Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Issues

Select view

Select search mode

 
22 of 22

opennms-webapp-remoting JARs are not signed

Fixed

Description

$ rpm -q opennms-webapp-remoting
opennms-webapp-remoting-20.0.2-1.noarch

 

$ jarsigner -verify org.opennms.features.remote-poller-20.0.2.jar

jar is unsigned.

 

None of the JARs appear signed with the exception of the eclipse stuff:

 

$ jarsigner -verify -verbose org.eclipse.persistence.moxy-2.5.1.jar

  • Signed by "CN="Eclipse.org Foundation, Inc.", OU=IT, O="Eclipse.org Foundation, Inc.", L=Ottawa, ST=Ontario, C=CA"
    Digest algorithm: SHA1
    Signature algorithm: SHA1withRSA, 2048-bit key
    Timestamped by "CN=GeoTrust Timestamping Signer 1, O=GeoTrust Inc, C=US" on Wed Sep 18 13:20:08 UTC 2013
    Timestamp digest algorithm: SHA-1
    Timestamp signature algorithm: SHA1withRSA, 1024-bit key

jar verified.

 

Environment

RHEL7

Acceptance / Success Criteria

None

Lucidchart Diagrams

Details

Assignee

Reporter

Components

Sprint

Fix versions

Affects versions

Priority

PagerDuty

Created August 29, 2017 at 4:28 PM
Updated October 18, 2017 at 5:38 PM
Resolved October 11, 2017 at 9:12 PM

Activity

Show:

Seth LegerOctober 18, 2017 at 4:22 PM

This bug was caused when issue was implemented.

Benjamin ReedOctober 11, 2017 at 9:12 PM

So I spent all day building and re-building trying to reproduce this, and realized I know exactly why it happens.

When we make an "official" release, I prime the maven cache with a ./compile.pl I do on the build machine, so I can do assembly-only builds for RPMs, DEBs, etc and not have to do all that compiler work multiple times.  In the official release docs, I don't include the `run-expensive-tasks` profile so it's skipping jar-signing.

 

I have updated the release docs to include the fixes.

Aaron ScamehornSeptember 20, 2017 at 3:48 PM

Hi Seth,

I did not build the code; this was from the RPM's.  

I tried both versions 19 & 20.

I also tried to self sign the jars, but ran into problems with the eclipse jars because those were signed...

Seth LegerSeptember 20, 2017 at 2:48 PM

Also, why did you mar this issue as 19.1.0? Did you also verify that this is a problem in the 19.1.0 release packages?

Seth LegerSeptember 20, 2017 at 2:47 PM

Hi Aaron, did you build the code yourself or is this from the release RPMs/DEBs?