alblanco/jsign repository overview

⁠Hardened Jsign Alpine Docker Image

A lightweight, security-focused Docker image built on Alpine Linux to sign binaries and installers using Jsign⁠.

Designed specifically for cross-platform CI/CD pipelines (GitLab CI, GitHub Actions, Azure DevOps) to sign binaries from Linux runners.

⁠Key Features

• Ultra-Lightweight: ~60 MB.
• Cross-Platform Support: Runs on linux/amd64 and linux/arm64.
• Security Hardened:
  • Runs under a dedicated non-root user (jsign).
  • Minimal attack surface based on Alpine Linux and JRE 17 Headless.
• Agnostic KMS Provider: Supports Azure Key Vault, AWS KMS, GCP KMS, HashiCorp Vault, YubiKey, PKCS#11/12, and local keystores.

⁠Quick Start

⁠Basic Usage

Mount your workspace containing the target binaries and execute the container, here a example to sign with Azure HSM

docker run --rm \
  -v $(pwd)/dist:/work \
  -w /work \
  alblanco/jsign:latest \
  --keystoretype AZUREKEYVAULT \
  --keystore "https://<your-vault-name>.vault.azure.net" \
  --storepass "<CLIENT_SECRET>" \
  --alias "<CERTIFICATE_NAME>" \
  --param vaultname="<VAULT_NAME>" \
  --param clientid="<CLIENT_ID>" \
  myapp.exe