Scripts for signing using PKCS11 library on Azure pipeline

DigiCert​​®​​ Software Trust Manager clients can be downloaded in a package.

set PATH=%path%;<path to DigiCert One Signing Manager Tools>

set PATH=%path%;C:\Program Files\DigiCert\DigiCert One Signing Manager Tools

Software Trust Manager enforces multifactor authentication for security. To access keypairs, certificates, and sign code, you need to set up two types of credentials: an API token and an authentication certificate.

Set the following environment variables:

Environment variables setup for pipeline

The client tools need these environment variables to connect with DigiCert​​®​​ Software Trust Manager to provide its service. They can be integrated as variables in the pipeline which Azure will automatically inject as environment variables in the agent or they can be configured at an operating system environment level.

variables:
- name: SM_CLIENT_CERT_PASSWORD
 value: <client authentication certificate password>
- name: SM_CLIENT_CERT_FILE
  value: <Path to client authentication certificate file>
- name: SM_HOST
  value: <host url>
- name: SM_API_KEY
  value: <API Token>
- name: PKCS11_CONFIG
  value: <Path to pkcs11properties.cfg>

The following scripts can be used to generate keypairs and certificates.

- task: CmdLine@2
  displayName: 'Generate Test Keypair'
  inputs:
    script: 'smctl keypair generate rsa <Keypair Name> --cert-alias=<Certificate Name> --cert-profile-id=<Certificate Profile ID> --generate-cert=true --key-type=TEST'

- task: CmdLine@2
  displayName: 'Generate Production Keypair'
  inputs:
    script: 'smctl keypair generate rsa <Keypair Name> --cert-alias=<Certificate Name> --cert-profile-id=<Certificate Profile ID> --generate-cert=true --key-type=PRODUCTION'

- task: CmdLine@2
  displayName: 'Generate Certificate for Existing Keypair'
  inputs:
    script: 'smctl keypair generate-cert <Keypair ID> --cert-alias=<Certificate Name> --cert-profile-id=<Certificate Profile ID>'

An example for an Azure DevOps pipeline step for signing a jar is:

- task: CmdLine@2
  displayName: 'Sign Jar'
  inputs:
    script: 'jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg $PKCS11_CONFIG -signedJar <Output path for the signed jar> <Input path for jar to be signed> <certificate alias> -tsa http://timestamp.digicert.com'

The input parameters for this example are the path where the signed jar needs to be output, the path to the jar that needs to be signed and the name/alias of the certificate that needs to be used for signing.

An example of an Azure DevOps step that verifies a signed jar:

- task: CmdLine@2
  displayName: 'Verify Signed Jar'
  inputs:
    script: 'jarsigner -verify <path to the signed jar>'

The only input for this step is the path to the signed jar that needs to be verified.

trigger:
- main

pool:
  name: 'default'
  demands: agent.os -equals Linux

variables:
  - name: SM_CLIENT_CERT_PASSWORD
    value: gxmiK9Oe72Pn
  - name: SM_CLIENT_CERT_FILE
    value: "/home/john.doe/smtools/local_pkcs12.p12"
  - name: SM_HOST
    value: https://clientauth.one.digicert.com
  - name: SM_API_KEY
    value: 01ff018928e385329550b6e7a1_9b38fc5fbb4ef99ceeb7d61e6984107efa4283583cb7a64f5e292582cd3ed848
  - name: PKCS11_CONFIG
    value: "/home/john.doe/smtools/pkcs11properties.cfg"
  - name: KEYPAIR_NAME
    value: "azure-keypair-$(Build.BuildId)"

steps:

- task: CmdLine@2
  displayName: 'Generate Keypair'
  inputs:
    script: '/home/siddharth/smtools/smctl keypair generate rsa $KEYPAIR_NAME --cert-alias=$KEYPAIR_NAME --cert-profile-id=16b073d1-8de8-4ea2-9f5e-88ba6e79063a --generate-cert=true --key-type=PRODUCTION'

- task: Gradle@2
  displayName: 'Build'
  inputs:
    workingDirectory: ''
    gradleWrapperFile: 'gradlew'
    gradleOptions: '-Xmx3072m'
    javaHomeOption: 'path'
    jdkDirectory: '/usr/lib/jvm/java-11-openjdk-amd64'
    jdkArchitectureOption: 'x64'
    publishJUnitResults: true
    testResultsFiles: '**/TEST-*.xml'
    tasks: 'build'

- task: CmdLine@2
  displayName: 'Sign Jar'
  inputs:
    script: 'jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg $PKCS11_CONFIG -signedJar $(System.DefaultWorkingDirectory)/app/build/libs/signed.jar $(System.DefaultWorkingDirectory)/app/build/libs/app.jar $KEYPAIR_NAME -tsa http://timestamp.digicert.com'

- task: PublishBuildArtifacts@1
  displayName: 'Publish Unsigned Jar'
  inputs:
    PathtoPublish: '$(System.DefaultWorkingDirectory)/app/build/libs/app.jar'
    ArtifactName: 'Unsigned Jar'
    publishLocation: 'Container'

- task: PublishBuildArtifacts@1
  displayName: 'Publish Signed Jar'
  inputs:
    PathtoPublish: '$(System.DefaultWorkingDirectory)/app/build/libs/signed.jar'
    ArtifactName: 'Signed Jar'
    publishLocation: 'Container'

- task: CmdLine@2
  displayName: 'Verify Signed Jar'
  inputs:
    script: 'jarsigner -verify $(System.DefaultWorkingDirectory)/app/build/libs/signed.jar'

Troubleshooting