Création de JNLP Maven avec signature de code EV

Question

J'utilise Maven et le webstart-maven-plugin pour générer un fichier JNLP et signer les fichiers jar de mon projet. Nous venons juste de renouveler notre certificat de signature de code et depuis février 2017, des jetons matériels sont fournis à la place des logiciels.

Selon la page de support GlobalSign, la bonne façon de signer des pots avec le jeton matériel est comme suit (voir article):

jarsigner -keystore NONE -storetype PKCS11 -tsa http://timestamp.globalsign.com/scripts/timestamp.dll -providerClass sun.security.pkcs11.SunPKCS11 -providerArg eToken.cfg test.jar "le-d0e453de-66db-414a-8fa8-0a07cfad66b5" 

J'ai suivi toutes les étapes décrites dans cet article et maintenant je suis essayer d'ajuster mon pom.xml pour appliquer le certificat EV Code Signing.

Au départ, j'utilisé un keystore (extrait, pom complète ci-dessous):

<!-- SIGNING --> 
<sign> 
    <keystore>${project.basedir}/src/main/jnlp/my.keystore</keystore> 
    <keypass>...</keypass> 
    <storepass>...</storepass> 
    <alias>...</alias> 
    <verify>true</verify> 
</sign> 

Maintenant, je suis en train de le mettre à jour pour obtenir le code EV signature au travail (extrait, pom complète ci-dessous):

<!-- SIGNING --> 
<sign> 
    <keystore>NONE</keystore> 
    <storetype>PKCS11</storetype> 
    <storepass>...</storepass> 
    <tsa>http://timestamp.globalsign.com/scripts/timestamp.dll</tsa> 
    <providerClass>sun.security.pkcs11.SunPKCS11</providerClass> 
    <providerArg>${project.basedir}/src/main/resources/token/eToken.config</providerArg> 
    <alias>le-d0e453de-66db-414a-8fa8-0a07cfad66b5</alias> <!-- I took the alias from the article as an example --> 
    <verify>true</verify> 
</sign> 

Cependant, il semble que tsa, providerClass et providerArg ne sont pas supportés sauf si j'ai manqué quelque chose. Je n'ai pas trouvé beaucoup d'informations sur le webstart-maven-plugin ou ce n'est pas à jour, ce qui est dommage :(

Y at-il une autre/meilleure façon de signer des jars tout en créant un JNLP? Toute aide serait beaucoup apprécié!

code pom.xml signature (avec keystore)

<profile> 
     <id>jnlp</id> 
     <build> 
      <plugins> 
       <plugin> 
        <groupId>org.codehaus.mojo</groupId> 
        <artifactId>webstart-maven-plugin</artifactId> 
        <version>1.0-beta-6</version> 
        <dependencies> 
         <dependency> 
          <groupId>org.codehaus.mojo</groupId> 
          <artifactId>webstart-pack200-impl</artifactId> 
          <version>1.0-beta-6</version> 
         </dependency> 
         <dependency> 
          <groupId>org.codehaus.mojo</groupId> 
          <artifactId>keytool-api-1.7</artifactId> 
          <version>1.5</version> 
         </dependency> 
        </dependencies> 
        <executions> 
         <execution> 
          <phase>package</phase> 
          <goals> 
           <goal>jnlp</goal> 
          </goals> 
         </execution> 
        </executions> 
        <configuration> 
         <!-- The path where the libraries are stored within the jnlp structure. not required. by default the libraries are within the working directory --> 
         <libPath>lib</libPath> 
         <!-- JNLP generation --> 
         <jnlp> 
          <mainClass>myApp.ui.MainApp</mainClass> 
         </jnlp> 

         <!-- SIGNING --> 
         <sign> 
          <keystore>${project.basedir}/src/main/jnlp/my.keystore</keystore> 
          <keypass>...</keypass> 
          <storepass>...</storepass> 
          <alias>...</alias> 
          <verify>true</verify> 
         </sign> 
         <verbose>true</verbose> 
         <updateManifestEntries> 
          <Application-Name>MyApp</Application-Name> 
          <Permissions>all-permissions</Permissions> 
          <Codebase>...</Codebase> 
          <Application-Library-Allowable-Codebase>...</Application-Library-Allowable-Codebase> 
          <Caller-Allowable-Codebase>...</Caller-Allowable-Codebase> 
         </updateManifestEntries> 

