Gradle - signModule Task not found

j.israelsen · November 18, 2024, 10:37pm

We are trying to following the instructions listed here to sign modules with Gradle:

inductiveautomation/ignition-module-tools/blob/f8ab54a14e4ca0b7899fe67593e4e81e56301925/gradle-module-plugin/SIGNING_VIA_HSM.md

*Signing modules via PKCS#11/HSM keystores is an incubating feature. See the note about the `certFile` setting below. The initial implementation was validated against a YubiKey 5 NFC, using the `9a` (PIV Authentication) instead of the `9c` (Digital Signature) slot. This is a workaround to the [repeated PIN challenge on every signing operation inherent to that slot](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107). In a future release this plugin should be able to support slot `9c`.*

# Signing Via Hardware Security Module
It's possible to sign a module using a PKCS#11 keystore, which is usually a hardware token such as a YubiKey. (There are software PKCS#11 keystores as well, though they are more common for testing in that they do not have the physical attributes that make for secure HSMs.)

This is an alternative to PKCS#12 file-base keystores that typically reside in the subdirectory of a user's home directory.

## Prerequesites
You should have the following:

* A hardware (or software) PKCS#11 compliant keystore that supports the [Java `SunPKCS11` provider](https://docs.oracle.com/en/java/javase/17/security/pkcs11-reference-guide1.html#GUID-6DA72F34-6C6A-4F7D-ADBA-5811576A9331).
* A PKCS#11 driver (or module) locally on your build workstation or on a build server, depending on the use case. Your HSM may be compatible with the [OpenSC Minidriver](https://github.com/OpenSC/OpenSC/wiki), which supports a wide variety of hardware tokens. Note that you may not get full support for `SunPKCS11` provider unless you use a driver from the HSM vendor. For example, YubiKey provides the [YKCS11 driver](https://developers.yubico.com/yubico-piv-tool/YKCS11/) as part of its `yubico-piv-tool` installation.
* The `SunPKCS11` provider requires you have a PKCS#11 configuration file specifying, among other things, the location of that driver on your filesystem. You can see examples of such files for [YubiKeys on Windows](gradle-module-plugin/src/functionalTest/resources/certs/pkcs11-yk5-win.cfg) and for [OpenSC on Linux](gradle-module-plugin/src/functionalTest/resources/certs/pkcs11.cfg) in this repository.
* Unless your HSM already contains your signing key(s), you may need a management application such as `yubico-piv-tool` or YubiKey Manager to generate a keypair on your device. You may also be able to use lower-level tools like `pkcs11-tool` that is bundled with the OpenSC tool suite or `keytool` that comes with Java.

## Steps
The first few steps here are heavily dependent on your HSM's support of generic key management tools like OpenSC `pkcs11-tool` or Java `keytool`, or alternatively the vendor's key management tool.

It is often the case however that even if you cannot generate (or import) a keypair with the generic tools, you may be able to list key information from the HSM with those tools.

This file has been truncated. show original

However, we are getting the following error:

When we list all the tasks from Gradle, we are unable to find the "signModule" in the list.

I'm sure there is something simple we're missing. Any thoughts?

Kevin.Herron · November 18, 2024, 10:50pm

The gradle plugin is meant to be used/reference by your own gradle build.

Have you set this up yet? ignition-module-tools/gradle-module-plugin at f8ab54a14e4ca0b7899fe67593e4e81e56301925 · inductiveautomation/ignition-module-tools · GitHub