Sign with AWS KMS

[fridex]

Hi all,

I've followed documentation on signing using AWS KMS (usign jsign 4.2):

 jsign --storetype AWS --keystore eu-west-3 \
       --storepass "<access-key>|<secret-key>|<session-token>" \
       --alias 12345678-abcd-1234-cdef-1234567890ab \
       --certfile full-chain.pem application.exe

However, I'm receiving the following error:

jsign: Failed to load the keystore eu-west-3
java.security.KeyStoreException: keystore type 'AWS' is not supported
    at net.jsign.KeyStoreUtils.load(KeyStoreUtils.java:77)
    at net.jsign.SignerHelper.build(SignerHelper.java:387)
    at net.jsign.SignerHelper.sign(SignerHelper.java:544)
    at net.jsign.JsignCLI.execute(JsignCLI.java:117)
    at net.jsign.JsignCLI.main(JsignCLI.java:40)
Caused by: java.security.KeyStoreException: AWS not found
    at java.base/java.security.KeyStore.getInstance(KeyStore.java:878)
    at net.jsign.KeyStoreUtils.load(KeyStoreUtils.java:74)
    ... 4 more
Caused by: java.security.NoSuchAlgorithmException: AWS KeyStore not available
    at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
    at java.base/java.security.Security.getImpl(Security.java:700)
    at java.base/java.security.KeyStore.getInstance(KeyStore.java:875)
    ... 5 more
Try `jsign --help' for more information.

The suggested jsing --help indeed does not state AWS as a supported storetype.

Following the changelog in the README file, there is written:

Version 4.3 (in development)
* The AWS KMS signing service has been integrated

I tried to compile the current master but AWS is still not listed as a supported storetype in --help listing. I would like to ask how mature signing with AWS KMS is and what is estimated time to have 4.3 released with eventual support.

[ebourg]

If AWS doesn't show up in --help you are probably still running the version 4.2.

AWS support is fairly new, I'm waiting for some feedback before publishing the version 4.3.

[fridex]

If AWS doesn't show up in --help you are probably still running the version 4.2.

The way I created the jar file:

1. clone, using the master branch
2. mvn compile (running openjdk 11 amd64)
3. mvn package
4. java -jar jsign/target/jsign-4.2.jar (assuming the version string is taken pom.xml which has 4.2)

If that's not the right way, please let us know.

AWS support is fairly new, I'm waiting for some feedback before publishing the version 4.3.

We can try it and send feedback if it will work for you.

[ebourg]

That looks good, and what is the output of java -jar jsign/target/jsign-4.2.jar --help?

[fridex]

I've rebuilt it and it looks like AWS is indeed listed - signing with AWS KMS works and it looks like signiture is okay (using a self-signed certificate for testing). Will do some more testing and will let you know results. Thanks for prompt response and time 👍🏻

[ebourg]

Nice! Thank you for testing

[sehot]

Hi I also wanted to work with AWS , I complied the code with "mvn package -DskipTests" , when I ran java -jar jsign/target/jsign-4.2.jar --help , I saw the AWS support , but when I tried to sign file ,

i'm getting this error :

 Exception in thread "main" java.lang.NoSuchMethodError: java.nio.ByteBuffer.limit(I)Ljava/nio/ByteBuffer;
        at net.jsign.pe.PEFile.read(PEFile.java:172)
        at net.jsign.pe.PEFile.<init>(PEFile.java:130)
        at net.jsign.pe.PEFile.<init>(PEFile.java:114)
        at net.jsign.pe.PEFile.isPEFile(PEFile.java:95)
        at net.jsign.Signable.of(Signable.java:124)
        at net.jsign.SignerHelper.sign(SignerHelper.java:549)
        at net.jsign.JsignCLI.execute(JsignCLI.java:117)
        at net.jsign.JsignCLI.main(JsignCLI.java:40)

what am I missing here ?

if I used 4.2 released , it is working .

[ebourg]

Did you use the same Java runtime to build and run Jsign?

[sehot]

no I didn't my bad , just tried it with the same java runtime and it worked! thanks !

[ebourg]

Good, actually you can build with Java 8 and run with Java 11+, but you can't build with Java 11+ and run with Java 8.

[sehot]

I'm not expert in Java but when I try to compile with "Java(TM) SE Runtime Environment (build 1.8.0_333-b02) " (version 8 right ? ) I got this error while compile : MavenReportException: Error while generating Javadoc: Unable to find javadoc command: The javadoc executable 'C:\Program Files (x86)\Java\jre1.8.0_333\bin\javadoc.exe' doesn't exist or is not a file. Verify the JAVA_HOME environment variable.

[ebourg]

That's probably because you are using the JRE (runtime only) and not the JDK (with the development tools).

[sehot]

Correct! , I replaced to JDK(8) and it is working !

thanks for your help !

[fridex]

It looks like we have pretty good experience running JSign with KMS so far. Is there something we could test for you to make sure the feature is considered stable?

Thank you!

[ebourg]

@fridex Jsign 5.0 with AWS support has just been released. There were some last minutes improvements to supports EC keys and automatic authentication from an EC2 instance.