Skip to content

Commit 99f3302

Browse files
adangeladangel
committed
Support JAR Signing for the update site
1 parent 461504e commit 99f3302

File tree

9 files changed

+202
-2
lines changed

9 files changed

+202
-2
lines changed

‎.ci/README.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Build Scripts for pmd-eclipse-plugin
2+
3+
## JAR Signing
4+
5+
Same solution as <https://github.com/spotbugs/spotbugs/issues/779>, using the Let's Encrypt certificate
6+
for pmd-code.org:
7+
8+
```
9+
$ export CI_SIGN_PASSPHRASE=...
10+
$ openssl pkcs12 -export -in Lets_Encrypt_pmd-code.org_2021-03-25.pem \
11+
-name eclipse-plugin \
12+
-password env:CI_SIGN_PASSPHRASE \
13+
-out pmd-eclipse-plugin.p12
14+
$ jarsigner -verbose \
15+
-keystore .ci/files/pmd-eclipse-plugin.p12 \
16+
-storepass changeit \
17+
-keypass changeit \
18+
-tsa http://timestamp.digicert.com \
19+
path/to/plugin-jar.jar \
20+
eclipse-plugin
21+
```
22+
23+
Note: The file "Lets_Encrypt_pmd-code.org_2021-03-25.pem" contains the private key, the certificate
24+
and intermediate certificates.
25+
26+
The file `pmd-eclipse-plugin.p12` is stored as `.ci/files/pmd-eclipse-plugin.p12.asc`, encrypted with PMD_CI_SECRET_PASSPHRASE.
27+
28+
Encrypt it via:
29+
30+
printenv PMD_CI_SECRET_PASSPHRASE | gpg --symmetric --cipher-algo AES256 --batch --armor \
31+
--passphrase-fd 0 \
32+
pmd-eclipse-plugin.p12
33+
34+
Decrypt it via:
35+
36+
printenv PMD_CI_SECRET_PASSPHRASE | gpg --batch --yes --decrypt \
37+
--passphrase-fd 0 \
38+
--output pmd-eclipse-plugin.p12 pmd-eclipse-plugin.p12.asc
39+
chmod 600 pmd-eclipse-plugin.p12
40+
41+
Signing the jar manually via `jarsigner` is difficult, since it changes the jar file and the p2 repo metadata
42+
fails with the wrong checksum. Therefore jarsigning is integrated via [maven-jarsigner-plugin](https://maven.apache.org/plugins/maven-jarsigner-plugin/). See also <https://stackoverflow.com/questions/7956267/tycho-jar-signing>.
43+
44+
Note: The Let's Encrypt certificate expires in May 2021. But while signing a digital timestamp is created
45+
using [DigiCert's Timestamp Server](https://knowledge.digicert.com/generalinformation/INFO4231.html). That's
46+
why the signature is valid longer than the certificate.

‎.ci/build.sh‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ function build() {
3939
pmd_ci_setup_secrets_private_env
4040
pmd_ci_setup_secrets_ssh
4141
pmd_ci_maven_setup_settings
42+
extract_keystore
4243
pmd_ci_log_group_end
4344

4445
if pmd_ci_maven_isSnapshotBuild; then
@@ -58,7 +59,7 @@ function snapshot_build() {
5859
# Build and upload the update site to Bintray
5960
xvfb-run --auto-servernum ./mvnw clean verify --show-version --errors --batch-mode \
6061
--no-transfer-progress \
61-
--activate-profiles snapshot-properties,release-composite
62+
--activate-profiles snapshot-properties,release-composite,sign
6263

6364
local qualifiedVersion
6465
qualifiedVersion="$(basename net.sourceforge.pmd.eclipse.p2updatesite/target/net.sourceforge.pmd.eclipse.p2updatesite-*.zip)"
@@ -113,7 +114,7 @@ function release_build() {
113114
# Build and deploy the update site to bintray
114115
xvfb-run --auto-servernum ./mvnw clean verify --show-version --errors --batch-mode \
115116
--no-transfer-progress \
116-
--activate-profiles release-composite
117+
--activate-profiles release-composite,sign
117118
pmd_ci_log_group_end
118119

119120
pmd_ci_log_group_start "Update Github Releases"
@@ -266,4 +267,13 @@ For older versions, see <https://sourceforge.net/projects/pmd/files/pmd-eclipse/
266267
" > index.md
267268
}
268269

270+
function extract_keystore() {
271+
local -r keystore=".ci/files/pmd-eclipse-plugin.p12"
272+
pmd_ci_log_info "Extracting keystore ${keystore}..."
273+
printenv PMD_CI_SECRET_PASSPHRASE | gpg --batch --yes --decrypt \
274+
--passphrase-fd 0 \
275+
--output "${keystore}" "${keystore}.asc"
276+
chmod 600 "${keystore}"
277+
}
278+
269279
build

