Skip to main content

Notice: this Wiki will be going read only early in 2024 and edits will no longer be possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.

Jump to: navigation, search

Difference between revisions of "JAR Signing"

 
(43 intermediate revisions by 11 users not shown)
Line 1: Line 1:
== Overview ==
+
#REDIRECT[[IT_Infrastructure_Doc#CBI_Maven_signing_plugin]]
We are working towards signing Eclipse builds for the 3.2 Callisto release.  The goal of signing is to allow users to verify that the content they obtain from eclipse.org and subsequently execute does indeed come from that source. Signing in a nutshell works as follows:
+
 
+
# Eclipse builds produce content in various forms (zips, update JARS)
+
# The Eclipse Foundation produces a signature of the build content using its private key (signature = private key + content)
+
# User downloads build content and signatures from eclipse.org or from mirrors
+
# The Eclipse Foundation makes available a [http://en.wikipedia.org/wiki/Public_key_infrastructure public key] for verifying signatures
+
# User consults some trusted authority to verify that the public key does indeed belong to the Eclipse Foundation
+
# Verification is performed on the user's machine (signature + public key = hash of content)
+
 
+
== Open problems ==
+
 
+
=== What gets signed? ===
+
 
+
The two principal outputs from the build process are update site JARs and stand-alone zips.
+
 
+
==== Signing stand-alone zips ====
+
 
+
The problem with stand-alone zips is that there is no opportunity to perform verification at download time.  The user would need to take a manual step to run verification on the zip before unzipping and using it.  Note that signing only the JARs within the stand-alone zips is not sufficient verification.  For example, the eclipse executable is not within a JAR, and a compromised executable would negate the value of any other signing.  Possible approaches for signing stand-alone executables:
+
 
+
* Do nothing.  If users want to obtain verifiable content, they must obtain it from an update site
+
* Sign only the JARs within the stand-alone zip.  This has no authentication value in itself, but might be useful raw material for others in the community who want to tackle complete authentication of an Eclipse-based application
+
* Create a signature of the entire zip file, and make the signature available in a separate JAR file.  The user would then have to perform verification manually
+
 
+
==== Signing update site content ====
+
 
+
Signing of content on Eclipse update sites is slightly easier.  All executable content is contained in JAR files, so the traditional Java JAR signing mechanism can be used.
+
 
+
=== How is signing done? ===
+
 
+
There are several ways we could sign update JAR content:
+
 
+
* Traditional Java JAR signing.  The JDK comes with a tool called [http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html jarsigner]. This tool signs JARs by producing a separate signature for every file in the JAR.  The signatures are put in the MANIFEST.MF file and in a separate signature file in the META-INF directory.  For optimization purposes, the signature of the MANIFEST.MF with all embedded signatures is also computed and placed in the signature file.  The pros of using this approach are that the jarsigner tool is already available, and the signed JAR can also be used for runtime verification. The cons are that producing signatures for every file adds bulk to the download (about 3MB for the Eclipse SDK), and it is very slow to run (about an hour for the Eclipse SDK).
+
* Compute a single signature per JAR file.  This should be much faster and have negligible size, but would require a custom signing tool. The signature would be placed in a separate JAR signed using jarsigner (either one signature JAR per update JAR, or one signature JAR per update site).
+
* Nested JARs.  A sneaky way to get a single signature per JAR is to put each JAR in a wrapper JAR, and sign the wrapper.  This would allow using the jarsigner tool, but would require significant changes to the structure of update site content, and changes to the update code to remove the signed wrappers
+
 
+
=== What public key (certificate) do we use? ===
+
 
+
=== Where are the signatures stored? ===
+
 
+
=== When does verification happen? ===
+
 
+
== Miscellaneous links ==
+
 
+
* [https://bugs.eclipse.org/bugs/show_bug.cgi?id=43889 OSGi Bundle signing bug report]
+
* [https://bugs.eclipse.org/bugs/show_bug.cgi?id=78208 Bug for runtime signing support]
+
* [https://bugs.eclipse.org/bugs/show_bug.cgi?id=94461 Bug for signing indicator in About dialog]
+
* [https://www.verisign.com/products-services/security-services/code-signing/digital-ids-code-signing/index.html Verisign code signing products]
+

Latest revision as of 04:10, 27 November 2020

Back to the top