Skip to content

Commit b44b1fe

Browse files
ulrichbulrichb
authored
Merge pull request #74 from SignPath/SP_1.222
SP 1.222 change logs
2 parents 80199ce + b251038 commit b44b1fe

3 files changed

Lines changed: 59 additions & 17 deletions

File tree

‎docs/_data/changelog.yml‎

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,40 @@
1+
- date: '2026-10-06'
2+
updates:
3+
application:
4+
version: 1.222.1
5+
new_features:
6+
- text: |-
7+
Added support for APK signature scheme v4:
8+
* The signing directive `<apk-sign>` has been replaced with [`<create-apk-signature>`](/artifact-configuration/reference#create-apk-signature).
9+
* Because a v4 signature is added as a separate `.idsig` file, the `<apk-file>` element must be nested in a container such as a ZIP archive.
10+
* For compatibility reasons, the legacy `<apk-sign>` directive still exists, but will be removed in a future version (in this case no ZIP archive is required).
11+
issues: [SIGN-8869]
12+
improvements:
13+
- text: |-
14+
The [`<jsf-sign>`](/artifact-configuration/reference#jsf-sign) directive now preserves property order formatting of the JSON file.
15+
issues: [SIGN-8889]
16+
bug_fixes:
17+
- text: |-
18+
Fixed: REST API Swagger descriptions contained incorrect `application/json-patch+json` content types for request body definitions.
19+
issues: [SIGN-8822]
20+
self_hosted_installations:
21+
version: 1.222.1
22+
breaking_changes:
23+
- text: |-
24+
Deep signing of MSI, CAB, APPX and MSIX files now requires deploying the optional `windowssigningmethodservice` component. Enable it via the `chartSettings.windowsSigningMethodService.replicaCount` setting in the `signpath-application` chart.
25+
new_features:
26+
- text: |-
27+
Self-hosted installations can now optionally provide an RFC 3161-compatible Time Stamping Authority (TSA) using a private PKI. While it cannot not produce generally accepted time stamps, it is useful for air-gapped environments. For details, see the _Timestamping server_ section of the installation guide.
28+
issues: [SIGN-8841]
29+
- text: |-
30+
Added support for Utimaco u.trust HSMs (new `signpath-signservice-utimacohsm-chart` Helm chart).
31+
improvements:
32+
- text: |-
33+
All Kubernetes Pods are now configured with memory limits. The default values can be overridden in the `chartSettings.resources` sections.
34+
issues: [SIGN-5989]
35+
- text: |-
36+
Several container security improvements including `automountServiceAccountToken=false` and `runAsNonRoot`.
37+
issues: [SIGN-8838, SIGN-8839]
138
- date: '2026-09-22'
239
updates:
340
application:
@@ -344,7 +381,7 @@
344381
* Easy access to detailed filters like used certificate or signing request status.
345382
issues: [SIGN-8337]
346383
- text: |-
347-
Added support for Android package (APK) signing via [`<apk-sign>`](/artifact-configuration/reference#apk-sign).
384+
Added support for Android package (APK) signing via [`<apk-sign>`](/artifact-configuration/reference#create-apk-signature).
348385
issues: [SIGN-8324]
349386
improvements:
350387
- text: |-

