Bugzilla – Full Text Bug Listing
| Summary: | Provide trusted certificates for code signing | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Community | Reporter: | John Arthorne <john.arthorne> | ||||||||
| Component: | Process | Assignee: | Eclipse Webmaster <webmaster> | ||||||||
| Status: | RESOLVED FIXED | QA Contact: | |||||||||
| Severity: | normal | ||||||||||
| Priority: | P3 | CC: | bokowski, jeffmcaffer, jrosenth, rivka, webmaster | ||||||||
| Version: | unspecified | ||||||||||
| Target Milestone: | --- | ||||||||||
| Hardware: | PC | ||||||||||
| OS: | All | ||||||||||
| Whiteboard: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
John Arthorne
I have created a wiki page to track the signing work that is going on for 3.2: http://wiki.eclipse.org/index.php/JAR_Signing The (perhaps ambitious) goal is to have infrastructure in place so that content on the Callisto update site can be signed in time for the synchronized release. *** Bug 134265 has been marked as a duplicate of this bug. *** To concur comment 0: - We have a secure signing process in place - That process safeguards our private key, where only the foundation can read it, while still allowing us to delegate signing to specific committers (ie, not every committer can sign) - The Foundation needs to purchase a trusted certificate, and configure our signing script to use it. I'm currently waiting for EMO approval of the expense, then I'll click the Submit button on the web form. D. Certificate has been purchased for a 3yr period, waiting for Verisign. D. Verisign have signed my certificate. I'll install it this week so we can start testing. Excellent! Boris mentioned that he has some experience with installing and setting up Verisign certificates, so you can drop him a line if you have any problems and he might be able to give some pointers. Grr... I *totally* forgot that I needed to create the private key with keytool, and instead created one using OpenSSL. Stupid Stupid Stupid Stupid Stupid Stupid Of course, now I'm struggling to get the blasted key into my keystore as keytool doesn't support importing this directly. I can't seem to convert the private key/cert into PKCS#12 format (so that I can import it with a tool like KeyMan) as the Verisign cert doesn't appear to be an x.509 cert, but rather some Digital ID.. At this point I'm totally screwed and don't know what to do. I barely remember this, but I think I wrote a little Java utility when I was stuck with a similar problem. Could you attach a private key, different but generated in the same way, so that I can experiment with it? ~> openssl genrsa -des3 1024 Generating RSA private key, 1024 bit long modulus .++++++ ..................++++++ e is 65537 (0x10001) Enter pass phrase: Something Verifying - Enter pass phrase: Something -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,C825E4A0768F21D5 mRrHFZj3l1JDiBUdArpKKTkvCzAMqYcAFmsxSvbirYqY6VkGt+M/SNdXyFFY/Nf5 iujyQ0obTAhfMsW4HtOvwAqN49XWrzZPkppNMcgixWzTq3/LDIdP/AqLQeQ1iXKL fZEffQV9aGt9P2rNINBjGztrzaN2l3IGkXBoy0jMdKQUuY6VUUvAGwsCp7SJoNlf QN1etp30SENcxfLcIL3tIymVA7hTlIj/sxHpd0sGrUEzXUW/AWl9vaRuPmnfz9W6 3G/Ed1hUdR4AxJ33mVWT0cl7HHse5bU4JS2uA0B0EZr3IF+k72Xb+QsL2yu3CqrR FX8rwsbBhRhlSaGSgg4GKIHfAvv1T1tUOxhnuLQgkFZItAwwyAbHZErSEse2Og0M ITkWjoxZ2H6bsSRuY0bNlALctOAdvdl3efDO3jZrwJ5yeOqUQGkfDhbDO40DETXW uLyYFOVJ0A7c569MFl69WkVRFgU5upHV+pUpIPB+7lsutGOb4kAPMSKfcCkCh5qk GmyjFkdXo/PdIdnQyGerrMhLR3KG6Zml9LLiLxQ4ksDzLM6v0MEMP4foIeHW97Lr 13wULahj+4FATM4Ve1NdXG2mdqik8Pho/c8GjGLCoIXShTo1DCWl/2BcPLKnGG8x FE4jWeqePm4vqNnN/utYoa3AXLZWl+/zrvdFvghsq1bL0NxSxkxUn4l5TGO3FWLI 2haBP36kSf+ICj9yOps9acGJHOAcuPshvrTDJy2W/vmkN9vl7f8KyhOuPEQBNNvn nBqwJe3hAGkZLoLBRpKKjll5u3ikazoD3yDaRQBMJko+4n0Aj8gZnw== -----END RSA PRIVATE KEY----- Try this: openssl pkcs12 -export -out keystore.pkcs12 -in www.crt -inkey www.key Where www.crt is the certificate file from verisign, and www.key is your private key generated by openssl. This should generate keystore.pkcs12 in the pkcs12 format. Then keyman can be used to import this into the Java keystore file. Some references: http://www.jguru.com/faq/view.jsp?EID=532461 (reply of January 16, 2006) http://mark.foster.cc/kb/openssl-keytool.html I tried that already this afternoon (see comment 7 paragraph 4). droy@utils:~> openssl pkcs12 -export -out keystore.pkcs12 -in