From a9d8c6aaae395b9b6968310c5850c14ca100ff0d Mon Sep 17 00:00:00 2001
From: aboyko <aboyko@vmware.com>
Date: Tue, 13 Jun 2023 17:16:13 -0400
Subject: [PATCH] Eclipse distro JAR and EXE signing

---
 .../pom.xml                                   | 37 ++++++-----
 .../pom.xml                                   | 37 ++++++-----
 .../pom.xml                                   | 37 ++++++-----
 .../pom.xml                                   | 37 ++++++-----
 eclipse-distribution/pom.xml                  | 41 ++++++++++++
 eclipse-distribution/scripts/sign-exe.sh      | 16 +++++
 eclipse-distribution/scripts/sign-jars.sh     | 29 +++++++++
 eclipse-language-servers/pom.xml              | 65 +++++++++----------
 eclipse-language-servers/scripts/sign-jars.sh | 15 +++--
 9 files changed, 214 insertions(+), 100 deletions(-)
 create mode 100755 eclipse-distribution/scripts/sign-exe.sh
 create mode 100755 eclipse-distribution/scripts/sign-jars.sh

diff --git a/eclipse-distribution/org.springframework.boot.ide.product.e425/pom.xml b/eclipse-distribution/org.springframework.boot.ide.product.e425/pom.xml
index 1788da61b..34cb23d26 100644
--- a/eclipse-distribution/org.springframework.boot.ide.product.e425/pom.xml
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e425/pom.xml
@@ -350,24 +350,31 @@
 
 								<taskdef resource="net/sf/antcontrib/antcontrib.properties" />
 
-								<exec executable="osslsigncode" failonerror="true">
-									<arg value="sign"/>
-									<arg value="-pkcs12"/>
-									<arg value="${env.WIN_KEY_LOCATION}"/>
-									<arg value="-pass"/>
-									<arg value="${env.bamboo_vault_signing_passphrase}"/>
-									<arg value="-n"/>
-									<arg value="Spring Tools 4"/>
-								    <arg value="-i"/>
-								    <arg value="https://spring.io"/>
-								    <arg value="-t"/>
-								    <arg value="http://timestamp.digicert.com"/>
-									<arg value="-in"/>
+								<exec executable="${project.parent.basedir}/scripts/sign-exe.sh" failonerror="true">
+									<env key="SSH_USER" path="${vm-signing.ssh.user}" />
+									<env key="SSH_KEY" path="${vm-signing.ssh.key}" />
+									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
 									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
-									<arg value="-out"/>
-								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
 								</exec>
 
+<!--								<exec executable="osslsigncode" failonerror="true">-->
+<!--									<arg value="sign"/>-->
+<!--									<arg value="-pkcs12"/>-->
+<!--									<arg value="${env.WIN_KEY_LOCATION}"/>-->
+<!--									<arg value="-pass"/>-->
+<!--									<arg value="${env.bamboo_vault_signing_passphrase}"/>-->
+<!--									<arg value="-n"/>-->
+<!--									<arg value="Spring Tools 4"/>-->
+<!--								    <arg value="-i"/>-->
+<!--								    <arg value="https://spring.io"/>-->
+<!--								    <arg value="-t"/>-->
+<!--								    <arg value="http://timestamp.digicert.com"/>-->
+<!--									<arg value="-in"/>-->
+<!--									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>-->
+<!--									<arg value="-out"/>-->
+<!--								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>-->
+<!--								</exec>-->
+
 							</target>
 						</configuration>
 						<goals>
diff --git a/eclipse-distribution/org.springframework.boot.ide.product.e426/pom.xml b/eclipse-distribution/org.springframework.boot.ide.product.e426/pom.xml
index 86b2e81f2..2d922fc07 100644
--- a/eclipse-distribution/org.springframework.boot.ide.product.e426/pom.xml
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e426/pom.xml
@@ -362,24 +362,31 @@
 
