Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Provide way to sign package/bundle with custom keyfile without writing passphrase to log #3513

Closed
mungojam opened this issue Aug 16, 2019 · 10 comments · Fixed by #3522
Closed

Provide way to sign package/bundle with custom keyfile without writing passphrase to log #3513

mungojam opened this issue Aug 16, 2019 · 10 comments · Fixed by #3522
Assignees
@dellis1972
Milestone
d16-4

Comments

@mungojam
Copy link

When I run msbuild with /t:SignAndroidPackage and provide a custom keystore, the keystore and key passwords end up being written out to the build log because it logs the call made to jarsigner / apksigner.

I wanted to prevent the passwords being written to the log, so I have ended up doing the signing as a separate step. In this step I make use of the :env the suffix in jarsigner or the env: prefix in apksigner before I switched to bundles.

Below is what my build looks like now. AndroidSigning_StorePass is an environment variable that I populate in a pre-build step with the password:

    commands:
       - msbuild MyProj/MyProj.csproj /restore
         /p:Configuration=Release
         /p:AndroidSdkDirectory=/android/sdk
         /t:Package
       - jarsigner -sigalg SHA256withRSA -digestalg SHA-256
         -keystore ../my.keystore
         -keypass:env AndroidSigning_StorePass
         -storepass:env AndroidSigning_StorePass
         -signedjar ./MyProj/bin/Release/com.me.myapp-Signed.aab
         ./MyProj/obj/Release/android/bin/com.me.myapp.aab $AndroidSigning_KeyAlias

The above seems to work fine, but it took a lot of effort to get there. It would be better if I could use the standard build target but still keep the sensitive data out of the log. Then I wouldn't need to do the custom signing and could benefit from any future tweaks that you put in the standard build target.
@dellis1972 dellis1972 self-assigned this Aug 20, 2019
@dellis1972 dellis1972 added this to the d16-4 milestone Aug 20, 2019
@dellis1972
Copy link
Contributor

@mungojam Thanks for the bug report, I will take a look at adding a couple of new MSBuild properties which will provide the env and file versions of the -keypass and -storepass command line arguments.

In fact it might be easier to allow the user to do something like

/p:AndroidSigningStorePass=env:Foo //use an EnvVar
/p:AndroidSigningStorePass=file:Foo // use a File
/p:AndroidSigningStorePass=Foo // use Foo

we can then just parse those values in the task an use the correct argument.

@mungojam
Copy link
Author

mungojam commented Aug 20, 2019 •
edited

In fact it might be easier to allow the user to do something like

/p:AndroidSigningStorePass=env:Foo //use an EnvVar
/p:AndroidSigningStorePass=file:Foo // use a File
/p:AndroidSigningStorePass=Foo // use Foo

we can then just parse those values in the task an use the correct argument

happy with that solution for my own use. It does rely on people not happening to start their passwords with env: or file: though, unlikely but not implausible. I expect the same issue affects the underlying apksigner though. Up to you :)

@dellis1972
Copy link
Contributor

Yup, if you have env: or file: in your password that would be a problem lol.

dellis1972 added a commit to dellis1972/xamarin-android that referenced this issue Aug 20, 2019
@dellis1972
[Xamarin.Android.Build.Tasks] Add EnvVar and File support for Signing…
d465144 
… APKs.

Fixes xamarin#3513

Both `jarsigner` and `apksigner` provide a way to use both
files and environment variables for the store and key passwords.

For `jarsigner` you have to suffix the parameter switch with either
`:env` or `:file` to use those options. For `apksigner` you have
to prefix the value with either `:env`, `:file` or `:pass`.

We currently only support raw passwords.

This commit adds support for using both `env:` and `file:` for
signing. When providing values for the MSBuild properties
such as `AndroidSigningStorePass` and `AndroidSigningKeyPass` all
they need to do is prefix the value with `env:` or `file:` to
use the alternative parameters.

	/p:AndroidSigningKeyPass=env:MyPasswordEnvVar
	/p:AndroidSigningKeyPass=file:PathToPasswordFile

This will stop passwords appearing in build logs etc.
@dellis1972 dellis1972 mentioned this issue Aug 20, 2019
Merged
dellis1972 added a commit to dellis1972/xamarin-android that referenced this issue Aug 21, 2019
@dellis1972
[Xamarin.Android.Build.Tasks] Add EnvVar and File support for Signing…
a7549b4 
… APKs.

Fixes xamarin#3513

Both `jarsigner` and `apksigner` provide a way to use both
files and environment variables for the store and key passwords.

For `jarsigner` you have to suffix the parameter switch with either
`:env` or `:file` to use those options. For `apksigner` you have
to prefix the value with either `:env`, `:file` or `:pass`.

We currently only support raw passwords.

This commit adds support for using both `env:` and `file:` for
signing. When providing values for the MSBuild properties
such as `AndroidSigningStorePass` and `AndroidSigningKeyPass` all
they need to do is prefix the value with `env:` or `file:` to
use the alternative parameters.

	/p:AndroidSigningKeyPass=env:MyPasswordEnvVar
	/p:AndroidSigningKeyPass=file:PathToPasswordFile

This will stop passwords appearing in build logs etc.
dellis1972 added a commit to dellis1972/xamarin-android that referenced this issue Aug 21, 2019
@dellis1972
[Xamarin.Android.Build.Tasks] Add EnvVar and File support for Signing…
00042ad 
… APKs.

Fixes xamarin#3513

Both `jarsigner` and `apksigner` provide a way to use both
files and environment variables for the store and key passwords.