jarsign.verisign.crt -inkey jarsign.verisign.key Enter pass phrase for jarsign.verisign.key: No certificate matches private key Using openssl verify on our https web cert returns a positive verification; however, droy@utils:~> openssl verify jarsign.verisign.crt unable to load certificate 28658:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:946: 28658:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:304:Type=X509_CINF 28658:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_D2I:nested asn1 error:tasn_dec.c:566:Field=cert_info, Type=X509 28658:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:pem_oth.c:82: Hmmm, I didn't try catting the Verisign intermediate and root cert like the Jan 16 comment. Will try this tomorrow as soon as I figure out which root cert I need ;) Thanks for the info. D. The bad news is that I tried every possible combination of the above and nothing worked. I was unable to export into PKCS12 format. The good news is that I can replace the certificate I purchased with a new one. I'll simply generate a private key and CSR using keytool, have the new cert signed, and all should be swell. D. Just a quick update... I got the "second" certificate from Verisign. This is a certificate that used the keystore's private key for the CSR. Following the import instructions at http://verisign.com/support/code-signing-support/code-signing/digital-id.html /shared/common/ibm-java2-ppc64-50/bin/keytool -import -trustcacerts -keystore /my/keystore -alias myalias -file verisign.crt Enter keystore password: keytool error: java.lang.Exception: Input not an X.509 certificate *sigh* back to Verisign support. Created attachment 39053 [details]
Sample JAR signed with a trusted cert
So it appears I'm the only idiot who uses a different Key password and Store password. Setting them to an identical value yields much easier results.
I was able to import the Verisign cert, sign a JAR using jarsigner and verify it using jarsigner. Please verify the attached jar to see if this is the expected result.
Should Technology projects (e.g. Mylar, AJDT) be using the same certificate? > Should Technology projects (e.g. Mylar, AJDT) be using the same certificate? I don't see why not. The purpose of the certificate is that it allows verification that a piece of software originated from eclipse.org. It seems to me that any software available on download.eclipse.org could take advantage of both the signing and pack200 (http://wiki.eclipse.org/index.php/Pack200) update support. (In reply to comment #16) > Should Technology projects (e.g. Mylar, AJDT) be using the same certificate? > I believe this is the intention. One (or two) committers would be trusted committers, who would be granted the privilege to sign their code on behalf of the Foundation, by using the process we're developing here. As soon as all the wrinkles are ironed out, we'll make the appropriate announcements. D. A code signing certificate has been installed and is in use on the signing server. Although we're not yet ready to announce the functionality of signing project jars and zips, this part of the requirement has been satisfied. FWIW, in comment 15 I requested the attached jar be verified to make sure it's properly signed and didn't get a reply. D. What's the bug that we're using to track this functionality becoming available to other projects (e.g. Mylar, AJDT)? Or will this be announced elsewhere when ready? > What's the bug that we're using to track this functionality becoming available > to other projects (e.g. Mylar, AJDT)? Or will this be announced elsewhere when > ready? There's nothing specific to the platform project with this signing infrastructure. I.e., once it's available to the platform, it is automatically enabled to work for any Eclipse project. Likely the only additional work is adding an appropriate person from each project to the "signers" ACL so they have permission to run the scripts. Follow bug 135044 for further updates on improvements that are in progress on the signing/packing tool. Created attachment 239059 [details]
TryTwain
Created attachment 239060 [details]
JTwain dll
The content of attachment 239059 [details] has been deleted for the following reason:
Looks like spam
The content of attachment 239060 [details] has been deleted for the following reason:
Looks like spam
|