 								<taskdef resource="net/sf/antcontrib/antcontrib.properties" />
 
-								<exec executable="osslsigncode" failonerror="true">
-									<arg value="sign"/>
-									<arg value="-pkcs12"/>
-									<arg value="${env.WIN_KEY_LOCATION}"/>
-									<arg value="-pass"/>
-									<arg value="${env.bamboo_vault_signing_passphrase}"/>
-									<arg value="-n"/>
-									<arg value="Spring Tools 4"/>
-								    <arg value="-i"/>
-								    <arg value="https://spring.io"/>
-								    <arg value="-t"/>
-								    <arg value="http://timestamp.digicert.com"/>
-									<arg value="-in"/>
+								<exec executable="${project.parent.basedir}/scripts/sign-exe.sh" failonerror="true">
+									<env key="SSH_USER" path="${vm-signing.ssh.user}" />
+									<env key="SSH_KEY" path="${vm-signing.ssh.key}" />
+									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
 									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
-									<arg value="-out"/>
-								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
 								</exec>
 
+<!--								<exec executable="osslsigncode" failonerror="true">-->
+<!--									<arg value="sign"/>-->
+<!--									<arg value="-pkcs12"/>-->
+<!--									<arg value="${env.WIN_KEY_LOCATION}"/>-->
+<!--									<arg value="-pass"/>-->
+<!--									<arg value="${env.bamboo_vault_signing_passphrase}"/>-->
+<!--									<arg value="-n"/>-->
+<!--									<arg value="Spring Tools 4"/>-->
+<!--								    <arg value="-i"/>-->
+<!--								    <arg value="https://spring.io"/>-->
+<!--								    <arg value="-t"/>-->
+<!--								    <arg value="http://timestamp.digicert.com"/>-->
+<!--									<arg value="-in"/>-->
+<!--									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>-->
+<!--									<arg value="-out"/>-->
+<!--								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>-->
+<!--								</exec>-->
+
 							</target>
 						</configuration>
 						<goals>
diff --git a/eclipse-distribution/org.springframework.boot.ide.product.e427/pom.xml b/eclipse-distribution/org.springframework.boot.ide.product.e427/pom.xml
index 788c7cc92..c88f34ff0 100644
--- a/eclipse-distribution/org.springframework.boot.ide.product.e427/pom.xml
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e427/pom.xml
@@ -362,24 +362,31 @@
 
 								<taskdef resource="net/sf/antcontrib/antcontrib.properties" />
 
-								<exec executable="osslsigncode" failonerror="true">
-									<arg value="sign"/>
-									<arg value="-pkcs12"/>
-									<arg value="${env.WIN_KEY_LOCATION}"/>
-									<arg value="-pass"/>
-									<arg value="${env.bamboo_vault_signing_passphrase}"/>
-									<arg value="-n"/>
-									<arg value="Spring Tools 4"/>
-								    <arg value="-i"/>
-								    <arg value="https://spring.io"/>
-								    <arg value="-t"/>
-								    <arg value="http://timestamp.digicert.com"/>
-									<arg value="-in"/>
+								<exec executable="${project.parent.basedir}/scripts/sign-exe.sh" failonerror="true">
+									<env key="SSH_USER" path="${vm-signing.ssh.user}" />
+									<env key="SSH_KEY" path="${vm-signing.ssh.key}" />
+									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
 									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
-									<arg value="-out"/>
-								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
 								</exec>
 
+<!--								<exec executable="osslsigncode" failonerror="true">-->
+<!--									<arg value="sign"/>-->
+<!--									<arg value="-pkcs12"/>-->
+<!--									<arg value="${env.WIN_KEY_LOCATION}"/>-->
+<!--									<arg value="-pass"/>-->
+<!--									<arg value="${env.bamboo_vault_signing_passphrase}"/>-->
+<!--									<arg value="-n"/>-->
+<!--									<arg value="Spring Tools 4"/>-->
+<!--								    <arg value="-i"/>-->
+<!--								    <arg value="https://spring.io"/>-->
+<!--								    <arg value="-t"/>-->
+<!--								    <arg value="http://timestamp.digicert.com"/>-->
+<!--									<arg value="-in"/>-->
+<!--									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>-->
+<!--									<arg value="-out"/>-->
+<!--								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>-->
+<!--								</exec>-->
+
 							</target>
 						</configuration>
 						<goals>
diff --git a/eclipse-distribution/org.springframework.boot.ide.product.e428/pom.xml b/eclipse-distribution/org.springframework.boot.ide.product.e428/pom.xml
index 670ecfd47..6b5388f0b 100644
--- a/eclipse-distribution/org.springframework.boot.ide.product.e428/pom.xml
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e428/pom.xml
@@ -362,24 +362,31 @@
 
