Introduction

The JS7 - Signing Certificate Renewal indicates the requirement to update expiring Signing Certificates. Such certificates are assigned when deploying Workflwos and Job Resources.

• The JS7 Controller and Agent make use of a journal to store infrastructure information and transactional data.
  • The journal is located in the <data>/state directory of the Controller's or Agent's data directory.
  • The journal consists of a number of files.
• The recommended proceeding is explained from JS7 - How to mitigate Signing Certificate Expiration.

Journal Update Class

The Journal Update Class is provided for download and can be used to update Controller and Agent journals.

The Java class is available for any supported platform.

Download

Usage

Invoking the Journal Update Class without arguments displays the usage clause:

Usage: java -jar update-journal.jar [Options] [Switches]

  Options:
    --state-dir=<directory> | required: state directory where the journals are located
    --old-cert=<path>       | optional: path to the current certificate (built-in:signature-certificate-valid-until-2025-10-12.pem; 
                                        see https://kb.sos-berlin.com/x/QbiKCw)
    --new-cert=<path>       | optional: path to the new certificate (built-in:signature-certificate-valid-until-2030-06-15.pem; 
                                        see https://kb.sos-berlin.com/x/QbiKCw)

  Switches:
    --check | -c            | optional: returns only the number of hits without replacement

Options

• --state-dir
  • Specifies the directory in which a Controller's or Agent's journal is located. Typically the state sub-directory of the data directory is used.
  • Permissions to read and to write to the directory and files are required.
• --old-cert
  • Specifies the location of a .pem file that holds the Signing Certificate that should be replaced
  • Defaults to the built-in Signing Certificate that expires on Oct 12th 2025.
• --new-cert
  • Specifies the location of a .pem file that holds the Signing Certificate that acts as a replacement.
  • Defaults to the built-in Signing Certificte that expires on June 30th, 2030.

Switches

• -h | --help
  • Displays usage.
• -c | --check
  • Checks if the indicated journal directory holds references to the old certificate.

Fallback

The Journal Update Class will create the state.zip file in the OS directory for temporary files:

• Unix: /tmp/state.zip
• Windows: %TEMP%/state.zip

An existing file with the same name will be overwritten.

Examples

The following examples illustrate typical use cases.

Update Controller Journal

# download Journal Update Class
cd /tmp
curl 'https://download.sos-berlin.com/JobScheduler.2.0/update-journal.jar' -O

# check if journal update is required
java -jar ./update-journal.jar --state-dir=/var/sos-berlin.com/js7/controller/state --check

# perform journal update
java -jar ./update-journal.jar --state-dir=/var/sos-berlin.com/js7/controller/state

Update Agent Journal

# download Journal Update Class
cd /tmp
curl 'https://download.sos-berlin.com/JobScheduler.2.0/update-journal.jar' -O

# check if journal update is required
java -jar ./update-journal.jar --state-dir=/var/sos-berlin.com/js7/agent/state --check

# perform journal update
java -jar ./update-journal.jar --state-dir=/var/sos-berlin.com/js7/agent/state

Resources

• JS7 - Signing Certificate Renewal
• JS7 - How to mitigate Signing Certificate Expiration