You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2021/08/17 21:38:48 UTC
[tomcat] branch 8.5.x updated: Update to JSign 4.0 to remove
dependency on client tools.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/8.5.x by this push:
new 7e7dbac Update to JSign 4.0 to remove dependency on client tools.
7e7dbac is described below
commit 7e7dbacc1d66cf4d50af3a4e77ee9e8509b51c0d
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Tue Aug 17 20:37:01 2021 +0100
Update to JSign 4.0 to remove dependency on client tools.
---
build.properties.default | 13 +++++++------
build.xml | 16 +++++++---------
webapps/docs/changelog.xml | 4 ++++
3 files changed, 18 insertions(+), 15 deletions(-)
diff --git a/build.properties.default b/build.properties.default
index 0a17af9..adb76cf 100644
--- a/build.properties.default
+++ b/build.properties.default
@@ -78,9 +78,10 @@ gpg.exec=/path/to/gpg
# Code signing of Windows installer
# See https://infra.apache.org/digicert-use.html for setup instructions
do.codesigning=false
-codesigning.pkcs11properties=${user.home}/.digicertone/pkcs11properties.cfg
-codesigning.alias=Tomcat-PMC-key-2021-04
+codesigning.alias=Tomcat-PMC-cert-2021-04
codesigning.digest=SHA-512
+codesigning.storetype=DIGICERTONE
+codesigning.storepass=set-this-in-build.properties
# ----- Settings to use when downloading files -----
trydownload.httpusecaches=true
@@ -297,15 +298,15 @@ findbugs.home=${base.path}/spotbugs-${findbugs.version}
findbugs.jar=${findbugs.home}/lib/spotbugs-ant.jar
findbugs.loc=${base-maven.loc}/com/github/spotbugs/spotbugs/${findbugs.version}/spotbugs-${findbugs.version}.tgz
-# ----- JSign, version 3.1 -----
+# ----- JSign, version 4.0 -----
# JSign 3.0 onwards requires Java 8 by default
# Use Java 7 build
-jsign.version=3.1
+jsign.version=4.0
-# checksums for JSign 3.1
+# checksums for JSign 4.0
jsign.checksum.enabled=true
jsign.checksum.algorithm=SHA-512
-jsign.checksum.value=481a6e7276688363106ee3492da52807577822b8114b13804df796cd143f479a50d0864215f63b9bb8120a85b2f6185b2845974872d11ff070407dd01879bb0e
+jsign.checksum.value=14e4de1755df3a616ef2725f54542a532c7b86d6fdbc214e355554c554068471e74f348eeafebf3074afcbec53786e5b3219de61cb52ad9b01120f03c304a4e9
jsign.home=${base.path}/jsign-${jsign.version}-java7
jsign.jar=${jsign.home}/jsign-${jsign.version}-java7.jar
diff --git a/build.xml b/build.xml
index d30526a..15c8fb8 100644
--- a/build.xml
+++ b/build.xml
@@ -2288,9 +2288,8 @@ skip.installer property in build.properties" />
unless="skip.installer" depends="-installer-create-uninstaller,setup-jsign"
if="${do.codesigning}">
<jsign file="${tomcat.dist}/Uninstall.exe"
- keystore="${codesigning.pkcs11properties}"
- storepass="NONE"
- storetype="PKCS11"
+ storepass="${codesigning.storepass}"
+ storetype="${codesigning.storetype}"
alias="${codesigning.alias}"
alg="${codesigning.digest}"
tsaurl="http://timestamp.digicert.com"/>
@@ -2317,12 +2316,11 @@ skip.installer property in build.properties" />
description="Builds and optionally signs the Windows installer"
depends="-installer,setup-jsign" if="${do.codesigning}" >
<jsign file="${tomcat.release}/v${version}/bin/${final.name}.exe"
- keystore="${codesigning.pkcs11properties}"
- storepass="NONE"
- storetype="PKCS11"
- alias="${codesigning.alias}"
- alg="${codesigning.digest}"
- tsaurl="http://timestamp.digicert.com"/>
+ storepass="${codesigning.storepass}"
+ storetype="${codesigning.storetype}"
+ alias="${codesigning.alias}"
+ alg="${codesigning.digest}"
+ tsaurl="http://timestamp.digicert.com"/>
<!-- .exe has changed so need to redo checksums and OpenPGP signature -->
<delete file="${tomcat.release}/v${version}/bin/${final.name}.exe.asc" />
<delete file="${tomcat.release}/v${version}/bin/${final.name}.exe.sha512" />
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 2fa5c43..9666a16 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -168,6 +168,10 @@
Fix failing build when building on non-English locales. Pull request
<pr>441</pr> provided by Dachuan J. (markt)
</fix>
+ <update>
+ Update to JSign version 4.0 to enable code signing without the need for
+ the installation of additional client tools. (markt)
+ </update>
</changelog>
</subsection>
</section>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [tomcat] branch 8.5.x updated: Update to JSign 4.0 to remove
dependency on client tools.