         <!-- BUILDING PROCESS --> 
         <pack200> 
          <enabled>false</enabled> 
         </pack200> 
        </configuration> 
       </plugin> 
       <plugin> 
        <groupId>org.apache.maven.plugins</groupId> 
        <artifactId>maven-assembly-plugin</artifactId> 
        <version>2.6</version> 
        <configuration> 
         <descriptorRefs> 
          <descriptorRef>jar-with-dependencies</descriptorRef> 
         </descriptorRefs> 
        </configuration> 
        <executions> 
         <execution> 
          <id>assemble-all</id> 
          <phase>package</phase> 
          <goals> 
           <goal>single</goal> 
          </goals> 
         </execution> 
        </executions> 
       </plugin> 
      </plugins> 
     </build> 
    </profile> 

pom.xml code EV signature (avec jeton SafeNet)

<profile> 
     <id>jnlp</id> 
     <build> 
      <plugins> 
       <plugin> 
        <groupId>org.codehaus.mojo</groupId> 
        <artifactId>webstart-maven-plugin</artifactId> 
        <version>1.0-beta-7</version> 
        <dependencies> 
         <dependency> 
          <groupId>org.codehaus.mojo</groupId> 
          <artifactId>webstart-pack200-impl</artifactId> 
          <version>1.0-beta-6</version> 
         </dependency> 
         <dependency> 
          <groupId>org.codehaus.mojo</groupId> 
          <artifactId>keytool-api-1.7</artifactId> 
          <version>1.5</version> 
         </dependency> 
        </dependencies> 
        <executions> 
         <execution> 
          <phase>package</phase> 
          <goals> 
           <goal>jnlp</goal> 
          </goals> 
         </execution> 
        </executions> 
        <configuration> 
         <!-- The path where the libraries are stored within the jnlp structure. not required. by default the libraries are within the working directory --> 
         <libPath>lib</libPath> 
         <!-- JNLP generation --> 
         <jnlp> 
          <mainClass>myApp.ui.MainApp</mainClass> 
         </jnlp> 

         <!-- SIGNING --> 
         <sign> 
          <keystore>NONE</keystore> 
          <storetype>PKCS11</storetype> 
          <storepass>...</storepass> 
          <tsa>http://timestamp.globalsign.com/scripts/timestamp.dll</tsa> 
          <providerClass>sun.security.pkcs11.SunPKCS11</providerClass> 
          <providerArg>${project.basedir}/src/main/resources/token/eToken.config</providerArg> 
          <alias>le-d0e453de-66db-414a-8fa8-0a07cfad66b5</alias> <!-- i took the alias from the article as an example --> 
          <verify>true</verify> 
         </sign> 
         <verbose>true</verbose> 
         <updateManifestEntries> 
          <Application-Name>MyApp</Application-Name> 
          <Permissions>all-permissions</Permissions> 
          <Codebase>...</Codebase> 
          <Application-Library-Allowable-Codebase>...</Application-Library-Allowable-Codebase> 
          <Caller-Allowable-Codebase>...</Caller-Allowable-Codebase> 
         </updateManifestEntries> 

         <!-- BUILDING PROCESS --> 
         <pack200> 
          <enabled>false</enabled> 
         </pack200> 
        </configuration> 
       </plugin> 
       <plugin> 
        <groupId>org.apache.maven.plugins</groupId> 
        <artifactId>maven-assembly-plugin</artifactId> 
        <version>2.6</version> 
        <configuration> 
         <descriptorRefs> 
          <descriptorRef>jar-with-dependencies</descriptorRef> 
         </descriptorRefs> 
        </configuration> 
        <executions> 
         <execution> 
          <id>assemble-all</id> 
          <phase>package</phase> 
          <goals> 
           <goal>single</goal> 
          </goals> 
         </execution> 
        </executions> 
       </plugin> 
      </plugins> 
     </build> 
    </profile> 

