Still using Artifactory 5.x ?
JFrog Artifactory 5.x User Guide
Need help with other JFrog products ?
JFrog Enterprise+ User Guide
JFrog Mission Control User Guide
JFrog Xray User Guide
JFrog Distribution User Guide
JFrog Bintray User Guide
JFrog Access User Guide
JFrog CLI User Guide
Have a question? Want to report an issue? Contact JFrog support
Signing keys are managed in the Admin module under Security | Signing Keys.
Debian Signing Key
Debian signing keys are also managed on this page, however these are not related to JAR signing. For details, please refer to Debian Signing Keys.
In order to sign JAR files, you first need to create a keystore, and generate and add key pairs to it. These can be created with Oracle's keytool utility, that comes built into your Java Runtime Environment (JRE), by executing the following command:
keytool -keystore <keystore filename> -keypass <key_password> -storepass <store_password> -alias <store_alias> \ -genkeypair -dname "cn=<cName>, ou=<orgUnit>, o=<orgName>, S=<stateName>, c=<country>" -validity <days>
For details, please refer to the Oracle keytool - Key and Certificate Management Tool documentation.
Before you can add a keystore, you must set the password that will be needed to make any later changes to the keystore. You will need this password to remove or update the keystore.
Set the password and click "Create". This will unlock the rest of the keystore management fields.
Once your keystore password is set and you have created a keystore and a set of signing keys, you can add them to Artifactory.
First upload your keystore file under Add Key-Store and enter the keystore password. Click "Unlock"
Once your keystore is set in Artifactory you may add key pairs under Add Key-Pair.
To remove a key pair, simply select the key pair and click "Remove".
Once Artifactory has a keystore and key pairs, you can configure a virtual repository with the key pair you wish to use for JAR signing. This is done in the Advanced settings of the virtual repository configuration screen.
