From 1499e50dd6e1dfd536fc158082cb0977aa0b56af Mon Sep 17 00:00:00 2001
From: Stefan Kolb <stefan-kolb@users.noreply.github.com>
Date: Fri, 2 Dec 2016 13:18:13 +0100
Subject: [PATCH] Installer Code Signing #1879 (#2320)

* Typo

* Set certificate file paths

* Changelog
---
 .gitignore                        |   3 +++
 .travis.yml                       |   2 +-
 CHANGELOG.md                      |   1 +
 build.gradle                      |   2 ++
 buildres/jabref-cert-2016.p12.enc | Bin 0 -> 5504 bytes
 circle.yml                        |   5 ++++-
 jabref.install4j                  |   4 ++--
 7 files changed, 13 insertions(+), 4 deletions(-)
 create mode 100644 buildres/jabref-cert-2016.p12.enc

diff --git a/.gitignore b/.gitignore
index cfcd6c34e69..9cf0806e4b2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,3 +52,6 @@ install4j6/
 
 # ignore the generated markdown file if the user forgets to delete it
 status.md
+
+# private data
+/buildres/jabref-cert-2016.p12
diff --git a/.travis.yml b/.travis.yml
index 692661c6bd1..2f7ee0338c6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ addons:
     packages:
       # most recent Java8 - this makes the JDK switcher obsolete - see https://github.com/travis-ci/travis-ci/issues/5897#issuecomment-218354129
       - oracle-java8-installer
-      # MySQL 5.6 as desccribed at https://docs.travis-ci.com/user/database-setup/#MySQL-5.6
+      # MySQL 5.6 as described at https://docs.travis-ci.com/user/database-setup/#MySQL-5.6
       - mysql-server-5.6
       - mysql-client-core-5.6
       - mysql-client-5.6
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce3a60555d8..3d47c7c2c7b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ We refer to [GitHub issues](https://github.com/JabRef/jabref/issues) by using `#
 
 ### Changed
 - URLs can now be passed as arguments to the `-import` and `-importToOpen` command line options. The referenced file is downloaded and then imported as usual.
+- Windows and OSX binaries are now signed with a certificate.
 - The default emacs executable name on linux changed from `gnuclient` to `emacsclient`. [feature-request 433](https://sourceforge.net/p/jabref/feature-requests/433/)
 - Adds integrity check to detect all bibtex keys which deviate from their generation pattern [#2206](https://github.com/JabRef/jabref/issues/2206)
 - Adds an integrity check that detects invalid DOIs [#1445](https://github.com/JabRef/jabref/issues/1445)
diff --git a/build.gradle b/build.gradle
index 401868168ee..cc3c81f6eb0 100644
--- a/build.gradle
+++ b/build.gradle
@@ -342,6 +342,8 @@ if (hasProperty('dev')) {
 task media(type: com.install4j.gradle.Install4jTask, dependsOn: "releaseJar") {
     projectFile = file('jabref.install4j')
     release = project.version
+    winKeystorePassword = System.getenv('CERTIFICATE_PW')
+    macKeystorePassword = System.getenv('CERTIFICATE_PW')
     variables = [
             versionFourDots: project.ext.threeDotVersion,
             buildFileName  : jar.archiveName,
diff --git a/buildres/jabref-cert-2016.p12.enc b/buildres/jabref-cert-2016.p12.enc
new file mode 100644
index 0000000000000000000000000000000000000000..6277bb8abdd6b64ccfa31eb08aca34d5364c6e0d
GIT binary patch
literal 5504
zcmV-`6@TheVQh3|WM5zBYNY-3b1~aE9O05BZ#S+kC_xI0ZN;QPL;g)3Hu{?%M7=F`
zA#oqFJt_zc${Jnsr;_K>M-L?_70+ep3A$CMlmBFZ1f4&{2~z5hVzx;aDK-Ocz#e8!
