hello there, the attached patch --already committed-- adds a new document describing, so far, the two security tools: jarsigner and keytool.
this is just a first cut, but hopefully in time it will include usage examples, and the documentation of other tools. cheers; rsn
Index: Makefile.am
===================================================================
RCS file: /cvsroot/classpath/classpath/doc/Makefile.am,v
retrieving revision 1.5
diff -u -r1.5 Makefile.am
--- Makefile.am 2 Jan 2005 17:04:13 -0000 1.5
+++ Makefile.am 2 May 2006 01:33:07 -0000
@@ -2,7 +2,7 @@
EXTRA_DIST = README.jaxp
-info_TEXINFOS = hacking.texinfo vmintegration.texinfo
+info_TEXINFOS = hacking.texinfo vmintegration.texinfo tools.texinfo
%.dvi : %.texinfo
texi2dvi $<
@@ -10,4 +10,4 @@
%.ps : %.dvi
dvips -o $@ $<
-docs: hacking.ps vmintegration.ps
+docs: hacking.ps vmintegration.ps tools.ps
Index: tools.texinfo
===================================================================
RCS file: tools.texinfo
diff -N tools.texinfo
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ tools.texinfo 2 May 2006 01:34:19 -0000
@@ -0,0 +1,781 @@
+\input texinfo @c -*-texinfo-*-
+
[EMAIL PROTECTED] %**start of header
[EMAIL PROTECTED] tools.info
[EMAIL PROTECTED] GNU Classpath Tools Guide
[EMAIL PROTECTED] %**end of header
+
[EMAIL PROTECTED] off
+
[EMAIL PROTECTED]
+This file documents the Tools included in a standard distribution of the GNU
+Classpath project deliverables.
+
+Copyright (C) 2006 Free Software Foundation, Inc.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] GNU Libraries
[EMAIL PROTECTED]
+* Classpath Tools: (tools). GNU Classpath Tools Guide
[EMAIL PROTECTED] direntry
[EMAIL PROTECTED] ifnotplaintext
[EMAIL PROTECTED] ifinfo
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] GNU Classpath Tools Guide
[EMAIL PROTECTED] Raif S. Naffah
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] 0pt plus 1filll
+Copyright @copyright{} 2006 Free Software Foundation, Inc.
[EMAIL PROTECTED] 2
+Permission is granted to make and distribute verbatim copies of this document
provided the copyright notice and this permission notice are preserved on all
copies.
+
+Permission is granted to copy and distribute modified versions of this
document under the conditions for verbatim copying, provided that the entire
resulting derived work is distributed under the terms of a permission notice
identical to this one.
+
+Permission is granted to copy and distribute translations of this manual into
another language, under the above conditions for modified versions, except that
this permission notice may be stated in a translation approved by the Free
Software Foundation.
+
[EMAIL PROTECTED] titlepage
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] Top, Security Tools, (dir), (dir)
[EMAIL PROTECTED] GNU Classpath Tools Guide
+
+This document contains important information you need to know in order to use
+the tools included in the GNU Classpath project deliverables.
+
+The Tools aim at providing a free replacement, similar in their behavior, to
+their counter-parts found in the Reference Implementation (RI) of the Java
+Software Development Kit (SDK).
+
[EMAIL PROTECTED] ifinfo
+
[EMAIL PROTECTED]
+* Security Tools:: Work securely with Java applications
+* I18N Issues:: How to add support for non-English languages
+
[EMAIL PROTECTED]
+ --- The Detailed Node Listing ---
+
+Security Tools
+
+* jarsigner Tool:: Sign and verify .JAR files
+* keytool Tool:: Manage private keys and public certificates
+
+I18N Issues
+
+* Language Resources:: Where resources are located
+* Message Formats:: How messages are internationalized
+
[EMAIL PROTECTED] detailmenu
[EMAIL PROTECTED] menu
+
[EMAIL PROTECTED]
----------------------------------------------------------------------
+
[EMAIL PROTECTED] Security Tools, I18N Issues, Top, Top
[EMAIL PROTECTED] node-name, next, previous, up
[EMAIL PROTECTED] Security Tools
+
+Two Security Tools are available with GNU Classpath: @b{jarsugner} and
@b{keytool}.