For `jarsigner` you have to suffix the parameter switch with either
`:env` or `:file` to use those options. For `apksigner` you have
to prefix the value with either `:env`, `:file` or `:pass`.

We currently only support raw passwords.

This commit adds support for using both `env:` and `file:` for
signing. When providing values for the MSBuild properties
such as `AndroidSigningStorePass` and `AndroidSigningKeyPass` all
they need to do is prefix the value with `env:` or `file:` to
use the alternative parameters.

	/p:AndroidSigningKeyPass=env:MyPasswordEnvVar
	/p:AndroidSigningKeyPass=file:PathToPasswordFile

This will stop passwords appearing in build logs etc.
dellis1972 added a commit to dellis1972/xamarin-android that referenced this issue Aug 22, 2019
@dellis1972
[Xamarin.Android.Build.Tasks] Add EnvVar and File support for Signing…
343f598 
… APKs.

Fixes xamarin#3513

Both `jarsigner` and `apksigner` provide a way to use both
files and environment variables for the store and key passwords.

For `jarsigner` you have to suffix the parameter switch with either
`:env` or `:file` to use those options. For `apksigner` you have
to prefix the value with either `:env`, `:file` or `:pass`.

We currently only support raw passwords.

This commit adds support for using both `env:` and `file:` for
signing. When providing values for the MSBuild properties
such as `AndroidSigningStorePass` and `AndroidSigningKeyPass` all
they need to do is prefix the value with `env:` or `file:` to
use the alternative parameters.

	/p:AndroidSigningKeyPass=env:MyPasswordEnvVar
	/p:AndroidSigningKeyPass=file:PathToPasswordFile

This will stop passwords appearing in build logs etc.
jonpryor pushed a commit that referenced this issue Aug 24, 2019
@dellis1972 @jonpryor
[Xamarin.Android.Build.Tasks] EnvVar & File support for Signing APKs (#…
04a4308 
…3522)

Fixes: #3513

Both `jarsigner` and `apksigner` provide a way to use both files and
environment variables for the store and key passwords.

For `jarsigner` you have to suffix the parameter switch with either
`:env` or `:file` to use those options.  For `apksigner` you have to
prefix the value with either `:env`, `:file` or `:pass`.

We currently only support raw passwords.

This commit adds support for using both `env:` and `file:` for signing.
When providing values for the MSBuild properties such as
`$(AndroidSigningStorePass)` and `$(AndroidSigningKeyPass)` all they
need to do is prefix the value with `env:` or `file:` to use the
alternative parameters.

	/p:AndroidSigningKeyPass=env:MyPasswordEnvVar
	/p:AndroidSigningKeyPass=file:PathToPasswordFile

This will stop passwords appearing in build logs etc.
@brendanzagaeski
Copy link
Member

Release status update

A new Preview version has now been published on Windows that includes the fix for this item. The fix is not yet included in a Release version. I will update this item again when a Release version is available that includes the fix.

The fix is not yet available on macOS. I will update this item again when a Preview version with the fix is available on macOS.

Fix included in Xamarin.Android 10.0.99.100.

Fix included on Windows in Visual Studio 2019 version 16.4 Preview 1. To try the Preview version that includes the fix, check for the latest updates in Visual Studio Preview.

Fix not yet available on macOS.

@mungojam
Copy link
Author

mungojam commented Sep 25, 2019 •
edited

Thanks, I actually need it for the Linux build of android which I fetch off Jenkins as part of a docker image. But that Linux build has been failing since earlier this year:

#2009

@mrk-han
Copy link

mrk-han commented Oct 2, 2019

Hey @mungojam , we are also seeking the Android.Xamarin.Linux build and just noticed it has been failing for sometime now. Have you received any communication on this? The main build looks like it is just failing to communicate to Github... https://jenkins.mono-project.com/view/Xamarin.Android/job/xamarin-android-linux/

@mungojam
Copy link
Author

mungojam commented Oct 2, 2019

I've not heard anything on it unfortunately

@brendanzagaeski
Copy link
Member

I'll aim to raise a question with team about whether there are plans to enable the Linux continuous build job again in the future.

For the moment, I'll add an update for the Windows and macOS packages.

Release status update

A new Release version has now been published on Windows that includes the fix for this item. The fix is not yet published in a Release version on macOS. I will update this item again when a Release version is available on macOS that includes the fix.

Fix included in Xamarin.Android 10.1.0.30.

Fix included on Windows in Visual Studio 2019 version 16.4. To get the new version that includes the fix, check for the latest updates or install the latest version from https://visualstudio.microsoft.com/downloads/.

(Fix also included on macOS in Visual Studio 2019 for Mac version 8.4 Preview 2.1 and higher. To try the Preview version that includes the fix, check for the latest updates on the Preview updater channel.)

@mrk-han
Copy link

mrk-han commented Jan 4, 2020

I'll aim to raise a question with team about whether there are plans to enable the Linux continuous build job again in the future.

Any word back on this? Thanks @brendanzagaeski

@brendanzagaeski
Copy link
Member

Apologies for the slow reply. I found out that there is some work in progress to see about making .deb packages available again for more recent Xamarin.Android commits, but the timeline for availability isn't yet known. I'll stay in the loop on that work and update #2009 and #4116 when there's news.

@xamarin xamarin locked as resolved and limited conversation to collaborators Jun 5, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@dellis1972 dellis1972

Labels
None yet
Projects
None yet
Milestone
d16-4
4 participants
@dellis1972 @mungojam @brendanzagaeski @mrk-han