Re: [tycho-user] Signing jars and P2

[Igor Fedorenko <igor@xxxxxxxxxxxxxx>]

Eclipse foundation certificate management approach is a bit
conservative, yes, but their reasoning is to protect the certificate
from "rogue" developers and compromised developer computers, which seems
reasonable, given they distributed and loosely controlled developer
audience. I am not security expert, however, so I don't know if there
are alternative less restrictive ways to manage signing certificates.

--
Regards,
Igor

On 11-09-03 9:15 AM, Benson Margulies wrote:
> > It is also possible to have solution specific to jarsigner plugin, which
> > I believe you suggest. This, however, will only work for one way of
> > singing jars and will not work for eclipse.org projects, for example,
> > which cannot use jarsigner plugin due to the way eclipse foundation
> > manages signing certificate(s).
>
> It is beginning to look as if ASF may end up with a signing discipline
> friendly to Tycho while Eclipse has none. Some might find this ironic.
>
> > --
> > Regards,
> > Igor
> >
> > On 11-09-02 7:24 AM, Benson Margulies wrote:
> > > I'm having a discussion at ASF about how we could set up a signature
> > > infrastructure, and I was hoping that Igor or someone could help me
> > > understand some parameters.
> > >
> > > Is it really required to sign the jars 'in the middle of the process'?
> > > If I left signing out of the picture, and made a P2 repository, can I
> > > then sign all the jars in plugins and features and achieve the desired
> > > result?
> > >
> > > Quite aside from the ASF, this to me suggests a slightly hackish
> > > alternative to the lifecycle problem: a new that is built by
> > > inheriting from the implementation of the jarsigner plugin. It's only
> > > purpose is to not be in the standard lifecycle, so that the tycho
> > > lifecycle could put it in the right place.
> > > _______________________________________________
> > > tycho-user mailing list
> > > tycho-user@xxxxxxxxxxx
> > > https://dev.eclipse.org/mailman/listinfo/tycho-user
> >
> > _______________________________________________
> > tycho-user mailing list
> > tycho-user@xxxxxxxxxxx
> > https://dev.eclipse.org/mailman/listinfo/tycho-user
> _______________________________________________
> tycho-user mailing list
> tycho-user@xxxxxxxxxxx
> https://dev.eclipse.org/mailman/listinfo/tycho-user