaround possible

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Christian Schulte added a comment -

It should be possible to use the arguments parameter for this like

<arguments>
  <argument>-tsa</argument>
  <argument>https://timestamp.geotrust.com/tsa</argument>
<arguments>

or

<arguments>
  <argument>-tsa</argument>
  <argument>${jarsigner.tsa}</argument>
<arguments>
Show
Christian Schulte added a comment - It should be possible to use the arguments parameter for this like <arguments> <argument> -tsa </argument> <argument> https://timestamp.geotrust.com/tsa </argument> <arguments> or <arguments> <argument> -tsa </argument> <argument> ${jarsigner.tsa} </argument> <arguments>
Hide
Permalink
Anthony Dahanne added a comment -

Hello Christian,
thank you for your answer.
I just tried the way you suggested, and, splitting the -tsa https://timestamp.geotrust.com/tsa down to 2 arguments seems to work !
So this workaround is ok for maven jar signer 1.2.
Now, I don't know if you prefer to close this issue or keep it open to support "out of the box" the tsa option in the next release.
Thanks again !

Show
Anthony Dahanne added a comment - Hello Christian, thank you for your answer. I just tried the way you suggested, and, splitting the -tsa https://timestamp.geotrust.com/tsa down to 2 arguments seems to work ! So this workaround is ok for maven jar signer 1.2. Now, I don't know if you prefer to close this issue or keep it open to support "out of the box" the tsa option in the next release. Thanks again !

People

  • Assignee:
    Unassigned
    Reporter:
    Anthony Dahanne
Vote (0)
Watch (0)

Dates

  • Created:
    Updated: