jarsigner and proxy with authentication for timestamp authority or alternatives

Question

Previously we were using a proxy without authentication and jarsigner was fine with that. Since the proxy is now requiring user and password we have no way for jarsigner to cope with that.

Is there a way to make jarsigner work with a proxy requiring authentication?

Here is the command we were using before (with no authentication):

jarsigner -sigalg SHA256withRSA -digestalg SHA-256 -verbose -tsa 'http://timestamp.digicert.com' -J-Dhttp.proxyHost=my.server -J-Dhttps.proxyPort=8080

We tried this:

jarsigner -sigalg SHA256withRSA -digestalg SHA-256 -verbose -tsa 'http://timestamp.digicert.com' -J-Dhttp.proxyHost=my.server -J-Dhttps.proxyPort=8080 -J-Dhttp.proxyUser=user-J-Dhttp.proxyPassword=password

And this:

jarsigner -sigalg SHA256withRSA -digestalg SHA-256 -verbose -tsa 'http://timestamp.digicert.com' -J-Djava.net.useSystemProxies=true

None of them is working.

Is there a way to sign jar files that works? That is: can jarsigner work? If not: are there other alternatives?

We are using openjdk8.

Answer 1

import sun.security.tools.jarsigner.Main;
import java.net.Authenticator;
import java.net.PasswordAuthentication;

public class NewJarSigner {
        public static void main(String args[]) throws Exception {
                System.setProperty("http.proxyHost","0.0.0.0");
                System.setProperty("https.proxyHost","0.0.0.0");
                System.setProperty("http.proxyPort","8080");
                System.setProperty("https.proxyPort","8080");

                Authenticator.setDefault(
                        new Authenticator() {
                        @Override
                                public PasswordAuthentication getPasswordAuthentication() {
                                        String authPassword="password";
                                        return new PasswordAuthentication("user", authPassword.toCharArray());
                                }
                        }
                );
                Main js = new Main();
                js.run(args);
        }
}

You compile this with

javac NewJarSigner.java -cp /path/to/jdk/lib/tools.jar

You run this with

java -cp .:/path/to/jdk/lib/tools.jar NewJarSigner

And you have a new jarsigner that works with proxy authentication.