+
[EMAIL PROTECTED]
+* jarsigner Tool:: Sign and verify .JAR files
+* keytool Tool:: Manage private keys and public certificates
[EMAIL PROTECTED] menu
+
+If while using these tools you think you found a bug, then please report it at
@uref{http://www.gnu.org/software/classpath/bugs.html,classpath-bugs}.
+
[EMAIL PROTECTED]
----------------------------------------------------------------------
+
[EMAIL PROTECTED] jarsigner Tool, keytool Tool, Security Tools, Security Tools
[EMAIL PROTECTED] node-name, next, previous, up
[EMAIL PROTECTED] The @code{jarsigner} Tool
+
[EMAIL PROTECTED] @b
+
[EMAIL PROTECTED] SYNOPSIS
[EMAIL PROTECTED] [OPTION]... FILE [EMAIL PROTECTED]
[EMAIL PROTECTED] -verify [OPTION]... FILE}
+
[EMAIL PROTECTED] DESCRIPTION
+When the first form is used, the tool signs the designated JAR file.
+
+The second form, on the other hand, is used to verify a previously signed JAR
file.
+
[EMAIL PROTECTED] is the .JAR file to process; i.e. to sign if the first syntax
form is used, or to verify if the second syntax form is used instead.
+
[EMAIL PROTECTED] must be a known @i{Alias} of a @i{Key Entry} in the
designated key store. The private key material associated with this @i{Alias}
is then used for signing the designated .JAR file.
+
[EMAIL PROTECTED] SIGNING OPTIONS
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -keystore URL
+Use this option to specify the location of the key store to use. The default
value is a file URL referencing the file named @file{.keystore} located in the
path returned by the call to @code{java.lang.System#getProperty(String)} using
@code{user.home} as argument.
+
+If a URL was specified, but was found to be malformed --e.g. missing protocol
element-- the tool will attempt to use the URL value as a file-name (with
absolute or relative path-name) of a key store --as if the protocol was
@code{file:}.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+Use this option to specify the type of the key store to use. The default
value, if this option is omitted, is that of the property @code{keystore.type}
in the security properties file, which is obtained by invoking the static
method call @code{getDefaultType()} in @code{java.security.KeyStore}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+Use this option to specify the password which will be used to unlock the key
store. If this option is missing, the User will be prompted to provide a
password.
+
[EMAIL PROTECTED] -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the
@i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key
Entry} using the same password protecting the key store. If this fails, you
will then be prompted to provide a password.
+
[EMAIL PROTECTED] -sigfile NAME
+Use this option to designate a literal that will be used to construct file
names for both the @code{.SF} and @code{.DSA} signature files. These files
will be generated, by the tool, and placed in the @file{META-INF} directory of
the signed JAR. Permissible characters for @code{NAME} must be in the range
"a-zA-Z0-9_-". All characters will be converted to upper-case ones.
+
+If this option is missing, the first eight characters of the @code{ALIAS}
argument will be used. When this is the case, any character in @code{ALIAS}
that is outside the permissible range of characters will be replaced by an
underscore.
+
[EMAIL PROTECTED] -signedjar FILE_NAME
+Use this option to specify the file name of the signed JAR. If this option is
omitted, then the signed JAR will be named the same as @code{FILE}; i.e. the
input JAR file will be replaced with the signed copy.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] VERIFICATION OPTIONS
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -verify
+Use this option to indicate that the tool is to be used for verification
purposes.
+
[EMAIL PROTECTED] -certs
+This option is used in conjunction with the @code{-verbose} option. When
present, along with the @code{-verbose} option, the tool will print more
detailed information about the certificates of the signer(s) being processed.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] COMMON OPTIONS
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -verbose
+Use this option to force the tool to generate more verbose messages, during
its processing.
+
[EMAIL PROTECTED] -internalsf
+When present, the tool will include --which otherwise it does not-- the
@code{.SF} file in the @code{.DSA} generated file.
+
[EMAIL PROTECTED] -sectionsonly
+When present, the tool will include in the @code{.SF} generated file --which
otherwise it does not-- a header containing a hash of the whole manifest file.
