Restores the crypto token implementations and the HSM keepalive service removed from SignServer Community Edition 7.7.
Under ticket DSS-3775, SignServer 7.7 removed the legacy PKCS#11 crypto token, both Azure Key Vault crypto tokens and the HSM keepalive timed service, along with their tests and sample configurations. Version 7.7.1 ships without them.
The lookup mechanism was left intact. PKCS11CryptoToken and CryptoServiceLocatorV2 were
changed from referencing the removed classes directly to resolving them by name:
- implClass = org.signserver.server.cryptotokens.LegacyPKCS11CryptoToken.class;
+ implClass = Class.forName(LEGACY_PKCS11_CRYPTO_TOKEN_CLASS);Supplying the classes is therefore enough. Crypto tokens are selected per worker through
CRYPTOTOKEN_IMPLEMENTATION_CLASS, so the Azure tokens need no registration either.
An overlay directory that the SignServer Ant build merges over the source tree before compiling, and a Dockerfile that applies it and replaces the rebuilt archive in the official image.
| Path | Purpose |
|---|---|
overlay/modules/SignServer-Server/src/main/java/ |
The restored implementations |
overlay/modules/SignServer-Test-P11/ |
The restored PKCS#11 test module |
overlay/doc/sample-configs/ |
The restored sample configurations |
docker/Dockerfile |
Builds SignServer with the overlay and layers the result onto the official image |
Restored implementations:
org.signserver.server.cryptotokens.LegacyPKCS11CryptoTokenorg.cesecore.keys.token.LegacyPKCS11CryptoTokenorg.signserver.server.cryptotokens.AzureKeyVaultCryptoTokenorg.signserver.server.cryptotokens.AzureKeyVaultKeyStoreDelegatororg.cesecore.keys.token.AzureCryptoTokenand itsAzureProviderorg.signserver.server.timedservices.hsmkeepalive.HSMKeepAliveTimedServiceand itsTestKeyDebugCryptoToken
Everything here is licensed under the GNU Lesser General Public License version 2.1 or later, the same terms as SignServer Community Edition. See LICENSE.
All restored Java files are unmodified upstream sources with their original licence headers preserved, taken from the commit before the removal. The remaining files are build and configuration files that carry no header of their own.
Three files differ from upstream and carry dated modification notices:
modules/pom.xml, which lists the restored test module again.modules/SignServer-Test-P11/pom.xml, whose parent version tracks the SignServer release this overlay builds against, and whose internal module dependency follows${project.version}rather than a hardcoded version.BaseProcessableTest.javaandSystemLoggingTest.java, which have their removed HSM coverage restored.
This repository is source only. Build the image locally; do not publish or distribute it.
The Dockerfile pulls keyfactor/signserver-ce at build time, so whoever builds it obtains
Keyfactor's binaries from Keyfactor directly. Nothing published here redistributes them.
SignServer is a trademark of Keyfactor. This project is not affiliated with, endorsed by or supported by Keyfactor, and the name is used only to identify the software these files apply to. The LGPL grants copyright permissions and no trademark rights.
docker build -f docker/Dockerfile -t signserver-ce:7.7.1-hsm .The build clones SignServer Community Edition at tag v7.7.1, applies the overlay, compiles
it, and copies the rebuilt SignServer-Server archive onto the official image. It fails if
any restored class is missing from the compiled output.
A single SIGNSERVER_VERSION build argument drives the base image, the source tag and the
name of the archive being replaced, so they cannot drift apart and leave two versions of the
server archive in the image. Because Maven requires the POM parent version to be a literal,
the build checks the overlay against that argument and stops if they disagree.
Note that the official image is published for linux/amd64 only. The Dockerfile builds the
jar on the host architecture, since a jar is portable, but the resulting image runs under
emulation on other platforms.
Point the Ant build at this repository:
cd <signserver checkout>/signserver
ant -Dcustomsignserver.home=/path/to/signserver-custom/overlay initThe default location is ../signserver-custom relative to the signserver directory, which
is inside the checkout. Overriding it keeps the checkout clean.
Crypto tokens are configured per worker. The restored sample configurations under
doc/sample-configs/ show the properties for each:
pkcs11-crypto.propertiesfor the legacy PKCS#11 crypto tokenazurekeyvault-crypto.propertiesfor Azure Key Vaulthsmkeepalive.propertiesfor the keepalive timed service
docker/Dockerfile.softhsm layers SoftHSM2 onto the image, registers it as a PKCS#11
library and pre-initialises one token, which is enough to exercise the restored PKCS#11
crypto token end to end.
docker build -f docker/Dockerfile.softhsm -t signserver-ce:7.7.1-hsm-softhsm .
docker run --rm -p 8080:8080 -p 8443:8443 signserver-ce:7.7.1-hsm-softhsmThe token is labelled signserver-test with PIN 1234, and the library is registered at
index 200 as SoftHSM2. A crypto worker then needs SHAREDLIBRARYNAME=SoftHSM2,
SLOTLABELTYPE=SLOT_LABEL and SLOTLABELVALUE=signserver-test.
This image is for testing only. SoftHSM2 stores keys in a file and offers none of the protection an HSM exists to provide, and its PINs are fixed build arguments.
Not restored, because no source for them has ever been published under the LGPL: AWS KMS, Fortanix DSM, Securosys Primus and P11NG. None of these has ever existed in this repository.
Three things need checking when the SignServer base version changes:
- The parent version in
modules/SignServer-Test-P11/pom.xmlis a literal, as Maven requires, and must be bumped to the new release. modules/pom.xml,BaseProcessableTest.javaandSystemLoggingTest.javaare copies of upstream files and must be refreshed from the new release.PKCS11CryptoTokenandCryptoServiceLocatorV2must still resolveLegacyPKCS11CryptoTokenby name. If upstream stops doing that, restoring the classes is no longer sufficient on its own.