How would you sign a .jar file using the Azure Key Vault in a Dev Ops Pipeline

Question

How would you sign a .jar file using the Azure Key Vault in a Dev Ops Pipeline

Rusty Crabbs 65

The requirements for code signing is that the certificate must be in a HSM based environment. Azure Key Vault is supported, so how does one sign a .jar file when the certificate is in an HSM environment? The certificate is non-exportable.

Emmanuel Bourg 0

You can also use the Jsign JCA provider to use an Azure KeyVault key with jarsigner.

The syntax looks like this:

jarsigner -J-cp -Jjsign.jar -J--add-modules -Jjava.sql \
          -providerClass net.jsign.jca.JsignJcaProvider \
          -providerArg <vault-name> \
          -keystore NONE \
          -storetype AZUREKEYVAULT \
          -storepass <api-access-token> \
          application.jar <key-name>

Accepted answer

1 additional answer

Your answer

Emmanuel Bourg 0 Reputation points

2024-01-06T16:36:07.0866667+00:00

You can also use the Jsign JCA provider to use an Azure KeyVault key with jarsigner.

The syntax looks like this:

jarsigner -J-cp -Jjsign.jar -J--add-modules -Jjava.sql \ -providerClass net.jsign.jca.JsignJcaProvider \ -providerArg <vault-name> \ -keystore NONE \ -storetype AZUREKEYVAULT \ -storepass <api-access-token> \ application.jar <key-name>

Answer 1

@Rusty Crabbs

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: How does one sign a .jar file when the certificate is in an HSM environment?

Solution: This could be done by Integrating KeyVault JCA provider with Jarsigner

If you have any other questions or are still running into more issues, please let me know.
Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Thanks,

Akshay Kaushik

Answer 2

Rusty Crabbs 65

This is the answer.

https://github.com/backwind1233/AzureDocs/blob/main/AzureJavaSDK/JCA/integrate_keyvault_JCA_provider_with_jarsigner.md

It is easy to configure and use.

Rusty Crabbs 65 Reputation points

2023-09-05T17:01:39.0833333+00:00

This solution doesn't work. The jarsigner comes back with an error:

arsigner error: java.lang.RuntimeException: private key is not a DSA or RSA key
Akshay-MSFT 17,951 Reputation points Microsoft Employee Moderator

2023-09-13T12:30:38.0333333+00:00

The error is as per documentation Jarsigner supported Algorithms are** DSA, RSA, ECDSA **.

Share via

How would you sign a .jar file using the Azure Key Vault in a Dev Ops Pipeline

1 additional answer

Your answer