Ant SignJar: Route Timestamp Requests Through a Proxy

A build can download all its dependencies and then need another network request while signing a JAR. That request goes to the Timestamp Authority through the jarsigner process launched by Ant’s SignJar task.

SignJar provides TSA-specific proxy attributes. Within an existing signing configuration, the relevant shape is:

<signjar jar="${jar.to.sign}"
         alias="${signing.alias}"
         keystore="${signing.keystore}"
         storepass="${signing.storepass}"
         tsaurl="https://tsa.example/"
         tsaproxyhost="proxy.example"
         tsaproxyport="8080" />

The values are placeholders for the build’s approved signing setup and TSA. Ant documents tsaproxyhost and tsaproxyport from version 1.9.5 onward.

In Ant 1.10.15, SignJar inspects the TSA URL’s scheme and translates these attributes into the corresponding HTTP or HTTPS proxy properties passed to jarsigner with -J-D. The proxy host itself is a hostname, with its port supplied separately. If the approved TSA is publicly reachable and the signing process is allowed to use an unauthenticated public intermediary, an HTTP proxy list entry can fill those two TSA proxy attributes.

This child-process boundary matters in a Maven antrun build too. Maven’s repository proxy configuration and properties in the JVM running Ant are not proof that the separately launched jarsigner received the route. Configure the task that creates that process.