Time for action – signing the plug-ins

Integrating signatures into a Tycho build is a matter of adding a plug-in to the build script. In addition, Java properties need to be passed in to provide access to the arguments required by the jarsigner tool.

  1. Add the plug-in to the parent pom.xml file:
    <plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-jarsigner-plugin</artifactId>
  <version>1.2</version>
  <executions>
    <execution>
      <id>sign</id>
      <goals>
        <goal>sign</goal>
      </goals>
    </execution>
  </executions>
</plugin>
  2. Run mvn package and an error is shown:
    [ERROR] Failed to execute goal
  org.apache.maven.plugins:maven-jarsigner-
  plugin:1.2:sign (sign)
  on project com.packtpub.e4.parent:
  The parameters 'alias' for goal
  org.apache.maven.plugins:maven-jarsigner-plugin:1.2:sign
  are missing or invalid -> [Help 1]
  3. Pass in the arguments required by jarsigner, which are supplied as Java system properties with a jarsigner prefix as follows (all on one line):
    mvn package
  -Djarsigner.alias=packtpub
  -Djarsigner.keypass=SayK3ys
  -Djarsigner.storepass=BarC0der
  -Djarsigner.keystore=/path/to/keystore
  4. If it is successful, the output should be as follows:
    [INFO] --- maven-jarsigner-plugin:1.2:sign (sign) @
  com.packtpub.e4.clock.ui ---
[INFO] 1 archive(s) processed
[INFO] --- maven-jarsigner-plugin:1.2:sign (sign) @
  com.packtpub.e4.feature ---
[INFO] 1 archive(s) processed
[INFO] --- maven-jarsigner-plugin:1.2:sign (sign) @
  com.packtpub.e4.update ---
[INFO] 1 archive(s) processed
  5. To run the sign step conditionally, a profile can be used. Move the sign plug-in from build to a separate top-level element profiles in pom.xml:
    <profiles>
  <profile>
    <id>sign</id>
    <build>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jarsigner-plugin</artifactId>
          ...
        </plugin>
      </plugins>
    </build>
  </profile>
</profiles>
  6. Now run the build with mvn package, and verify that it runs without signing.
  7. Run the build with signing enabled by running mvn package -Psign to enable the sign profile; it should ask for the alias, as before.
  8. To automatically enable the sign profile whenever the jarsigner.alias property is provided, add the following to the profile:
    <profile>
  <id>sign</id>
  <activation>
    <property>
      <name>jarsigner.alias</name>
    </property>
  </activation>
  <build>
    ...
  </build>
</profile>
  9. Now, run the build as mvn package -Djarstore.alias=packtpub ... to verify that signing runs without needing to specify the -Psign argument.

What just happened?

By adding the maven-jarsigner-plugin to the build, Maven signed any JAR file that was built (including the content.jar and artifacts.jar files, which don't really need to be signed). This is a standard pattern for building any signed Java content in Maven and isn't Tycho or Eclipse-specific.

The parameters to jarsigner are specified as system properties. The -D flag for Maven, like Java, is used to specify a system property on the command line. The maven-jarsigner-plugin reads its properties with a prefix of jarsigner, so the alias is passed as jarsigner.alias and the keystore as jarsigner.store.

Note that the location of the store needs to be specified as a full path, since the plug-in will run with different directories (specifically the "target" directory of the build). Attempting to use a relative path will fail.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset