Authentication issue with Google Cloud

[mvives-broadsign]

Hi everyone, While trying to sign a msi using GOOGLE store, I encounter an authentication error. As I'm not familiar with Google Cloud (this is the first time I'm using it), I might not have generate the proper API Key.

Here is the command and the error

• Command:

  jsign --storetype GOOGLECLOUD --storepass <API_KEY> --keystore <KeyRing PATH> --alias <Key NAME> --certfile my.crt <MSI FILE>```

• Error

  jsign: Failed to retrieve the private key from the keystore
  java.security.UnrecoverableKeyException: Unable to fetch Google Cloud private key 'projects/control-crypto-test/locations/europe-west1/keyRings/Control-KR/cryptoKeys/SigningKey4'
      at net.jsign.jca.GoogleCloudSigningService.getPrivateKey(GoogleCloudSigningService.java:146)
      at net.jsign.jca.SigningServiceKeyStore.engineGetKey(SigningServiceKeyStore.java:41)
      at java.base/java.security.KeyStore.getKey(KeyStore.java:1057)
      at net.jsign.SignerHelper.build(SignerHelper.java:410)
      at net.jsign.SignerHelper.sign(SignerHelper.java:500)
      at net.jsign.JsignCLI.execute(JsignCLI.java:116)
      at net.jsign.JsignCLI.main(JsignCLI.java:40)
  Caused by: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
      at net.jsign.jca.RESTClient.query(RESTClient.java:74)
      at net.jsign.jca.RESTClient.get(RESTClient.java:43)
      at net.jsign.jca.GoogleCloudSigningService.getPrivateKey(GoogleCloudSigningService.java:135)
      ... 6 more
  Try `jsign --help' for more information.

I've generated the api key using APIs & Services > Credentials > API Keys in Google cloud but I'm not sure if this is the correct location.

[mvives-broadsign]

Ok, I managed to solve my issue by using jsign --storetype GOOGLECLOUD --storepass $(gcloud auth print-access-token) .... Now I have to figure out the Unknown signature type requested: SHA256WITHEC ;)

[ebourg]

For the EC key you'll have to build jsign 4.1 from sources.