Answer 1

Avertissement: Je suis le mainteneur du javafx-maven-plugin.

cela a rapporté et maintenant être disponible, pour plus d'informations, voir ce lien: https://github.com/javafx-maven-plugin/javafx-maven-plugin/issues/291

Comme déjà mentionné sur le JavaFX-maven-plugin, voici la solution pour obtenir ce travail:

<plugin> 
    <groupId>com.zenjava</groupId> 
    <artifactId>javafx-maven-plugin</artifactId> 
    <version>8.8.4-SNAPSHOT</version> 
    <!-- this configuration is share among all executions --> 
    <configuration> 
     <mainClass>fqdn.to.your.MainClass</mainClass> 
     <description>test signing</description> 
     <title>launch</title> 
     <verbose>true</verbose> 
     <j2seVersion>1.8+</j2seVersion> 
     <appName>simpleApplicationName</appName> 

     <!-- this only sets the field inside jar-file --> 
     <allPermissions>true</allPermissions> 
    </configuration> 
    <executions> 
     <execution> 
      <!-- required before build-native, creates target/jfx/app --> 
      <id>create-jfxjar</id> 
      <phase>package</phase> 
      <goals> 
       <goal>build-jar</goal> 
      </goals> 
     </execution> 
     <execution> 
      <!-- creates target/jfx/web --> 
      <id>create-jnlp-bundle</id> 
      <phase>package</phase> 
      <goals> 
       <goal>build-native</goal> 
      </goals> 
      <!-- this configuration is only specific to this execution --> 
      <configuration> 
       <!-- as we only want to create the JNLP-package, use fixed bundler-ID --> 
       <bundler>jnlp<bundler> 

       <bundleArguments> 
        <!-- this makes the JNLP-file having permissions being set --> 
        <!-- AND it is the trigger for signing jar-files using jarsigner --> 
        <jnlp.allPermisions>true</jnlp.allPermisions> 

        <!-- the JNLP-bundler is a bit picky about its parametes, it does not use <appName> --> 
        <jnlp.outfile>simpleApplicationName</jnlp.outfile> 
       </bundleArguments> 

       <!-- this setting is required for the new "jarsigner"-feature --> 
       <noBlobSigning>true</noBlobSigning> 

       <!-- these are required, please change them for your own requirements --> 
       <keyStoreAlias>myalias</keyStoreAlias> 
       <keyStorePassword>mypass</keyStorePassword> 

       <!-- as this keystore is no file, please disable file-checks --> 
       <skipKeyStoreChecking>true</skipKeyStoreChecking> 
       <!-- this is new too and required, as PKCS11 does not want some keypass --> 
       <skipKeypassWhileSigning>true</skipKeypassWhileSigning> 

       <!-- this is used for additional parameters for the jarsigner command --> 
       <additionalJarsignerParameters> 
        <additionalJarsignerParameter>-keystore</additionalJarsignerParameter> 
        <additionalJarsignerParameter>NONE</additionalJarsignerParameter> 
        <additionalJarsignerParameter>-storetype</additionalJarsignerParameter> 
        <additionalJarsignerParameter>PKCS11</additionalJarsignerParameter> 
        <additionalJarsignerParameter>-tsa</additionalJarsignerParameter> 
        <additionalJarsignerParameter>http://timestamp.globalsign.com/scripts/timestamp.dll</additionalJarsignerParameter> 
        <additionalJarsignerParameter>-providerClass</additionalJarsignerParameter> 
        <additionalJarsignerParameter>sun.security.pkcs11.SunPKCS11</additionalJarsignerParameter> 
        <additionalJarsignerParameter>-providerArg</additionalJarsignerParameter> 
        <additionalJarsignerParameter>${project.basedir}/src/main/resources/token/eToken.config</additionalJarsignerParameter> 
        <!-- I DO KNOW that this is verbose ... --> 
       </additionalJarsignerParameters> 

       <!-- the jnlp-bundler gets a bit messy, lots of files, so we want to mimic "jfx:web"-folder-structure --> 
       <nativeOutputDir>${project.build.directory}/jfx/web</nativeOutputDir> 
      </configuration> 
     </execution> 
    </executions> 
</plugin> 

Cette version n'est pas encore disponible mais disponible en tant que SNAPSHOT à partir de sonatype-repository.