When that header is included, the tool can quickly check, during verification,
if the hash (in the header) matches or not the manifest file.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+A fully qualified class name of a @i{Security Provider} to add to the current
list of @i{Security Providers} already installed in the JVM in-use. If a
provider class is specified with this option, and was successfully added to the
runtime --i.e. it was not already installed-- then the tool will attempt to
remove this @i{Security Provider} before exiting.
+
[EMAIL PROTECTED] -help
+Prints a help text similar to this one.
+
[EMAIL PROTECTED] table
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED]
----------------------------------------------------------------------
+
[EMAIL PROTECTED] keytool Tool, , jarsigner Tool, Security Tools
[EMAIL PROTECTED] node-name, next, previous, up
[EMAIL PROTECTED] The @code{keytool} Tool
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] SYNOPSIS
[EMAIL PROTECTED] [COMMAND]...}
+
[EMAIL PROTECTED] DESCRIPTION
+A Java-based tool for managing both @i{Key Entries} as well as @i{Trusted
Certificates}.
+
+Multiple @code{COMMAND}s may be specified at once, each complete with its own
options. @b{keytool} will parse all the arguments, before processing, and
executing, each @code{COMMAND}. If an exception occurs while executing one
@code{COMMAND} @b{keytool} will abort.
+
+A @code{COMMAND} can be one of the followings:
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -genkey [EMAIL PROTECTED]
+Generate a new @i{Key Entry}, eventually creating a new key store.
+
[EMAIL PROTECTED] -import [EMAIL PROTECTED]
+Add, to a key store, @i{Key Entries} (private keys and certificate chains
authenticating the public keys) and @i{Trusted Certificates} (3rd party
certificates which can be used as @i{Trust Anchors} when building
chains-of-trust).
+
[EMAIL PROTECTED] -selfcert [EMAIL PROTECTED]
+Generate a new self-signed @i{Trusted Certificate}.
+
[EMAIL PROTECTED] -identitydb [EMAIL PROTECTED]
[EMAIL PROTECTED] IMPLEMENTED [EMAIL PROTECTED]
+Import a JDK 1.1 style Identity Database.
+
[EMAIL PROTECTED] -certreq [EMAIL PROTECTED]
+Issue a @i{Certificate Signing Request} (CSR) which can be then sent to a
@i{Certification Authority} (CA) to issue a certificate signed (by the CA) and
authenticating the @i{Subject} of the request.
+
[EMAIL PROTECTED] -export [EMAIL PROTECTED]
+Export a certificate from a key store.
+
[EMAIL PROTECTED] -list [EMAIL PROTECTED]
+Print one or all certificates in a key store to @code{STDOUT}.
+
[EMAIL PROTECTED] -printcert [EMAIL PROTECTED]
+Print a human-readable form of a certificate, in a designated file, to
@code{STDOUT}.
+
[EMAIL PROTECTED] -keyclone [EMAIL PROTECTED]
+Clone a @i{Key Entry} in a key store.
+
[EMAIL PROTECTED] -storepasswd [EMAIL PROTECTED]
+Change the password protecting a key store.
+
[EMAIL PROTECTED] -keypasswd [EMAIL PROTECTED]
+Change the password protecting a @i{Key Entry} in a key store.
+
[EMAIL PROTECTED] -delete [EMAIL PROTECTED]
+Delete a @i{Key Entry} or a @i{Trusted Certificate} from a key store.
+
[EMAIL PROTECTED] -help
+Prints a help text similar to this one.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] OPTIONS COMMON TO MORE THAN ONE COMMAND
+The following @code{OPTION}s are used in more than one @code{COMMAND}. They
are described here to reduce redundancy.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED]
[EMAIL PROTECTED] -alias ALIAS
+Every entry, be it a @i{Key Entry} or a @i{Trusted Certificate}, in a key
store is uniquely identified by a user-defined @i{Alias} string. Use this
option to specify the @i{Alias} to use when referring to an entry in the key
store. Unless specified otherwise, a default value of @code{mykey} shall be
used when this option is omitted from the command line.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -keyalg ALGORITHM
+Use this option to specify the canonical name of the key-pair generation
algorithm. The default value for this option is @code{DSS} (a synonym for the
Digital Signature Algorithm also known as DSA).
