annotate make/SignJars.gmk @ 10607:19e02e44f2c8

Merge
author asaha
date Mon, 01 Dec 2014 11:37:49 -0800
parents ee3c7ab60373
children
rev   line source
erikj@6356 1 #
erikj@8717 2 # Copyright (c) 2012, 2013, Oracle and/or its affiliates. All rights reserved.
erikj@6356 3 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
erikj@6356 4 #
erikj@6356 5 # This code is free software; you can redistribute it and/or modify it
erikj@6356 6 # under the terms of the GNU General Public License version 2 only, as
erikj@6356 7 # published by the Free Software Foundation. Oracle designates this
erikj@6356 8 # particular file as subject to the "Classpath" exception as provided
erikj@6356 9 # by Oracle in the LICENSE file that accompanied this code.
erikj@6356 10 #
erikj@6356 11 # This code is distributed in the hope that it will be useful, but WITHOUT
erikj@6356 12 # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
erikj@6356 13 # FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
erikj@6356 14 # version 2 for more details (a copy is included in the LICENSE file that
erikj@6356 15 # accompanied this code).
erikj@6356 16 #
erikj@6356 17 # You should have received a copy of the GNU General Public License version
erikj@6356 18 # 2 along with this work; if not, write to the Free Software Foundation,
erikj@6356 19 # Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
erikj@6356 20 #
erikj@6356 21 # Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
erikj@6356 22 # or visit www.oracle.com if you need additional information or have any
erikj@6356 23 # questions.
erikj@6356 24 #
erikj@6356 25
erikj@6356 26 include $(SPEC)
erikj@6356 27 include MakeBase.gmk
erikj@6356 28
ihse@8330 29 # (The terms "OpenJDK" and "JDK" below refer to OpenJDK and Oracle JDK
erikj@6356 30 # builds respectively.)
erikj@6356 31 #
ihse@8330 32 # JCE builds are very different between OpenJDK and JDK. The OpenJDK JCE
ihse@8330 33 # jar files do not require signing, but those for JDK do. If an unsigned
erikj@6356 34 # jar file is installed into JDK, things will break when the crypto
erikj@6356 35 # routines are called.
erikj@6356 36 #
erikj@6356 37 # All jars are created in CreateJars.gmk. This Makefile does the signing
erikj@6356 38 # of the jars for JDK.
erikj@6356 39 #
erikj@6356 40 # For JDK, the binaries use pre-built/pre-signed binary files stored in
erikj@6356 41 # the closed workspace that are not shipped in the OpenJDK workspaces.
erikj@6356 42 # We still build the JDK files to verify the files compile, and in
ihse@8330 43 # preparation for possible signing. Developers working on JCE in JDK
ihse@8330 44 # must sign the JCE files before testing. The JCE signing key is kept
erikj@6356 45 # separate from the JDK workspace to prevent its disclosure.
erikj@6356 46 #
ihse@8330 47 # SPECIAL NOTE TO JCE/JDK developers: The source files must eventually
erikj@6356 48 # be built, signed, and then the resulting jar files MUST BE CHECKED
ihse@8330 49 # INTO THE CLOSED PART OF THE WORKSPACE*. This separate step *MUST NOT
erikj@6356 50 # BE FORGOTTEN*, otherwise a bug fixed in the source code will not be
erikj@8717 51 # reflected in the shipped binaries.
erikj@8717 52 #
erikj@8717 53 # Please consult with Release Engineering, which is responsible for
erikj@8717 54 # creating the final JCE builds suitable for checkin.
erikj@6356 55 #
erikj@6356 56
erikj@6356 57 # Default target
erikj@6356 58 all:
erikj@6356 59
erikj@6356 60 ifndef OPENJDK
erikj@6356 61
erikj@6356 62 README-MAKEFILE_WARNING := \
lana@8887 63 "\nPlease read jdk/make/SignJars.gmk for further build instructions.\n"
erikj@6356 64
erikj@6356 65 #
erikj@6356 66 # Location for JCE codesigning key.