Answer 2

Pourquoi ne pas utiliser javafxpackager? Il peut créer à la fois Java Webstart et des formulaires exécutables et les signer facilement. C'est ce que recommande Oracle. Je l'ai été pendant des années et l'aime vraiment. J'utilise ses tâches fourmi mais je crois qu'ils ont aussi un plugin maven.

Voici plus d'informations:

http://docs.oracle.com/javafx/2/deployment/packager.htm

Answer 3

Je suis face de même problème ces jours-ci. Je réussis à l'aide d'une « solution »

Solution 1 (un pot de graisse):

• maven-ombre-plugin (il est le moyen facile de créer un « pot de graisse » avec dépendances et juste signer ce pot)
• maven-plugin-jarsigner (pour signer le pot à l'ombre du jeton)
• webstart-maven-plugin (uniquement pour but jnlp)

Voici mon pom:

<dependencies> 

    ... 

</dependencies> 

<build> 
    <plugins> 

     ... 

     <plugin> 
      <groupId>org.apache.maven.plugins</groupId> 
      <artifactId>maven-shade-plugin</artifactId> 
      <version>3.0.0</version> 
      <executions> 
       <execution> 
        <id>shade</id> 
        <phase>package</phase> 
        <goals> 
         <goal>shade</goal> 
        </goals> 
        <configuration> 
         <transformers> 
          <transformer 
           implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer"> 
           <manifestEntries> 
            <Permissions>all-permissions</Permissions> 
           </manifestEntries> 
          </transformer> 
         </transformers> 
        </configuration> 
       </execution> 
      </executions> 
     </plugin> 
     <plugin> 
      <groupId>org.apache.maven.plugins</groupId> 
      <artifactId>maven-jarsigner-plugin</artifactId> 
      <version>1.4</version> 
      <executions> 
       <execution> 
        <id>sign</id> 
        <phase>package</phase> 
        <goals> 
         <goal>sign</goal> 
        </goals> 
       </execution> 
      </executions> 
      <configuration> 
       <keystore>NONE</keystore> 
       <storepass>******</storepass> 
       <storetype>PKCS11</storetype> 
       <tsa>http://rxxxxx.globalsign.com/advanced</tsa> 
       <providerClass>sun.security.pkcs11.SunPKCS11</providerClass> 
       <providerArg>${project.basedir}/src/main/eToken.cfg</providerArg> 
       <alias>xxxxxxxxxxxxx</alias> 
       <archive>${project.build.directory}/${project.build.FinalName}.${project.packaging}</archive> 
       <arguments> 
        <argument>-J-Dhttp.proxyHost=my.proxy.com</argument> 
        <argument>-J-Dhttp.proxyPort=8080</argument> 
       </arguments> 
      </configuration> 
     </plugin> 
     <plugin> 
      <groupId>org.codehaus.mojo.webstart</groupId> 
      <artifactId>webstart-maven-plugin</artifactId> 
      <version>1.0-beta-7</version> 
      <executions> 
       <execution> 
        <id>build-jnlp</id> 
        <phase>package</phase> 
        <goals> 
         <goal>jnlp</goal> 
        </goals> 
       </execution> 
      </executions> 
      <configuration> 
       <makeArchive>false</makeArchive> 
       <jnlp> 
        <inputTemplateResourcePath>${project.basedir}/src/main/jnlp</inputTemplateResourcePath> 
        <inputTemplate>template.vm</inputTemplate> 
        <mainClass>test</mainClass> 
       </jnlp> 
      </configuration> 
     </plugin> 
    </plugins> 

</build> 

Et modèle.vm:

