java - 如何使用 Maven JarSigner 签署多个 Jar

Question

我有一个从 maven-assembly-plugin 生成两个 JAR 文件的程序。我想使用 maven-jarsigner-plugin 对两个 jar 进行签名。当我应用基本的 jarsigner 时，它只签署了一个 JARS。当我添加存档目录字段时：

<archiveDirectory>${project.basedir}/target</archiveDirectory>

它失败，因为通用的“执行失败”签名命令，或者在签署第二个 jar 时无法将 .jar 重命名为 .jar.orig。唯一会/可能会使用 jar 的是构建过程本身。有没有其他人看过这个？当我删除上面的 'archiveDirectory' 行并只构建一个 jar 并将另一个注释掉时，这可以正常工作。

<build>
    <plugins>
        <plugin>
            <artifactId>maven-assembly-plugin</artifactId>
            <version>2.4</version>
            <executions>
                <execution>
                    <id>build-first</id>
                    <configuration>
                        <appendAssemblyId>false</appendAssemblyId>
                        <archive>
                            <manifest>
                                <mainClass>my.class.Executive</mainClass>
                            </manifest>
                            <manifestEntries>
                                <Class-Path>.</Class-Path>
                            </manifestEntries>
                        </archive>
                        <descriptorRefs>
                            <descriptorRef>jar-with-dependencies</descriptorRef>
                        </descriptorRefs>
                        <finalName>DaExecutive</finalName>
                    </configuration>
                    <phase>package</phase>
                    <goals>
                        <goal>single</goal>
                    </goals>
                </execution>
                <execution>
                    <id>build-second</id>
                    <configuration>
                        <appendAssemblyId>false</appendAssemblyId>
                        <archive>
                            <manifest>
                                <mainClass>my.class.ExampleGUI</mainClass>
                            </manifest>
                            <manifestEntries>
                                <Class-Path>.</Class-Path>
                            </manifestEntries>
                        </archive>
                        <descriptorRefs>
                            <descriptorRef>jar-with-dependencies</descriptorRef>
                        </descriptorRefs>
                        <finalName>ExampleAppGui</finalName>
                    </configuration>
                    <phase>package</phase>
                    <goals>
                        <goal>single</goal>
                    </goals>
                </execution>
            </executions>
        </plugin>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-jarsigner-plugin</artifactId>
            <version>1.4</version>
            <executions>
                <execution>
                    <id>sign</id>
                    <goals>
                        <goal>sign</goal>
                    </goals>
                </execution>
            </executions>
            <configuration>

              <archiveDirectory>${project.basedir}/target</archiveDirectory>                   
                <keystore>${project.basedir}/myKeystore.jks</keystore>
                <storepass>pw</storepass>
                <alias>ABC</alias>
                <verify>false</verify>
            </configuration>
        </plugin>
    </plugins>
</build>

