All geek questions in one place

Jarsigner issue with jre / lib / ext removal

According to this article: https://blogs.oracle.com/java-platform-group/planning-safe-removal-of-under-used-endorsed-extension-directories

jre / lib / ext is removed in Java 9.

My problem is that I use Jarsigner, which in previous versions of Java found a jour provider in the jre / lib / ext folder.

jarsigner -tsa timestamp.digicert.com -verbose -keystore NONE -storetype PKCS11 -storepass null -providername <MY_PROVIDER_NAME> <JAR_FILE> <CERTIFICATE_NAME>

How can I solve it?

+5
source share
2 answers

i finally managed to solve this problem based on https://docs.oracle.com/javase/9/security/howtoimplaprovider.htm#JSSEC-GUID-7C304A79-6D0B-438B-A02E-51648C909876

You need to do the following (only indicate what's new for Java9):

Follow step 4 and add the module declaration:

 module com.foo.MyProvider { provides java.security.Provider with p.MyProvider; requires java.security.jgss; }

When starting up Jarsigner using the path module:

 jarsigner -J--module-path -J<PATH_TO_PROVIDER_JAR> -J--add-modules -J<MODULE_NAME> -tsa timestamp.digicert.com -verbose -keystore NONE -storetype PKCS11 -storepass null -providername <MY_PROVIDER_NAME> <JAR_FILE> <CERTIFICATE_NAME>
+1
source

changes to the installed image JDK / JRE brings run-time images that consist of directories, including -

conf - contains .properties, .policy and other types of files intended for editing by developers, developers and end users. These files were previously located in the lib directory or its subdirectories.

The java.security file in JDK9 (located under .../Home/conf/security ) lists the SunPKCS11 provider among the default list of providers.

 security.provider.13=SunPKCS11

# The SunPKCS11 configuration in the reference guide contains information on how to add a provider that is present in the jdk.crypto.cryptoki JDK module.

So, ideally, there should be no need to configure the path to the sunpkcs11 provider in Java9.

Addendum and an example of how providers are combined into modules, to it from JEP 220: Modular runtime images

Security policy files and other uses of the CodeSource API can use jrt URLs to refer to specific modules in order to grant permissions. Now you can identify the cryptography provider with an elliptic curve, for example, at the jrt URL

 jrt:/jdk.crypto.ec

Other modules that are currently granted all permissions, but do not actually require them, may be trivially de-privileged, i.e. exactly the permissions they require.

+2
source

Source: https://habr.com/ru/post/1273546/

More articles:


All Articles