Plugin Signing

warning

Storing Secrets

Never commit your credentials to the Version Control System! Instead, use environment variables, like:

token.set(providers.environmentVariable("PUBLISH_TOKEN"))
password.set(providers.environmentVariable("PRIVATE_KEY_PASSWORD"))

To generate an RSA private.pem private key, run the openssl genpkey command in the terminal, as below:

openssl genpkey\
  -aes-256-cbc\
  -algorithm RSA\
  -out private_encrypted.pem\
  -pkeyopt rsa_keygen_bits:4096

After that, it's required to convert it into the RSA form with:

openssl rsa\
  -in private_encrypted.pem\
  -out private.pem

At this point, the generated private.pem content should be provided to the signPlugin.privateKey property (2.x, 1.x). The provided password should be specified as the signPlugin.password property (2.x, 1.x).

As a next step, we will generate a chain.crt certificate chain with:

openssl req\
  -key private.pem\
  -new\
  -x509\
  -days 365\
  -out chain.crt

The content of the chain.crt file will be used for the signPlugin.certificateChain property (2.x, 1.x).

tip

Information about generating a public key based on the private key will be added later when uploading public keys to JetBrains Marketplace becomes available.

To avoid storing hard-coded values in the project configuration, the most suitable method for local development would be using environment variables provided within the Run/Debug Configuration.

To specify secrets like PUBLISH_TOKEN and values required for the signPlugin Gradle task (2.x, 1.x), modify your Gradle configuration as follows:

signPlugin {
  certificateChain.set(providers.environmentVariable("CERTIFICATE_CHAIN"))
  privateKey.set(providers.environmentVariable("PRIVATE_KEY"))
  password.set(providers.environmentVariable("PRIVATE_KEY_PASSWORD"))
}

publishPlugin {
  token.set(providers.environmentVariable("PUBLISH_TOKEN"))
}

signPlugin {
  certificateChain = providers.environmentVariable("CERTIFICATE_CHAIN")
  privateKey = providers.environmentVariable("PRIVATE_KEY")
  password = providers.environmentVariable("PRIVATE_KEY_PASSWORD")
}

publishPlugin {
  token = providers.environmentVariable("PUBLISH_TOKEN")
}

In the Run/Debug Configuration for publishPlugin Gradle task (2.x, 1.x), provide Environment Variables using relevant environment variable names:

warning

Encoding Values

Note that both the private key and certificate chain are multi-line values. It is necessary to transform them first using Base64 encoding before providing the single-line field in the Environment Variables panel.

The corresponding Gradle task properties will automatically detect and decode the Base64-encoded values.

CLI tool is required if you don't rely on either Gradle plugin – i.e., when working with Themes.

Get the latest Marketplace ZIP Signer CLI Tool version from the GitHub Releases page. After downloading the marketplace-zip-signer-cli.jar, execute it as below:

java -jar marketplace-zip-signer-cli.jar sign\
  -in "unsigned.zip"\
  -out "signed.zip"\
  -cert-file "/path/to/chain.crt"\
  -key-file "/path/to/private.pem"\
  -key-pass "PRIVATE_KEY_PASSWORD"

Before looking at how we can sign a plugin, let's first review how verification works when a non-JetBrains certificate is used. As of 2021.2, during verification, IntelliJ-based IDEs check if the plugin was signed with the JetBrains CA certificate or any public key provided by the user via Settings | Plugins | Manage Plugin Certificates. In 2021.2.1, a system property has been added: intellij.plugins.truststore, pointing to a trusted JKS TrustStore. During verification, the plugin's public key is extracted from the signature. The last certificate entry in the chain matched against the certificates stored in one of the storages from above.

If an internal CA is available, it can be used to generate certificates for signing. When choosing this route, the certificate chain includes the root CA public key at the end of the chain.

With this approach, existing internal TrustStores may exist and could be used. Be sure when choosing a TrustStore that the CAs are limited to the internal CAs you trust. Using a TrustStore with public CAs can expose users to an attack vector.

If adding a TrustStore to a user's environment is not possible, the user may also add the root CAs public key to Settings | Plugins | Manage Plugin Certificates.

Using a self-signed certificate is an option if no internal CAs exist. To generate the key and public key, see Generate Private Key.

If providing users with a TrustStore, you can generate one with the public key using keytool:

keytool -import -alias IdeaPlugin -file chain.crt -keystore pluginKeystore.jks -storepass changeit

(note: the TrustStore password must remain changeit)

Otherwise, users may add the public key manually to Settings | Plugins | Manage Plugin Certificates.