Re: [tycho-user] Block unsigned jar in eclipse RCP

[Guillaume Dufour <guillaume.duff@xxxxxxxxx>]

Sorry for this quick reply, but to be more specific. When i said overwrite, i mean, i don't want anybody change (open the jar and replace) a class for security reason.

On Thu, Oct 22, 2020 at 1:01 PM Guillaume Dufour <guillaume.duff@xxxxxxxxx> wrote:

Hello,

I want to block overwrite of some classes in an Eclipse RCP (OSGI) application. I sign all my jars but when i modify the SHA-256 in the manifest, the application start without problem.

As i see it's normal because OSGI don't check signature by default here : wiki.eclipse.org/JAR_Signing

Is it possible to force signature check on class loading in an Eclipse RCP on all jars or on some specific jars ?

If not, how could I protect on code overwrite in java eclipse RCP world ?

For information all my code is already obfuscated and jars are signed.

I already post this on stackoverflow but without any reply :

https://stackoverflow.com/questions/64459897/block-unsigned-jar-in-eclipse-rcp

Regards,

Guillaume