|Re: [equinox-dev] Signed bundles|
First of all, thanks for your reply!
On Feb 4, 2008, at 23:30 , Matt Flaherty wrote:
You can enable the signature verification system by setting the system property "osgi.signature.support.verify" to true. Equinox uses the system property, "osgi.framework.keystore" to look in a keystore of type JKS to find additional trusted certificates beyond those in the JRE's cacerts file. You don't need the alias or a password for the alias.
So, reiterating, if I want to run Equinox with OSGi security enabled and have it use my own keystore, I have to start it like this (formatted a bit for clarity, but typed as one big line):
Basically, I'm asking how Equinox is being run to be compliant with OSGi security.
I'm still experiencing problems with PermissionAdmin, but I'll explain that in a separate post because I think I might have run into a bug now.
The code that actually does the legwork of verifying the signatures over jarfiles was a provisional API formerly known as the JarVerifier - we've recently refactored it and established a supported API for signed content. Take a look in security/src in org.eclipse.osgi for the API. Some of these properties will be getting new osgi.signedcontent.* enablers with the new API, and we've also added support for disabling entire bundles based on the signer and a pluggable authentiation and authorization mechanism.
Thanks for the background information. At the moment, my interest is purely in OSGi security, I'm assuming that the API you describe is an extension to that?
Not well documented yet, but I'll take care of that shortly: https://bugs.eclipse.org/bugs/show_bug.cgi?id=217765
I've subscribed to that one, thanks.