Skip to main content

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [cross-project-issues-dev] Deprecating the command line JAR signing service (aka /usr/bin/sign) - read if you use Buckminster

I am not able to get the eclipse jarsigner maven plugin to work. I've made the this change to my pom, but I'm getting the following error:

ERROR] Plugin org.eclipse.cbi.maven.plugins:eclipse-jarsigner-plugin:1.1.5 or one of its dependencies could not be resolved: Failure to find org.eclipse.cbi.maven.plugins:eclipse-jarsigner-plugin:jar:1.1.5 in https://repo.eclipse.org/content/repositories/maven_central/ was cached in the local repository, resolution will not be reattempted until the update interval of eclipse.maven.central.mirror has elapsed or updates are forced -> [Help 1]

Could anyone tell me what I'm doing wrong?

Thanks,
Sam


--
Sam Davis
Senior Software Engineer, Tasktop
Committer, Eclipse Mylyn
http://tasktop.com

On Mon, May 28, 2018 at 11:59 AM, Sam Davis <sam.davis@xxxxxxxxxxx> wrote:
Hi,

Just a note that this change affects more projects than expected. It turns out that even though Mylyn is not using Buckminster, we are using /usr/bin/sign as part of an ant script run by our build.

Sam


--
Sam Davis
Senior Software Engineer, Tasktop
Committer, Eclipse Mylyn
http://tasktop.com

On Thu, Apr 12, 2018 at 2:47 AM, Mikaël Barbero <mikael.barbero@eclipse-foundation.org> wrote:
Hi,

A quick update about the termination date of the command line Jar signing service (aka /usr/bin/sign). 

With Oxygen.3a GA being available since yesterday, a grace period of 4 weeks is now starting before shutdown.

The termination date is set to May 9th.

Cheers,
Mikael

--
Mikaël Barbero - Eclipse Foundation
IT Services - Release Engineering
📱 (+33) 642 028 039
🐦 @mikbarbero

Le 22 août 2017 à 17:01, Mikaël Barbero <mikael.barbero@eclipse-foundation.org> a écrit :

Hi,

Effective immediately, we are deprecating the usage the command line signing service (aka /usr/bin/sign). 

Most certainly, this will only affect you if you use Buckminster as a build system (because Buckminster can only sign jars via /usr/bin/sign service). If you use Tycho, you're not concerned. 

There are two strategies for Buckminster users: 

1- Migrate to a modern / maintained build plugin system (see  Buckminster's activity - https://projects.eclipse.org/projects/tools.buckminster). See Tycho documentation (https://wiki.eclipse.org/Tycho/Pack200#Pack200_and_Signing) and CBI Jarsigner Maven plugin (https://www.eclipse.org/cbi/maven-plugins/documentation/latest/eclipse-jarsigner-plugin/sign-mojo.html) for how to add jar signing to a Tycho build. 

2- Deactivate signing in Buckminster and do the repacking and the signing phase as a post build step. You will need to do some shell scripting (in your CI instance) to browse all the jars, pack200/unpack200 them (aka repack) and then sign them. To sign a jar, you can use the webservice that the CBI maven plugin uses in the background (see the Jar signing web service documentation for details - https://wiki.eclipse.org/IT_Infrastructure_Doc#Web_service_.28Instant.29). 

If option 2 is chosen and highly motivated, we can provide some assistance with the shell script (fill a bug under CBI/Signing-Service https://bugs.eclipse.org/bugs/enter_bug.cgi?product=CBI&component=signing-service).

I've updated our documentation (https://wiki.eclipse.org/IT_Infrastructure_Doc#Deprecated_-_ZIP_and_JAR_files_from_the_command_line_.28queued_or_not.29) to mention the deprecation. A bug has been created to keep track of the termination (https://bugs.eclipse.org/bugs/show_bug.cgi?id=521263). 

Cheers,
Mikael


--
Mikaël Barbero - Eclipse Foundation
IT Services - Release Engineering
📱 (+33) 642 028 039
🐦 @mikbarbero



_______________________________________________
cross-project-issues-dev mailing list
cross-project-issues-dev@eclipse.org
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/cross-project-issues-dev



Back to the top