Control Deliverable Signing

WebLogic Workshop requires that the control deliverable ZIP file be signed with a digital signature. Control authors can use the JDK jar signing tools to ensure to users that the ZIP file has not been tampered with since the signing. Workshop looks for such a signature when downloading a control deliverable from a control stub, and prompts the user with the result.

 BEA Validated

To sign a control deliverable, follow these steps:


1) Create a keystore and permanent key using the JDK keytool utility with the following format:

keytool -genkey -alias <youralias> -keyalg RSA -validity 730 -keystore keystore -dname "CN=<cName>, OU=<orgUnit>, O=<org>, L=<city>, S=<state>, C=<countryCode>"
When prompted, create a password for the keystore and the key and do not lose the passwords or the keystores.


2) Generate a certificate authentication request like so:

keytool -certreq -alias <youralias> -file <yourcertrequestname> -keystore keystore


3) Submit this certificate request file to Verisign or Thawte to get a code signing certificate. These are the two signing authorities that are recognized by default in WebLogic Workshop.


4) Add the cert you get back to the keystore like so:

keytool -import -keystore keystore -file <yourresponse> -alias <youralias> -trustcacerts


5) Sign the control deliverable:

jarsigner MyControl.zip <youralias>


6) Test to see if it passes Workshop verification:

java JarVerifier <full path to MyControl.zip>

More information on keytool and jarsigner can be found here.
The JarVerifier tool is available for download here.