A windows artifacts signing with jsign

Author: fvarrui

build.gradle

@@ -6,6 +6,7 @@ plugins {
 	id 'com.gradle.plugin-publish' version '0.12.0'
     id 'io.codearte.nexus-staging' version '0.21.2'
     id 'eclipse'
+	id 'de.undercouch.download' version '4.1.1'
 }
 
 repositories {
@@ -48,7 +49,8 @@ dependencies {
     implementation 'org.apache.velocity:velocity-engine-core:2.0'
 	implementation 'io.github.fvarrui:gradle-launch4j:2.4.7'
 	implementation 'com.netflix.nebula:gradle-ospackage-plugin:8.4.1'
-    
+	implementation 'net.jsign:jsign-core:3.1'
+	
     testImplementation 'junit:junit:4.12'
 
     compileOnly 'org.apache.maven.plugin-tools:maven-plugin-annotations:3.6.0'
@@ -210,3 +212,11 @@ nexusStaging {
 	username = project.findProperty('ossrhUser') ?: ''
 	password = project.findProperty('ossrhPassword') ?: ''
 }
+
+task updateUniversalJavaApplicationStub(type: Download) {
+	group 'Update'
+	description 'Downloads universalJavaApplicationStub to src/main/resources/mac and overrides the existing one.'
+	src 'https://github.com/fvarrui/universalJavaApplicationStub/releases/download/v3.1.0b/universalJavaApplicationStub'
+	dest file('src/main/resources/mac')
+	overwrite true
+}

src/main/java/io/github/fvarrui/javapackager/gradle/CreateWindowsExe.java

@@ -10,16 +10,16 @@
 
 import edu.sc.seis.launch4j.tasks.Launch4jLibraryTask;
 import io.github.fvarrui.javapackager.model.WindowsConfig;
-import io.github.fvarrui.javapackager.packagers.ArtifactGenerator;
 import io.github.fvarrui.javapackager.packagers.Context;
 import io.github.fvarrui.javapackager.packagers.Packager;
+import io.github.fvarrui.javapackager.packagers.WindowsArtifactGenerator;
 import io.github.fvarrui.javapackager.packagers.WindowsPackager;
 import io.github.fvarrui.javapackager.utils.FileUtils;
 
 /**
  * Creates Windows native executable on Gradle context
  */
-public class CreateWindowsExe extends ArtifactGenerator {
+public class CreateWindowsExe extends WindowsArtifactGenerator {
 
 	public CreateWindowsExe() {
 		super("Windows EXE");
@@ -72,6 +72,8 @@ public File apply(Packager packager) throws Exception {
 
 		File generatedExe = new File(project.getBuildDir(), "launch4j/" + executable.getName());
 
+		sign(generatedExe, windowsPackager);
+		
 		FileUtils.copyFileToFile(generatedExe, executable);
 
 		return executable;

src/main/java/io/github/fvarrui/javapackager/maven/CreateWindowsExe.java

@@ -19,16 +19,16 @@
 import org.twdata.maven.mojoexecutor.MojoExecutor.Element;
 
 import io.github.fvarrui.javapackager.model.WindowsConfig;
-import io.github.fvarrui.javapackager.packagers.ArtifactGenerator;
 import io.github.fvarrui.javapackager.packagers.Context;
 import io.github.fvarrui.javapackager.packagers.Packager;
+import io.github.fvarrui.javapackager.packagers.WindowsArtifactGenerator;
 import io.github.fvarrui.javapackager.packagers.WindowsPackager;
 
 /**
  * Copies all dependencies to app folder on Maven context
  * 
  */
-public class CreateWindowsExe extends ArtifactGenerator {
+public class CreateWindowsExe extends WindowsArtifactGenerator {
 
 	public CreateWindowsExe() {
 		super("Windows EXE");
@@ -108,6 +108,8 @@ public File apply(Packager packager) {
 					Context.getMavenContext().getEnv()
 				);
 