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -keysize SIZE
+Use this option to specify the number of bits of the shared modulus (for both
the public and private keys) to use when generating new keys. A default value
of @code{1024} will be used if this option is omitted from the command line.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -validity DAY_COUNT
+Use this option to specify the number of days a newly generated certificate
will be valid for. The default value is @code{90} (days) if this option is
omitted from the command line.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -storetype STORE_TYPE
+Use this option to specify the type of the key store to use. The default
value, if this option is omitted, is that of the property @code{keystore.type}
in the security properties file, which is obtained by invoking the static
method call @code{getDefaultType()} in @code{java.security.KeyStore}.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -storepass PASSWORD
+Use this option to specify the password protecting the key store. If this
option is omitted from the command line, you will be prompted to provide a
password.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -keystore URL
+Use this option to specify the location of the key store to use. The default
value is a file URL referencing the file named @file{.keystore} located in the
path returned by the call to @code{java.lang.System#getProperty(String)} using
@code{user.home} as argument.
+
+If a URL was specified, but was found to be malformed --e.g. missing protocol
element-- the tool will attempt to use the URL value as a file-name (with
absolute or relative path-name) of a key store --as if the protocol was
@code{file:}.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+A fully qualified class name of a @i{Security Provider} to add to the current
list of @i{Security Providers} already installed in the JVM in-use. If a
provider class is specified with this option, and was successfully added to the
runtime --i.e. it was not already installed-- then the tool will attempt to
removed this @i{Security Provider} before exiting.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -file FILE_NAME
+Use this option to designate a file to use with a command. When specified with
this option, the value is expected to be the fully qualified path of a file
accessible by the File System. Depending on the command, the file may be used
as input or as output. When this option is omitted from the command line,
@code{STDIN} will be used instead, as the source of input, and @code{STDOUT}
will be used instead as the output destination.
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] -v
+Unless specified otherwise, use this option to enable more verbose output.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] X.500 DISTINGUISHED NAME
+A @i{Distinguished Name} (or DN) MUST be supplied with some of the
@code{COMMAND}s using a @code{-dname} option. The syntax of a valid value for
this option MUST follow RFC-2253 specifications. Namely the following
components (with their accepted meaning) will be recognized. Note that the
component name is case-insensitive:
+
[EMAIL PROTECTED] @var
[EMAIL PROTECTED] CN
+The Common Name; e.g. @kbd{host.domain.com}
[EMAIL PROTECTED] OU
+The Organizational Unit; e.g. @kbd{IT Department}
[EMAIL PROTECTED] O
+The Organization Name; e.g. @kbd{The Sample Company}
[EMAIL PROTECTED] L
+The Locality Name; e.g. @kbd{Sydney}
[EMAIL PROTECTED] ST
+The State Name; e.g. @kbd{New South Wales}
[EMAIL PROTECTED] C
+The 2-letter Country identifier; e.g. @kbd{AU}
[EMAIL PROTECTED] ftable
+
+When specified with a @code{-dname} option, each pair of component/value will
be separated from the other with a comma. Each component and value pair MUST be
separated by an equal sign. For example, the following is a valid DN value:@*
+
[EMAIL PROTECTED]
+CN=host.domain.com, O=The Sample Company, L=Sydney, ST=NSW, C=AU
[EMAIL PROTECTED] format
[EMAIL PROTECTED]
+If the @i{Distinguished Name} is required, and no valid default value can be
used, the tool will prompt you to enter the information through the console.
+
[EMAIL PROTECTED] -genkey COMMAND
+Generate a new key-pair (both private and public keys), and save these
credentials in the key store as a @i{Key Entry}, associated with the designated
(if was specified in the @code{-alias} option) or default (if the @code{-alias}
option is omitted) @i{Alias}.
+
+The private key material will be protected with a user-defined password (see
@code{-keypass} option). The public key on the other hand will be part of a
self-signed X.509 certificate, which will form a 1-element chain and will be
saved in the key store.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -keyalg ALGORITHM
+For more details @pxref{keyalg,, ALGORITHM}.
