Breadcrumbs

JArchive Signer

The signer has the fully qualified class name: org.signserver.module.jarchive.signer.JArchiveSigner

Overview

The signer signs Java Archives or ZIP files (.jar, .war, .ear, .apk and .zip etc) according to the JAR File Specification. The signature can optionally include a timestamp response from a TSA using the RFC#3161 format.

Available Properties

Property

Default

Description

SIGNATUREALGORITHM 

SHA256withRSA

(Optional) Algorithm for signing.

DIGESTALGORITHM 

SHA-256

(Optional) Algorithm for message digests.

DO_LOGRESPONSE_DIGEST 

True

(Optional) If a digest of the response should be computed and logged.

DO_LOGREQUEST_DIGEST 

True

(Optional) If a digest of the request should be computed and logged.

KEEPSIGNATURE 

True

(Optional) True if existing signature files should be kept. If disabled, no previous META-INF/*.SF,.RSA,.DS or .EC files are kept.

LOGRESPONSE_DIGESTALGORITHM 

SHA256

Algorithm used to create the message digest (hash) of the response document to put in the log.

LOGREQUEST_DIGESTALGORITHM 

SHA256

Algorithm used to create the message digest (hash) of the request document to put in the log.

REPLACESIGNATURE 

True

(Optional) True if an existing signature with the same name should be overwritten and not fail with an error.

SIGNATURE_NAME_TYPE 

KEYALIAS

(Optional) Type of signature name to use:

  • KEYALIAS: Default. Takes the name from the key alias of the key used to sign the response, after converting it according to the signature name rules (see SIGNATURE_NAME_VALUE).

  • VALUE: Takes the name from the SIGNATURE_NAME_VALUE property.

SIGNATURE_NAME_VALUE

None

The value for the signature name if the SIGNATURE_NAME_TYPE requires a value. With the type VALUE, the name is taken directly from this property but must follow the signature name rules:

  • Only characters from A-Z0-9_.-

  • Minimum 1 character

  • Maximum 8 characters

Optional or required depending on SIGNATURE_NAME_TYPE.

TSA_DIGESTALGORITHM

SHA-256

(Optional) Algorithm for timestamp digests.

TSA_PASSWORD 

None

Login password used if the TSA uses HTTP Basic Auth. Required if TSA_USERNAME is specified.

TSA_POLICYOID 

None

(Optional) Time-stamping policy OID to request from the TSA.

TSA_URL 

None

(Optional) URL of external (authenticode) timestamp authority.

Cannot be combined with TSA_WORKER.

TSA_USERNAME 

None

(Optional) Login username used if the TSA uses HTTP Basic Auth.

TSA_WORKER 

None

(Optional) Worker ID or name of internal (RFC#3161) timestamp signer in the same SignServer.

Cannot be combined with TSA_URL.

ZIPALIGN 

False

(Optional) True if the offset at which each file entry's data starts should be aligned to 4 bytes.

Worker Log Fields

Field

Description

REQUEST_DIGEST 

A message digest (hash) for the request document in hex encoding.

REQUEST_DIGEST_ALGORITHM 

The name of the message digest (hash) algorithm used for the request digest in the log.

RESPONSE_DIGEST 

A message digest (hash) for the response document in hex encoding.

RESPONSE_DIGEST_ALGORITHM 

The name of the message digest (hash) algorithm used for the response digest in the log.