‎.ci/files/pmd-eclipse-plugin.p12.asc‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
-----BEGIN PGP MESSAGE-----
2+
3+
jA0ECQMCNBTrjKBgGin/0uwBN4Ot2VLOFHXZ2TNe8gnvfe2X6hGPegr4TOBhPtwh
4+
q4acBLaPNTBPLthWYSrPH3AH737cKinXXSzV9XwCRA+NGEEF8SBGeIzMN0t6ZHsd
5+
LtRqihvU925rnWaEGWc/DwKR86iubEx7xGdhxMBeWQ/yLw3NH/wV2Iy4InN/lpjJ
6+
TpkIRFhbg9zIfCVbW+XPJFlO3dPGDggK28o3PQl7uoiKCG9bI1/Sm+aBzQPqYTrD
7+
R87cYjjl+xv42/vgHjGua4bFfHNRK0KPc1U9JPyVmIEcB/uziRtmqfbTpv2B0jNc
8+
/Ec82PPz80Jpf7ijNt+T9sywtr1gGSYuA4ExmXlP/jmSDVsLHymTbF8k0tsWPYVn
9+
srP6D3dZqc0/i5Dv/cAAXvyv5GuiwigYKv+ikO5uJs4Dlf80roZwS4CjN0c+UUpr
10+
n77QWhQ788mu1iqRGMXAhZNcVxPpQHTc4v+mcxvYYryy7TTzMkdxuouZ4dFBr/Fi
11+
5uNiXxqFoUS1LWCZQOYsY+ByKvPbVhwcCC9vdhBhjcb2cUgZezKBDd/hIw7xbQXr
12+
i2obiCONAy1h80fqAixG/oYYE/46j8LE5oUi+lJtjiUc8VooN3R1E03XjZnyTtkP
13+
f1MzDOnDxYw5wmabEANOlBlFrqVeEKg7tyUCMr8+9HbGDqPtC1E3xyBKJnBqSN93
14+
TSund5o/Uce3YdsQbTmz0OM+LCmlCr3gFhCA/xq6DErFGn2csbsvSjbINdP+cdlO
15+
dy9rOw77KDddQ4RuAGvGjsjPKl76WV8gmTpkjXdL8i35h0zOVtJBdVHrKP+M40g5
16+
8NHK9I7jRkkFKswmDNy26m2UJSzaWtkfmXElwMk36ahXacFt7B6dD2a1brzx/m5w
17+
vW0meVNhaArZ9gQrZ8q7CZhlYvk3Tj8HSLnLV72YoqdTp+0UMahcqtMAMxxIIoQf
18+
DUJeSMZryFsulWh6qnyEQzDbwRMdY+rI6SOKuKlQaEtEbRqkYvs3Gx0JdH2xcfJO
19+
hG5ukkkmdqxheys0ldY8fg04mHd1d4Vx3PTRvUDo5ZLu85Yml+c1Pq4hlvxqV6/f
20+
jqRsD/hU/JlFm7tN29irvnA/YuFs+dDcYRp4jThQBlVgB4jr7tuL63RoMsg510SU
21+
9KokrKAXocpz1orC1HscROntHJdUubUGibAsbuXtQ2f0QHPXRF2/r8l7Ny6GmsbK
22+
OZZ/XhMsD4WQrEY0eb6NnxN4bCBLGxSvE8HTwXftmG2zswRmfy0S+pwtjsgb1H0T
23+
LyyJe7tdtqaLIDmW8JaybxwKEs9vEfheK1fkf2qbgRh8ANa1vqRqdidYUi+LiQB4
24+
YabjFSjOraEfTANxfaaGzOWjJDepcqsfIY0QpKdR/i9zoDKvpRQ2aj/sP8DaJqbT
25+
DigQOGyd8gAdUfesQXw8LsNuIYffFD8BnphLAKsRAU3hw/QRGhrut3i945gIz1hv
26+
Vo9zIzVFvuGJ3enZKkwL7g9mfrq2o0Q4culkGw/0yfae+W+jZo9/VSArYGM0opUJ
27+
y6elkUZuNA7Rs9MX9MOFw8muNrktNCm1WbgsYk+mvgYzwX8Zpfs7nmyMNMAf66UO
28+
eHw4qNU70FJy1eivQea5fgzMY4xYMJjeQkO4Rvu7dOf/eWv7Mof0uGUTzv4VXlpz
29+
f+XmBAmO0fX+AEtOyaqU0HMGkLTaOxJdPVCYGAd5adLTeRvumE9Qrc32yESKk2xc
30+
PM8lHOm3VuT4hDv265iEGH2kpfPGEa7UoFR/3GNcSyu4TGUfsAUrmU5Gx43bPhpR
31+
UI2OAGMJKkEMDKn6AtM8LztfYSBhy3jimf9B/62prdAUXUAlvRatWm7SnPpw3Vf1