 								<taskdef resource="net/sf/antcontrib/antcontrib.properties" />
 
-								<exec executable="osslsigncode" failonerror="true">
-									<arg value="sign"/>
-									<arg value="-pkcs12"/>
-									<arg value="${env.WIN_KEY_LOCATION}"/>
-									<arg value="-pass"/>
-									<arg value="${env.bamboo_vault_signing_passphrase}"/>
-									<arg value="-n"/>
-									<arg value="Spring Tools 4"/>
-								    <arg value="-i"/>
-								    <arg value="https://spring.io"/>
-								    <arg value="-t"/>
-								    <arg value="http://timestamp.digicert.com"/>
-									<arg value="-in"/>
+								<exec executable="${project.parent.basedir}/scripts/sign-exe.sh" failonerror="true">
+									<env key="SSH_USER" path="${vm-signing.ssh.user}" />
+									<env key="SSH_KEY" path="${vm-signing.ssh.key}" />
+									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
 									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
-									<arg value="-out"/>
-								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>
 								</exec>
 
+<!--								<exec executable="osslsigncode" failonerror="true">-->
+<!--									<arg value="sign"/>-->
+<!--									<arg value="-pkcs12"/>-->
+<!--									<arg value="${env.WIN_KEY_LOCATION}"/>-->
+<!--									<arg value="-pass"/>-->
+<!--									<arg value="${env.bamboo_vault_signing_passphrase}"/>-->
+<!--									<arg value="-n"/>-->
+<!--									<arg value="Spring Tools 4"/>-->
+<!--								    <arg value="-i"/>-->
+<!--								    <arg value="https://spring.io"/>-->
+<!--								    <arg value="-t"/>-->
+<!--								    <arg value="http://timestamp.digicert.com"/>-->
+<!--									<arg value="-in"/>-->
+<!--									<arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>-->
+<!--									<arg value="-out"/>-->
+<!--								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/win32/win32/x86_64/sts-${unqualifiedVersion}.${p2.qualifier}/SpringToolSuite4.exe"/>-->
+<!--								</exec>-->
+
 							</target>
 						</configuration>
 						<goals>
diff --git a/eclipse-distribution/pom.xml b/eclipse-distribution/pom.xml
index 222b9bd56..da69140fb 100644
--- a/eclipse-distribution/pom.xml
+++ b/eclipse-distribution/pom.xml
@@ -95,6 +95,9 @@
 		<encoding>UTF-8</encoding>
 
 		<misc.p2.repo.version>3.9.4.202211021051</misc.p2.repo.version>
+
+		<vm-signing.ssh.user>signer</vm-signing.ssh.user>
+		<vm-signing.ssh.key>/home/bamboo/.ssh/id_rsa</vm-signing.ssh.key>
 	</properties>
 
 	<profiles>
@@ -147,6 +150,32 @@
 			</properties>
 		</profile>
 
+		<profile>
+			<id>vm-signing</id>
+			<build>
+				<plugins>
+					<plugin>
+						<artifactId>exec-maven-plugin</artifactId>
+						<groupId>org.codehaus.mojo</groupId>
+						<executions>
+							<execution>
+								<id>VM JAR Sign</id>
+								<phase>package</phase>
+								<goals>
+									<goal>exec</goal>
+								</goals>
+							</execution>
+						</executions>
+						<configuration>
+							<arguments>
+								<argument>${project.build.directory}</argument>
+							</arguments>
+						</configuration>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
+
 		<profile>
 			<id>e425</id>
 			<properties>
@@ -866,6 +895,18 @@
 					</dependencies>
 				</plugin>
 