Posted by Mark Thomas <ma...@apache.org>.
On 17/08/2021 23:33, Mark Thomas wrote:
> On 17/08/2021 22:38, markt@apache.org wrote:
>> This is an automated email from the ASF dual-hosted git repository.
>>
>> markt pushed a commit to branch 8.5.x
>> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>>
>>
>> The following commit(s) were added to refs/heads/8.5.x by this push:
>> new 7e7dbac Update to JSign 4.0 to remove dependency on client
>> tools.
>
> Probably one for Emmanuel.
>
> I'm trying to do a release build from 8.5.x with 1.7.0_80_x64 (Oracle)
> and I am getting the following error below on signing.
>
> Any hints on how to fix this?
I enabled TLS debug logging which provided enough clues to figure out
the problem. It was a cipher suite problem. Once I enabled the specific
cipher suite that both DigiCert's service and Java 7 support then I was
able to complete a release build with Java 7u80.
I need to test building on Linux and MacOS. I'll update BUILDING.txt
once that testing is complete.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [tomcat] branch 8.5.x updated: Update to JSign 4.0 to remove
dependency on client tools.
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Mark,
On 8/17/21 18:33, Mark Thomas wrote:
> On 17/08/2021 22:38, markt@apache.org wrote:
>> This is an automated email from the ASF dual-hosted git repository.
>>
>> markt pushed a commit to branch 8.5.x
>> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>>
>>
>> The following commit(s) were added to refs/heads/8.5.x by this push:
>> new 7e7dbac Update to JSign 4.0 to remove dependency on client
>> tools.
>
> Probably one for Emmanuel.
>
> I'm trying to do a release build from 8.5.x with 1.7.0_80_x64 (Oracle)
> and I am getting the following error below on signing.
>
> Any hints on how to fix this?
This looks to me like an untrusted client certificate error.
-chris
>
> C:\asf-tomcat\build.xml:2295: Couldn't sign
> C:\asf-tomcat\output\dist\Uninstall.exe
> at net.jsign.JsignTask.execute(JsignTask.java:183)
> at
> org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:293)
> at sun.reflect.GeneratedMethodAccessor4.invoke(Unknown Source)
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>
> at java.lang.reflect.Method.invoke(Method.java:606)
> at
> org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:106)
> at org.apache.tools.ant.Task.perform(Task.java:352)
> at org.apache.tools.ant.Target.execute(Target.java:437)
> at org.apache.tools.ant.Target.performTasks(Target.java:458)
> at
> org.apache.tools.ant.Project.executeSortedTargets(Project.java:1406)
> at org.apache.tools.ant.Project.executeTarget(Project.java:1377)
> at
> org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:41)
>
> at org.apache.tools.ant.Project.executeTargets(Project.java:1261)
> at org.apache.tools.ant.Main.runBuild(Main.java:857)
> at org.apache.tools.ant.Main.startAnt(Main.java:236)
> at org.apache.tools.ant.launch.Launcher.run(Launcher.java:287)
> at org.apache.tools.ant.launch.Launcher.main(Launcher.java:112)
> Caused by: net.jsign.SignerException: Couldn't sign
> C:\asf-tomcat\output\dist\Uninstall.exe
> at net.jsign.SignerHelper.sign(SignerHelper.java:517)
> at net.jsign.JsignTask.execute(JsignTask.java:181)
> ... 16 more
> Caused by: net.jsign.bouncycastle.operator.RuntimeOperatorException:
> exception obtaining signature: java.security.GeneralSecurityException:
> javax.net.ssl.SSLHandshakeException: Received fatal alert:
> handshake_failure
> at
> net.jsign.bouncycastle.operator.jcajce.JcaContentSignerBuilder$1.getSignature(Unknown
> Source)
> at
> net.jsign.bouncycastle.cms.SignerInfoGenerator.generate(Unknown Source)
> at
> net.jsign.bouncycastle.cms.CMSSignedDataGenerator.generate(Unknown Source)
> at
> net.jsign.bouncycastle.cms.CMSSignedDataGenerator.generate(Unknown Source)
> at
> net.jsign.asn1.authenticode.AuthenticodeSignedDataGenerator.generate(AuthenticodeSignedDataGenerator.java:50)
>
> at
> net.jsign.AuthenticodeSigner.createSignedData(AuthenticodeSigner.java:363)
> at net.jsign.AuthenticodeSigner.sign(AuthenticodeSigner.java:334)
> at net.jsign.SignerHelper.sign(SignerHelper.java:509)
> ... 17 more
> Caused by: java.security.SignatureException:
> java.security.GeneralSecurityException:
> javax.net.ssl.SSLHandshakeException: Received fatal alert:
> handshake_failure
> at
> net.jsign.jca.SigningServiceSignature.engineSign(SigningServiceSignature.java:64)
>
> at
> java.security.Signature$Delegate.engineSign(Signature.java:1205)
> at java.security.Signature.sign(Signature.java:578)
> ... 25 more
> Caused by: java.security.GeneralSecurityException:
> javax.net.ssl.SSLHandshakeException: Received fatal alert:
> handshake_failure
> at
> net.jsign.jca.DigiCertOneSigningService.sign(DigiCertOneSigningService.java:207)
>
> at
> net.jsign.jca.SigningServiceSignature.engineSign(SigningServiceSignature.java:62)
>
> ... 27 more
> Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert:
> handshake_failure
> at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
> at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
> at
> sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1979)
> at
> sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1086)
> at
> sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1332)
>
> at
> sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1359)
> at
> sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1343)
> at
> sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
> at
> sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
>
> at
> sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1092)
>
> at
> sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
>
> at net.jsign.jca.RESTClient.query(RESTClient.java:62)
> at net.jsign.jca.RESTClient.post(RESTClient.java:47)
> at
> net.jsign.jca.DigiCertOneSigningService.sign(DigiCertOneSigningService.java:202)
>
> ... 28 more
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [tomcat] branch 8.5.x updated: Update to JSign 4.0 to remove
dependency on client tools.
