search

ebourg / jsign

Java implementation of Microsoft Authenticode for signing Windows executables, installers & scripts
https://ebourg.github.io/jsign
Apache License 2.0
250 stars 107 forks source link

Maven plugin does not use maven proxy settings #51

Closed ebayedq closed 5 years ago

ebayedq commented 5 years ago

The Maven plugin does not use maven proxy settings defined ~/.m2/settings.xml when it calls the timestamping service. Unfortunately, you also can't switch off the timestamping step because the tsmode property has a default value, so PESignerHelper always ends up enabling it:

new PESigner(chain, privateKey).withTimestamping(tsaurl != null || tsmode != null)...

Altogether this means that you can't use the plugin at all, if you're behind a proxy.

ebourg commented 5 years ago

Thank you for the feedback, I'll look into that.

ebayedq commented 5 years ago

I just found this project which has solved the issue pragmatically, it seems: https://github.com/webdriverextensions/webdriverextensions-maven-plugin.

The relevant code is in ProxyUtils.java.

Let me know what you think, maybe we can adapt that for jsign.

ebourg commented 5 years ago

Nice, do you want to try to provide a fix based on this implementation (minus the use of the httpclient if possible) ?

ebayedq commented 5 years ago

Sure, I'll have a go at it!

ebayedq commented 5 years ago

Since jsign-core already supports proxies, I think this is all that's needed: https://github.com/ebayedq/jsign/commit/795f091e17b4a3086e550db9504a429356992f10

I will try it out tomorrow at the office with my company's proxy.

ebourg commented 5 years ago

It looks good, let me know how it works with your proxy, I don't have one to test it.

I've also disabled the timestamping by default in the plugin (fd9b4d4d8864)

ebayedq commented 5 years ago

I tested https://github.com/ebourg/jsign/pull/52 with a real proxy today and it works great.