Return-Path: 
 <users-return-120976-apmail-maven-users-archive=maven.apache.org@maven.apache.org>
X-Original-To: apmail-maven-users-archive@www.apache.org
Delivered-To: apmail-maven-users-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id AC27F59D7
	for <apmail-maven-users-archive@www.apache.org>;
 Thu, 12 May 2011 17:33:43 +0000 (UTC)
Received: (qmail 25679 invoked by uid 500); 12 May 2011 17:33:41 -0000
Delivered-To: apmail-maven-users-archive@maven.apache.org
Received: (qmail 25621 invoked by uid 500); 12 May 2011 17:33:41 -0000
Mailing-List: contact users-help@maven.apache.org; run by ezmlm
Precedence: bulk
List-Unsubscribe: <mailto:users-unsubscribe@maven.apache.org>
List-Help: <mailto:users-help@maven.apache.org>
List-Post: <mailto:users@maven.apache.org>
List-Id: "Maven Users List" <users.maven.apache.org>
Reply-To: "Maven Users List" <users@maven.apache.org>
Delivered-To: mailing list users@maven.apache.org
Received: (qmail 25613 invoked by uid 99); 12 May 2011 17:33:41 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 12 May 2011 17:33:41 +0000
X-ASF-Spam-Status: No, hits=-0.0 required=5.0
	tests=SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (athena.apache.org: local policy)
Received: from [12.107.188.150] (HELO mx1.compuware.com) (12.107.188.150)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 12 May 2011 17:33:34 +0000
Received: from nasa-dtw-ex009.nasa.cpwr.corp (unknown [10.10.0.230])
	by mx1.compuware.com (Postfix) with ESMTP id 0F4AE72D6D4
	for <users@maven.apache.org>; Thu, 12 May 2011 17:33:12 +0000 (GMT)
Importance: normal
Priority: normal
Received: from nasa-yul-ex001.nasa.cpwr.corp ([172.22.174.37]) by
 nasa-dtw-ex009.nasa.cpwr.corp with Microsoft SMTPSVC(6.0.3790.3959);
 Thu, 12 May 2011 13:33:11 -0400
x-mimeole: Produced By Microsoft MimeOLE V6.00.3790.4325
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
x-cr-puzzleid: {83604370-AE34-4E5E-B22B-09A674A39ED6}
Content-Class: urn:content-classes:message
x-cr-hashedpuzzle: XMA= AZeA A7TP BIUI C9sM D2U5 Eyvr Fa9X GK6v GzWe HYZH HkfL
 H3Ot IDHr JLQE
 LEpa;1;dQBzAGUAcgBzAEAAbQBhAHYAZQBuAC4AYQBwAGEAYwBoAGUALgBvAHIAZwA=;Sosha1_v1;7;{83604370-AE34-4E5E-B22B-09A674A39ED6};YQBuAHQAaABvAG4AeQAuAGQAYQBoAGEAbgBuAGUAQABjAG8AbQBwAHUAdwBhAHIAZQAuAGMAbwBtAA==;Thu,
 12 May 2011 17:33:08
 GMT;TQBhAHYAZQBuACAASgBhAHIAUwBpAGcAbgBlAHIAIABhAG4AZAAgAHQAaQBtAGUAcwB0AGEAbQBwACAAYQB1AHQAaABvAHIAaQB0AHkA
Subject: Maven JarSigner and timestamp authority
Date: Thu, 12 May 2011 13:33:08 -0400
Message-ID: 
 <F5E17F858D21DE49A70318CC9EEC8A3506530182@nasa-yul-ex001.nasa.cpwr.corp>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Maven JarSigner and timestamp authority
thread-index: AcwQyqhmrqJWqjVLSHylPyHf0rAPVA==
From: "Dahanne, Anthony" <Anthony.Dahanne@compuware.com>
To: <users@maven.apache.org>
X-OriginalArrivalTime: 12 May 2011 17:33:11.0870 (UTC)
 FILETIME=[AA9C25E0:01CC10CA]

Hello Maven users,
I'm in the process of mavenizing an ant build (alright !) but there is a
step, signing, that seems not that obvious to achieve.
I can use the maven jar signer and sign my jars ok , with :

<plugin>
	<groupId>org.apache.maven.plugins</groupId>
	<artifactId>maven-jarsigner-plugin</artifactId>
	<version>1.2</version>
	<executions>
	  <execution>
		<id>sign</id>
		<goals>
		  <goal>sign</goal>
		</goals>
	  </execution>
	  <execution>
		<id>verify</id>
		<goals>
			<goal>verify</goal>
		</goals>
	</execution>
	</executions>
	<configuration>
		  <keystore>${keystore.location}</keystore>
		  <storepass>${keystore.store.password}</storepass>
		  <keypass>${keystore.key.password}</keypass>
		  <alias>${keystore.alias}</alias>
	</configuration>
</plugin>

And setting the variables in my settings.xml.
But, I want more; in fact, the people who used to do the signing with
ant, also timestamped their jars while doing so.
Why ? because imagine your authority expires in 2012, and you signed
your jar in 2011, you do not want your users to have a security warning
when they install and use this jar in 2012+ (since when you signed it
you had the authority to do so back then in 2011; at least this is what
I understood from this process :-P )
So, with ant, they did that :

<signjar alias=3D"${sign.alias}" keystore=3D"${sign.keystore}"
	storepass=3D"${sign.storepass}"
	preservelastmodified=3D"true"
	tsaurl=3D"${tsa.url}">
	<path>
		<fileset dir=3D"${buildDirectory}/buildRepo/plugins">
			<include name=3D"**/com.company*.jar" />
		</fileset>
	</path>
</signjar>

Did you notice that "tsaurl=3Durl" ?
According to the doc, http://ant.apache.org/manual/Tasks/signjar.html
"URL for a timestamp authority for timestamped JAR files in Java1.5+"
Thing is, in maven jar signer, there is not such option :
http://maven.apache.org/plugins/maven-jarsigner-plugin/sign-mojo.html=20
Is there a maven plugin to accomplish this ?
If not, should I create a feature request on maven jar signer Jira ?
Or, but I would feel so sorry, should I use the maven ant runner plugin
to do this :-(

Thank you,
Best regards,


Anthony Dahanne
Software Developer
Compuware Montreal
75 Rue Queen, Suite 6500
Montreal, QC, Canada H3C 2N6
+1-514-798-8949


=20
Le contenu de ce courriel s'adresse au destinataire seulement. Il =
contient de l'information pouvant =C3=AAtre confidentielle. Vous ne =
devez ni le copier ni l'utiliser ni le divulguer =C3=A0 qui que ce soit =
=C3=A0 moins que vous soyez le destinataire ou une personne =
d=C3=A9sign=C3=A9e autoris=C3=A9e. Si vous le receviez par erreur, =
veuillez nous aviser imm=C3=A9diatement et le d=C3=A9truire.
=20
The contents of this e-mail are intended for the named addressee only. =
It contains information that may be confidential. Unless you are the =
named addressee or an authorized designee, you may not copy or use it, =
or disclose it to anyone else. If you received it in error please notify =
us immediately and then destroy it.
=20


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org