You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by el...@apache.org on 2026/09/20 10:54:14 UTC
(maven-jarsigner-plugin) branch master updated: Fix misleading tsapolicyid warning when no TSA servers configured (#162)
This is an automated email from the ASF dual-hosted git repository.
elharo pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-jarsigner-plugin.git
The following commit(s) were added to refs/heads/master by this push:
new 30d3542 Fix misleading tsapolicyid warning when no TSA servers configured (#162)
30d3542 is described below
commit 30d35420fa6aa7d0277b75ed1fbd15b22c5fcd88
Author: Elliotte Rusty Harold <el...@users.noreply.github.com>
AuthorDate: Sun Sep 20 06:54:08 2026 -0400
Fix misleading tsapolicyid warning when no TSA servers configured (#162)
When neither tsa nor tsacert are configured, the tsapolicyid length
check produces a misleading 'Too many OIDs' warning even though the
real problem is that no TSA servers are configured at all.
Fix by guarding the count comparison with a check that at least one
TSA source is configured before emitting the warning.
Fixes #149
---
.../maven/plugins/jarsigner/JarsignerSignMojo.java | 3 +-
.../plugins/jarsigner/JarsignerSignMojoTest.java | 44 ++++++++++++++++++++++
2 files changed, 46 insertions(+), 1 deletion(-)
diff --git a/src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java b/src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java
index 1d64fe9..ff5caea 100644
--- a/src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java
+++ b/src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java
@@ -287,7 +287,8 @@ public class JarsignerSignMojo extends AbstractJarsignerMojo {
if (tsa.length > 0 && tsacert.length > 0) {
getLog().warn(getMessage("warnUsageTsaAndTsacertSimultaneous"));
}
- if (tsapolicyid.length > tsa.length || tsapolicyid.length > tsacert.length) {
+ if ((tsa.length > 0 || tsacert.length > 0)
+ && (tsapolicyid.length > tsa.length || tsapolicyid.length > tsacert.length)) {
getLog().warn(getMessage("warnUsageTsapolicyidTooMany", tsapolicyid.length, tsa.length, tsacert.length));
}
if (tsa.length > 1 && maxTries == 1) {
diff --git a/src/test/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojoTest.java b/src/test/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojoTest.java
index 7dabde7..e764d2f 100644
--- a/src/test/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojoTest.java
+++ b/src/test/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojoTest.java
@@ -445,6 +445,50 @@ public class JarsignerSignMojoTest {
verify(log).info(contains("1 archive(s) processed"));
}
+ /**
+ * Test that no misleading "Too many OIDs" warning is emitted when tsapolicyid is configured
+ * but neither tsa nor tsacert are configured. See
+ * <a href="https://github.com/apache/maven-jarsigner-plugin/issues/149">issue #149</a>.
+ */
+ @Test
+ public void testTsapolicyidWarningNotEmittedWhenNoTsaConfigured() throws Exception {
+ Artifact mainArtifact = TestArtifacts.createJarArtifact(projectDir, "my-project.jar");
+ when(project.getArtifact()).thenReturn(mainArtifact);
+ when(jarSigner.execute(any(JarSignerSignRequest.class))).thenReturn(RESULT_OK);
+
+ // Configure tsapolicyid but leave tsa and tsacert empty (not configured)
+ configuration.put("tsapolicyid", "1.3.6.1.4.1.4146.2.3.1.2");
+
+ JarsignerSignMojo mojo = mojoTestCreator.configure(configuration);
+
+ mojo.execute();
+
+ // The misleading "Too many OIDs" warning must not be emitted
+ verify(log, never()).warn(contains("Too many"));
+ }
+
+ /**
+ * Test that the "Too many OIDs" warning IS emitted when tsapolicyid has more entries than
+ * tsa, and tsa is actually configured.
+ */
+ @Test
+ public void testTsapolicyidWarningEmittedWhenMoreOidsThanTsaServers() throws Exception {
+ Artifact mainArtifact = TestArtifacts.createJarArtifact(projectDir, "my-project.jar");
+ when(project.getArtifact()).thenReturn(mainArtifact);
+ when(jarSigner.execute(any(JarSignerSignRequest.class))).thenReturn(RESULT_OK);
+
+ // Configure one tsa server but two tsapolicyid entries
+ configuration.put("tsa", "http://timestamp.example.com");
+ configuration.put("tsapolicyid", "1.3.6.1.4.1.4146.2.3.1.2,2.16.840.1.114412.7.1");
+
+ JarsignerSignMojo mojo = mojoTestCreator.configure(configuration);
+
+ mojo.execute();
+
+ // The "Too many OIDs" warning should be emitted
+ verify(log).warn(contains("Too many"));
+ }
+
/** Test what is logged when verbose=false */
@Test
public void testLoggingVerboseFalse() throws Exception {