obriencj/python-javatools — pull request #8 by KonstantinShemyak (2014-08-31 21:05:28+00:00)
Title: Added option "-s" for signing JAR with an external command (OpenSSL used)

This is the change which I actually needed from python-javatools. We have a compact system, which is required to sign some JARs. The system does not have JRE at all because of size (and security ;-) ) requirements. This pull request implements the signing. Creation of text files (`MANIFEST.MF` and `KEYALIAS.SF`) is what Python is busy with. The crypto part (`KEYALIAS.RSA`) is done with an external call to OpenSSL.

This required three changes to existing Manifest class:
1. In `KEYALIAS.SF`, the checksums are calculated over the `MANIFEST.MF` - which means that we must track the order of entries in the manifest. So, Manifest inherits from `OrderedDict` instead of `dict`.
2. To get the checksum correct, we need to know the newline flavor in the manifest.
3. Because of the previous, `store_item()` must be an instance method of `Manifest` to put the correct newlines.

The new functionality can be tested like this:
(Prerequisites: `cert.pem` and `key.pem` are the certificate and private key used for signing. `keystore.pfx` is the same two things packed into a PKCS12 for `jarsigner` to be able to verify the signature.)

echo "We are cool at signing JARs" > data.txt
zip data.jar data.txt
mkdir META-INF
manifest -c -d SHA-256 data.jar > META-INF/MANIFEST.MF
zip -r data.jar META-INF
manifest -s cert.pem key.pem KEYALIAS data.jar

Now the JAR is signed, and the signature can be verified with `jarsigner`:

jarsigner -keystore foo.pfx -storetype PKCS12 -storepass 123456 data.jar KEYALIAS