| Re: [tycho-user] Skipping Default Eclipse Digital Signature in generated product exe file |
|
Hi, It seems there is still a misunderstanding. The EXE file is NOT generated at build time by Tycho. It is already built and provided by
Eclipse via an update site. Other Tycho builds just consume the published executable.
From the documentation [1]: “The equinox launcher
comes in 3 pieces: the native executable (eclipse.exe), a shared library (eclipse_1017.dll) and the launcher jar (org.eclipse.equinox.launcher_1.0.0.jar). The executable lives in the root of the eclipse install. The shared library is in a platform specific
fragment (i.e. org.eclipse.equinox.launcher.win32.win32.x86). The shared library and the launcher jar live in the plugins directory.” The artifacts are available via Git [2]. IIRC the executables in the Eclipse p2 repo are signed since 4.13 according to this ticket [3]. Previously only the executables in the
products published by Eclipse (namely the Eclipse IDE) were signed, not the ones in the repository. Following the comments in the referenced ticket it was decided to sign the executables in the repository also, because unsigned executables cause issues in
current operating system versions. And as the executable is build and provided by Eclipse, it is now signed and sealed to ensure that nobody modifies it if it is consumed via Eclipse update sites. If you need an unsigned executable from 4.13 on, you probably will need to build the launcher [4] yourself. Then you can sign it with
a company signature afterwards. Not sure if the executable in [2] is already signed, but that should be easy to test. [1]
https://www.eclipse.org/equinox/documents/quickstart-framework.php [2]
https://git.eclipse.org/c/equinox/rt.equinox.binaries.git/tree/ [3]
https://bugs.eclipse.org/bugs/show_bug.cgi?id=548431 Mit freundlichen Grüßen / Best regards Von: tycho-user <tycho-user-bounces@xxxxxxxxxxx> Im Auftrag von
Jonah Graham Hello, I was wondering what progress you have made since you raised this same question in August[1]? As mentioned in the August conversation and associated bug[2], the signing is not
done by tycho, the input eclipse.exe is signed by Eclipse. FWIW, you (and no one outside of builds run on Eclipse Foundation servers) can sign anything with the Eclipse Foundation signature. You may find this SO q&a[3] useful, it is some info about removing a signature. Jonah On Mon, 1 Feb 2021 at 12:17, Sathish Kumar Maheshwaran (RBEI/EMT1) <SathishKumar.Maheswaran@xxxxxxxxxxxx> wrote:
|