+
[EMAIL PROTECTED] -keysize KEY_SIZE
+For more details @pxref{keysize,, KEY_SIZE}.
+
[EMAIL PROTECTED] -sigalg ALGORITHM
+The canonical name of the digital signature algorithm to use for signing
certificates. If this option is omitted, a default value will be chosen based
on the type of the key-pair; i.e. the algorithm that ends up being used by the
-keyalg option. If the key-pair generation algorithm is @code{DSA}, the value
for the signature algorithm will be @code{SHA1withDSA}. If on the other hand
the key-pair generation algorithm is @code{RSA}, then the tool will use
@code{MD5withRSA} as the signature algorithm.
+
[EMAIL PROTECTED] -dname NAME
+This a mandatory value for the command. If no value is specified --i.e. the
@code{-dname} option is omitted-- the tool will prompt you to enter a
@i{Distinguished Name} to use as both the @i{Owner} and @i{Issuer} of the
generated self-signed certificate.
+
+For more details @pxref{dn,, X.500 DISTINGUISHED NAME}.
+
[EMAIL PROTECTED] -keypass PASSWORD
+Use this option to specify the password which the tool will use to protect the
newly created @i{Key Entry}.
+
+If this option is omitted, you will be prompted to provide a password.
+
[EMAIL PROTECTED] -validity DAY_COUNT
+For more details @pxref{validity,, DAY_COUNT}.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -import COMMAND
+Read an X.509 certificate, or a PKCS#7 @i{Certificate Reply} from a designated
input source and incorporate the certificates into the key store.
+
+If the @i{Alias} does not already exist in the key store, the tool treats the
certificate read from the input source as a new @i{Trusted Certificate}. It
then attempts to discover a chain-of-trust, starting from that certificate and
ending at another @i{Trusted Certificate}, already stored in the key store. If
the @code{-trustcacerts} option is present, an additional key store, of type
@code{JKS} named @file{cacerts}, and assumed to be present in @[EMAIL
PROTECTED]@}/lib/security} will also be consulted if found [EMAIL
PROTECTED]@[EMAIL PROTECTED] refers to the location of an installed @i{Java
Runtime Environment} (JRE). If no chain-of-trust can be established, and unless
the @code{-noprompt} option has been specified, the certificate is printed to
@code{STDOUT} and the user is prompted for a confirmation.
+
+If @i{Alias} exists in the key store, the tool will treat the certificate(s)
read from the input source as a @i{Certificate Reply}, which can be a chain of
certificates, that eventually would replace the chain of certificates
associated with the @i{Key Entry} of that @i{Alias}. The substitution of the
certificates only occurs if a chain-of-trust can be established between the
bottom certificate of the chain read from the input file and the @i{Trusted
Certificates} already present in the key store. Again, if the
@code{-trustcacerts} option is specified, additional @i{Trusted Certificates}
in the same @file{cacerts} key store will be considered. If no chain-of-trust
can be established, the operation will abort.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -file FILE_NAME
+For more details @pxref{file,, FILE_NAME}.
+
[EMAIL PROTECTED] -keypass PASSWORD
+Use this option to specify the password which the tool will use to protect the
@i{Key Entry} associated with the designated @i{Alias}, when replacing this
@i{Alias}' chain of certificates with that found in the certificate reply.
+
+If this option is omitted, and the chain-of-trust for the certificate reply
has been established, the tool will first attempt to unlock the @i{Key Entry}
using the same password protecting the key store. If this fails, you will then
be prompted to provide a password.
+
[EMAIL PROTECTED] -noprompt
+Use this option to prevent the tool from prompting the user.
+
[EMAIL PROTECTED] -trustcacerts
+Use this option to indicate to the tool that a key store, of type @code{JKS},
named @file{cacerts}, and usually located in @file{lib/security} in an
installed @i{Java Runtime Environment} should be considered when trying to
establish chain-of-trusts.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -selfcert COMMAND
+Generate a self-signed X.509 version 1 certificate. The newly generated
certificate will form a chain of one element which will replace the previous
chain associated with the designated @i{Alias} (if @code{-alias} option was
specified), or the default @i{Alias} (if @code{-alias} option was omitted).
