How can you integrate trusted signing with jarsigner?

Question

How can you integrate trusted signing with jarsigner?

John Earle 50

We currently sign java .jar files with jarsigner (java jdk utility) using a 3rd party certificate (cloud-based) and their support for the jarsigner utility. Is there any way to integrate trusted signing with the jarsigner?

Sandeep G-MSFT 20,911 Reputation points Microsoft Employee Moderator

2024-07-22T03:59:34.34+00:00

@John Earle

Thank you for posting this in Microsoft Q&A.

I am looking into this issue and will get back to you post my research.
Adrian Gonzalez 0 Reputation points

2024-10-08T15:54:07.8933333+00:00

@John Earle did you manage to make this work for you? we're also struggling with this and got no reply back from MS.

@Sandeep G-MSFT any update?
Chant Development 0 Reputation points

2024-10-08T16:36:29.9433333+00:00

Hi Andrian. No. This remains an issue for us. We have not heard anything from MS.

1 answer

Your answer

Sandeep G-MSFT 20,911 Reputation points Microsoft Employee Moderator

2024-07-22T03:59:34.34+00:00

@John Earle

Thank you for posting this in Microsoft Q&A.

I am looking into this issue and will get back to you post my research.
Adrian Gonzalez 0 Reputation points

2024-10-08T15:54:07.8933333+00:00

@John Earle did you manage to make this work for you? we're also struggling with this and got no reply back from MS.

@Sandeep G-MSFT any update?
Chant Development 0 Reputation points

2024-10-08T16:36:29.9433333+00:00

Hi Andrian. No. This remains an issue for us. We have not heard anything from MS.

Answer 1

FS 0

Seems https://ebourg.github.io/jsign/ could work?

John Earle 50 Reputation points

2025-01-05T18:33:56.34+00:00

It is supposed to be in next release 7.0.
John Earle 50 Reputation points

2025-01-05T18:36:22.5066667+00:00

Possibly. The support for trusted-signing is part of the next release 7.0.
John Earle 50 Reputation points

2025-02-05T16:42:12.07+00:00

jsign 7.0 does work with jarsigner.
Adrian Gonzalez 0 Reputation points

2025-02-05T17:44:18.8066667+00:00

jsign can't sign jar's:

Windows executables, DLLs, Microsoft Installers (MSI), Cabinet files (CAB), Catalog files (CAT), Windows packages (APPX/MSIX), Microsoft Dynamics 365 extension packages, NuGet packages and scripts (PowerShell, VBScript, JScript, WSF)
John Earle 50 Reputation points

2025-02-05T18:20:29.7066667+00:00

jarsigner -J-cp -Jjsign-7.0.jar ...

worked for us
Justin Warwick 1 Reputation point

2025-02-05T18:55:59.5033333+00:00
@Adrian Gonzales : I think your citation refers to invoking the jar as a standalone utility in and of itself; scroll down a little more... https://ebourg.github.io/jsign/#jar-signing

@John Earle do you mind sharing your full command line and JDK version number? I feel like I'm close but I'm getting Error occurred during initialization of boot layer

java.lang.module.FindException: Module java not found after executing:

$accessTokenFilename = "az_access_token.json" #recently minted with "az" cli tool. jarsigner.exe -J-cp -Jjsign-7.0.jar -J--add-modules -Jjava.sql ` -verify -verbose ` -providerClass net.jsign.jca.JsignJcaProvider ` -providerArg wus3.codesigning.azure.net ` -tsa http://timestamp.acs.microsoft.com ` -keystore NONE ` -storetype TRUSTEDSIGNING ` -storepass (Get-Content $accessTokenFilename | ConvertFrom-Json).accessToken ` .\fndutil.jar priv-trusted-signing/priv-int-Code-Signing-Certificates

Using JDK v21, jarsigner 21.0.5, by the way.
John Earle 50 Reputation points

2025-02-05T20:17:47.8+00:00

jarsigner -tsa "http://timestamp.acs.microsoft.com" -tsadigestalg SHA-256 -sigalg SHA256withRSA -digestalg SHA-256 -J-cp -Jjsign-7.0.jar -J--add-modules -Jjava.sql -providerClass net.jsign.jca.JsignJcaProvider -providerArg "xxx.codesigning.azure.net" -keystore NONE -storetype TRUSTEDSIGNING -storepass "pasted-accessToken-value-from-JSON-string" -signedjar "outpath\signed\mylib.jar" "inpath\tobesigned\mylib.jar" trustedsigningaccount/accountlogin
Sohaib 0 Reputation points

2025-02-27T16:50:31.9433333+00:00

@Justin Warwick Did you ever get it sorted?

I've basically ended up with the same command as yours but I've been getting

jarsigner: Certificate chain not found for: my-account/my-app. my-account/my-app must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

I tried with @John Earle 's command as well but same output:

jarsigner \

-tsa "http://timestamp.acs.microsoft.com" \

-tsadigestalg SHA-256 \

-sigalg SHA256withRSA \

-digestalg SHA-256 \

-J-cp -Jjsign.jar -J--add-modules -Jjava.sql \

-providerClass net.jsign.jca.JsignJcaProvider \

-providerArg "neu.codesigning.azure.net" \

-keystore NONE \

-storetype TRUSTEDSIGNING \

-storepass $TOKEN \

-signedjar "./signed.jar" "./1.jar" my-account/my-app
John Earle 50 Reputation points

2025-02-27T17:00:12.9366667+00:00

Verify that your token has not expired. They usually only last a couple of hours.
Sohaib 0 Reputation points

2025-02-28T09:06:48.02+00:00

I've done it as soon as the token is generated. I'm not sure if i'm the account i'm using to generate the auth token doesn't have the right access (but it should do) or if I've got the <account>/<profile> wrong for my alias but again that should be correct as far as I can see. Did you hit any of these issues when you signed jars? Thanks again :)

I got the signing working but I'm receiving this error for the certs:

Warning:

The signer's certificate chain is invalid. Reason: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The TSA certificate chain is invalid. Reason: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The timestamp will expire within one year on 2025-04-17.

POSIX file permission and/or symlink attributes detected. These attributes are ignored when signing and are not protected by the signature.

The signer certificate will expire on 2025-03-02.

Is this result the same for you guys?

Share via

How can you integrate trusted signing with jarsigner?

1 answer

Your answer