z{XU{Gk%RiaUUyN%gcl3H<NDJxY0^2n7Xjs3fY!y-`OMnWUTpG`#yYBQbLIRLF>+3;
z&4R5oLbNnfSj(cR$S$od$AxTpV4R%fMk&Z5EF(=i2s^)|rQ(JY1qqpNx8SsD$xz&u
zWnE})981{&$Zv&4^cIfGVZYa!*ZR026?JA)51Ob*e)kNAxoS2m6l}8`9H&!%6YjZT
zI%JSzL&by<{Dpl>8eKwf1G}r&@AR77tM~kvLxxC|M=@0J)SJh)iJ*_`ZeJp-4p?V=
z5?5D=cLw!DI45~jr^-fJeq?dr+=546F4wD%WP?fZ;Hi2JehTXA`OFmsslEVPAjoC^
znp-HBHU<sCShu<#UoAE8x|WAcR?;g$9KPxI*crhLjFU?@C4X;~65G8tClNpFhNCR7
zDYis&1r@RB$ZADxJ4dmY^cXY-kb5E3^VrKi`jx(_PK0aBl%M_U51is=!ayBv^Hg3{
zXJVr_&gs+sWXd`={c<O)%g_q(RE$a*&CeFA$*})2-7112JAeKer!?Hrq5YLcL(!DJ
z-xj2eh1;81A;wn9V5SpUsIfWr+NDo>R4ei3kL`T}0B(5(w0$FQwD4`yYiG%7@_TtB
zwbieiXsEH?rG)q@HLD$AH_TWZX9x6)TnF&<)60D*x3#LIzjjWsU^w^MGe)*PD|%e7
zop&STfm9Z4LM19WbDqyLD1b`dxs%~wOfuW<7i4`2l5+UBrm+lL5b4YC|EPVgRgid#
z@P<dJ{1>Ic<@?`^QQ=ez1f-`(S+0e4Mq$GH*Q=E~x@9G`^D}ccvEC#45|X~98)<nh
zKJ@v&$Qs_!9v~!}BMsy!hO^3%jdT_$RGe4*Lq~CPMS1b<2G|zTAu4-JSS@qCQ*{5m
zS`J#xSNo6ZQXpvFWtmg(%CpZ^PHVJ+=8D;SpOILjD>B*3$@z2LSI-$9{iWF1IV@Iw
z?%SXI7Cw~HHv-g~XnanLbwC_8s3mMg#^MmL4j4@hJ%W8zVz|qphSWUqKpx|AZj1qE
zjVt%s@o(3KWJN&vr||eW&;p&&o`t$qw!XIEsleL2<a)1EFB+>dxgghxQQuWMD%_#q
zAp-cwB1QOZMYF}-a~u_(LretvJ*KkNqZsQyvJ^#TatmRmL`f9JBildD*+cs_0FW+u
zC6ZWKu~c5M56B+}`NT`PCS{oBJ%gz4p_~#nysK=w;ll#gPrYcz8^7Rle$fEHQ}f3A
z^Xm7S<#w(N&t>&pfumC*lEpoH9=%xb>)zLduhR)#LS%P2S-!L|6hX9QT3jEX>y^O`
zePKQ}(D(*hR4o~hvzB$P!j|ke2?P?XuWl{D%gUS9Ttv@b+$ZyAMpmp1Yn9iSrYn{m
za>1)lAe`B^V$M1CgtdIB*yzD2uJ2^f8>ObCsMb>NeENir{ylidWdX2Vtnss_5E=`0
zpX+dM`M{%l<i3B{A|AxUgK@WH#^RtyBHSYWRNzJm`N;7em`CfXWf0%zp(aX=ud0u%
ze+<<m@*v(dqE+dxJ_y`bP_uE<Ti$B2$0Dq;tRH6iqDaUPJ34FB_HD!m<iY!3Ec86)
