SignJar Task

SignJar

Description

Signs JAR files with the jarsigner command line tool. It will take a named file in the jar attribute, and an optional destDir or signedJar attribute. Nested filesets are also supported; here only an (optional) destDir is allowed. If a destination directory or explicit JAR file name is not provided, JARs are signed in place.

Dependency rules

Nonexist destination JARs are created/signed
Out of date destination JARs are created/signed
If a destination file and a source file are the same, and lazy is true, the JAR is only signed if it does not contain a signature by this alias.
If a destination file and a source file are the same, and lazy is false, the JAR is signed.

Parameters

Attribute	Description	Required
jar	the jar file to sign	Yes, unless nested filesets have been used.
alias	the alias to sign under	Yes.
storepass	password for keystore integrity.	Yes.
keystore	keystore location	No
storetype	keystore type	No
keypass	password for private key (if different)	No
sigfile	name of .SF/.DSA file	No
signedjar	name of signed JAR file. This can only be set when the `jar` attribute is set.	No.
verbose	(true \| false) verbose output when signing	No; default false
internalsf	(true \| false) include the .SF file inside the signature block	No; default false
sectionsonly	(true \| false) don't compute hash of entire manifest	No; default false
lazy	flag to control whether the presence of a signature file means a JAR is signed. This is only used when the target JAR matches the source JAR	No; default false
maxmemory	Specifies the maximum memory the jarsigner VM will use. Specified in the style of standard java memory specs (e.g. 128m = 128 MBytes)	No
preservelastmodified	Give the signed files the same last modified time as the original jar files.	No; default false.
tsaurl	URL for a timestamp authority for timestamped JAR files in Java1.5+	No
tsacert	alias in the keystore for a timestamp authority for timestamped JAR files in Java1.5+	No

Parameters as nested elements

Attribute	Description	Required
fileset	fileset of JAR files to sign.	No
mapper	A mapper to rename jar files during signing	No, and only one can be supplied

Examples

<signjar jar="${dist}/lib/ant.jar"
alias="apache-group" storepass="secret"/>

signs the ant.jar with alias "apache-group" accessing the keystore and private key via "secret" password.

About timestamp signing

Timestamped JAR files are a new feature in Java1.5; a feature supported in Ant since Ant 1.7. Ant does not yet support proxy setup for this singing process, and the whole TSA feature is not tested yet. Furthermore, the official TSA documentation warns that the API is subject to change. If a future version of Java changes the API, Ant will break. It may be possible to hide changes if and when they occur, but this can not be guaranteed.