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -sigalg ALGORITHM
+The canonical name of the digital signature algorithm to use for signing the
certificate. If this option is omitted, a default value will be chosen based on
the type of the private key associated with the designated @i{Alias}. If the
private key is a @code{DSA} one, the value for the signature algorithm will be
@code{SHA1withDSA}. If on the other hand the private key is an @code{RSA} one,
then the tool will use @code{MD5withRSA} as the signature algorithm.
+
[EMAIL PROTECTED] -dname NAME
+Use this option to specify the @i{Distinguished Name} of the newly generated
self-signed certificate. If this option is omitted, the existing
@i{Distinguished Name} of the base certificate in the chain associated with the
designated @i{Alias} will be used instead.
+
+For more details @pxref{dn,, X.500 DISTINGUISHED NAME}.
+
[EMAIL PROTECTED] -validity DAY_COUNT
+For more details @pxref{validity,, DAY_COUNT}.
+
[EMAIL PROTECTED] -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the
@i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key
Entry} using the same password protecting the key store. If this fails, you
will then be prompted to provide a password.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -identitydb COMMAND
[EMAIL PROTECTED] IMPLEMENTED YET}.
+
+Import a JDK 1.1 style Identity Database.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -file FILE_NAME
+For more details @pxref{file,, FILE_NAME}.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -certreq COMMAND
+Generate a PKCS#10 @i{Certificate Signing Request} (CSR) and writes it to a
designated output destination. The contents of the destination should look
something like the following:
+
[EMAIL PROTECTED]
+-----BEGIN NEW CERTIFICATE REQUEST-----
+MI...QAwXzEUMBIGA1UEAwwLcnNuQGdudS5vcmcxGzAZBgNVBAoMElUg
+Q2...A0GA1UEBwwGU3lkbmV5MQwwCgYDVQQIDANOU1cxCzAJBgNVBACC
+...
+FC...IVwNVOfQLRX+O5kAhQ/a4RTZme2L8PnpvgRwrf7Eg8D6w==
+-----END NEW CERTIFICATE REQUEST-----
[EMAIL PROTECTED] example
+
[EMAIL PROTECTED]: Some documentation (e.g. RSA examples) claims that the
@code{Attributes} field, in the CSR is @code{OPTIONAL} while RFC-2986 implies
the opposite. This implementation considers this field, by default, as
@code{OPTIONAL}, unless the option @code{-attributes} is specified on the
command line.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -sigalg ALGORITHM
+The canonical name of the digital signature algorithm to use for signing the
certificate. If this option is omitted, a default value will be chosen based on
the type of the private key associated with the designated @i{Alias}. If the
private key is a @code{DSA} one, the value for the signature algorithm will be
@code{SHA1withDSA}. If on the other hand the private key is an @code{RSA} one,
then the tool will use @code{MD5withRSA} as the signature algorithm.
+
[EMAIL PROTECTED] -file FILE_NAME
+For more details @pxref{file,, FILE_NAME}.
+
[EMAIL PROTECTED] -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the
@i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key
Entry} using the same password protecting the key store. If this fails, you
will then be prompted to provide a password.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] -attributes
+Use this option to force the tool to encode a @code{NULL} DER value in the CSR
as the value of the @code{Attributes} field.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -export COMMAND
+Export a certificate stored in the key store to a designated output
destination, either in binary format (if the @code{-v} option is specified), or
in RFC-1421 compliant encoding (if the @code{-rfc} option is specified
+instead).
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -file FILE_NAME
+For more details @pxref{file,, FILE_NAME}.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -rfc
+Use RFC-1421 specifications when encoding the output.
+
[EMAIL PROTECTED] -v
+Output the certificate in binary DER encoding. This is the default output
format of the command if neither @code{-rfc} nor @code{-v} options were
detected on the command line. If both this option and the @code{-rfc} option
are detected on the command line, the tool will opt for the RFC-1421 style
encoding.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -list COMMAND
+Print one or all of the key store entries to @code{STDOUT}. Usually this
command will only print a @i{fingerprint} of the certificate, unless either the
@code{-rfc} or the @code{-v} option is specified.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+If this option is omitted, the tool will print ALL the entries found in the
key store.
