[cbi-dev] About Signing plugins

[Mickael Istria <mistria@xxxxxxxxxx>]

Hi all,

I'm wondering what is currently the best way to sign content of a p2 repository using Maven/Tycho.

I see there are currently eclipse-signing-maven-plugin (from Intalio folks, which also deals with packing, documented as part of Minerva) and the eclipse-jarsigner-plugin (from Igor, which has to be used in combination with the tycho-pack200-plugins, not documented?). eclipse-jarsigner-plugin seems easier to use since it does not take parameters, but it is not available on an "official" Maven repo nor on maven.eclipse.org and lacks of documentation.

I'm pretty sure that in the end, only one signing plugin would remain.
Which one will it be? Which one should I use now?
If we come to a conclusion on that, then we should consider updating those documentations: http://wiki.eclipse.org/JAR_Signing and http://wiki.eclipse.org/Minerva#Signing

Cheers,
--

Mickael Istria
Eclipse developer at JBoss, by Red Hat
My blog - My Tweets