Sign a jar file created with maven-assembly plugin

Question

I'd like to build an assembly and then sign it. My problem is that the jarsigner signs not the assembly, only the standalone jar file. Could you tell me what is the problem? Maven seems like 'magic' to me after having used Ant for years.. I can't see the way the plugins cooperate and pass information to each other.

After executing mvn install, I get two jar files, one called example-1.0.0-SNAPSHOT.jar and this is signed, and one called example-1.0.0-jar-with-dependencies.jar and this is not signed. I do not need the solo one, only the assembly, but that signed.

Here is my pom.xml:

<build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jarsigner-plugin</artifactId>
                <version>1.2</version>
                <executions>
                    <execution>
                        <id>sign</id>
                        <goals>
                            <goal>sign</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <keystore>${project.basedir}\keystore\mykeystore</keystore>
                    <alias>myalias</alias>
                    <storepass>...</storepass>
                    <keypass>...</keypass>
                </configuration>
            </plugin>

            <plugin>
                <artifactId>maven-assembly-plugin</artifactId>
                <executions>
                    <execution>
                        <id>make-my-assembly</id>
                        <phase>package</phase>
                        <goals>
                            <goal>single</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <archive>
                        <manifest>
                            <mainClass>com.example.FooBar</mainClass>
                        </manifest>
                    </archive>
                    <appendAssemblyId>true</appendAssemblyId>
                    <descriptorRefs>
                        <descriptorRef>jar-with-dependencies</descriptorRef>
                    </descriptorRefs>
                </configuration>
            </plugin>
        </plugins>
    </build>

Answer 1

    <configuration>
        <archiveDirectory>${project.build.directory}</archiveDirectory>
        <includes>
           <include>*.jar</include>
        </includes>
        <keystore>${project.basedir}/keystore/mykeystore</keystore>
        <alias>keyalias</alias>
        <storepass>storepass</storepass>
        <keypass>keypass</keypass>
    </configuration>

Refer this http://maven.apache.org/plugins/maven-jarsigner-plugin/sign-mojo.html

Answer 2

You should try to put the maven-assembly-plugin into the prepare-package phase instead of the package phase:

  <plugin>
    <artifactId>maven-assembly-plugin</artifactId>
    <executions>
        <execution>
            <id>make-my-assembly</id>
            <phase>prepare-package</phase>
            <goals>
                <goal>single</goal>
            </goals>
        </execution>
    </executions>
    ...
</plugin>