Signing Jars with AKV certificate

[JasGawera]

Hi, I'm currently trying to test viability of using AKV to store our Java code signing certificate.
I currently use a local certificate, and use the ant signjar task for jar signing.

When trying to test a self signed certificate in AKV (before purchasing a real one)
I've come across various issues with setting classpath etc (as I need to use Java 8 and Java 21)
I was led to this tool, which seems it could be what I need.

Is there a simple guide to using this tool with AKV to sign jar files?

I've seen this example:
jarsigner -J-cp -Jjsign.jar -J--add-modules -Jjava.sql \ -providerClass net.jsign.jca.JsignJcaProvider \ -providerArg <vault-name> \ -keystore NONE \ -storetype AZUREKEYVAULT \ -storepass <api-access-token> \ application.jar <key-name>

What is the significance of the "java.sql" argument?
How do I generate an API access token?

I've tried running this with some arguments missing hoping to get some useful error messages but it seems to indicate it won't work with jar files. And infact jar files are not listed on the supported file types list.
java -jar repository\jsign-7.4.jar --storetype AZUREKEYVAULT myApplication.jar jsign: Unsupported file: myApplication.jar

Thanks for any advice on this.

[ebourg]

What is the significance of the "java.sql" argument?

With Java 11+ some modules have to be added to the module path to avoid a runtime error.

How do I generate an API access token?

With the Azure CLI:

az account get-access-token --resource "https://vault.azure.net"

I've tried running this with some arguments missing hoping to get some useful error messages but it seems to indicate it won't work with jar files. And infact jar files are not listed on the supported file types list.

You don't run Jsign directly to sign a jar file. You run jarsigner and specify the Jsign provider to access the keystore.

[JasGawera]

Thanks for the super-fast response. That was very helpful and I was able to sign a jar file with my self-signed certificate.
I'll need to look into how to get a service to service signing access token as my token life is only an hour.
If you know of a good guide on this, that would be excellent 😄 I'm new to AKV.

[ebourg]

No idea sorry, but you can try asking to Gemini or ChatGPT :)