‎docs/_data/tables/artifact-configuration.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ signing-file-elements:
7777
description: "Java packages/archives"
7878
- element: "`<apk-file>`"
7979
isComposite: "No"
80-
directive: "[`<apk-sign>`](#apk-sign)"
80+
directive: "[`<create-apk-signature>`](#create-apk-signature)"
8181
extensions: ".apk"
8282
description: "Android app packages"
8383
- element: "`<rpm-file>`"
@@ -162,7 +162,7 @@ signing-method-categories:
162162
notes: |
163163
A signature is added, and the file's format does not change. The signed file replaces the unsigned file for all practical purposes.
164164
165-
Several platforms including Windows, Apple, and Java provide a variety of file formats that support embedded signatures.
165+
Embedded formats are always platform-specific. Several platforms including Windows, Apple, and Java provide a variety of file formats with embedded signatures.
166166
syntax: |
167167
`<`_format_`-sign />`
168168
- category: "##### Enveloped {#enveloped-signing-methods}"
@@ -171,7 +171,7 @@ signing-method-categories:
171171
notes: |
172172
The signed file consists of the signature and the original file, often encoded. The original file usually needs to be extracted from the enveloped file in order to be used. Depending on the format and tool, extraction and verification are ideally a single step.
173173
174-
Enveloped signatures are available for all file types using the `<file>` element.
174+
Generic enveloped signatures are available for all file types using the `<file>` element.
175175
syntax: |
176176
`<`_format_`-sign output-file-name="..." />`
177177
- category: "##### Detached {#detached-signing-methods}"
@@ -180,7 +180,7 @@ signing-method-categories:
180180
notes: |
181181
The signature file contains the signature and a cryptographic hash code of the original file. Verify the signature before accessing the signed file.
182182
183-
Detached signatures are available for all file types using the `<file>` element.
183+
Generic detached signatures are available for all file types using the `<file>` element. The file element must be contained in a composite file such as a ZIP archive.
184184
syntax: |
185185
`<create-`_format_`-signature output-file-name="..." />`
186186
@@ -205,9 +205,9 @@ signing-directives:
205205
- directive: "[`<jar-sign>`](#jar-sign)"
206206
name: Java Archives
207207
category: "[Embedded](#embedded-signing-methods)"
208-
- directive: "[`<apk-sign>`](#apk-sign)"
208+
- directive: "[`<create-apk-signature>`](#create-apk-signature)"
209209
name: Android app packages
210-
category: "[Embedded](#embedded-signing-methods)"
210+
category: "[Embedded](#embedded-signing-methods) and [Detached](#detached-signing-methods)"
211211
- directive: "[`<rpm-sign>`](#rpm-sign)"
212212
name: RPM Package Manager
213213
category: "[Embedded](#embedded-signing-methods)"

‎docs/artifact-configuration/reference.md‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -229,33 +229,38 @@ jarsigner -verify -strict <file>.zip
229229
Add the `-verbose` option to see the certificate.
230230

231231
{:.panel.info}
232-
> ** No longer supported for Android packages
232+
> **No longer supported for Android packages**
233233
>
234-
> Current Android versions require signing schemes v2 or v3. Use [`<apk-sign>'](#apk-sign) instead of `<jar-sign>`.
234+
> Current Android versions require signature schemes v2 or higher. Use [`<create-apk-signature>`](#create-apk-signature) instead of `<jar-sign>`.
235235
236-
#### `<apk-sign>`: Android app packages {#apk-sign}
236+
#### `<create-apk-signature>`: Android app packages {#create-apk-signature}
237237

238238
{% include editions.md feature="file_based_signing.apk" %}
239239

240-
{%- include_relative render-ac-directive-table.inc directive="apk-sign" -%}
240+
{%- include_relative render-ac-directive-table.inc directive="create-apk-signature" -%}
241241

242-
Android app package files support [signatures](https://source.android.com/docs/security/features/apksigning) in different schema versions depending on the app's SDK.
242+
Android app package files support [signatures](https://source.android.com/docs/security/features/apksigning) in different scheme versions depending on the app's SDK.
243+
244+
Signatures of schemes v1 to v3 are embedded in the APK file. A v4 signature is added as a separate file next to the input APK file, named with an added `.idsig` extension (for example, `sample.apk.idsig`). Therefore, `<apk-file>` must be nested in a container such as `<zip-file>`, as shown in the example below.
243245

244246
**Supported options:**
245247

246248
| Option | Optional | Description
247249
|------------------------|----------|----------------
248-
| `min-sdk-version` | Yes | The lowest Android framework API level that `apk-sign` uses for verification compatibility. By default, `apk-sign` uses the value of the minSdkVersion attribute from the app's manifest file.
249-
| `max-sdk-version` | Yes | The highest Android framework API level that `apk-sign` uses for verification compatibility.
250+
| `min-sdk-version` | Yes | The lowest Android framework API level that `create-apk-signature` uses for verification compatibility. By default, `create-apk-signature` uses the value of the minSdkVersion attribute from the app's manifest file.
251+
| `max-sdk-version` | Yes | The highest Android framework API level that `create-apk-signature` uses for verification compatibility.
250252

253+
These options are equivalent to `--min-sdk-version` and `--max-sdk-version` for [`apksigner`](https://developer.android.com/tools/apksigner#options-sign-general).
251254

252255
##### Example
253256

254257
~~~ xml
255258
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
256-
<apk-file>
257-
<apk-sign />
258-
</apk-file>
259+
<zip-file>
260+
<apk-file path="sample.apk">
261+
<create-apk-signature />
262+
</apk-file>
263+
</zip-file>
259264
</artifact-configuration>
260265
~~~
261266

0 commit comments

Comments
 (0)