+				<plugin>
+					<artifactId>exec-maven-plugin</artifactId>
+					<groupId>org.codehaus.mojo</groupId>
+					<configuration>
+						<executable>scripts/sign-jars.sh</executable>
+						<environmentVariables>
+							<SSH_USER>${vm-signing.ssh.user}</SSH_USER>
+							<SSH_KEY>${vm-signing.ssh.key}</SSH_KEY>
+						</environmentVariables>
+					</configuration>
+				</plugin>
+
 			</plugins>
 		</pluginManagement>
 	</build>
diff --git a/eclipse-distribution/scripts/sign-exe.sh b/eclipse-distribution/scripts/sign-exe.sh
new file mode 100755
index 000000000..7575588e4
--- /dev/null
+++ b/eclipse-distribution/scripts/sign-exe.sh
@@ -0,0 +1,16 @@
+set -e
+in_file=$1
+out_file=$2
+
+in_filename="$(basename -- $in_file)"
+
+echo "Copying $in_filename to remote machine..."
+scp -i $SSH_KEY $in_file $SSH_USER@vm-tools.spring.vmware.com:/opt/bamboo
+echo "Signing $in_filename..."
+ssh -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com -- /build/apps/signing/signserver/signc -v --input=/opt/bamboo/$in_filename --keyid=authenticode_SHA2 --signmethod="winddk-8.1" --output=/opt/bamboo/$in_filename --hash sha256
+echo "Copying **signed** $in_filename back... (into $out_file)"
+scp -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com:/opt/bamboo/$in_filename $out_file
+echo "Cleaning up remote machine..."
+ssh -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com -- rm /opt/bamboo/$in_filename
+echo "Successfully signed $in_filename"
+
diff --git a/eclipse-distribution/scripts/sign-jars.sh b/eclipse-distribution/scripts/sign-jars.sh
new file mode 100755
index 000000000..e5ec9edc7
--- /dev/null
+++ b/eclipse-distribution/scripts/sign-jars.sh
@@ -0,0 +1,29 @@
+set -e
+target_folder=$1
+if [ -d "$target_folder" ]
+then
+  echo "Sign JARs in directory: $target_folder"
+  files=`ls $target_folder`
+  for file in $files
+  do
+#    echo "Found $file..."
+    if ! [ -d $file ]
+    then
+#      echo "Looking at: $target_folder/$file"
+      extension="${file##*.}"
+#      echo "Detected extension = $extension"
+      if [ "$extension" = "jar" ]
+      then
+        echo "Copying $file to remote machine..."
+        scp -i $SSH_KEY $target_folder/$file $SSH_USER@vm-tools.spring.vmware.com:/opt/bamboo
+        echo "Signing $file..."
+        ssh -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com -- /build/apps/signing/signserver/signc -v --input=/opt/bamboo/$file --keyid=jarsign_vmware --signmethod="jdk-1.8.0_121" --output=/opt/bamboo/$file
+        echo "Copying **signed** $file back... (into $target_folder/$file)"
+        scp -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com:/opt/bamboo/$file $target_folder/$file
+        echo "Cleaning up remote machine..."
+        ssh -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com -- rm /opt/bamboo/$file
+        echo "Successfully signed $file"
+      fi
+    fi
+  done
+fi
diff --git a/eclipse-language-servers/pom.xml b/eclipse-language-servers/pom.xml
index 414c7eacc..bd0887b96 100644
--- a/eclipse-language-servers/pom.xml
+++ b/eclipse-language-servers/pom.xml
@@ -160,6 +160,31 @@
 			</properties>
 		</profile>
 
