[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
RE: [orbit-dev] Signing Orbit (was: Orbit Buildproblem: commons.net ready forrelease but does not show up)
|
Yes.
Since the most common case is that consumers
get
Orbit bundles into their builds, then prepare one
large
ZIP file of everything and have that large ZIP
signed
(or not, if they don't like), it's better to not sign
Orbit
for now - until the sign script excludes
already-signed
bundles.
Note that we said earlier that we wanted to
re-sign
bundles which are already
signed from the original
vendor again with the Eclipse certificate. So it
looks
like it would not be sufficient if the signing script
just
checked with jarsigner
-verify.
Cheers,
--
Martin Oberhuber
Wind River Systems,
Inc.
Target Management Project Lead, DSDP PMC Member
http://www.eclipse.org/dsdp/tm
One issue - there is a bug opened
against the jar processor to not resign signed jars
https://bugs.eclipse.org/bugs/show_bug.cgi?id=174475
In an earlier Orbit call it was mentioned
that we didn't want build teams to have to manually maintain a list of Orbit
jars to exclude from signing
Kim
Jeff
McAffer/Ottawa/IBM@IBMCA Sent by: orbit-dev-bounces@xxxxxxxxxxx
03/16/2007 10:39 AM
Please respond
to Orbit Developer discussion
<orbit-dev@xxxxxxxxxxx> |
|
To
| Orbit Developer discussion
<orbit-dev@xxxxxxxxxxx>
|
cc
|
|
Subject
| Re: [orbit-dev] Signing Orbit
(was: Orbit Build problem: commons.net
ready forrelease but does not show
up) |
|
All the bundles we produce should be signed IMHO.
Is there a need for unsigned ones? Do other projects provide
both?
Jeff
"Oberhuber, Martin"
<Martin.Oberhuber@xxxxxxxxxxxxx> Sent by:
orbit-dev-bounces@xxxxxxxxxxx
03/16/2007 09:45 AM
Please respond
to Orbit Developer discussion
<orbit-dev@xxxxxxxxxxx> |
|
To
| "Orbit Developer
discussion" <orbit-dev@xxxxxxxxxxx>
|
cc
|
|
Subject
| [orbit-dev] Signing Orbit (was:
Orbit Build problem: commons.net ready
forrelease but does not show up) |
|
Since we already
produce a single ZIP of all Orbit bundles,
what about providing a ZIP of signed bundles
in addition to
the unsigned one?
Then, consumers have
the choice. Getting a complete ZIP
bundle signed is a single easy step
that can even be done
manually when it's just for the
milestones.
Cheers,
--
Martin Oberhuber
Wind River Systems,
Inc.
Target Management Project Lead, DSDP PMC Member
http://www.eclipse.org/dsdp/tm
From: orbit-dev-bounces@xxxxxxxxxxx
[mailto:orbit-dev-bounces@xxxxxxxxxxx] On Behalf Of Oberhuber,
Martin
Sent: Friday, March 16, 2007 10:56 AM
To: Orbit
Developer discussion
Subject: RE: [orbit-dev] Orbit Build problem:
commons.net ready forrelease.. but does not show up
Thanks for the quick
fix, Dave!
I
verified my bundles and I'm fine with the build.
Only thing I was
wondering, is what's our strategy for signing?
The current S-builds are not
signed. Is that intentional?
It looks like as of Platform M6, there are
still bugs with verifying signed,
packed bundles (bug 163421 in general, and bug 175284 for Platform/PDE).
Since these bugs can
lead to verification errors when trying to install a
bundle from an update site into
a 1.5 or later VM (and thus make installation
impossible from the update site in that
case), it might be a good
idea to wait with signing Orbit until these are fixed.
And start delivering
signed Orbit bundles with our next milestone. Or is that too
late?
Cheers,
--
Martin Oberhuber
Wind River Systems,
Inc.
