[MJARSIGNER-16] Add the option -tsa to the configuration

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2
• Fix Version/s: 1.3
• Environment: all
• Flags: Patch
• Assignee: Tony Chemit
• Reporter: Anthony Dahanne
• Created: 14/May/11 15:57
• Updated: 06/Apr/15 01:16
• Resolved: 12/Nov/13 09:46

Description

Since JDK 5, Sun/Oracle added to the JDK jarsigner tool, the possibility to use a Timestamp authority while signing.
The option is docuemnted there :
http://download.oracle.com/javase/6/docs/technotes/tools/windows/jarsigner.html#Options

and for those interested in this feature (timestamping), some good explanation about this technology can be found there :
http://en.wikipedia.org/wiki/Trusted_timestamping

I have attached a patch that includes the addition of this argument to the command line; and a new integration test.

Applying this patch, you should be able to ask a timestamp authority to certify the date of signing, using this configuration for example :

 
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jarsigner-plugin</artifactId>
        <version>@project.version@</version>
        <configuration>
          <alias>test-01</alias>
          <keypass>key-passwd</keypass>
          <sigfile>TESTING</sigfile>
          <tsa>https://timestamp.geotrust.com/tsa</tsa>
        </configuration>
        <executions>
          <execution>
            <id>sign-jars</id>
            <goals>
              <goal>sign</goal>
            </goals>
          </execution>
          <execution>
            <id>verify-jars</id>
            <goals>
              <goal>verify</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

you can find this code in the patch integration test (timestampauthority , src/it/timestampauthority)

Working on this patch, I THOUGHT there was a workaround, playing around with the <arguments> option :

 
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jarsigner-plugin</artifactId>
        <version>@project.version@</version>
        <configuration>
          <alias>test-01</alias>
          <keypass>key-passwd</keypass>
          <sigfile>TESTING</sigfile>
          <arguments>
             <arguments>-tsa https://timestamp.geotrust.com/tsa</arguments>
          <arguments>  
        </configuration>
        <executions>
          etc...
        </executions>
      </plugin>

but it wraps this argument with quotes ("-tsa https://timestamp.geotrust.com/tsa" ) ; something the JDK jarsigner tool does not accept; so... no workaround possible

Issue Links

• depends upon: MSHARED-299 Add support for -tsa during signing (Trusted Timestamping)
• depends upon: MJARSIGNER-27 Use maven-jarsigner 1.3