Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v2025.01.01] Update jdk8u sign.sh Eclipse signing to not sign apims Microsoft files (#4112) #4113

Merged
merged 1 commit into from
Jan 8, 2025
Merged

[v2025.01.01] Update jdk8u sign.sh Eclipse signing to not sign apims Microsoft files (#4112) #4113

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 32 additions & 27 deletions sign.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,38 +78,43 @@ signRelease()
echo "Signing ${f}"
if [ "$SIGN_TOOL" = "eclipse" ]; then
if [ "${VERSION}" = "8" ]; then
echo "Signing $f using Eclipse Foundation codesign service"
dir=$(dirname "$f")
file=$(basename "$f")
mv "$f" "${dir}/unsigned_${file}"
if ! curl --fail --silent --show-error -o "$f" -F file="@${dir}/unsigned_${file}" https://cbi.eclipse.org/authenticode/sign; then
echo "curl command failed, sign of $f failed"
# Check if file is a Microsoft supplied file that is already signed
if [[ "$file" =~ api-ms-win.* ]] || [[ "$file" =~ API-MS-Win.* ]] || [[ "$file" =~ msvcp.* ]] || [[ "$file" =~ ucrtbase.* ]] || [[ "$file" =~ vcruntime.* ]]; then
echo "Skipping Microsoft file $file"
else
echo "Signing $f using Eclipse Foundation codesign service"
mv "$f" "${dir}/unsigned_${file}"
if ! curl --fail --silent --show-error -o "$f" -F file="@${dir}/unsigned_${file}" https://cbi.eclipse.org/authenticode/sign; then
echo "curl command failed, sign of $f failed"

# Retry up to 20 times
max_iterations=20
iteration=1
success=false
echo "Code Not Signed For File $f"
while [ $iteration -le $max_iterations ] && [ $success = false ]; do
echo $iteration Of $max_iterations
sleep 1
if ! curl --fail --silent --show-error -o "$f" -F file="@${dir}/unsigned_${file}" https://cbi.eclipse.org/authenticode/sign; then
echo "curl command failed, $f Failed Signing On Attempt $iteration"
success=false
iteration=$((iteration+1))
if [ $iteration -gt $max_iterations ]
then
echo "Errors Encountered During Signing"
exit 1
# Retry up to 20 times
max_iterations=20
iteration=1
success=false
echo "Code Not Signed For File $f"
while [ $iteration -le $max_iterations ] && [ $success = false ]; do
echo $iteration Of $max_iterations
sleep 1
if ! curl --fail --silent --show-error -o "$f" -F file="@${dir}/unsigned_${file}" https://cbi.eclipse.org/authenticode/sign; then
echo "curl command failed, $f Failed Signing On Attempt $iteration"
success=false
iteration=$((iteration+1))
if [ $iteration -gt $max_iterations ]
then
echo "Errors Encountered During Signing"
exit 1
fi
else
echo "$f Signed OK On Attempt $iteration"
success=true
fi
else
echo "$f Signed OK On Attempt $iteration"
success=true
fi
done
done
fi
chmod --reference="${dir}/unsigned_${file}" "$f"
rm -rf "${dir}/unsigned_${file}"
fi
chmod --reference="${dir}/unsigned_${file}" "$f"
rm -rf "${dir}/unsigned_${file}"
else
echo "Eclipse signing for JDK version ${VERSION} does not externally sign Windows executables post-build"
fi
Expand Down
Loading