Target Management Project Lead, DSDP PMC Member
http://www.eclipse.org/dsdp/tm
From: orbit-dev-bounces@xxxxxxxxxxx
[mailto:orbit-dev-bounces@xxxxxxxxxxx] On Behalf Of David M
Williams
Sent: Friday, March 16, 2007 9:11 AM
To: Orbit
Developer discussion
Cc: Orbit Developer discussion;
orbit-dev-bounces@xxxxxxxxxxx
Subject: Re: [orbit-dev] Orbit Build
problem: commons.net ready for release.. but does not show up
I fixed the main
problem, but didn't check your specific plugins, so (everyone) take a look at
the latest "S-build" in the committers area and see if all is well.
If
there's no objections raised, I'll move the latest S build to the "stable"
download area Friday afternoon. (And if anyone needs to wait until Sunday
evening or so, my guess it that would not impact anyone, but Kim (or similar)
can name an an absolute cut-off time as to when they'd like to cut over to the
latest S-build for their final M6 week).
"Oberhuber, Martin"
<Martin.Oberhuber@xxxxxxxxxxxxx> Sent by:
orbit-dev-bounces@xxxxxxxxxxx
03/15/2007 04:19 AM
Please respond
to Orbit Developer discussion
<orbit-dev@xxxxxxxxxxx> |
|
To
| "Orbit Developer
discussion" <orbit-dev@xxxxxxxxxxx>
|
cc
|
|
Subject
| [orbit-dev] Orbit Build problem:
commons.net ready for release .. but
does not show up |
|
Hi Orbiters,
I have
converted org.apache.commons.net and org.apache.oro
to follow the Orbit
style and be single-jar bundles. I think
I've done everything right,
updated the set1 feature.xml,
set unpack=false, released the bundles and
the feature...
and the build machine did indeed produce a new
I-build,
BUT my bundles do not show up on the download
page:
http://download.eclipse.org/tools/orbit/committers/drops/I200703150053/
actually,
they are not even listed in the map file
(CVS, GET) available from the
download page.
For me, it looks like the build machine only picked
up
the mapfile from the "set2" branch of the
org.eclipse.orbit.releng
project. But my bundles are
in build.feature.set1 so I released them to the
set1
branch (and that's where they originally were).
Should I go
ahead and release my bundles to the "set2"
branch of the releng project as
well? Or is the build
currently broken just taking the set2 branch? The
Wiki
http://wiki.eclipse.org/index.php/Orbit_Builds#Steps
says "Be sure
the map 'branch' is loaded in your workspace
that matches the name of the
feature, set1, set2, etc."
and that's what I did...
I'm confident
that my bundles are set up correctly, since
I can build them myself and use
them correctly. But I'm lost
with the Orbit build process. David or anyone
else, can you
help?
The previous
I-build
http://download.eclipse.org/tools/orbit/committers/drops/I200703110639/
had
many more components, with mapfiles from download page looking
like a
combination of both the "set1" and "set2" branches
of the releng project,
so I assume that there's indeed
something
broken...
Thanks,
--
Martin Oberhuber
Wind River
Systems, Inc.
Target Management Project Lead, DSDP PMC
Member
http://www.eclipse.org/dsdp/tm
> -----Original
Message-----
> From: orbit-dev-bounces@xxxxxxxxxxx
>
[mailto:orbit-dev-bounces@xxxxxxxxxxx] On Behalf Of DJ Houghton
> Sent:
Tuesday, March 13, 2007 10:10 PM
> To: Orbit Developer
discussion
> Subject: Re: [orbit-dev] Promoting I200703110639 to
'downloads'
>
> David,
>
> >From the call today
there are some changes in
> org.apache.commons.net that
> will be
happening this week before the promotion to a stable
build.
_______________________________________________
orbit-dev mailing
list
orbit-dev@xxxxxxxxxxx
https://dev.eclipse.org/mailman/listinfo/orbit-dev
_______________________________________________
orbit-dev
mailing
list
orbit-dev@xxxxxxxxxxx
https://dev.eclipse.org/mailman/listinfo/orbit-dev
_______________________________________________
orbit-dev mailing
list
orbit-dev@xxxxxxxxxxx
https://dev.eclipse.org/mailman/listinfo/orbit-dev