32+
Hteeb7SmuECX4Ywux41enDyXr9oU6s0jtdh0LXlfYi63unjUP/ety19B6CwPnSkc
33+
q5n4374IvgjuswDxOkc8kCxVG+o7U2tgSzZzzM7Pv5o8LSrFL2dRUGEgRhkkQBKO
34+
jaNaBxPDL12Q2Bd3mz6t8BW1giYNOE+W1gTvbhgWaseC4Uzl9iClzuMBp/U+xNV3
35+
S95pNFcI14JZmUeIngjv2/URfce8a4fh0od5xUgQCkGuFw2y4RZM9la2BItQ7AfH
36+
a/895nNnkMbOJCPtSyq5Hle1TVD2oyyTug2JRYt0tzUzOIDsnF6AWEEp74ypBoUr
37+
PJUUmS85eXbl7LOBG7blnnN/HX+yyjh92UBvvGlFntBtM4T/Bgi/ebheCIJSfNPv
38+
eqleOHBwr3u25rr6HrYbhR0EMuJXOVbqTCuLov3v8ik6oLkBh1jGUXSFM2rs1slB
39+
KdWteW26OzMbsGjTijl5nB6FhmfMPksO0mD0nKbqC97wJOeL8DVPrlQJDSZDJcjQ
40+
BOB9TG0Mg2cy/t9NlgvqhFzw5Ledr8BGu2QF8/q9Ah4ywcW0eUJ60pSb4SYYyKPF
41+
T9huJh9nMH/8UDjy1IbEGAjkflAsiLUF3BUX+xMEDDzuRUyKueNAWe7yhk2TGMz+
42+
sdjPhS3azvrjhkxLvKuDHYApLf0+qyYfm6k4hZEoev4yowC817uQx6tAcsF0joVj
43+
YP5mCWOxaoJWvFHyFIHpLcq92u7rw9T/qFOnjJrgzQ726Cygxjtl7cRC6rI8Yoyu
44+
avTrnRQJt7kN78jW8quLsFXybzT9/LB/6yu1xAAYhU9p8v1lvx+Z/j68xnx90KUq
45+
+9BwG7eOjelRH5pu42crgSArvbVImmgA8pbPiPjNIh+U/I2bwPiBKUD6WDfZidrN
46+
Gt2PkEZ/20Z54bm+GLFcvcp+x+uhWArxwgvK7vc03Y+b6PdKUW3FP0KVk9LwkhHw
47+
eh9T5BqCzpjeph7Uw7lzaXC0zdOD+ebSZ3Q9zQNDClhODwoDtGg+w5f7pAKlsBK4
48+
141KopWdqZiC38YEI9YUHx6K/IvlIQwh0A40mPXbXFN2DayifrVTsQcN4vGvP2kw
49+
n4OheNFPnF6lMrDCFJs4j17D7lwByjyreVWTZLhCTGJVu2Dv+Tol4982Vj9N/2Ou
50+
RatFhVYeQsS92brFqckf05kJhPDMHGy+1hFgkFgnS2bOaGk6jLitZwd+8Q6GnZr8
51+
9pSNv8WmD5C2KKSwAPkX/LCxDR3nHssv4HhLtSY+fO7FC52JSDb8T4nNxtiaZnLg
52+
kkNrHtE6DafWZGG3BRqlNa3iKJMkcOJYby3i9OebePXULjLRTD39LUa/LQkZuA4O
53+
O8Q7y6jX2DwV3+q0InVrf71bxZ9xmX9wjfupmMLgWNNa4CIJk1mpc28kFCnR0F69
54+
gYdbdrvggFJMilzPvKXaTxf6E9/6VNUwpjHiY0XcYbhcxP4zk4WgIb2QDOeuKpYk
55+
Tnq4QvNzpu0lRqxk625IRTbLlcP691GgKTUuiO49gNvGnjU6tXqtUapQCcjqlBo0
56+
HrNE5e88snhju3zxvHzzrskUN08KcN7PdNPEjtW5rTavcBSp5A1sAjmyJZoKLflV
57+
AJyvgfV4kpm1Q/Gin8H9IBgQDylbWcEHVZuwQbO9SefLqWFvgL+L0KM4Ikyg251I
58+
Cl+9exH+yQiFa8U6pPuGULAGB7z9rEHj43WacubejHjPWsJkplOAsYoIryAIvkG8
59+
2FMpgw+ZKxYd2+srhXKjYLIQYamRmr+D4vmNcka3FI20Z0/f1H8hn/j0hutO03yM
60+
O9XgtiNaO5DdCdsQa3Rn3FE3IbEHU9XTJELlBjV4NKNtk46hvqy655ZuYQhMLxjV
61+
aqMqjieaUJ/L+bn4OnGu+8F7fag3ZpPCZEtH4J8zlXjBD/JTdr4RR1nRvW9Fqwid
62+