<?xml version="1.0" encoding="utf-8"?> 
<jnlp spec="1.0+" codebase="http://www.mycompany.com/poc" href="launch.jnlp"> 
    <information> 
     <title>xxxx</title> 
     <vendor>$project.Organization.Name</vendor> 
     <homepage href="http://www.mycompany.com" /> 
     <description>$project.Description</description> 
     <offline-allowed /> 
    </information> 
    <security> 
     <all-permissions /> 
    </security> 
    <resources> 
     <j2se version="1.7+" /> 
     $dependencies 
    </resources> 
    <application-desc main-class="$mainClass" /> 
</jnlp> 

Solution 2 (plusieurs bocaux):

• maven-jar-plugin (pour définir toutes les autorisations dans le récipient principal manifeste)
• webstart-maven-plugin (uniquement pour but jnlp)
• maven-plugin-jarsigner (pour signer tous les pots en/jnlp de jeton)

Voici mon pom:

<dependencies> 

    ... 

</dependencies> 

<build> 
    <plugins> 

     ... 
     <plugin> 
      <groupId>org.apache.maven.plugins</groupId> 
      <artifactId>maven-jar-plugin</artifactId> 
      <executions> 
       <execution> 
        <id>update-manifest-permissions-entry</id> 
        <phase>prepare-package</phase> 
        <goals> 
         <goal>jar</goal> 
        </goals> 
       </execution> 
      </executions> 
      <configuration> 
       <archive> 
        <addMavenDescriptor>false</addMavenDescriptor> 
        <manifestEntries> 
         <Permissions>all-permissions</Permissions> 
        </manifestEntries> 
       </archive> 
      </configuration> 
     </plugin> 
     <plugin> 
      <groupId>org.codehaus.mojo</groupId> 
      <artifactId>webstart-maven-plugin</artifactId> 
      <version>1.0-beta-7</version> 
      <executions> 
       <execution> 
        <id>build-jnlp</id> 
        <phase>package</phase> 
        <goals> 
         <goal>jnlp</goal> 
        </goals> 
       </execution> 
      </executions> 
      <configuration> 
       <makeArchive>false</makeArchive> 
       <jnlp> 
        <inputTemplateResourcePath>${project.basedir}/src/main/jnlp</inputTemplateResourcePath> 
        <inputTemplate>template.vm</inputTemplate> 
        <mainClass>test</mainClass> 
       </jnlp> 
      </configuration> 
     </plugin> 
     <plugin> 
      <groupId>org.apache.maven.plugins</groupId> 
      <artifactId>maven-jarsigner-plugin</artifactId> 
      <version>1.4</version> 
      <executions> 
       <execution> 
        <id>sign</id> 
        <phase>install</phase> 
        <goals> 
         <goal>sign</goal> 
        </goals> 
       </execution> 
      </executions> 
      <configuration> 
       <keystore>NONE</keystore> 
       <storepass>xxxxx</storepass> 
       <storetype>PKCS11</storetype> 
       <tsa>http://xxx.globalsign.com/xxx</tsa> 
       <providerClass>sun.security.pkcs11.SunPKCS11</providerClass> 
       <providerArg>${project.basedir}/src/main/eToken.cfg</providerArg> 
       <alias>xxxxxxx</alias> 
       <processMainArtifact>false</processMainArtifact> 
       <archiveDirectory>${project.build.directory}/jnlp</archiveDirectory> 
       <arguments> 
        <argument>-J-Dhttp.proxyHost=myproxy.company.com</argument> 
        <argument>-J-Dhttp.proxyPort=8080</argument> 
       </arguments> 
      </configuration> 
     </plugin> 
    </plugins> 

</build> 

Et template.vm:

<?xml version="1.0" encoding="utf-8"?> 
<jnlp spec="1.0+" codebase="http://www.mycompany.com/poc" href="launch.jnlp"> 
    <information> 
     <title>xxxx</title> 
     <vendor>$project.Organization.Name</vendor> 
     <homepage href="http://www.mycompany.com" /> 
     <description>$project.Description</description> 
     <offline-allowed /> 
    </information> 
    <security> 
     <all-permissions /> 
    </security> 
    <resources> 
     <j2se version="1.7+" /> 
     $dependencies 
    </resources> 
    <application-desc main-class="$mainClass" /> 
</jnlp>