|
1 | 1 | # GradleJarSigner |
2 | | -This is a simple gradle plugin that uses ant to execute the [jarsigner](https://docs.oracle.com/javase/8/docs/technotes/tools/windows/jarsigner.html) utility. This embeds a signature in the jar file that can be used to verify its contents haven't been modified and came from a specific source. This does NOT create an external GPG signature file. The built in signing plugin does that. |
3 | 2 |
|
4 | | -I made this because I got tired of having to configure everything manually for this in every project, and I wanted to have a simple way of signing data in Github Actions. |
| 3 | +This is a simple gradle plugin that uses ant to execute |
| 4 | +the [jarsigner](https://docs.oracle.com/javase/8/docs/technotes/tools/windows/jarsigner.html) |
| 5 | +utility. This embeds a signature in the jar file that can be used to verify its |
| 6 | +contents haven't been modified and came from a specific source. |
| 7 | + |
| 8 | +I made this because I got tired of having to configure everything manually for |
| 9 | +this in every project, and I wanted to have a simple way of signing data in |
| 10 | +GitHub Actions. |
| 11 | + |
| 12 | +> [!NOTE] |
| 13 | +> This does **not** create an external GPG signature file. The built-in |
| 14 | +> [signing](https://docs.gradle.org/current/userguide/publishing_signing.html) |
| 15 | +> plugin does that. |
5 | 16 |
|
6 | 17 | ### Usage |
7 | | -I haven't published this to the gradle plugin portal yet so until I do you need to have this in your settings.gradle. |
8 | | - |
9 | | - pluginManagement { |
10 | | - repositories { |
11 | | - gradlePluginPortal() |
12 | | - maven { url = 'https://maven.minecraftforge.net/' } |
13 | | - } |
14 | | - } |
15 | | -And in your build.gradle |
16 | | - |
17 | | - plugins { |
18 | | - id 'net.minecraftforge.gradlejarsigner' |
19 | | - } |
20 | | -This will add a extension name 'jarSigner' to your project where you can configure the signing information, or you can configure it in each signing task. |
21 | | - |
22 | | - jarSigner { |
23 | | - alias = 'key_name' |
24 | | - storePass = 'store_password' |
25 | | - keyPass = 'key_password' |
26 | | - keyStoreFile = file('keystore_file') |
27 | | - // Or you can specify the keystore file as a base64 encoded string. |
28 | | - // This is mainly meant to allow it to be passed in via a Github Action Secret |
29 | | - keyStoreData = 'aGVsbG8=' |
30 | | - } |
31 | | - |
32 | | -Then to sign the `jar` task you can do `jarSigner.sign(jar)`, this works for any Jar or Zip task. |
33 | | -You can also configure the task itself to specify any of the information set in the global config as well as any filters on the data you wish to sign. |
34 | | - |
35 | | - jarSigner.sign(jar) { |
36 | | - alias = 'key_name' |
37 | | - storePass = 'store_password' |
38 | | - keyPass = 'key_password' |
39 | | - keyStoreFile = file('keystore_file') |
40 | | - exclude 'unsigned.txt' |
41 | | - } |
42 | | - |
43 | | -### Github Secrets |
44 | | -A large motivation for this was wanting to use Github Actions and still be able to sign my built files. Github does not allow you to have files as [secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets) just strings and the workarounds I found involved committing a encrypted form of your keystore to your repo and then decrypting it during an Action. Instead I decided to allow you to specify the keystore file as a base64 encoded string which can be used as a Secret. |
45 | | - |
46 | | -You can either manually configure the information by pulling the secrets yourself, or I added a simple helper `jarSigner.autoDetect()` which which search the following locations in order: |
47 | | - |
48 | | - if (prefix != null) { |
49 | | - project.findProperty(prefix + '.' + prop) |
50 | | - System.getenv(prefix + '.' + prop) |
51 | | - } |
52 | | - project.findProperty(prop) |