erikj@6356 67 #
ihse@8330 68 SIGNING_KEY_DIR := /security/ws/JCE-signing/src
ihse@8330 69 SIGNING_KEYSTORE := $(SIGNING_KEY_DIR)/KeyStore.jks
erikj@6356 70 SIGNING_PASSPHRASE := $(SIGNING_KEY_DIR)/passphrase.txt
ihse@8330 71 SIGNING_ALIAS := oracle_jce_rsa
erikj@6356 72
erikj@6356 73 #
erikj@6356 74 # Defines for signing the various jar files.
erikj@6356 75 #
erikj@6356 76 check-keystore:
erikj@6356 77 @if [ ! -f $(SIGNING_KEYSTORE) -o ! -f $(SIGNING_PASSPHRASE) ]; then \
ihse@8330 78 $(PRINTF) "\n$(SIGNING_KEYSTORE): Signing mechanism *NOT* available..."; \
ihse@8330 79 $(PRINTF) $(README-MAKEFILE_WARNING); \
ihse@8330 80 exit 2; \
erikj@6356 81 fi
erikj@6356 82
erikj@8949 83 $(JDK_OUTPUTDIR)/jce/signed/%: $(JDK_OUTPUTDIR)/jce/unsigned/%
erikj@6824 84 $(call install-file)
erikj@6356 85 $(JARSIGNER) -keystore $(SIGNING_KEYSTORE) \
erikj@6356 86 $@ $(SIGNING_ALIAS) < $(SIGNING_PASSPHRASE)
erikj@6356 87 @$(PRINTF) "\nJar codesigning finished.\n"
erikj@6356 88
erikj@8717 89 JAR_LIST := \
erikj@8717 90 jce.jar \
erikj@8949 91 policy/limited/local_policy.jar \
erikj@8949 92 policy/limited/US_export_policy.jar \
erikj@8949 93 policy/unlimited/local_policy.jar \
erikj@8949 94 policy/unlimited/US_export_policy.jar \
ihse@8330 95 sunec.jar \
ihse@8330 96 sunjce_provider.jar \
ihse@8330 97 sunpkcs11.jar \
erikj@8717 98 sunmscapi.jar \
erikj@8717 99 ucrypto.jar \
erikj@8717 100 #
erikj@6356 101
erikj@8949 102 UNSIGNED_JARS := $(wildcard $(addprefix $(JDK_OUTPUTDIR)/jce/unsigned/, $(JAR_LIST)))
erikj@8717 103
erikj@8717 104 ifeq ($(UNSIGNED_JARS), )
erikj@8949 105 $(error No jars found in $(JDK_OUTPUTDIR)/jce/unsigned/)
erikj@8717 106 endif
erikj@8717 107
erikj@8949 108 SIGNED_JARS := $(patsubst $(JDK_OUTPUTDIR)/jce/unsigned/%,$(JDK_OUTPUTDIR)/jce/signed/%, \
erikj@8949 109 $(UNSIGNED_JARS))
erikj@6356 110
erikj@6356 111 $(SIGNED_JARS): check-keystore
erikj@6356 112
erikj@8949 113 $(JDK_OUTPUTDIR)/jce/signed/policy/unlimited/README.txt: \
erikj@8949 114 $(JDK_OUTPUTDIR)/jce/unsigned/policy/unlimited/README.txt
erikj@8949 115 $(install-file)
erikj@8949 116
erikj@8949 117 all: $(SIGNED_JARS) $(JDK_OUTPUTDIR)/jce/signed/policy/unlimited/README.txt
erikj@8717 118 @$(PRINTF) "\n*** The jar files built by the 'sign-jars' target are developer ***"
erikj@8717 119 @$(PRINTF) "\n*** builds only and *MUST NOT* be checked into the closed workspace. ***"
erikj@8717 120 @$(PRINTF) "\n*** ***"
erikj@8717 121 @$(PRINTF) "\n*** Please consult with Release Engineering: they will generate ***"
erikj@8717 122 @$(PRINTF) "\n*** the proper binaries for the closed workspace. ***"
erikj@8717 123 @$(PRINTF) "\n"
ihse@8330 124 @$(PRINTF) $(README-MAKEFILE_WARNING)
erikj@6356 125
ihse@8330 126 endif # !OPENJDK