From e6aa4f1a6e5cf9d815e933c290e353003d77ff5f Mon Sep 17 00:00:00 2001
From: Daniel Pocock <daniel@pocock.pro>
Date: Thu, 10 Jul 2014 20:46:03 +0200
Subject: [PATCH] Improve JAR signing: enforce pack/sign/compress order with
 depends, sign with both SHA-1 and SHA-256

---
 web-start/WebStartBuild.xml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/web-start/WebStartBuild.xml b/web-start/WebStartBuild.xml
index 153e95a6a..c9c111032 100644
--- a/web-start/WebStartBuild.xml
+++ b/web-start/WebStartBuild.xml
@@ -147,8 +147,16 @@
 	</target>
 
 	<!-- sign libs -->
-	<target name="sign-libs" description="Sign all jars within the release folder.">
+	<target name="sign-libs" description="Sign all jars within the release folder." depends="repack-libs">
 		<echo message="Signing libs in ${release.dir}" />
+		<!-- some JARs are distributed with their own SHA-1 signature, we invoke
+		     this once for SHA1 to overwrite that with our signature -->
+		<signjar alias="${keystore.alias}" keystore="${keystore.file}" storepass="${keystore.password}" lazy="true" digestalg="SHA1">
+			<path>
+				<fileset dir="${release.dir}" includes="**/*.jar" />
+			</path>
+		</signjar>
+		<!-- now we apply the default (SHA-256 for JDK 1.7) signature to every JAR -->
 		<signjar alias="${keystore.alias}" keystore="${keystore.file}" storepass="${keystore.password}" lazy="true">
 			<path>
 				<fileset dir="${release.dir}" includes="**/*.jar" />
@@ -161,12 +169,13 @@
 		<echo message="Repacking libs in ${release.dir}" />
 		<apply executable="${pack200.path}" parallel="false">
 			<arg value="--repack" />
+			<arg value="--segment-limit=-1" />
 			<fileset dir="${release.dir}" includes="**/*.jar" />
 		</apply>
 	</target>
 
 	<!-- compress libs -->
-	<target name="compress-libs" description="Comperss all jars within release folder.">
+	<target name="compress-libs" description="Comperss all jars within release folder." depends="sign-libs">
 		<echo message="Compressing libs in ${release.dir}" />
 		<apply executable="${pack200.path}" parallel="false" dest="${release.dir}">
 			<!--<arg value="- -modification-time=latest"/>-->