+
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -rfc
+Use RFC-1421 specifications when encoding the output.
+
[EMAIL PROTECTED] -v
+Output the certificate in human-readable format. If both this option and the
@code{-rfc} option are detected on the command line, the tool will opt for the
human-readable form and will not abort the command.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -printcert COMMAND
+Read a certificate from a designated input source and print it to
@code{STDOUT} in a human-readable form.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -file FILE_NAME
+For more details @pxref{file,, FILE_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -keyclone COMMAND
+Clone an existing @i{Key Entry} and store it under a new (different) @i{Alias}
protecting, its private key material with possibly a new password.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -dest ALIAS
+Use this option to specify the new @i{Alias} which will be used to identify
the cloned copy of the @i{Key Entry}.
+
[EMAIL PROTECTED] -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the
@i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key
Entry} using the same password protecting the key store. If this fails, you
will then be prompted to provide a password.
+
[EMAIL PROTECTED] -new PASSWORD
+Use this option to specify the password protecting the private key material of
the newly cloned copy of the @i{Key Entry}.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -storepasswd COMMAND
+Change the password protecting a key store.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -new PASSWORD
+The new, and different, password which will be used to protect the designated
key store.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -keypasswd COMMAND
+Change the password protecting the private key material of a designated @i{Key
Entry}.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the
@i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key
Entry} using the same password protecting the key store. If this fails, you
will then be prompted to provide a password.
+
[EMAIL PROTECTED] -new PASSWORD
+The new, and different, password which will be used to protect the private key
material of the designated @i{Key Entry}.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED] -delete COMMAND
+Delete a designated key store entry.
+
[EMAIL PROTECTED] @b
[EMAIL PROTECTED] -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
[EMAIL PROTECTED] -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
[EMAIL PROTECTED] -keystore URL
+For more details @pxref{keystore,, URL}.
+
[EMAIL PROTECTED] -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
[EMAIL PROTECTED] -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
[EMAIL PROTECTED] -v
+For more details @pxref{verbose}.
+
[EMAIL PROTECTED] table
[EMAIL PROTECTED] table
+
[EMAIL PROTECTED]
----------------------------------------------------------------------
+
[EMAIL PROTECTED] I18N Issues, , Security Tools, Top
[EMAIL PROTECTED] node-name, next, previous, up
[EMAIL PROTECTED] I18N Issues
+
+Some tools [EMAIL PROTECTED] Tools}-- allow using other than the English
language when prompting the User for input, and outputing messages. This
chapter describes the elements used to offer this support and how they can be
adapted for use with specific languages.
+
[EMAIL PROTECTED]
+* Language Resources:: Where resources are located
+* Message Formats:: How messages are internationalized
[EMAIL PROTECTED] menu
+
[EMAIL PROTECTED]
----------------------------------------------------------------------
+
[EMAIL PROTECTED] Language Resources, Message Formats, I18N Issues, I18N Issues
[EMAIL PROTECTED] node-name, next, previous, up
[EMAIL PROTECTED] Language-Specific Resources
+
+The Tools use Java @code{ResourceBundle}s to store messages, and message
templates they use at runtime to generate the message text itself, depending on
the locale in use at the time.
+
+The @i{Resource Bundles} these tools use are essentially Java @i{Properties}
files consisting of a set of @i{Name/Value} pairs. The @i{Name} is the
@i{Propery Name} and the @i{Value} is a substitution string that is used when
the code references the associated @i{Name}. For example the following is a
line in a @i{Resource Bundle} used by the @code{keytool} Tool:
+
[EMAIL PROTECTED]
+Command.23=A correct key password MUST be provided
[EMAIL PROTECTED] example
+
+When the tool needs to signal a mandatory but missing key password, it would
reference the property named @code{Command.23} and the message "@kbd{A correct
key password MUST be provided}" will be used instead. This indirect referencing
of "resources" permits replacing, as late as possible, the English strings with
strings in other languages, provided of course @i{Resource Bundles} in those
languages are provided.