z>0*v~`Vk3ufE%gKLX50zhy<ZFv=@-Q`9TL&+F%XR$*Oy`GGa4?wzXgkBl$ht<^nkz
z`^A@xvI!53zzz=ea{6=7oDtj!p9wyholjJ(17blnWd(6AJv47v#;cOdy)|0sdNJ=d
zt$cUpjFhzTEcA+-{qY)-n#GcLz-IprwuF%N0f0zbHl}T%7`Z-jxOgizN-&@rzSDYi
zcL`zY8maaYvyWtT*AS*3wk*v9d>`xs!Aw)qF7{LI_Pli3v~vXe`y4wOUsZVs!Cs^i
zjAsrTW?0)6+j*kG9J+dYp7xIsd&b_)??qQAjR*oZf`j6{xjPoH#)R$7q+Xkvkd&!1
zKPHn(i}^q-$gO#o{tG{!CL={wQcK7aKl2gyq*Iu9w+nG1u{Sdr_3qK3xxG867FP-m
zlF{^VSn4d#0>*KIy)}Sq0HE9n^C@89r$Xl0e5d&Se&v#Po00Hz3vq=1N*)vZ49_rn
zliozyJG0d46>C{mlCX-r!^zT5fElJ2OgL#2s{WM`_)fvzE6o>bReZ6@24Y9h{+(NG
zcAC>43!5!i4O4D>lLP1GH&4o~oxXHW_iur+pn9q^u%T+ck+ZE^c;2zklRWyHE;^q0
z6%wPt=x^M(gdf}qqltS?(^J*Q`CNTy@!pvWj!#|0QCRu?`2=(qrN8M@B98p)&6NMo
zJs769*@PVsybq?faRB}OS$yMAoZi3fRiAkZW=*Yioc?m}^u7LR2wu)DugI&cdIL7^
z+(XnS@W2vIsI6G#+pa>G=E(fUbMz3l!d8ZeiLa4g_Qw)AxfrS=4VvsOHs8q??GFfK
zv<r|=fkB3YD0a`8&TqFDLm|yqI!W{Ay|Hm8q$;&ul2?usTA66-*Nbt=SsyM%pd5Fe
zxO+GiYVN7d-Yf;_*?q`>vdAXypUSUt8?OqK3>C1L{hU$H(PsI5xNWwBK=Q;~vvPNL
zCR`~&&BZ_iC7rjt1{Pn4OV<^@1iW$e<EFpP+2-hfJr5zlgcfRZad<i-D3~2`(Hg7Y
zhKfO=WLIc8E%GN}S7I<|I>tZ5Cx#gy5GljcW1@BD56lS|yj#S3JHlcBj-cI<^)NwQ
zp7~M9qC?v5BF4E|982qPo$R1%bsG&UlrJu`^Ta^Ds{>#vqq?(-opXZaVvdrnh<`Id
z!uee{C&4Q29z*-%SH-M7*+tm2%F$MQzM>QvB}~fbhmJ)^<zA~;2a#Z}AJ&{d^YG%a
z6Ha4Z&X%0)pHSSE<;1`(zq)CmYW7S+ynCB8`}iL{?nE)A25zaF{h!?L^j4wP*;aUt
zY;aPq^m-e?dGQC0qH?j*k!H0Nx8~U;sNfzi_#zdR<()s}fEHgRQHIMX3=&wI^}r3I
z%#~?61fM=TYfJ141oANM2EHwu6DQQ)ActcQkx<zheW|bhp}Daj?Lu+_sMu{+k4H-)
zE~$TDe;){Zrl84f?N)M;;rj&bb?bW4!CmJvz?f3rT%O1)xCFffiLY}QLjxXZ30lI9
z_gjesUZNdkHw4Yz50)uzDJe)ZXdsZOikBz*&pX^J`bd}G&Z9o+pjEg~&f{ilk5C3U
zs+JM*!pgNW)h|3ygV!^HQ*nPc+oX(l>|EdO1yLdo<b|bd9F-GRE?#5xAgK2j(;M(?
