Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the jsign.certfile system property to feed an additional certificate with the JCA provider #215

Closed

Conversation

umireon
Copy link

@umireon umireon commented Apr 11, 2024

Maybe related to #119

Background

We have developed an Android app and Google requires us to sign our build artifact when we upload it to Google Play Console.
For better security, we'd like to sign our build artifact with Google Cloud KMS and we found this excellent product.
We composed the following command to sign our aab with Cloud KMS.

jarsigner -J-cp -Jjsign-6.0.jar -J--add-modules -Jjava.sql \
  -providerClass net.jsign.jca.JsignJcaProvider \
  -providerArg projects/PROJECT_ID/locations/global/keyRings/KEYRING_NAME \
  -keystore NONE \
  -storetype GOOGLECLOUD \
  -storepass "$(gcloud auth print-access-token)" \
  -certchain full-chain.pem \
  ./app/build/outputs/bundle/release/app-release.aab \
  KEY_NAME/cryptoKeyVersions/VERSION

However, it does not work with the following error.

jarsigner error: java.lang.RuntimeException: Failed to load the certificate from 

I read the code of jsign and found that the GOOGLECLOUD provider needs the public key to sign but Cloud KMS does not store certificates.
In this PR, we'd like to propose to add a way to feed an additional certificate to Jsign when it is used as a JCA provider.

Overview

When Jsign is used as a JCA provider, namely with jarsigner, we can provide additional options via the system property of Java.
Adding this PR enable users to sign JAR artifacts with jarsigner and Cloud KMS by the following command.

jarsigner -J-cp -Jjsign-6.1-SNAPSHOT.jar -J--add-modules -Jjava.sql \
  -J-Djsign.certfile=full-chain.pem \
  -providerClass net.jsign.jca.JsignJcaProvider \
  -providerArg projects/PROJECT_ID/locations/global/keyRings/KEYRING_NAME \
  -keystore NONE \
  -storetype GOOGLECLOUD \
  -storepass "$(gcloud auth print-access-token)" \
  -certchain full-chain.pem \
  ./app/build/outputs/bundle/release/app-release.aab \
  KEY_NAME/cryptoKeyVersions/VERSION

Thank you in advance!

Best,

@ebourg
Copy link
Owner

ebourg commented Apr 11, 2024

Thank you for the PR, however this is maybe not necessary.

Jsign needs to know the algorithm of the key for signing (RSA of ECDSA), when using Google Cloud there are 3 ways to get this information:

  • from the certificate chain provided, however the jarsigner certchain parameter isn't propagated to Jsign
  • from the key description, but this requires an extra GCP API call and the cloudkms.cryptoKeyVersions.get permission or the Cloud KMS Viewer role
  • from the alias if the algorithm is appended, like this: mykey/cryptoKeyVersions/2:RSA

Assuming you are using the latest release of Jsign, I think you can fix this issue either by adjusting the permissions or by appending :RSA to the key alias. Let me know if this works for you.

@umireon
Copy link
Author

umireon commented Apr 11, 2024

Thank you for suggestion, I will try later!

@umireon
Copy link
Author

umireon commented Apr 11, 2024

I got it worked with the RSA suffix! Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants