Package org.apache.maven.plugins.jarsigner

Class TsaSelector

java.lang.Object

org.apache.maven.plugins.jarsigner.TsaSelector

class TsaSelector
extends Object

Helper class to select a Time Stamping Authority (TSA) server along with parameters to send. The protocol is defined in RFC 3161: Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP). From a jarsigner perspective there are two things that are important: 1. Finding a TSA server URL 2. What parameters to use for TSA server communication. Finding a URL can be done in two ways: a) The end-user has specified an explicit URL (the most common way) b) The end-user has specified a keystore alias that points to a certificate in the active keystore. From the certificate the X509v3 extension "Subject Information Access" field is examined to find the TSA server URL. Example:

    [vagrant@podmanhost ~]$ openssl x509 -noout -ext subjectInfoAccess -in tsa-server.crt
    Subject Information Access:
        AD Time Stamping - URI:http://timestamp.globalsign.com/tsa/r6advanced1
    

Each TSA server vendor typically has defined its own OID for what "policy" to use in the timestamping process. For example GlobalSign might use 1.3.6.1.4.1.4146.2.3.1.2. A DigiCert TSA server would not accept this OID. In most cases there is no need for the end-user to specify this because the TSA server will choose a default. jarsigner will send a message digest to the TSA server along with the message digest algorithm. For example SHA-384. A TSA server might reject the chosen algorithm, but typically most TSA servers supports the "common" ones (like SHA-256, SHA-384 and SHA-512). In most cases there is no need for the end-user to specify this because the jarsigner tool choose a good default.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
(package private) static class	TsaSelector.TsaServer	Representation of a single TSA server and the parameters to use for it

Field Summary

Fields

Modifier and Type	Field	Description
private final ThreadLocal<TsaSelector.TsaServer>	currentTsaServer	The current TsaServer in use (if any).
private final List<TsaSelector.TsaServer>	tsaServers	List of TSA servers.

Constructor Summary

Constructors

Constructor	Description
TsaSelector(String[] tsa, String[] tsacert, String[] tsapolicyid, String tsadigestalg)

Method Summary

Modifier and Type	Method	Description
(package private) TsaSelector.TsaServer	getServer()	Gets the next "best" TSA server to use.
(package private) void	registerFailure()	Register that the current used TsaServer was involved in a jarsigner execution that failed.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

currentTsaServer

private final ThreadLocal<TsaSelector.TsaServer> currentTsaServer

The current TsaServer in use (if any). One per thread

tsaServers

private final List<TsaSelector.TsaServer> tsaServers

List of TSA servers. Will at minimum contain a dummy/empty value

Constructor Details

TsaSelector

TsaSelector(String[] tsa,
 String[] tsacert,
 String[] tsapolicyid,
 String tsadigestalg)

Method Details

getServer

TsaSelector.TsaServer getServer()

Gets the next "best" TSA server to use. Uses a "best effort" approach without any synchronization. It may not select the "snapshot-consistent" best TSA server, but good enough.

registerFailure

void registerFailure()

Register that the current used TsaServer was involved in a jarsigner execution that failed. This could be a problem with the TsaServer, but it could also be other factors unrelated to the TsaServer. Regardless of the cause of the failure it is registered as a failure for the current used TsaServer to be used when determining the next TsaServer to try.