如何使用jarsigner簽署一打JAR文件？

Question

我想使用jarsigner簽署二十個jar文件，只給一次密碼。

根據手冊頁，在命令行上使用for-loop仍然強制我輸入每個文件的密碼，因此無法將多個文件分配給jarsigner。

我更喜歡命令行的解決方案，但可以使用ant/maven解決方案。
系統是Linux。

如何簽署一打jar文件，只給一次密碼？

Answer 1

以下是來自PSCode的Ant構建文件的代碼片段 - 它標記了一堆Jars。訣竅在於foreach元素。

<target name="createjars" 
    depends="compile" 
    description="Jars the compiled classes"> 
    <mkdir dir="${build}/jar/" /> 

    <foreach target="jar.package" param="package" inheritall="true"> 
     <path> 
      <dirset dir="${src}/java/org/pscode" includes="**/*" /> 
     </path> 
    </foreach> 
</target> 

..和..

<target name='jar.package'> 
    <script language='javascript'> 
     <![CDATA[ 
      prop = pscode.getProperty('package'); 
      index1 = prop.lastIndexOf('pscode') + 7; 
      index2 = prop.length(); 
      prop1 = prop; 
      path = prop1.substring(index1, index2); 
      path2 = path.replaceAll('\\\\','/'); 
      pscode.setProperty('path', path2); 

      name = path2.replaceAll('/','.'); 
      pscode.setProperty('jar.name', name + '.jar'); 
     ]]> 
    </script> 

    <xmlproperty file="${src}/java/org/pscode/${path}/manifest.xml" /> 
    <!-- echo message='jar.name: ${jar.name} *** ${application.title}'/--> 
    <if> 
     <not> 
      <uptodate targetfile='${build}/dist/lib/${jar.name}' > 
       <srcfiles dir= '${build}/share/org/pscode/${path}' includes='*.class'/> 
      </uptodate> 
     </not> 
     <then> 
      <jar 
       destfile='${build}/dist/lib/${jar.name}' 
       index='true' 
       update='true'> 
       <manifest> 
         <attribute name="Implementation-Title" value="${application.title}" /> 
         <attribute name="Implementation-Vendor" value="${vendor}" /> 
         <attribute name="Implementation-Vendor-Id" value="org.pscode" /> 
         <attribute name='Implementation-Version' value='${now}' /> 
       </manifest> 
       <fileset dir='${build}/share'> 
        <include name='org/pscode/${path}/*.class' /> 
       </fileset> 
       <fileset dir='${src}/java'> 
        <include name='org/pscode/${path}/*.png' /> 
        <include name='org/pscode/${path}/*.jpg' /> 
        <include name='org/pscode/${path}/*.gif' /> 
        <include name='org/pscode/${path}/*.xml' /> 
        <include name='org/pscode/${path}/*.html' /> 
        <include name='org/pscode/${path}/*.ser' /> 
       </fileset> 
      </jar> 
     </then> 
    </if> 

    <!-- If the Jar is updated, any previous signatures will be invalid, it 
    needs to be signed again. We cannot use the issigned condition since 
    that merely checks if a Jar is signed, not if the digital signatures are 
    valid. --> 
    <exec 
     executable='${jar.signer}' 
     resultproperty='jar.signer.result.property' 
     outputproperty='jar.signer.output.property'> 
     <arg value='-verify' /> 
     <arg value='${build}/dist/lib/${jar.name}' /> 
    </exec> 

    <if> 
     <or> 
      <not> 
       <equals arg1='${jar.signer.result.property}' arg2='0' /> 
      </not> 
      <or> 
       <contains 
        string='${jar.signer.output.property}' 
        substring='unsigned' 
        casesensitive='false' /> 
       <or> 
        <contains 
         string='${jar.signer.output.property}' 
         substring='SecurityException' 
         casesensitive='false' /> 
       </or> 
      </or> 
     </or> 
     <then> 
      <signjar 
       jar='${build}/dist/lib/${jar.name}' 
       alias='pscode' 
       storepass='${sign.password}' 
       force='true' 
       verbose='${verbose}' 
       keystore='${user.home}/${sign.pathfilename}' /> 
     </then> 
    </if> 

</target> 

Answer 2

只是爲了記錄：jarsigner能夠從文件中讀取或從一個環境變量的密鑰庫和密鑰的密碼，使用-keypass/-storepass命令行選項以及:file或:env修飾符。

因此，它可能把每一個口令在一個文件中（在我的例子：~/.storepass和~/.keypass），並使用了這樣的循環使用登錄的當前目錄下的所有jar文件的關鍵key_alias：

for i in ./*.jar; do jarsigner -storepass:file ~/.storepass -keypass:file ~/.keypass "$i" key_alias;done 

要讀的jarsigner從環境變量的密碼，你必須先創建這些變量：

export storepass="mystorepassword" 
export keypass="mykeypassword" 

現在，這個循環裏看ke：

for i in ./*.jar; do jarsigner -storepass:env storepass -keypass:env keypass jarfile.jar key_alias;done