+		<profile>
+			<id>vm-signing</id>
+			<build>
+				<plugins>
+					<plugin>
+						<artifactId>exec-maven-plugin</artifactId>
+						<groupId>org.codehaus.mojo</groupId>
+						<executions>
+							<execution>
+								<id>VM JAR Sign</id>
+								<phase>package</phase>
+								<goals>
+									<goal>exec</goal>
+								</goals>
+							</execution>
+						</executions>
+						<configuration>
+							<arguments>
+								<argument>${project.build.directory}</argument>
+							</arguments>
+						</configuration>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
 
 		<profile>
 			<id>e425</id>
@@ -394,32 +419,6 @@
 			</properties>
 		</profile>
 
-		<profile>
-			<id>vm-signing</id>
-			<build>
-				<plugins>
-					<plugin>
-						<artifactId>exec-maven-plugin</artifactId>
-						<groupId>org.codehaus.mojo</groupId>
-						<executions>
-							<execution><!-- Run our version calculation script -->
-								<id>VM JAR Sign</id>
-								<phase>package</phase>
-								<goals>
-									<goal>exec</goal>
-								</goals>
-							</execution>
-						</executions>
-						<configuration>
-							<arguments>
-								<argument>${project.build.directory}</argument>
-							</arguments>
-						</configuration>
-					</plugin>
-				</plugins>
-			</build>
-		</profile>
-
 	</profiles>
 
 	<repositories>
@@ -671,13 +670,13 @@
 				<plugin>
 					<artifactId>exec-maven-plugin</artifactId>
 					<groupId>org.codehaus.mojo</groupId>
-						<configuration>
-							<executable>scripts/sign-jars.sh</executable>
-							<environmentVariables>
-								<SSH_USER>${vm-signing.ssh.user}</SSH_USER>
-								<SSH_KEY>${vm-signing.ssh.key}</SSH_KEY>
-							</environmentVariables>
-						</configuration>
+					<configuration>
+						<executable>scripts/sign-jars.sh</executable>
+						<environmentVariables>
+							<SSH_USER>${vm-signing.ssh.user}</SSH_USER>
+							<SSH_KEY>${vm-signing.ssh.key}</SSH_KEY>
+						</environmentVariables>
+					</configuration>
 				</plugin>
 
 			</plugins>
diff --git a/eclipse-language-servers/scripts/sign-jars.sh b/eclipse-language-servers/scripts/sign-jars.sh
index 75f7ddce9..e5ec9edc7 100755
--- a/eclipse-language-servers/scripts/sign-jars.sh
+++ b/eclipse-language-servers/scripts/sign-jars.sh
@@ -1,24 +1,25 @@
 set -e
-if [ -d "$1" ]
+target_folder=$1
+if [ -d "$target_folder" ]
 then
-  echo "Sign JARs in directory: $1"
-  files=`ls $1`
+  echo "Sign JARs in directory: $target_folder"
+  files=`ls $target_folder`
   for file in $files
   do
 #    echo "Found $file..."
     if ! [ -d $file ]
     then
-#      echo "Looking at: $1/$file"
+#      echo "Looking at: $target_folder/$file"
       extension="${file##*.}"
 #      echo "Detected extension = $extension"
       if [ "$extension" = "jar" ]
       then
         echo "Copying $file to remote machine..."
-        scp -i $SSH_KEY $1/$file $SSH_USER@vm-tools.spring.vmware.com:/opt/bamboo
+        scp -i $SSH_KEY $target_folder/$file $SSH_USER@vm-tools.spring.vmware.com:/opt/bamboo
         echo "Signing $file..."
         ssh -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com -- /build/apps/signing/signserver/signc -v --input=/opt/bamboo/$file --keyid=jarsign_vmware --signmethod="jdk-1.8.0_121" --output=/opt/bamboo/$file
-        echo "Copying **signed** $file back... (into $1/$file)"
-        scp -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com:/opt/bamboo/$file $1/$file
+        echo "Copying **signed** $file back... (into $target_folder/$file)"
+        scp -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com:/opt/bamboo/$file $target_folder/$file
         echo "Cleaning up remote machine..."
         ssh -i $SSH_KEY $SSH_USER@vm-tools.spring.vmware.com -- rm /opt/bamboo/$file
         echo "Successfully signed $file"