Remove jarsigner timestamp from keystore check#928
Open
XeduR wants to merge 1 commit into
Open
Conversation
- Drop the hardcoded `-tsa http://timestamp.digicert.com` from both jarsigner commands in the Android keystore credential check, making the check fully offline - Fixes the misleading "password not valid, or JDK not found" failure when the timestamp host is unreachable. The test jar is discarded anyway and Gradle already signs the real APK/AAB with no timestamp, so shipped apps are unaffected - Remove the dead `#if 0` jarsigner block in AndroidAppBuildController.mm (a superseded inline copy of the same check)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Solar2D's Android keystore credential check (ListKeyStore::AreKeyStoreAndAliasPasswordsValid) runs jarsigner with a hardcoded
-tsa http://timestamp.digicert.comto sign a throwaway _coronatest.jar, purely to confirm the keystore and alias passwords are valid. The timestamp serves no purpose and the signed jar is discarded immediately.The real APK/AAB is signed by Gradle with no timestamp authority configured at all. Android and Google Play do not require a signature timestamp. The only effect of the flag is to add a network round-trip to DigiCert to an otherwise fully offline password check, and when that host is unreachable (due to connection issues, geoblocking, etc.) the check fails and the Simulator reports a misleading "The password for the alias was not valid, or the Java JDK was not found."
This PR removes the
-tsaargument from both jarsigner command strings (the Mac/Linux and Windows branches). jarsigner signs fine without it (it prints a "no timestamp" warning and still exits 0), so a valid keystore still validates and a wrong password still fails. The shipped artifact is unchanged because it was never timestamped to begin with. The change also deletes a dead#if 0block in AndroidAppBuildController.mm that held a superseded inline copy of the same check.I have tested this on Solar2D Simulator on Windows and it works as intended.
Changes:
-tsa http://timestamp.digicert.comfrom both jarsigner commands in the Android keystore credential check, making the check fully offline#if 0jarsigner block in AndroidAppBuildController.mm (a superseded inline copy of the same check)