Package org.apache.maven.plugins.jarsigner

Class JarsignerSignMojo

java.lang.Object
org.apache.maven.plugin.AbstractMojo
org.apache.maven.plugins.jarsigner.AbstractJarsignerMojo
org.apache.maven.plugins.jarsigner.JarsignerSignMojo
All Implemented Interfaces:
org.apache.maven.plugin.ContextEnabled, org.apache.maven.plugin.Mojo
@Mojo(name="sign", defaultPhase=PACKAGE, threadSafe=true) public class JarsignerSignMojo extends AbstractJarsignerMojo
Signs a project artifact and attachments using jarsigner.
Since:
1.0

  • Field Details

    • keypass

      @Parameter(property="jarsigner.keypass") private String keypass
      See options.

    • sigfile

      @Parameter(property="jarsigner.sigfile") private String sigfile
      See options.

    • removeExistingSignatures

      @Parameter(property="jarsigner.removeExistingSignatures", defaultValue="false") private boolean removeExistingSignatures
      Indicates whether existing signatures should be removed from the processed JAR files prior to signing them. If enabled, the resulting JAR will appear as being signed only once.
      Since:
      1.1

    • tsa

      @Parameter(property="jarsigner.tsa") private String[] tsa

      URL(s) to Time Stamping Authority (TSA) server(s) to use to timestamp the signing. See options. Separate multiple TSA URLs with comma (without space) or a nested XML tag.

      
 <configuration>
   <tsa>http://timestamp.digicert.com,http://timestamp.globalsign.com/tsa/r6advanced1</tsa>
 </configuration>
 
      
 <configuration>
   <tsa>
     <url>http://timestamp.digicert.com</url>
     <url>http://timestamp.globalsign.com/tsa/r6advanced1</url>
   </tsa>
 </configuration>

      Usage of multiple TSA servers only makes sense when maxTries is more than 1. A different TSA server will only be used at retries.

      Changed to a list since 3.1.0. Single XML element (without comma) is still supported.

      Since:
      1.3

    • tsacert

      @Parameter(property="jarsigner.tsacert") private String[] tsacert

      Alias(es) for certificate(s) in the active keystore used to find a TSA URL. From the certificate the X509v3 extension "Subject Information Access" field is examined to find the TSA server URL. See options. Separate multiple aliases with comma (without space) or a nested XML tag.

      
 <configuration>
   <tsacert>alias1,alias2</tsacert>
 </configuration>
 
      
 <configuration>
   <tsacert>
     <alias>alias1</alias>
     <alias>alias2</alias>
   </tsacert>
 </configuration>

      Should not be used at the same time as the tsa parameter (because jarsigner will typically ignore tsacert, if tsa is set).

      Usage of multiple aliases only makes sense when maxTries is more than 1. A different TSA server will only be used at retries.

      Changed to a list since 3.1.0. Single XML element (without comma) is still supported.

      Since:
      1.3

    • tsapolicyid

      @Parameter(property="jarsigner.tsapolicyid") private String[] tsapolicyid

      OID(s) to send to the TSA server to identify the policy ID the server should use. If not specified TSA server will choose a default policy ID. Each TSA server vendor will typically define their own policy OIDs. See options. Separate multiple OIDs with comma (without space) or a nested XML tag.

      
 <configuration>
   <tsapolicyid>1.3.6.1.4.1.4146.2.3.1.2,2.16.840.1.114412.7.1</tsapolicyid>
 </configuration>
 
      
 <configuration>
   <tsapolicyid>
     <oid>1.3.6.1.4.1.4146.2.3.1.2</oid>
     <oid>2.16.840.1.114412.7.1</oid>
   </tsapolicyid>
 </configuration>

      If used, the number of OIDs should be the same as the number of elements in tsa or tsacert. The first OID will be used for the first TSA server, the second OID for the second TSA server and so on.

      Since:
      3.1.0

    • tsadigestalg

      @Parameter(property="jarsigner.tsadigestalg") private String tsadigestalg
      The message digest algorithm to use in the messageImprint that the TSA server will timestamp. A default value (for example SHA-384) will be selected by jarsigner if this parameter is not set. Only available in Java 11 and later. See options.
      Since:
      3.1.0

    • certchain

      @Parameter(property="jarsigner.certchain", required=false) private File certchain
      Location of the extra certificate chain file. See options.
      Since:
      1.5

    • maxTries

      @Parameter(property="jarsigner.maxTries", defaultValue="1") private int maxTries
      How many times to try to sign a jar (assuming each previous attempt is a failure). This option may be desirable if any network operations are used during signing, for example using a Time Stamp Authority or network based PKCS11 HSM solution for storing code signing keys. The default value of 1 indicates that no retries should be made.
      Since:
      3.1.0

    • maxRetryDelaySeconds

      @Parameter(property="jarsigner.maxRetryDelaySeconds", defaultValue="0") private int maxRetryDelaySeconds
      Maximum delay, in seconds, to wait after a failed attempt before re-trying. The delay after a failed attempt follows an exponential backoff strategy, with increasing delay times.
      Since:
      3.1.0

    • threadCount

      @Parameter(property="jarsigner.threadCount", defaultValue="1") private int threadCount
      Maximum number of parallel threads to use when signing jar files. Increases performance when signing multiple jar files, especially when network operations are used during signing, for example when using a Time Stamp Authority or network based PKCS11 HSM solution for storing code signing keys. Note: the logging from the signing process will be interleaved, and harder to read, when using many threads.
      Since:
      3.1.0

    • waitStrategy

      private JarsignerSignMojo.WaitStrategy waitStrategy
      Current WaitStrategy, to allow for sleeping after a signing failure.

