JOSM's digital signature has expired

[scai]

When launching the web version from https://josm.openstreetmap.de/download/josm.jnlp a warning is shown. It tells that the digital signature ("Open Source Developer, Vincent PRIVAT") has expired. In fact the digital signature's validity ranges from Mon Nov 23 01:00:00 CET 2015 to Tue Nov 22 01:00:00 CET 2016.

[Don-vip]

The renewal is in progress. A bit late this year, sorry.

[anonymous]

Please use time stamped signatures because they do not expire with the signing certificate: ​https://docs.oracle.com/javase/tutorial/deployment/webstart/deploying.html

[stoecker]

Replying to anonymous:

Please use time stamped signatures because they do not expire with the signing certificate: ​https://docs.oracle.com/javase/tutorial/deployment/webstart/deploying.html

Time stamping with Certum did not work anymore and was thus disabled. We should check if we can reenable it after the renewal.

[Don-vip]

See #12596

[Don-vip]

I have re-signed the tested jar and built a new latest jar with the 2016 certificate.

[francois.lacombe]

Ticket #14044 has been marked as a duplicate of this ticket.

[francois.lacombe]

Currently, this exception rises when using freshly downloaded jnlp from website :

com.sun.deploy.net.JARSigningException: Détection d'une entrée non signée dans la ressource : https://josm.openstreetmap.de/download/josm-tested.jar

at com.sun.javaws.security.SigningInfo.getCommonCodeSignersForJar(Unknown Source)
at com.sun.javaws.security.SigningInfo.check(Unknown Source)
at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResourcesHelper(Unknown Source)
at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResources(Unknown Source)
at com.sun.javaws.Launcher.prepareResources(Unknown Source)
at com.sun.javaws.Launcher.prepareAllResources(Unknown Source)
at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
at com.sun.javaws.Launcher.launch(Unknown Source)
at com.sun.javaws.Main.launchApp(Unknown Source)
at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
at com.sun.javaws.Main.access$000(Unknown Source)
at com.sun.javaws.Main$1.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

[stoecker]

Somehow the resigning killed all entries in the manifest except the signatures.

[Don-vip]

Don't know what happened but now it's finally fixed!

[anonymous]

Thanks to all!
An user reported the error, which I forwarded to talk-de.
It is good for our users to get a such quick solution, and to know about the reason for this error.
He told me that it should be possible to automatize the annual(?) update of the signature.
Bests, Markus

[Don-vip]

Milestone renamed