53 | | - System.getenv(prop) |
54 | | -`prefix` defaults to `project.name` you can override by calling `jarSigner.autoDetect('prefix')` |
| 18 | + |
| 19 | +You can apply the plugin by declaring it in your `build.gradle` file. |
| 20 | + |
| 21 | +```groovy |
| 22 | +plugins { |
| 23 | + id 'net.minecraftforge.gradlejarsigner' |
| 24 | +} |
| 25 | +``` |
| 26 | + |
| 27 | +This will add an extension named `jarSigner` to your project where you can |
| 28 | +configure the signing information. |
| 29 | + |
| 30 | +```groovy |
| 31 | +jarSigner { |
| 32 | + alias = 'key_name' |
| 33 | + storePass = 'store_password' |
| 34 | + keyPass = 'key_password' |
| 35 | + keyStoreFile = file('keystore_file') |
| 36 | + // Or you can specify the keystore file as a base64 encoded string. |
| 37 | + // This is mainly meant to allow it to be passed in via a Github Action Secret |
| 38 | + keyStoreData = 'aGVsbG8=' |
| 39 | +} |
| 40 | +``` |
| 41 | + |
| 42 | +Then, to sign the `jar` task, you can do `jarSigner.sign(jar)`. This works for |
| 43 | +any Jar or Zip task. |
| 44 | + |
| 45 | +You can also configure the task itself to specify any of the information set in |
| 46 | +the global config as well as any filters on the data you wish to sign. |
| 47 | + |
| 48 | +```groovy |
| 49 | +jarSigner.sign(jar) { |
| 50 | + alias = 'key_name' |
| 51 | + storePass = 'store_password' |
| 52 | + keyPass = 'key_password' |
| 53 | + keyStoreFile = file('keystore_file') |
| 54 | + exclude 'unsigned.txt' |
| 55 | +} |
| 56 | +``` |
| 57 | + |
| 58 | +### GitHub Secrets |
| 59 | + |
| 60 | +A large motivation for this was wanting to use GitHub Actions and still be able |
| 61 | +to sign my built files. GitHub does not allow you to have files as |
| 62 | +[secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets), |
| 63 | +just strings. The workarounds I found involved committing an encrypted form of |
| 64 | +your keystore to your repo and then decrypting it during an Action. I instead |
| 65 | +decided to allow you to specify the keystore file as a base64 encoded string |
| 66 | +which can be used as a secret. |
| 67 | + |
| 68 | +You can either manually configure the information by pulling the secrets |
| 69 | +yourself, or I added a simple helper `jarSigner.autoDetect()` which which search |
| 70 | +the following locations in order: |
| 71 | + |
| 72 | +```groovy |
| 73 | +if (prefix != null) { |
| 74 | + project.findProperty(prefix + '.' + prop) |
| 75 | + System.getenv(prefix + '.' + prop) |
| 76 | +} |
| 77 | +project.findProperty(prop) |
| 78 | +System.getenv(prop) |
| 79 | +``` |
| 80 | + |
| 81 | +`prefix` defaults to `project.name`. You can override this by calling |
| 82 | +`jarSigner.autoDetect('prefix')`. |
55 | 83 |
|
56 | 84 | For the following properties: |
57 | 85 |
|
58 | | - jarSigner { |
59 | | - alias = 'SIGN_KEY_ALIAS' |
60 | | - keyPass = 'SIGN_KEY_PASSWORD' |
61 | | - storePass = 'SIGN_KEYSTORE_PASSWORD' |
62 | | - keyStoreData = 'SIGN_KEYSTORE_DATA' |
63 | | - } |
| 86 | +```groovy |
| 87 | +jarSigner { |
| 88 | + alias = 'SIGN_KEY_ALIAS' |
| 89 | + keyPass = 'SIGN_KEY_PASSWORD' |
| 90 | + storePass = 'SIGN_KEYSTORE_PASSWORD' |
| 91 | + keyStoreData = 'SIGN_KEYSTORE_DATA' |
| 92 | +} |
| 93 | +``` |
64 | 94 |
|
65 | 95 | ### Conclusion |
66 | | -I'm sure there are improvements that could be made, but it works good enough for me so this is where I'm at. If you have suggestions for improvements feel free to submit them. But the point of this plugin is to be small, simple, and single purpose. |
| 96 | + |
| 97 | +I'm sure there are improvements that could be made, but it works good enough for |
| 98 | +me so this is where I'm at. If you have suggestions for improvements feel free |
| 99 | +to submit them. But the point of this plugin is to be small, simple, and single |
| 100 | +purpose. |
0 commit comments