rD4BJZsGdtNE7KUZnmyelINl8hYphKtJLJVqJD40SP3LTXTm9humySx7zAljTJLY
63+
BOgaytzkeMOdF/B8IhgubCy4egO/LlqHW9LRJUl5AkEijurT/lzIZG8nTAeVdR7e
64+
YyUGS5C22+qPLd5Az17putBkhnfj1Z03yFd9Lyghud1Hm326LBVHvcQqY/s/erpq
65+
o+tHpBp71tw3EGO3QObDL53Oa7YuqyQHl1klMM6KKFMMOteuEl5Heg5wJ2PmVpoq
66+
kcUoQj9F7DhjmqynaquNYoed+bZ6aYjtcvVrkQFmY4kuD2FI/kVtbiF919EzYMaJ
67+
G1t7gPCzWU4DV1hyMk6OE8Ins7IL/Rsk2sn+mAmrxg3Kib5+vbQlQd3AuJTMTL/v
68+
ZrRrYJAjDvO/VRx3KT0ovPCSInZhGfJtUb70d+Lt1Q8tFcb7eWRz4vup89rPjEuR
69+
rXhxdqeHzDf2qvkm6CPLvdtXzktCBuu9lt4UrQw+vextng1w+e1+eGbBth/vHeBs
70+
LCgAM1W1P62f4ykdywecJQT5gK71I1fcPRAcuLan4nGuHq50bPuAT2kfhgt/fH7R
71+
rBb/d++1pYien0i1NdgNu6zS+JW9j3Bi77Y705aUoRtikj3LZBkAqArxoQurDrv4
72+
8GRFmb7lkT8APesXtCFT14cNvb/kQFgkBqc2P2JR5QnqHqnL58glbm+hqllokP4Z
73+
qmvi90dXWBCSKgHkR6//hEgeIG2R/aycmRrEQglH/Hs5Krv7ImIHCCWOyMDeY9hv
74+
xnFvYjDNX1oEyWxLgXg9KWsiLO12FoPSgG+q8xBwU5rA/Z37tgg0aWq/Gc15oqEF
75+
1O144jHpn01UK2TtA9h1ilQEo7x4bb/zG17HMu9vDNuh7TvFoTKpQQp6yKvp4l1k
76+
5JV2B8fQRv3792+mpdS17zhWcXSR6ly65ssI0bH9tHISsVgq40/Gi791XHcBegJ8
77+
Wkw+8/yvDuEKFljZr+g9M2iI1SImuFDKTP8hRYuqYhbrLiYECdrpb8jxHKwtTzQS
78+
+BHOOQ3uu7PT0+ggJN02KWUQ29HE0eAXgOWS+C8YTUGkaMlBS9bP/XfvxUGd4E6H
79+
8jnFqvsRBf9Vi9xHaJPk6LWfJmB51KQmfFVyr22bJBLLvvzuegaNd2iijul49KwG
80+
PJG3ra4NNSiOfY3FKsA2SFqGheh+KuOYq3JdQ6o2mG7JkxctOvv18BZl7UMJ9GeV
81+
C0FjS13Ozp+/ItA4aVrMJpiou2PwuitD1q8cnR4cEzJxUlc1/O2VTomvc6ofczYi
82+
V6Ik8bzDnbBP9MAQSZ6l6rJevadGLreSfP8YHHUUF0zw53wcsRv0SQWXOBAxotx9
83+
lz6BQRLJHNK+DgFt2AXrjUoEDZLNxSNsJaO4V8Ly8oiQlZKDGuYouoPLjOj6cpvf
84+
OHGFJnsSEqdYdyOkU00JLeEcp3UIKfhpeQR0N+RPSD83/hmrcNUnd3MKLLE8sDSv
85+
1r+Zvc7aZyypK87mNv8P4HMOUwJq54SDNS1yNYZ2jEeOiHFQOea1iZGyaJH1zWX8
86+
KdwBb0d5NVbzksfwJCeGTvwygr59dYFhnZhBvJTVUairPPwl/+O1InHkNQyF1EQv
87+
oqGkF/Ani6bobj2WLuvN4RO1ecKjeMF5nEoO6TbG0kpeDeuukUAwEe2TkWjnxXio
88+
acnAPNGQz/IVadq6YiCg+l1DG+4JgJJyoCQsvdzM4RiKqJWmAtUPWzb3ViCSnCo4
89+
/hITQksfyDyYTMQpkFsp+JaNigjBcNIDnlTIdpJFNsFGmd6uNUWbRhEYUTcnIojX
90+
TryXkl3vYVXwSHQIe0XbZwEqb+otUkVd+dtiGV2r0sRdoRgL7UGaMuuLY9F769xB
91+
6DNOLmf8NUxzoMZI2APN+o2RXULPHt95a2qwhLNsGewT2SieWEGogKxO+S8/wNgk
92+
HVzb/cYs2xpJ6A==
93+
=6F99
94+
-----END PGP MESSAGE-----