这是详细的错误输出：

[DEBUG] Processing     C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\ExampleAppGui.jar
[DEBUG] cmd.exe /X /C ""C:\Program Files\Java\jdk1.8.0_181\jre\..\bin\jarsigner.exe" -keystore C:\Users\atalak\Desktop\GitRepo\DataAdapter/myKeystore.jks -storepass ***** C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\ExampleAppGui.jar key_2017"
[DEBUG] Executing: cmd.exe /X /C ""C:\Program Files\Java\jdk1.8.0_181\jre\..\bin\jarsigner.exe" -keystore C:\Users\atalak\Desktop\GitRepo\DataAdapter/myKeystore.jks -storepass ***** C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\ExampleAppGui.jar key_2017"
[DEBUG] jar signed.
[DEBUG] 
[DEBUG] Warning: 
[DEBUG] The signer certificate will expire within six months.
[DEBUG] No -tsa or -tsacert is provided and this jar is not timestamped. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2019-03-15) or after any future revocation date.
[DEBUG] Processing C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\DaExecutive.jar
[DEBUG] cmd.exe /X /C ""C:\Program Files\Java\jdk1.8.0_181\jre\..\bin\jarsigner.exe" -keystore C:\Users\atalak\Desktop\GitRepo\DataAdapter/myKeystore.jks -storepass ***** C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\DaExecutive.jar key_2017"
[DEBUG] Executing: cmd.exe /X /C ""C:\Program Files\Java\jdk1.8.0_181\jre\..\bin\jarsigner.exe" -keystore C:\Users\atalak\Desktop\GitRepo\DataAdapter/myKeystore.jks -storepass ***** C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\DaExecutive.jar key_2017"
[DEBUG] jarsigner: attempt to rename C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\DaExecutive.jar to C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\DaExecutive.jar.orig failed
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 36.631 s
[INFO] Finished at: 2018-10-22T12:29:33-04:00
[INFO] Final Memory: 28M/694M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-jarsigner-plugin:1.4:sign (sign) on project DataAdapter: Failed executing 'cmd.exe /X /C ""C:\Program Files\Java\jdk1.8.0_181\jre\..\bin\jarsigner.exe" -keystore C:\Users\atalak\Desktop\GitRepo\DataAdapter/myKeystore.jks -storepass ***** C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\DaExecutive.jar key_2017"' - exitcode 1 -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-jarsigner-plugin:1.4:sign (sign) on project DataAdapter: Failed executing 'cmd.exe /X /C ""C:\Program Files\Java\jdk1.8.0_181\jre\..\bin\jarsigner.exe" -keystore C:\Users\atalak\Desktop\GitRepo\DataAdapter/myKeystore.jks -storepass ***** C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\DaExecutive.jar key_2017"' - exitcode 1
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:212)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:116)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:80)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:51)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:307)
    at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:193)
    at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:106)
    at org.apache.maven.cli.MavenCli.execute(MavenCli.java:863)
    at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:288)
    at org.apache.maven.cli.MavenCli.main(MavenCli.java:199)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:415)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:356)
Caused by: org.apache.maven.plugin.MojoExecutionException: Failed executing 'cmd.exe /X /C ""C:\Program Files\Java\jdk1.8.0_181\jre\..\bin\jarsigner.exe" -keystore C:\Users\atalak\Desktop\GitRepo\DataAdapter/myKeystore.jks -storepass ***** C:\Users\atalak\Desktop\GitRepo\DataAdapter\target\DaExecutive.jar key_2017"' - exitcode 1
    at org.apache.maven.plugins.jarsigner.AbstractJarsignerMojo.processArchive(AbstractJarsignerMojo.java:515)
    at org.apache.maven.plugins.jarsigner.AbstractJarsignerMojo.execute(AbstractJarsignerMojo.java:343)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:134)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:207)
    ... 20 more
[ERROR] 
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException

score 0 · Accepted Answer

您在 maven-jarsigner-plugin 中设置目录，也许他是锁定您的文件的人尝试为每个 jar 安装 1 个插件

    <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jarsigner-plugin</artifactId>
        <version>1.4</version>
        <executions>
            <execution>
                <id>sign</id>
                <goals>
                    <goal>sign</goal>
                </goals>
            </execution>
        </executions>
        <configuration>
            <archive>${project.basedir}/target/ExampleAppGui.jar</archive>
            <keystore>${project.basedir}/myKeystore.jks</keystore>
            <storepass>pw</storepass>
            <alias>ABC</alias>
            <verify>false</verify>
        </configuration>
    </plugin>

    <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jarsigner-plugin</artifactId>
        <version>1.4</version>
        <executions>
            <execution>
                <id>sign</id>
                <goals>
                    <goal>sign</goal>
                </goals>
            </execution>
        </executions>
        <configuration>
            <archive>${project.basedir}/target/DaExecutive.jar</archive>
            <keystore>${project.basedir}/myKeystore.jks</keystore>
            <storepass>pw</storepass>
            <alias>ABC</alias>
            <verify>false</verify>
        </configuration>
    </plugin>

score 0 · Accepted Answer

检查这个项目，我是根据你的代码制作的。

它签署了 3 个 jar 档案。

我的插件标签看起来像：

<plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jarsigner-plugin</artifactId>
                <version>1.4</version>
                <executions>
                    <execution>
                        <id>sign</id>
                        <goals>
                            <goal>sign</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>verify</id>
                        <goals>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <verbose>true</verbose>
                    <certs>true</certs>
                    <keystore>${basedir}/server.jks</keystore>
                    <alias>server</alias>
                    <storepass>masterkey</storepass>
                    <keypass>masterkey</keypass>
                </configuration>
            </plugin>

看起来这是唯一的区别。

跑：

mvn 清洁包

生成档案。

最后，我弄清楚为什么它不起作用：<appendAssemblyId>false</appendAssemblyId> 从两次执行中删除。我在 GitHub 上提交了源代码。

java - 如何使用 Maven JarSigner 签署多个 Jar

2 回答 2

Related

Reference