Sign a jar file created with maven-assembly plugin

问题

I'd like to build an assembly and then sign it. My problem is that the jarsigner signs not the assembly, only the standalone jar file. Could you tell me what is the problem? Maven seems like 'magic' to me after having used Ant for years.. I can't see the way the plugins cooperate and pass information to each other.

After executing mvn install, I get two jar files, one called example-1.0.0-SNAPSHOT.jar and this is signed, and one called example-1.0.0-jar-with-dependencies.jar and this is not signed. I do not need the solo one, only the assembly, but that signed.

Here is my pom.xml:

<build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jarsigner-plugin</artifactId>
                <version>1.2</version>
                <executions>
                    <execution>
                        <id>sign</id>
                        <goals>
                            <goal>sign</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <keystore>${project.basedir}\keystore\mykeystore</keystore>
                    <alias>myalias</alias>
                    <storepass>...</storepass>
                    <keypass>...</keypass>
                </configuration>
            </plugin>

            <plugin>
                <artifactId>maven-assembly-plugin</artifactId>
                <executions>
                    <execution>
                        <id>make-my-assembly</id>
                        <phase>package</phase>
                        <goals>
                            <goal>single</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <archive>
                        <manifest>
                            <mainClass>com.example.FooBar</mainClass>
                        </manifest>
                    </archive>
                    <appendAssemblyId>true</appendAssemblyId>
                    <descriptorRefs>
                        <descriptorRef>jar-with-dependencies</descriptorRef>
                    </descriptorRefs>
                </configuration>
            </plugin>
        </plugins>
    </build>

回答1:

You should try to put the maven-assembly-plugin into the prepare-package phase instead of the package phase:

  <plugin>
    <artifactId>maven-assembly-plugin</artifactId>
    <executions>
        <execution>
            <id>make-my-assembly</id>
            <phase>prepare-package</phase>
            <goals>
                <goal>single</goal>
            </goals>
        </execution>
    </executions>
    ...
</plugin>

回答2:

    <configuration>
        <archiveDirectory>${project.build.directory}</archiveDirectory>
        <includes>
           <include>*.jar</include>
        </includes>
        <keystore>${project.basedir}/keystore/mykeystore</keystore>
        <alias>keyalias</alias>
        <storepass>storepass</storepass>
        <keypass>keypass</keypass>
    </configuration>

Refer this http://maven.apache.org/plugins/maven-jarsigner-plugin/sign-mojo.html

回答3:

Change order of plugins in your POM. Order is relevant in Maven. Run mvn install again and review output log. You should be able to see the order of actions from the log.

来源：https://stackoverflow.com/questions/11384704/sign-a-jar-file-created-with-maven-assembly-plugin