[MJAR-67] jar:sign - Jars containing invalid remains of older signatures won't get signed

[jira-importer]

Gottfried Ganßauge opened MJAR-67 and commented

I'm trying to ease the burden of applet deployment by integrating every dependency of that applet into the applet's .jar archive.
For this purpose I'm using the unpack goal of the dependency plugin (see attached POM).
For a particular case I had to integrate an already signed applet.

There is no way I can get the integrated jar signed using jar:sign - I always get an error from jarsigner (see attached error.log).
The problem seems to be that jarsigner is called with -verify - although I'm explicitely turning it of in plugin configuration.
When calling jarsigned from the command line without -verify it runs to completion.
When running it with -verify from the command line the same error occurs as in the maven build.

---

Affects: 2.1

Attachments:

• error.log (39.82 kB)
• jar-plugin.patch (1.12 kB)
• MJAR-67.diff (1.60 kB)
• pom.xml (3.23 kB)

1 votes, 1 watchers

[jira-importer]

Gottfried Ganßauge commented

I'm attaching a patch to SIgnJarMojo which avoids the issue by ignoring exceptions thrown on the attempt to check for an already signed jar.
This passes all tests but I couldn't add a new test as I'm not sure how to provoke the error without a broken jar file at hand.

[jira-importer]

Gottfried Ganßauge commented

a patch generated by running "svn diff" on my changed tree

[jira-importer]

Jerome Lacoste commented

The problem seems to be that jarsigner is called with -verify - although I'm explicitely turning it of in plugin configuration.

I have a feeling that the attached patch is not enough right way to fix the issue,

The exception should be thrown by default and a user flag should be there to allow bypassing the failed check.
Also the log message should be warn instead of info. Patch coming.

Finally you could also try to remove signatures (try the webstart:unsign mojo)

Another solution was for JarSignVerifyMojo to not throw an exception when errorWhenNotSigned is true, which I didn't like much,

[jira-importer]

Jerome Lacoste commented

Force the user to add a flag to bypass this issue. Failures cause by signing an already signed jar should not go unnoticed.

So the exception is thrown by default and a user flag is added to allow bypassing the failed check.
Finally the log message is a warning instead of info.

[jira-importer]

Benjamin Bentmann commented

The jarsigner related goals in this plugin will be deprecated, please use the dedicated maven-jarsigner-plugin instead.