# Request: a new module-signer release that includes PR #7 (.p12 keystores)

**URL:** <https://forum.inductiveautomation.com/t/request-a-new-module-signer-release-that-includes-pr-7-p12-keystores/117833>\
**Category:** Module Development\
**Created:** [November 13, 2026, 8:21am UTC](https://forum.inductiveautomation.com/t/request-a-new-module-signer-release-that-includes-pr-7-p12-keystores/117833 "2026-11-13T08:21:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![christofer.dutz](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/christofer.dutz/32/76634_2.png) [@christofer.dutz](https://forum.inductiveautomation.com/u/christofer.dutz)\
**Post date:** [November 13, 2026, 8:21am UTC](https://forum.inductiveautomation.com/t/request-a-new-module-signer-release-that-includes-pr-7-p12-keystores/117833/1 "2026-11-13T08:21:08Z")

</div>

Hi all,

We build and sign our third-party Ignition modules with  
com.inductiveautomation.ignitionsdk:module-signer. The latest version on your Nexus  
(inductiveautomation-releases) is still 0.0.1, published in June 2020.

In April I opened PR #7 on [GitHub - inductiveautomation/module-signer: A utility that signs modules for use in Ignition · GitHub](https://github.com/inductiveautomation/module-signer),  
which detects .p12 keystores as PKCS#12 and matches the extension  
case-insensitively. Until then only .pfx was recognised. It was merged on 2026-04-27  
and is the current master (ce362b1), but it hasn't been released. To use it, we  
currently build the signer from source as a git submodule.

Would it be possible to publish a 0.0.2 from the current master to the Nexus? That  
would let us, and probably others, depend on the official artifact instead of a  
self-built snapshot.

It isn't urgent: on current JDKs 0.0.1 also loads a .p12, because the JDK's JKS  
keystore type falls back to reading PKCS#12. With the release, the keystore type  
would be picked correctly instead of relying on that fallback.

If you're cutting a release anyway, the open dependabot PR #4 (commons-io 2.1 → 2.7)  
might be worth merging first, since commons-io 2.1 is quite old.

Thanks a lot!  
Chris
