Index: trunk/.github/workflows/ant.yml
===================================================================
--- trunk/.github/workflows/ant.yml	(revision 18141)
+++ trunk/.github/workflows/ant.yml	(revision 18142)
@@ -116,6 +116,14 @@
 
       - name: Build with Ant
+        env:
+          SIGN_ALIAS: ${{ secrets.SIGN_ALIAS }}
+          SIGN_CERT: ${{ secrets.SIGN_CERT }}
+          SIGN_KEYPASS: ${{ secrets.SIGN_KEYPASS }}
+          SIGN_STOREPASS: ${{ secrets.SIGN_STOREPASS }}
+          SIGN_TSA: ${{ secrets.SIGN_TSA }}
         # Calls ant with -Dreleasebuild=true if we're a 'tested' build
         run: |
+          SIGN_KEYSTORE=certificate.p12
+          echo "$SIGN_CERT" | base64 --decode > $SIGN_KEYSTORE
           if [ "${{ needs.createrelease.outputs.josm_prerelease }}" == "true" ]; then
             ANT="${{ env.ANT_HOME }}/bin/ant"
@@ -124,4 +132,5 @@
           fi
           $ANT dist
+          rm $SIGN_KEYSTORE
 
       - name: Upload jar
Index: trunk/build.xml
===================================================================
--- trunk/build.xml	(revision 18141)
+++ trunk/build.xml	(revision 18142)
@@ -41,4 +41,13 @@
         <property name="test.dir" location="${base.dir}/test"/>
         <property name="src.dir" location="${base.dir}/src"/>
+        <condition property="sign.jar">
+            <and>
+                <isset property="env.SIGN_ALIAS"/>
+                <isset property="env.SIGN_KEYSTORE"/>
+                <isset property="env.SIGN_KEYPASS"/>
+                <isset property="env.SIGN_STOREPASS"/>
+                <isset property="env.SIGN_TSA"/>
+            </and>
+        </condition>
         <condition property="noJavaFX">
             <or>
@@ -176,4 +185,7 @@
             </manifest>
         </jar>
+        <!-- Sign jar if all environment variables are set -->
+    	<signjar jar="${dist.jar}" alias="${env.SIGN_ALIAS}" tsaurl="${env.SIGN_TSA}"
+            keystore="${env.SIGN_KEYSTORE}" storepass="${env.SIGN_STOREPASS}" keypass="${env.SIGN_KEYPASS}" if:set="sign.jar" />
     </target>
     <!-- Windows target -->