如何使用 Ant 检查签名的 jar 文件？

Question

我使用 Ant signjar 任务 签署 jar 文件，现在我想先测试一下部署。

我可以检查一下，

jarsigner -verify sbundle.jar 

但我不知道是否可以用 Ant 做同样的事情？

Answer 1

另一种方法是基于 Maven 脚本进行构建。
Maven 确实提出了 jarsigner:verify< /code>插件

如果这不是一个有效的可能性，您仍然可以使用 Exec Ant任务直接调用jarsigner命令。
如果返回码设置正确，您可以添加属性 failonerror （如果命令退出时返回码不是 0，则停止构建过程。）

Answer 2

以下 Ant 代码可用于验证 JAR 文件签名。一旦遇到签名无效或缺失的 JAR 文件，脚本就会失败。

请注意，for 任务需要 ant-contrib。

<!-- Macro to verify whether or not a JAR file is signed -->
<macrodef name="verify-signatures">
    <attribute name="filesetref" />
    <sequential>
        <for param="file">
            <path>
                <fileset refid="@{filesetref}" />
            </path>
            <sequential>
                <echo message="Verifying signature on file: @{file}" />
                <exec executable="jarsigner" failonerror="true">
                    <arg value="-verify" />
                    <arg value="@{file}" />
                </exec>
                <fail message="@{file} must be signed">
                    <condition>
                        <not>
                            <issigned file="@{file}" />
                        </not>
                    </condition>
                </fail>
            </sequential>
        </for>
    </sequential>
</macrodef>

<!-- Define the list of files to check -->
<fileset dir="p2repo" id="jarfiles">
    <include name="**/*.jar" />
</fileset>

<!-- Verify signatures -->   
<verify-signatures filesetref="jarfiles" />

Answer 3

蚂蚁条件报价“已分配”。

“测试 jarfile 是否已签名。如果传递了签名的名称，则检查文件是否存在该特定签名；否则检查文件是否存在任何签名。它不执行严格的签名验证；它只执行寻找签名的存在。
此条件是在 Apache Ant 1.7 中添加的。”

来自 Ant 条件

Answer 4

您可以使用 Ant 中的VerifyJar 任务来执行此操作。这是 Ant 帮助的链接
https://ant.apache.org/manual/Tasks/verifyjar.html

一次验证多个 JAR 文件的示例代码。

<verifyjar keystore="mykeystore" keypass="abc"
          storepass="abc" alias="myalias">
    <path>
        <fileset dir="${build.dir}/signedjar" includes="**/*.jar" />
    </path>
</verifyjar>

Answer 5

基于@torkildr 的回答。

可以使宏将嵌套路径或文件集传递到 ant-contrib 任务。

<target name="verify-artifacts" description="Just an example of usage">
    <verify-artifacts>
        <fileset dir="${project.ear.dir}" includes="*.*ar"/>
    </verify-artifacts>
</target>

<macrodef name="verify-artifacts">
    <element name="artifact-path" implicit="true"/>
    <sequential>
        <for param="file">
            <artifact-path/>
            <sequential>
                <verify-artifact file="@{file}"/>
            </sequential>
        </for>
    </sequential>
</macrodef>

<macrodef name="verify-artifact">
    <attribute name="file"/>
    <attribute name="alias" default="${artifact.sign.keystore.alias}"/>
    <attribute name="keystore" default="${artifact.sign.keystore.path}"/>
    <attribute name="password" default="${artifact.sign.keystore.password}"/>
    <sequential>
        <if>
            <istrue value="${artifact.sign.enabled}"/>
            <then>
                <echo message="Trying to verify @{file} with alias @{alias} from @{keystore}"/>
                <required-macro-param value="@{alias}" prop="artifact.sign.keystore.alias"/>
                <required-macro-param value="@{keystore}" prop="artifact.sign.keystore.path"/>
                <required-macro-param value="@{password}" prop="artifact.sign.keystore.password"/>
                <fail message="Keystore path '@{keystore}' not found">
                    <condition>
                        <not><available file="@{keystore}" type="file"/></not>
                    </condition>
                </fail>
                <fail message="Artifact '@{file}' not found">
                    <condition>
                        <not><available file="@{file}" type="file"/></not>
                    </condition>
                </fail>
                <!-- jarsigner -verify -keystore @{keystore} -storepass @{password} @{file} @{alias} -->
                <exec executable="jarsigner" failonerror="true">
                    <arg value="-verify"/>
                    <arg value="-keystore"/>
                    <arg value="@{keystore}"/>
                    <arg value="-storepass"/>
                    <arg value="@{password}"/>
                    <arg value="@{file}"/>
                    <arg value="@{alias}"/>
                </exec>
            </then>
        </if>
    </sequential>
</macrodef>

<macrodef name="required-macro-param">
    <attribute name="prop"/>
    <attribute name="value"/>
    <sequential>
        <!--<echo message="@{value}"/>-->
        <fail message="You must set property '@{prop}'">
            <condition>
                <and>
                    <or>
                        <equals arg1="@{value}" arg2=""/>
                        <matches string="@{value}" pattern="^\$\{.*?\}$"/>
                    </or>
                    <!--<not><isset property="@{prop}"/></not>-->
                </and>
            </condition>
        </fail>
    </sequential>
</macrodef>

<macrodef name="sign-artifact">
    <attribute name="file"/>
    <attribute name="alias" default="${artifact.sign.keystore.alias}"/>
    <attribute name="keystore" default="${artifact.sign.keystore.path}"/>
    <attribute name="password" default="${artifact.sign.keystore.password}"/>
    <sequential>
        <if>
            <istrue value="${artifact.sign.enabled}"/>
            <then>
                <echo message="Trying to sign @{file} with alias @{alias} from @{keystore}"/>
                <required-macro-param value="@{alias}" prop="artifact.sign.keystore.alias"/>
                <required-macro-param value="@{keystore}" prop="artifact.sign.keystore.path"/>
                <required-macro-param value="@{password}" prop="artifact.sign.keystore.password"/>
                <fail message="Keystore path '@{keystore}' not found">
                    <condition>
                        <not><available file="@{keystore}" type="file"/></not>
                    </condition>
                </fail>
                <fail message="Artifact '@{file}' not found">
                    <condition>
                        <not><available file="@{file}" type="file"/></not>
                    </condition>
                </fail>
                <signjar jar="@{file}" alias="@{alias}" keystore="@{keystore}" storepass="@{password}"/>
                <fail message="Signature check failed">
                    <condition>
                        <not><issigned file="@{file}" name="@{alias}"/></not>
                    </condition>
                </fail>
            </then>
        </if>
    </sequential>
</macrodef>

<macrodef name="sign-artifacts">
    <element name="artifact-path" implicit="true"/>
    <sequential>
        <for param="file">
            <artifact-path/>
            <sequential>
                <sign-artifact file="@{file}"/>
            </sequential>
        </for>
    </sequential>
</macrodef>

<property name="artifact.sign.enabled" value="true"/>
<property name="artifact.sign.keystore.alias" value="alias"/>
<property name="artifact.sign.keystore.path" value="keystore.jks"/>
<property name="artifact.sign.keystore.password" value="pwd"/>