z(el%D$t@<K%sYc@I!IgZb0*QFL)-Y#5LXM1Zj7HMvxJrn(N4ThF@PZ8t2eI3OSP^%
ziU89BeF)VC))^r?NMqg%D*UJNYX*D?H<)kFYg|`(xWv!`Eo@<K%lfq^RtJAf<6t<F
zRIea6rDyjpnMTug<A6ma;xhI1i%JDrKZ$x3Eat1=g*V4<RGT^Q3L0KKPis(ImeR-m
z|Jo%n69URh1Ut7j2}e+->9~KP&}h+bIh)NRXPC8xr@xrajlT8%cmrixQWXERcd|Ei
z90a!{_MDQ--aR%iGcDXhvZ9{vaX?ac%6W8D0^i-qVb-2hhX79`LX}P8#2UC9X<>1C
z)&<AzqLZk81{x1iKv`y(=Y5me()hchRbfwCXo$C8P5KBJQR-@eu!`dOuLGZd`kF<p
zX3f!Fl}3?VD&qk#^M;Ui1CC!i19vJiY?AdgKq^@t*eR+#dgPy<ZfZ-oY|AiRxg9HD
z+C_OeY{b8It-34{iWrVjMUn?!y)>zM2LKE<L!7CuRE)XJGVRK{A@O_caQtBoCIxHi
zoj0$nDgUWNN-KE-h()Y*iBhONwP7v)nEHiH!@i=R;-CXmsX`#(vs9o<8E80XWk>E4
zyT>-HFS;>(T{H%q^mlOs=A8K3015XwRRgH7(P)p<97sr@)eB&Q0f4(N#@d#VhT(la
z<@T3~?kI1ijYR2rqY9dfW_dH-i^1<Eg?f`G@c`(2-NLl;H{9GYX|68zA)mgm<vjeN
zz)N;Zy{s3v%FQmrC)!V>DCPZR#*YLaqJ8Os42cjgd0w~GQC410qC7Dm2aG+!_G4Xu
z^D{Erv)&pDxj$9XaS>ro?y4R!VtSm7N#XEab9-cs>?@v_Tg}~1!W}9bwqM!Ia=5w(
zU2JM^izDBBKE;|DmdGgRs|84i@M_iA{?S{I5QUNB8i>kA>%(W9-9^PlVjjODrR$jf
z3qTRejI)||#@oh-<2S_1fS-#Y**?maqvaRMfbd<2+w9>EdLF(C1{<-FP%~(N6_5Do
zWl0?S1ckoX-b<vq@^$escLS~?kBrY#F#P9Mcj&HDhe=n}3^yF01wfqu`v%`O$3Vt)
z@i6S{SH8iO_o09ah%h&y!@;ga>EhUmtt%Oek}d;WxD6ccv<fRU*leEc7|WU9fJ!Wx
z&dN=iIQhFT4L9bCwYov6$F<LE3fxD3O8w2QrIWe%b379R|FA87<+PZ<tsxAjRNA?n
zSqPp{hh0l<p#<FJ+4FEN%I$|D@|4Xb^%4oM<q}N?Yb2}AUs`w3^^EJCf>y?^!`*sO
z62CRWfoY}Y9A*DS1t((}B-jSO7Ko@+N_uI@YfPqsJ6sHX_hMhuY4c?UN!?O4MG2Ay
za<`(o05XVdop+L!bI9#?w29MXGaD}&m$6vm0K`GFg(TGapk2+_K1^~=l_&?vJI;;a
z>PYy~K9ZnY%_<%w#-rA)h3qQ-ftzw3FqEyCD15Q~2~vvcY`Ijg0pD!w#O`y{PK_2K
z7+E&r8#CNt$xFZk;e?K5aO$&DU)EYc+Qi4l%xuecQ!az0!T)LK>5G13`iE4AGXsZN
zn~|!^0IVW{XI)bwi$oJf;FSB9!}3)vUL|^o3b$S2k-zr83K8ot>^~u4!4d(lOG{J$
z$bn&no-^;>-B%A}c`Idl+nq*b3i1yL7SGpzgUY(&+WTbK4J*X`gl=>)FdvJZHY3#X
z%VACdeXrN&hhTN2elPCRV2ZFprGPG#F~zf4YIqRFJNHQU%Cd)VBcM6NUiDJ0xxPP0
z`2j!FVnngVB}Uh+yFM}YTNXC=<D+SPxMZY>vLn7r91rg1sWdffaGA0$B}&=8ck8o}
zb@{j+oTo#UCql>^;^p{)&wC~dXIW5S*soI3u)ggt5J`rs#U<0-9u?0d0UZ^DCD({L
zdqy<?)FsOC!+OtqY<Jqwpz^Z||M#e?%K~c^F-U<{8(q*5zHtxNK&&4hEKn<9CfI2b
z82wJ0PHI-;8K<j)8Zztenf;9@hzn_bvln&33W|TQu)wu?XRDqF!NgxuLf{>85v@JL
z7ed22ZceXu^4*21mGFZCc`4aQdELC_20Lq=DN-AXqedA!vV`WPBUgXt-puM6E!VT$
z{6tT6t#R^mvIArcC`w_K&HkGdWWUbRK^VpU?aZyAy2*MQcF7s|v%}d%Hb^(kaX32=
z!KM9CYF^(V9H>}@`*QYQWdn2Zq`oHWJ%FvFQrPgQe9wb>J$oGe*;>w@wbl5Jtf1=~