    • tsaSelector

      private TsaSelector tsaSelector

    • MAX_WAIT_EXPONENT_ATTEMPT

      private static final int MAX_WAIT_EXPONENT_ATTEMPT
      Exponent limit for exponential wait after failure function. 2^20 = 1048576 sec ~= 12 days.
      See Also:

  • Constructor Details

    • JarsignerSignMojo

      public JarsignerSignMojo()

  • Method Details

    • getCommandlineInfo

      protected String getCommandlineInfo(org.apache.maven.shared.utils.cli.Commandline commandLine)
      Description copied from class: AbstractJarsignerMojo
      Gets a string representation of a Commandline.

      This method creates the string representation by calling commandLine.toString() by default.

      Overrides:
      getCommandlineInfo in class AbstractJarsignerMojo
      Parameters:
      commandLine - The Commandline to get a string representation of.
      Returns:
      The string representation of commandLine.

    • preProcessArchive

      protected void preProcessArchive(File archive) throws org.apache.maven.plugin.MojoExecutionException
      Description copied from class: AbstractJarsignerMojo
      Pre-processes a given archive.
      Overrides:
      preProcessArchive in class AbstractJarsignerMojo
      Parameters:
      archive - The archive to process, must not be null.
      Throws:
      org.apache.maven.plugin.MojoExecutionException - if pre-processing failed

    • validateParameters

      protected void validateParameters() throws org.apache.maven.plugin.MojoExecutionException
      Description copied from class: AbstractJarsignerMojo
      Validate the user supplied configuration/parameters.
      Overrides:
      validateParameters in class AbstractJarsignerMojo
      Throws:
      org.apache.maven.plugin.MojoExecutionException - if the user supplied configuration make further execution impossible

    • createRequest

      protected org.apache.maven.shared.jarsigner.JarSignerRequest createRequest(File archive) throws org.apache.maven.plugin.MojoExecutionException
      Creates the jar signer request to be executed.
      Specified by:
      createRequest in class AbstractJarsignerMojo
      Parameters:
      archive - the archive file to treat by jarsigner
      Returns:
      the request
      Throws:
      org.apache.maven.plugin.MojoExecutionException - if an exception occurs

    • updateJarSignerRequestWithTsa

      private void updateJarSignerRequestWithTsa(org.apache.maven.shared.jarsigner.JarSignerSignRequest request, TsaSelector.TsaServer tsaServer)
      Modifies JarSignerRequest with TSA parameters

    • processArchives

      protected void processArchives(List<File> archives) throws org.apache.maven.plugin.MojoExecutionException
      Process (sign/verify) a list of archives. Processing of files may be parallelized for increased performance.
      Overrides:
      processArchives in class AbstractJarsignerMojo
      Parameters:
      archives - list of jar files to process
      Throws:
      org.apache.maven.plugin.MojoExecutionException - if an error occurs during the processing of archives

    • executeJarSigner

      protected void executeJarSigner(org.apache.maven.shared.jarsigner.JarSigner jarSigner, org.apache.maven.shared.jarsigner.JarSignerRequest request) throws org.apache.maven.shared.utils.cli.javatool.JavaToolException, org.apache.maven.plugin.MojoExecutionException
      Executes jarsigner (execute signing or verification for a jar file). Will retry signing up to maxTries times if it fails.
      Specified by:
      executeJarSigner in class AbstractJarsignerMojo
      Parameters:
      jarSigner - the JarSigner execution interface
      request - the JarSignerRequest with parameters JarSigner should use
      Throws:
      org.apache.maven.plugin.MojoExecutionException - if all signing attempts fail
      org.apache.maven.shared.utils.cli.javatool.JavaToolException - if jarsigner could not be invoked

    • setWaitStrategy

      void setWaitStrategy(JarsignerSignMojo.WaitStrategy waitStrategy)
      Set current WaitStrategy. Package private for testing.

    • defaultWaitStrategy

      private void defaultWaitStrategy(int attempt, Duration maxRetryDelay) throws org.apache.maven.plugin.MojoExecutionException
      Throws:
      org.apache.maven.plugin.MojoExecutionException

    • waitAfterFailure

      void waitAfterFailure(int attempt, Duration maxRetryDelay, JarsignerSignMojo.Sleeper sleeper) throws org.apache.maven.plugin.MojoExecutionException
      Package private for testing
      Throws:
      org.apache.maven.plugin.MojoExecutionException