Posted by Mark Thomas <ma...@apache.org>.
On 17/08/2021 22:38, markt@apache.org wrote:
> This is an automated email from the ASF dual-hosted git repository.
>
> markt pushed a commit to branch 8.5.x
> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>
>
> The following commit(s) were added to refs/heads/8.5.x by this push:
> new 7e7dbac Update to JSign 4.0 to remove dependency on client tools.
Probably one for Emmanuel.
I'm trying to do a release build from 8.5.x with 1.7.0_80_x64 (Oracle)
and I am getting the following error below on signing.
Any hints on how to fix this?
Thanks,
Mark
C:\asf-tomcat\build.xml:2295: Couldn't sign
C:\asf-tomcat\output\dist\Uninstall.exe
at net.jsign.JsignTask.execute(JsignTask.java:183)
at
org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:293)
at sun.reflect.GeneratedMethodAccessor4.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at
org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:106)
at org.apache.tools.ant.Task.perform(Task.java:352)
at org.apache.tools.ant.Target.execute(Target.java:437)
at org.apache.tools.ant.Target.performTasks(Target.java:458)
at
org.apache.tools.ant.Project.executeSortedTargets(Project.java:1406)
at org.apache.tools.ant.Project.executeTarget(Project.java:1377)
at
org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:41)
at org.apache.tools.ant.Project.executeTargets(Project.java:1261)
at org.apache.tools.ant.Main.runBuild(Main.java:857)
at org.apache.tools.ant.Main.startAnt(Main.java:236)
at org.apache.tools.ant.launch.Launcher.run(Launcher.java:287)
at org.apache.tools.ant.launch.Launcher.main(Launcher.java:112)
Caused by: net.jsign.SignerException: Couldn't sign
C:\asf-tomcat\output\dist\Uninstall.exe
at net.jsign.SignerHelper.sign(SignerHelper.java:517)
at net.jsign.JsignTask.execute(JsignTask.java:181)
... 16 more
Caused by: net.jsign.bouncycastle.operator.RuntimeOperatorException:
exception obtaining signature: java.security.GeneralSecurityException:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at
net.jsign.bouncycastle.operator.jcajce.JcaContentSignerBuilder$1.getSignature(Unknown
Source)
at
net.jsign.bouncycastle.cms.SignerInfoGenerator.generate(Unknown Source)
at
net.jsign.bouncycastle.cms.CMSSignedDataGenerator.generate(Unknown Source)
at
net.jsign.bouncycastle.cms.CMSSignedDataGenerator.generate(Unknown Source)
at
net.jsign.asn1.authenticode.AuthenticodeSignedDataGenerator.generate(AuthenticodeSignedDataGenerator.java:50)
at
net.jsign.AuthenticodeSigner.createSignedData(AuthenticodeSigner.java:363)
at net.jsign.AuthenticodeSigner.sign(AuthenticodeSigner.java:334)
at net.jsign.SignerHelper.sign(SignerHelper.java:509)
... 17 more
Caused by: java.security.SignatureException:
java.security.GeneralSecurityException:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at
net.jsign.jca.SigningServiceSignature.engineSign(SigningServiceSignature.java:64)
at java.security.Signature$Delegate.engineSign(Signature.java:1205)
at java.security.Signature.sign(Signature.java:578)
... 25 more
Caused by: java.security.GeneralSecurityException:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at
net.jsign.jca.DigiCertOneSigningService.sign(DigiCertOneSigningService.java:207)
at
net.jsign.jca.SigningServiceSignature.engineSign(SigningServiceSignature.java:62)
... 27 more
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert:
handshake_failure
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
at
sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1979)
at
sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1086)
at
sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1332)
at
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1359)
at
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1343)
at
sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
at
sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1092)
at
sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
at net.jsign.jca.RESTClient.query(RESTClient.java:62)
at net.jsign.jca.RESTClient.post(RESTClient.java:47)
at
net.jsign.jca.DigiCertOneSigningService.sign(DigiCertOneSigningService.java:202)
... 28 more
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org