This is an automated email from the ASF dual-hosted git repository.
stevedlawrence pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/daffodil-infrastructure.git
The following commit(s) were added to refs/heads/main by this push:
new 4aa2fff Switch to SHA256 for ssl.com signatures
4aa2fff is described below
commit 4aa2fffac7b1dbfd475bcad2533689c6d3e1fb35
Author: Steve Lawrence <[email protected]>
AuthorDate: Mon Aug 17 13:49:35 2026 -0400
Switch to SHA256 for ssl.com signatures
Using SHA512 results in the error:
net.jsign.bouncycastle.operator.RuntimeOperatorException: exception
obtaining signature: java.security.GeneralSecurityException:
java.io.IOException: invalid_request: invalid signature algorithm in request
It seems ssl.com does not support sha512 algorithms when signing windows
executables.
DAFFODIL-3090
---
actions/release-candidate/dist/post/index.js | 3 ++-
actions/release-candidate/src/post.js | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/actions/release-candidate/dist/post/index.js
b/actions/release-candidate/dist/post/index.js
index 53d580a..e34f146 100644
--- a/actions/release-candidate/dist/post/index.js
+++ b/actions/release-candidate/dist/post/index.js
@@ -125643,8 +125643,9 @@ async function run() {
}
if (artifact.name.endsWith(".exe") &&
do_esigner) {
// see
https://infra.apache.org/code-signing-use.html for more information
+ // note that ssl.com does not suppport
SHA512 signature algorithm
const cert_uuid =
"d97c5110-c66a-4c0c-ac0c-1cd6af812ee6";
- await exec("jsign", ["--storetype",
"ESIGNER", "--alias", cert_uuid, "--storepass", esigner_storepass, "--keypass",
esigner_keypass, "--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg",
"SHA512", `${ artifact.parentPath }/${ artifact.name }`]);
+ await exec("jsign", ["--storetype",
"ESIGNER", "--alias", cert_uuid, "--storepass", esigner_storepass, "--keypass",
esigner_keypass, "--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg",
"SHA256", `${ artifact.parentPath }/${ artifact.name }`]);
}
const shasum_output = await
getExecOutput("sha512sum", ["--binary", artifact.name], {
cwd: artifact.parentPath
diff --git a/actions/release-candidate/src/post.js
b/actions/release-candidate/src/post.js
index a1648a1..f3fc0d2 100644
--- a/actions/release-candidate/src/post.js
+++ b/actions/release-candidate/src/post.js
@@ -52,8 +52,9 @@ async function run() {
}
if (artifact.name.endsWith(".exe") &&
do_esigner) {
// see
https://infra.apache.org/code-signing-use.html for more information
+ // note that ssl.com does not suppport
SHA512 signature algorithm
const cert_uuid =
"d97c5110-c66a-4c0c-ac0c-1cd6af812ee6";
- await exec("jsign", ["--storetype",
"ESIGNER", "--alias", cert_uuid, "--storepass", esigner_storepass, "--keypass",
esigner_keypass, "--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg",
"SHA512", `${ artifact.parentPath }/${ artifact.name }`]);
+ await exec("jsign", ["--storetype",
"ESIGNER", "--alias", cert_uuid, "--storepass", esigner_storepass, "--keypass",
esigner_keypass, "--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg",
"SHA256", `${ artifact.parentPath }/${ artifact.name }`]);
}
const shasum_output = await
getExecOutput("sha512sum", ["--binary", artifact.name], {
cwd: artifact.parentPath