‎net.sourceforge.pmd.eclipse.p2updatesite/pom.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@
3434
<!-- note that the following must be consistent with the path schema
3535
used to publish child composite repositories and actual released p2 repositories -->
3636
<child.repository.path.prefix>../../releases/</child.repository.path.prefix>
37+
38+
<keystore>${basedir}/../${keystorePath}</keystore>
3739
</properties>
3840

3941
<build>

‎net.sourceforge.pmd.eclipse.plugin.test.fragment/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,8 @@
1313
<artifactId>net.sourceforge.pmd.eclipse.plugin.test.fragment</artifactId>
1414
<packaging>eclipse-plugin</packaging>
1515

16+
<properties>
17+
<keystore>${basedir}/../${keystorePath}</keystore>
18+
</properties>
19+
1620
</project>

‎net.sourceforge.pmd.eclipse.plugin.test/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313
<artifactId>net.sourceforge.pmd.eclipse.plugin.test</artifactId>
1414
<packaging>eclipse-test-plugin</packaging>
1515

16+
<properties>
17+
<keystore>${basedir}/../${keystorePath}</keystore>
18+
</properties>
19+
1620
<build>
1721
<plugins>
1822
<plugin>

‎net.sourceforge.pmd.eclipse.plugin/pom.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313
<artifactId>net.sourceforge.pmd.eclipse.plugin</artifactId>
1414
<packaging>eclipse-plugin</packaging>
1515

16+
<properties>
17+
<keystore>${basedir}/../${keystorePath}</keystore>
18+
</properties>
1619

1720
<dependencies>
1821
<dependency>

‎net.sourceforge.pmd.eclipse/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,8 @@
1313
<artifactId>net.sourceforge.pmd.eclipse</artifactId>
1414
<packaging>eclipse-feature</packaging>
1515

16+
<properties>
17+
<keystore>${basedir}/../${keystorePath}</keystore>
18+
</properties>
19+
1620
</project>

‎pom.xml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@
2828
<checkstyle.plugin.version>3.1.1</checkstyle.plugin.version>
2929

3030
<updatesite.orbit>https://archive.eclipse.org/tools/orbit/downloads/drops/${orbit.version}/repository/</updatesite.orbit>
31+
32+
<keystorePath>.ci/files/pmd-eclipse-plugin.p12</keystorePath>
33+
<keystore>${basedir}/${keystorePath}</keystore>
3134
</properties>
3235

3336
<repositories>
@@ -267,4 +270,34 @@
267270
</pluginManagement>
268271
</build>
269272

273+
<profiles>
274+
<profile>
275+
<id>sign</id>
276+
<build>
277+
<plugins>
278+
<plugin>
279+
<groupId>org.apache.maven.plugins</groupId>
280+
<artifactId>maven-jarsigner-plugin</artifactId>
281+
<version>3.0.0</version>
282+
<configuration>
283+
<alias>eclipse-plugin</alias>
284+
<keystore>${keystore}</keystore>
285+
<keypass>${env.CI_SIGN_PASSPHRASE}</keypass>
286+
<storepass>${env.CI_SIGN_PASSPHRASE}</storepass>
287+
<tsa>http://timestamp.digicert.com</tsa>
288+
<verbose>true</verbose>
289+
</configuration>
290+
<executions>
291+
<execution>
292+
<id>sign</id>
293+
<goals>
294+
<goal>sign</goal>
295+
</goals>
296+
</execution>
297+
</executions>
298+
</plugin>
299+
</plugins>
300+
</build>
301+
</profile>
302+
</profiles>
270303
</project>

0 commit comments

Comments
 (0)