Verify Windows and Mac Signing signatures in all executables and installers #848

andrew-m-leonard · 2023-11-28T16:46:06Z

For Temurin builds, verify that for Windows and Mac platforms all the following are correctly signed with a non-adhoc Signature:

Mac:
- Within JMODs executable format files
- jdk|jre/bin executable format files
- *.pkg installers (also verify Notarized)
Windows:
- Within JMODs all .exe/.dll executable files
- jdk|jre/bin all .exe/.dll executable files
- *.msi installers

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

andrew-m-leonard · 2023-11-29T16:06:50Z

run tests

adamfarley

LGTM

steelhead31

LGTM

eclipse-temurin-bot · 2023-11-29T19:13:31Z

 PR TESTER RESULT 

❎ Some pipelines failed or the job was aborted! ❎
See the pipeline-build-check below for more information...

karianna · 2023-11-29T19:35:27Z

Digging into the pipeline failures - looks like Mac Os X signing failures e.g.,

Error: executable is 'adhoc' Signed: unpacked/jdk/expanded_java.management.jmod/lib/libmanagement.dylib
FAILURE: The following 194 executables are not signed correctly:
unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/jwebserver
unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/jfr
unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/rmiregistry

karianna

Error: executable is 'adhoc' Signed: unpacked/jdk/expanded_java.management.jmod/lib/libmanagement.dylib
FAILURE: The following 194 executables are not signed correctly:
unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/jwebserver
unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/jfr
unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/rmiregistry

andrew-m-leonard · 2023-11-30T08:42:28Z

Error: executable is 'adhoc' Signed: unpacked/jdk/expanded_java.management.jmod/lib/libmanagement.dylib FAILURE: The following 194 executables are not signed correctly: unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/jwebserver unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/jfr unpacked/jre/jdk-21.0.1+12-jre/Contents/Home/bin/rmiregistry

@karianna So yeah, the pr-tester does not Eclipse "Sign" the dylibs, so it's actually accurate, but we obviously don't want the pr-tester to fail! So I shall have to exclude the sign_verification from the pr-tester.

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

andrew-m-leonard · 2023-11-30T08:46:42Z

run tests

Added check to not verify pr-tester as it does not sign binaries

eclipse-temurin-bot · 2023-11-30T11:20:58Z

 PR TESTER RESULT 

❎ Some pipelines failed or the job was aborted! ❎
See the pipeline-build-check below for more information...

andrew-m-leonard · 2023-11-30T11:28:35Z

run tests

eclipse-temurin-bot · 2023-11-30T14:57:16Z

 PR TESTER RESULT 

✅ All pipelines passed! ✅

andrew-m-leonard · 2023-11-30T15:10:04Z

@karianna checks look all good now

…allers (adoptium#848) * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Signing verifier job Signed-off-by: Andrew Leonard <anleonar@redhat.com> * Don't verify pr-tester binaries as they are not signed Signed-off-by: Andrew Leonard <anleonar@redhat.com> --------- Signed-off-by: Andrew Leonard <anleonar@redhat.com>

andrew-m-leonard added 30 commits November 22, 2023 10:24

Signing verifier job

089f565

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

8607168

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

85b0eda

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

cfac822

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

dff906f

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

364239d

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

b77f9bf

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

ae27273

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

b785ea3

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

3355152

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

df270aa

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

5584177

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

ee442cb

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

e88d623

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

431e73d

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

4c38281

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

2588dd4

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

a243ea4

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

2de20dc

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

a955b0a

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

c4d9723

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

20d1395

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

4555bbc

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

9196e15

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

4e1c969

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

66bca21

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

3aadbfd

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

ea6ae8c

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

e0d0d27

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

f7e7077

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

andrew-m-leonard added 12 commits November 29, 2023 13:47

Signing verifier job

6ec6cc5

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

6b8f4d2

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

13fb79c

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

5607b6f

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

1f1d74b

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

a4963e8

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

3ffea58

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

268018e

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

d81a3d8

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

5d5db03

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

c118ab9

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

Signing verifier job

70cfd26

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

andrew-m-leonard requested a review from karianna November 29, 2023 16:06

adamfarley approved these changes Nov 29, 2023

View reviewed changes

steelhead31 approved these changes Nov 29, 2023

View reviewed changes

karianna previously requested changes Nov 29, 2023

View reviewed changes

Don't verify pr-tester binaries as they are not signed

d1ca460

Signed-off-by: Andrew Leonard <anleonar@redhat.com>

andrew-m-leonard requested a review from karianna November 30, 2023 08:46

andrew-m-leonard merged commit 7b9559c into adoptium:master Dec 1, 2023
28 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Verify Windows and Mac Signing signatures in all executables and installers #848

Verify Windows and Mac Signing signatures in all executables and installers #848

andrew-m-leonard commented Nov 28, 2023

andrew-m-leonard commented Nov 29, 2023

adamfarley left a comment

steelhead31 left a comment

eclipse-temurin-bot commented Nov 29, 2023

karianna commented Nov 29, 2023

karianna left a comment

andrew-m-leonard commented Nov 30, 2023

andrew-m-leonard commented Nov 30, 2023

eclipse-temurin-bot commented Nov 30, 2023

andrew-m-leonard commented Nov 30, 2023

eclipse-temurin-bot commented Nov 30, 2023

andrew-m-leonard commented Nov 30, 2023

Verify Windows and Mac Signing signatures in all executables and installers #848

Verify Windows and Mac Signing signatures in all executables and installers #848

Conversation

andrew-m-leonard commented Nov 28, 2023

andrew-m-leonard commented Nov 29, 2023

adamfarley left a comment

Choose a reason for hiding this comment

steelhead31 left a comment

Choose a reason for hiding this comment

eclipse-temurin-bot commented Nov 29, 2023

 PR TESTER RESULT 

karianna commented Nov 29, 2023

karianna left a comment

Choose a reason for hiding this comment

andrew-m-leonard commented Nov 30, 2023

andrew-m-leonard commented Nov 30, 2023

eclipse-temurin-bot commented Nov 30, 2023

 PR TESTER RESULT 

andrew-m-leonard commented Nov 30, 2023

eclipse-temurin-bot commented Nov 30, 2023

 PR TESTER RESULT 

andrew-m-leonard commented Nov 30, 2023