+			sign(executable, windowsPackager);
+			
 		} catch (MojoExecutionException e) {
 
 			throw new RuntimeException(e);

src/main/java/io/github/fvarrui/javapackager/model/WindowsConfig.java

@@ -37,6 +37,7 @@ public class WindowsConfig implements Serializable {
 	private boolean wrapJar = true;
 	private LinkedHashMap<String, String> setupLanguages = new LinkedHashMap<>();
 	private SetupMode setupMode = SetupMode.installForAllUsers;
+	private WindowsSigning signing;
 
 	public File getIcoFile() {
 		return icoFile;
@@ -238,6 +239,14 @@ public void setSetupMode(SetupMode setupMode) {
 		this.setupMode = setupMode;
 	}
 
+	public WindowsSigning getSigning() {
+		return signing;
+	}
+
+	public void setSigning(WindowsSigning signing) {
+		this.signing = signing;
+	}
+
 	@Override
 	public String toString() {
 		return "WindowsConfig [icoFile=" + icoFile + ", headerType=" + headerType + ", companyName=" + companyName
@@ -249,7 +258,7 @@ public String toString() {
 				+ ", disableFinishedPage=" + disableFinishedPage + ", createDesktopIconTask=" + createDesktopIconTask
 				+ ", generateSetup=" + generateSetup + ", generateMsi=" + generateMsi + ", generateMsm=" + generateMsm
 				+ ", msiUpgradeCode=" + msiUpgradeCode + ", wrapJar=" + wrapJar + ", setupLanguages=" + setupLanguages
-				+ ", setupMode=" + setupMode + "]";
+				+ ", setupMode=" + setupMode + ", signing=" + signing + "]";
 	}
 
 	/**

src/main/java/io/github/fvarrui/javapackager/model/WindowsSigning.java

@@ -0,0 +1,91 @@
+package io.github.fvarrui.javapackager.model;
+
+import java.io.File;
+
+import org.apache.commons.lang3.StringUtils;
+
+public class WindowsSigning {
+
+	private String storetype;
+	private File keystore;
+	private File certfile;
+	private File keyfile;
+	private String storepass;
+	private String alias;
+	private String keypass;
+	private String alg;
+
+	public String getStoretype() {
+		return storetype;
+	}
+
+	public void setStoretype(String storetype) {
+		this.storetype = storetype;
+	}
+
+	public File getKeystore() {
+		return keystore;
+	}
+
+	public void setKeystore(File keystore) {
+		this.keystore = keystore;
+	}
+
+	public File getCertfile() {
+		return certfile;
+	}
+
+	public void setCertfile(File certfile) {
+		this.certfile = certfile;
+	}
+
+	public File getKeyfile() {
+		return keyfile;
+	}
+
+	public void setKeyfile(File keyfile) {
+		this.keyfile = keyfile;
+	}
+
+	public String getStorepass() {
+		return storepass;
+	}
+
+	public void setStorepass(String storepass) {
+		this.storepass = storepass;
+	}
+
+	public String getAlias() {
+		return alias;
+	}
+
+	public void setAlias(String alias) {
+		this.alias = alias;
+	}
+
+	public String getKeypass() {
+		return keypass;
+	}
+
+	public void setKeypass(String keypass) {
+		this.keypass = keypass;
+	}
+
+	public String getAlg() {
+		return alg;
+	}
+
+	public void setAlg(String alg) {
+		this.alg = alg;
+	}
+
+	@Override
+	public String toString() {
+		String keypass = this.keypass != null ? StringUtils.repeat("*", this.keypass.length()) : "";
+		String storepass = this.storepass != null ? StringUtils.repeat("*", this.storepass.length()) : "";
+		return "WindowsSigning [storetype=" + storetype + ", keystore=" + keystore + ", certfile=" + certfile
+				+ ", keyfile=" + keyfile + ", storepass=" + storepass + ", alias=" + alias + ", keypass=" + keypass + ", alg=" + alg
+				+ "]";
+	}
+
+}

src/main/java/io/github/fvarrui/javapackager/packagers/GenerateMsi.java

@@ -12,7 +12,7 @@
  * Creates a MSI file including all app folder's content only for
  * Windows so app could be easily distributed
  */
-public class GenerateMsi extends ArtifactGenerator {
+public class GenerateMsi extends WindowsArtifactGenerator {
 
 	public GenerateMsi() {
 		super("MSI installer");
@@ -59,6 +59,9 @@ public File apply(Packager packager) throws Exception {
 			throw new Exception("MSI installer file generation failed!");
 		}
 
