We have several maven projects, which are built on the build server. In some cases we want to sign our deliverables. We use Maven Jarsigner Plugin to do that.
We face the following questions:
- Where should we store the passwords for signing?
- What is a good strategy for signing maven projects?
We don't want to put our keystore somewhere on our servers and hardcode a path to it. So we just wrapped this keystore in a jar and uploaded it as an artifact to our inner maven repository. When we want to sign a maven project, we download the keystore artifact using the Maven Dependency Plugin and attach signing goal to maven build lifecycle. Here is more detailed information.
In order to hide the passwords for the keystore, we put them into our corporate pom.xml
file. We also think about storing passwords in settings.xml
on the build server.
When a project is built and signed on a developer machine, we sign it with self-signed certificate. But when project is built and signed on a build server, we sign it with our "official" certificate.
Is it a good strategy?