+
+For the GNU Classpath Tools described in this Guide, the @i{Resource Bundles}
are files named @file{MessageBundle[_ll[_CC[_VV]]].properties} where:
+
[EMAIL PROTECTED] @var
[EMAIL PROTECTED] ll
+Is the 2-letter code for the Language,
[EMAIL PROTECTED] CC
+Is the 2-letter code for the Region, and
[EMAIL PROTECTED] VV
+Is the 2-letter code for the Variant of the language.
[EMAIL PROTECTED] ftable
+
+The complete list of language codes can be found at
@uref{http://ftp.ics.uci.edu/pub/ietf/http/related/iso639.txt, Code for the
representation of names of languages}. A similar list for the region codes can
be found at
@uref{http://userpage.chemie.fu-berlin.de/diverse/doc/ISO_3166.html, ISO 3166
Codes (Countries)}.
+
+The location of the @i{Resource Bundles} for the GNU Classpath Tools is
specific to each tool. The next table shows where these files are found in a
standard GNU Classpath distribution:
+
[EMAIL PROTECTED] @code
[EMAIL PROTECTED] jarsigner
[EMAIL PROTECTED]/classpath/tools/jarsigner}
[EMAIL PROTECTED] keytool
[EMAIL PROTECTED]/classpath/tools/keytool}
[EMAIL PROTECTED] ftable
+
+The collection of @i{Resource Bundles} in a location act as an inverted tree
with a parent-child relationship. For example suppose in the
@file{gnu/classpath/tools/keytool} there are 3 message bundles named:
+
[EMAIL PROTECTED]
[EMAIL PROTECTED] @code{MessageBundle.properties}
[EMAIL PROTECTED] @code{MessageBundle_fr.properties}
[EMAIL PROTECTED] @code{MessageBundle_fr_FR.properties}
[EMAIL PROTECTED] enumerate
+
+In the above example, bundle #1 will act as the parent of bundle #2, which in
turn will act as the parent for bundle #3. This ordering is used by the Java
runtime to choose which file to load based on the set Locale. For example if
the Locale is @code{fr_CH}, @code{MessageBundle_fr.properties} will be used
because (a) @code{MessageBundle_fr_CH.properties} does not exist, but (b)
@code{MessageBundle_fr.properties} is the parent for the required bundle, and
it exists. As another example, suppose the Locale was set to @code{en_AU}; then
the tool will end up using @code{MessageBundle.properties} because (a)
@code{MessageBundle_en_AU.properties} does not exist, (b)
@code{MessageBundle_en.properties} which is the parent for the required bundle
does not exist, but (c) @code{MessageBundle.properties} exists and is the root
of the hierarchy.
+
+You can see from the examples above that @file{MessageBundle.properties} is
the safety net that the Java runtime falls back to when failing to find a
specific bunlde and its parent(s). This file is always provided with the Tool.
In time, more localized versions will be included to cater for other languages.
+
+In the meantime, if you are willing to contribute localized versions of these
resources, grab the @file{MessageBundle.properties} for a specific tool;
translate it; save it with the appropriate language and region suffix and mail
it to @code{classpath@@gnu.org}.
+
[EMAIL PROTECTED]
----------------------------------------------------------------------
+
[EMAIL PROTECTED] Message Formats, , Language Resources, I18N Issues
[EMAIL PROTECTED] node-name, next, previous, up
[EMAIL PROTECTED] Message Formats
+
+If you open any of the @file{MessageBundle.properties} described in the
previous section, you may see properties that look like so:
+
[EMAIL PROTECTED]
+Command.67=Issuer: @[EMAIL PROTECTED]
+Command.68=Serial number: @{0,[EMAIL PROTECTED]
+Command.69=Valid from: @{0,date,[EMAIL PROTECTED] - @{0,time,[EMAIL PROTECTED]
+Command.70=\ \ \ \ \ until: @{0,date,[EMAIL PROTECTED] - @{0,time,[EMAIL
PROTECTED]
[EMAIL PROTECTED] example
+
+These are @i{Message Formats} used by the tools to customize a text string
that will then be used either as a prompt for User input or as output.
+
+If you are translating a @file{MessageBundle.properties} be careful not to
alter text between curly braces.
+
[EMAIL PROTECTED]
----------------------------------------------------------------------
+
[EMAIL PROTECTED]
pgpFmig7mhnAi.pgp
Description: PGP signature