z8n8{SUaEduX)rH7oqN4oLG5v)3%~Uqt0e<2m<QUii7R4XDmLg|qTW+>B;$Uj^0a|v
z%EsQ&`_>6>pXt5R2PL-|`2Xsru~w0XCgrT^>yhNfF8TQrrbs2+aeXj1`Bmah&Hvda
z0yRLK!?uvI*!-xU8&_89wOF*e7$_;b(u(W+)}LrSxVPHoJKj*QJ?%nHDA+~(;RdvQ
zCPraUHcU6LLT=m<{ICR=ImQoup^;Q6zU{|D-QZB?S#nLNR^4k0p`S&LjX%7r07<~R
zVgUTt9q8D!4@sNj_AGEyKaiE?geqBXfz3Ai*EBRR4nRXKD&qbICr7u!P9+2VuaHmz
z_R_`X*{g`yf9}vIy6Ib*ef4z>ff=6t@KVA)%5}O?Y2(Jlph`!H$W7%j{x6x_f@xPt
zY(+;?9gLz<mdy?^K3vDNY`uB$7*GxQ2$Lon3DnCUKHoPR3M){OwEljm=E*5ZVNE<<
z46q*Leek{T;Q!+zAG*e-SCed99>^#1E0u@d;a25b%*O?(uvU1yxSU2ms<Bg!ss+_~
z$NK#Mg^#<8fe1U5b<vpPiCT+HWGctI0;2@<yApl^Qwm#I{)(kxK3nuIBF7dWS<yA`
zZ|g4LAdwMW8VI(?q%=2GuEeMUsFY^Ca*qZ!%xbyxPOuTwRgf(zv&$bjPx;3zYitaz
zj`tvA(;>pqzfrD9@3QL|u)=dMHGP)?B!oB*kCY~K2JAq`mwSn%a*Hh@89ve6aHj3n
zdcr%3FueqCXb4eqp)sLQ_Q`*d-P7UI>tZ{2<_mzd3{@WuVOK>r8sq#9XR~;yEyWQ=
z^*Pk0bk!H`plD|2)ST;Py>y1NOnmtjyyRWur?vc97<SQL?n0N3?b(L3`BqcwNA*Xt
zp&6oPTfZeo3eID~8RZ$fwXFw71SR}jxHX?NG3L}R4E-M+Jtg`qQOEi~ukX24RE%XF
zp+wyU#7hX6ej0{YQLIU9^LD80X9myJsvVXu_vW24&wg-_iKv)FR}IQkjY}3Y$%TIt
z>?WMdV6NYA2B46#TdbM*$7eR~tOqst;XJHJQo$fh;1?t@M)-rXV1&>1Pz$McBOcxB
zNQC0zkcCizDickP#GBfFwES}rPk#5+V^o*wmgLObYwvOk>PRJwy#|ZTB~vC<4~Dx-
z-wC!62mv@j8{fq|(6M#)hH=0MJ9}Mpl84b5I93`GW}#)wT=KIWC+O`tWe<B3XssU1
z(%Y7D5xL1pBRPzua=t<=keCkx023C?n~SSUHpVl56Tuh|v0TSTD7zRN^_(U>E)knz
z6HqM={dRA6T57Z2R2Q7fdSa*g_=zZdblrH9{%_3!dB}Y(c>p$o^)T9Cf#fT@e}2Z2
znHd<>&mh94v?g-(#2auFx2xJ~HYgL6YyHGAv_&PU<Gl_rn`J{d$pK}4u6=BV9Z&Mo
z_{tPM2rz+43V&{#NfwIS-X>_L!g~q};^O=>g>J!Wtf2U=^aqOSE3BoHjVZLzP`fPu
zkxY}WgP~bwa&xm87$&pK?!AV^%iAq4VFd^D^J5TOMY1?=CS(|9Dt|cfv2cJ_`nOL<
zB7d;eFI~@w&O#wEy1fTwNrV9GzynYcot(#DS5l3jY809|KkOy?0Dt8qUaR#AW+NOE
C;l-i=

literal 0
HcmV?d00001

diff --git a/circle.yml b/circle.yml
index 5043ee6f2d5..148d880cfde 100644
--- a/circle.yml
+++ b/circle.yml
@@ -6,8 +6,11 @@ machine:
 
 dependencies:
   pre:
+    # update locally with:
+    # openssl aes-256-cbc -e -in ./buildres/jabref-cert-2016.p12 -out jabref-cert-2016.p12.enc -k {PASSWORD}
+    - openssl aes-256-cbc -d -in ./buildres/jabref-cert-2016.p12.enc -out ./buildres/jabref-cert-2016.p12 -k $CERTIFICATE
     - scripts/prepare-install4j.sh
-    - install4j6/bin/install4jc --verbose --license=$INSTALL4J_KEY
+    - install4j6/bin/install4jc --verbose --license=$INSTALL4J_KEY --win-keystore-password $CERTIFICATE_PW --mac-keystore-password $CERTIFICATE_PW
