javamavenappletjar-signingsigned-applet

Can Maven re-sign dependencies?


I'm using maven-jarsigner-plugin to sign a shaded uber-jar of mine. I do need to distribute some dependencies in their own jars though, and want to take those jars from a Maven repo, clear them of any existing signatures, and sign them with my own certificate.

Are there any Maven plugins that do this, or would i involve some Ant plugin hackery?


Solution

  • Turns out maven-jarsigner-plugin can re-sign existing jars using it's removeExistingSignatures config element. So simple!

    I use maven-dependency-plugin to copy artifacts into a .war project in the generate-resources phase, then sign them in the process-resources phase.

    <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-dependency-plugin</artifactId>
        <version>2.8</version>
        <executions>
            <execution>
                <id>copy</id>
                <phase>generate-resources</phase>
                <goals>
                    <goal>copy</goal>
                </goals>
                <configuration>
                    <artifactItems>
                        <artifactItem>
                            <groupId>org.lwjgl.lwjgl</groupId>
                            <artifactId>lwjgl-platform</artifactId>
                            <version>2.9.0</version>
                            <classifier>natives-osx</classifier>
                            <type>jar</type>
                            <overWrite>true</overWrite>
                            <outputDirectory>src/main/webapp/</outputDirectory>
                            <destFileName>lwjgl-platform-natives-osx.jar</destFileName>
                        </artifactItem>   
                    </artifactItems>        
                    <outputDirectory>src/main/webapp</outputDirectory>
                    <overWriteReleases>true</overWriteReleases>
                    <overWriteSnapshots>true</overWriteSnapshots>
                </configuration>
            </execution>
        </executions>
    </plugin>
    
    <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jarsigner-plugin</artifactId>
        <version>1.2</version>
        <executions>
            <execution>
                <id>sign</id>
                <phase>process-resources</phase>
            <goals>
                <goal>sign</goal>
                </goals>
        </execution>
        </executions>
        <configuration>
            <keystore>${basedir}/path/to/my.keystore</keystore>
            <alias>alias</alias>
            <storepass>password</storepass>
            <keypass>password</keypass>
            <verbose>true</verbose>
            <archiveDirectory>src/main/webapp/</archiveDirectory>
            <processMainArtifact>false</processMainArtifact>
            <removeExistingSignatures>true</removeExistingSignatures>
        </configuration>
    </plugin>