Integration with marketplace-zip-signer

[ls-bit]

Hi,
I am trying to get the JetBrains marketplace-zip-signer to work with Jsign.

It seemed like it could be possible, but I am running into an issue that marketplace-zip-signer does not provide a way to pass the keystore provider arg to Jsign. When running the following command:

# provider.properties just contains:  security.provider.1=net.jsign.jca.JsignJcaProvider
 java -cp marketplace-zip-signer-cli.jar:jsign.jar \
      -Djava.security.properties=provider.properties \
      org.jetbrains.zip.signer.ZipSigningTool sign \
      -ks-provider-name Jsign \
      -ks example.p12 \
      -ks-type pkcs12 \
      -ks-pass changeit \
      -ks-key-alias test \
      -cert example.crt \
      -in jsign-marketplace.zip \
      -out jsign-marketplace-signed.zip

I get the error:

Exception in thread "main" java.lang.IllegalArgumentException: keystore parameter must be set
        at net.jsign.KeyStoreType$4.validate(KeyStoreType.java:152)
        at net.jsign.KeyStoreBuilder.validate(KeyStoreBuilder.java:264)
        at net.jsign.KeyStoreBuilder.build(KeyStoreBuilder.java:284)
        at net.jsign.jca.JsignJcaProvider$JsignJcaKeyStore.getKeyStore(JsignJcaProvider.java:110)
        at net.jsign.jca.JsignJcaProvider$JsignJcaKeyStore.engineAliases(JsignJcaProvider.java:143)
        at net.jsign.jca.AbstractKeyStoreSpi.engineContainsAlias(AbstractKeyStoreSpi.java:71)
        at net.jsign.jca.AbstractKeyStoreSpi.engineIsKeyEntry(AbstractKeyStoreSpi.java:87)
        at java.base/java.security.KeyStore.isKeyEntry(KeyStore.java:1346)
        at org.jetbrains.zip.signer.signer.KeystoreUtilsKt.getSignerInfo(KeystoreUtils.kt:21)
        at org.jetbrains.zip.signer.signer.SignerInfoLoader.loadSignerInfoFromKeystore(SignerInfoLoader.kt:20)       
        at org.jetbrains.zip.signer.signer.SignerInfoLoader.loadSignerInfoFromKeystore$default(SignerInfoLoader.kt:10)
        at org.jetbrains.zip.signer.ZipSigningTool.sign(ZipSigningTool.kt:46)
        at org.jetbrains.zip.signer.ZipSigningTool.main(ZipSigningTool.kt:29)

So it seems that either marketplace-zip-signer or jsign would need to be slightly changed to allow integration.

One idea would be for Jsign to try to read the provider arg from a system property as a fallback. Then you could pass the keystore provider arg as a system property, which could make integration more easy with other tools.

Or maybe there is a better solution?

Thanks for any suggestions

[ebourg]

It looks like marketplace-zip-signer support for security providers is incomplete, it should have command line parameters to set the class and the configuration argument of the provider. Currently it can only reference a provider by name as defined in the properties file, and this method doesn't allow to set the configuration argument.

[ls-bit]

Right, that would probably the best solution. I was hoping to find a way to make it work with minimal effort.

Out of curiosity, I just tested reading keystore provider arg from a system property in JsignJcaProvider in the default constructor by adding one line at the end:

this.keystore = System.getProperty("jsign.keystore");

But that just resulted in a StackOverflowError:

Exception in thread "main" java.lang.StackOverflowError
	at net.jsign.KeyStoreBuilder.createFile(KeyStoreBuilder.java:214)
	at net.jsign.KeyStoreBuilder.certfile(KeyStoreBuilder.java:190)
	at net.jsign.jca.JsignJcaProvider$JsignJcaKeyStore.<init>(JsignJcaProvider.java:106)
	at net.jsign.jca.JsignJcaProvider.lambda$new$0(JsignJcaProvider.java:72)
	at net.jsign.jca.ProviderService.newInstance(ProviderService.java:39)
	at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
	at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
	at java.base/java.security.Security.getImpl(Security.java:655)
	at java.base/java.security.KeyStore.getInstance(KeyStore.java:870)
	at net.jsign.KeyStoreType.getKeystore(KeyStoreType.java:666)
	at net.jsign.KeyStoreBuilder.build(KeyStoreBuilder.java:285)
	at net.jsign.jca.JsignJcaProvider$JsignJcaKeyStore.getKeyStore(JsignJcaProvider.java:111) <-- these last two lines are looping forever
	at net.jsign.jca.JsignJcaProvider$JsignJcaKeyStore.engineAliases(JsignJcaProvider.java:144) <--

Maybe it is not that easy after all 😄