   override:
     # We do this to decrease build time by using CircleCI's cache. See https://discuss.circleci.com/t/effective-caching-for-gradle/540 for a longer motivation.
     - ./gradlew compileJava
diff --git a/jabref.install4j b/jabref.install4j
index 0d5c17660ae..210e8554a8d 100644
--- a/jabref.install4j
+++ b/jabref.install4j
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <install4j version="6.1.3" transformSequenceNumber="5">
-  <directoryPresets config="./LICENSE" />
+  <directoryPresets config="build/releases/${compiler:buildFileName}" />
   <application name="JabRef" distributionSourceDir="" applicationId="0034-7691-1464-4754" mediaDir="build/install4j" mediaFilePattern="${compiler:sys.shortName}_${compiler:sys.platform}_${compiler:sys.version}" compression="6" lzmaCompression="false" pack200Compression="false" excludeSignedFromPacking="true" commonExternalFiles="false" createMd5Sums="true" shrinkRuntime="true" shortName="JabRef" publisher="JabRef Community" publisherWeb="http://www.jabref.org/" version="DEV" allPathsRelative="true" backupOnSave="false" autoSave="true" convertDotsToUnderscores="true" macSignature="????" macVolumeId="780dfea2d33a0244" javaMinVersion="1.8" javaMaxVersion="" allowBetaVM="false" jdkMode="runtimeJre" jdkName="">
     <languages skipLanguageSelection="true" languageSelectionInPrincipalLanguage="false">
       <principalLanguage id="en" customLocalizationFile="" />
@@ -41,7 +41,7 @@
       <variable name="version" value="3.1dev" description="" category="" />
     </variables>
     <mergedProjects />
-    <codeSigning macEnabled="false" macPkcs12File="" windowsEnabled="false" windowsKeySource="pkcs12" windowsPvkFile="" windowsSpcFile="" windowsPkcs12File="" />
+    <codeSigning macEnabled="true" macPkcs12File="./buildres/jabref-cert-2016.p12" windowsEnabled="true" windowsKeySource="pkcs12" windowsPvkFile="" windowsSpcFile="" windowsPkcs12File="./buildres/jabref-cert-2016.p12" />
   </application>
   <files keepModificationTimes="false" missingFilesStrategy="warn" globalExcludeSuffixes="" defaultOverwriteMode="4" defaultUninstallMode="0" launcherOverwriteMode="3" defaultFileMode="644" defaultDirMode="755">
     <filesets />