Add the jsign.certfile system property to feed an additional certificate with the JCA provider

[umireon]

Maybe related to #119

Background

We have developed an Android app and Google requires us to sign our build artifact when we upload it to Google Play Console. For better security, we'd like to sign our build artifact with Google Cloud KMS and we found this excellent product. We composed the following command to sign our aab with Cloud KMS.

jarsigner -J-cp -Jjsign-6.0.jar -J--add-modules -Jjava.sql \
  -providerClass net.jsign.jca.JsignJcaProvider \
  -providerArg projects/PROJECT_ID/locations/global/keyRings/KEYRING_NAME \
  -keystore NONE \
  -storetype GOOGLECLOUD \
  -storepass "$(gcloud auth print-access-token)" \
  -certchain full-chain.pem \
  ./app/build/outputs/bundle/release/app-release.aab \
  KEY_NAME/cryptoKeyVersions/VERSION

However, it does not work with the following error.

jarsigner error: java.lang.RuntimeException: Failed to load the certificate from 

I read the code of jsign and found that the GOOGLECLOUD provider needs the public key to sign but Cloud KMS does not store certificates. In this PR, we'd like to propose to add a way to feed an additional certificate to Jsign when it is used as a JCA provider.

Overview

When Jsign is used as a JCA provider, namely with jarsigner, we can provide additional options via the system property of Java. Adding this PR enable users to sign JAR artifacts with jarsigner and Cloud KMS by the following command.

jarsigner -J-cp -Jjsign-6.1-SNAPSHOT.jar -J--add-modules -Jjava.sql \
  -J-Djsign.certfile=full-chain.pem \
  -providerClass net.jsign.jca.JsignJcaProvider \
  -providerArg projects/PROJECT_ID/locations/global/keyRings/KEYRING_NAME \
  -keystore NONE \
  -storetype GOOGLECLOUD \
  -storepass "$(gcloud auth print-access-token)" \
  -certchain full-chain.pem \
  ./app/build/outputs/bundle/release/app-release.aab \
  KEY_NAME/cryptoKeyVersions/VERSION

Thank you in advance!

Best,

[ebourg]

Thank you for the PR, however this is maybe not necessary.

Jsign needs to know the algorithm of the key for signing (RSA of ECDSA), when using Google Cloud there are 3 ways to get this information:

• from the certificate chain provided, however the jarsigner certchain parameter isn't propagated to Jsign
• from the key description, but this requires an extra GCP API call and the cloudkms.cryptoKeyVersions.get permission or the Cloud KMS Viewer role
• from the alias if the algorithm is appended, like this: mykey/cryptoKeyVersions/2:RSA

Assuming you are using the latest release of Jsign, I think you can fix this issue either by adjusting the permissions or by appending :RSA to the key alias. Let me know if this works for you.

[umireon]

Thank you for suggestion, I will try later!

[umireon]

I got it worked with the RSA suffix! Thank you!