+		// sign installer
+		sign(msiFile, windowsPackager);
+		
 		return msiFile;
 	}
 

src/main/java/io/github/fvarrui/javapackager/packagers/GenerateSetup.java

@@ -11,7 +11,7 @@
  * Creates a Setup file including all app folder's content only for
  * Windows so app could be easily distributed
  */
-public class GenerateSetup extends ArtifactGenerator {
+public class GenerateSetup extends WindowsArtifactGenerator {
 
 	public GenerateSetup() {
 		super("Setup installer");
@@ -48,6 +48,9 @@ public File apply(Packager packager) throws Exception {
 			throw new Exception("Windows setup file generation failed!");
 		}
 
+		// sign installer
+		sign(setupFile, windowsPackager);
+		
 		return setupFile;
 	}
 

src/main/java/io/github/fvarrui/javapackager/packagers/WindowsArtifactGenerator.java

@@ -0,0 +1,65 @@
+package io.github.fvarrui.javapackager.packagers;
+
+import java.io.File;
+
+import io.github.fvarrui.javapackager.utils.Logger;
+import io.github.fvarrui.javapackager.utils.SignerException;
+import io.github.fvarrui.javapackager.utils.SignerHelper;
+
+public abstract class WindowsArtifactGenerator extends ArtifactGenerator {
+	
+	private static final String TIMESTAMPING_AUTHORITY = "http://timestamp.comodoca.com/authenticode";
+
+	public WindowsArtifactGenerator() {
+		super();
+	}
+
+	public WindowsArtifactGenerator(String artifactName) {
+		super(artifactName);
+	}
+
+	protected void sign(File file, WindowsPackager packager) {
+		if (packager.getWinConfig().getSigning() == null)
+			return;
+
+		Logger.infoIndent("Signing " + file);
+
+		File keystore = packager.getWinConfig().getSigning().getKeystore();
+		File certfile = packager.getWinConfig().getSigning().getCertfile();
+		File keyfile = packager.getWinConfig().getSigning().getKeyfile();
+		String alg = packager.getWinConfig().getSigning().getAlg();
+		String storetype = packager.getWinConfig().getSigning().getStoretype();
+		String storepass = packager.getWinConfig().getSigning().getStorepass();
+		String alias = packager.getWinConfig().getSigning().getAlias();
+		String keypass = packager.getWinConfig().getSigning().getKeypass();
+		String tsa = TIMESTAMPING_AUTHORITY;
+		String displayName = packager.getDisplayName();
+		String url = packager.getUrl();
+
+		try {
+
+			SignerHelper helper = new SignerHelper();
+			helper.name(displayName);
+			helper.url(url);
+			helper.alg(alg);
+			helper.keystore(keystore);
+			helper.storepass(storepass);
+			helper.storetype(storetype);
+			helper.alias(alias);
+			helper.certfile(certfile);
+			helper.keyfile(keyfile);
+			helper.keypass(keypass);
+			helper.tsaurl(tsa);
+			helper.sign(file);
+
+			Logger.infoUnindent(file + " successfully signed!");
+
+		} catch (SignerException e) {
+
+			Logger.errorUnindent(file + " could not be signed", e);
+
+		}
+
+	}
+
+}

src/main/java/io/github/fvarrui/javapackager/utils/SignerException.java

@@ -0,0 +1,14 @@
+package io.github.fvarrui.javapackager.utils;
+
+@SuppressWarnings("serial")
+public class SignerException extends Exception {
+
+    public SignerException(String message) {
+        super(message);
+    }
+
+    public SignerException(String message, Throwable cause) {
+        super(message, cause);
+    }
+    
+}