Re: [orbit-dev] [Hudson] Build failed in Hudson: orbit-recipes #35

["David M Williams" <david_williams@xxxxxxxxxx>]

As a general reminder, or comment, jars
can usually be signed more than once. I am assuming that applies to JCE
too? And "stripping a signature" is typically bad form. 
BUT, if signed more than once, it is
important not to re-condition for pack200. That will break the signature
for sure. 

Oh, I guess you said we already broke
the signature my removing some files. Sorry, forgot about that part. 
But, you still can not "condition"
the jar more than once (usually) unless you know exactly how it was done
the first time -- which VM was used, what options were used, etc. In such
cases it is typically not safe to apply the pack200 operation -- again,
unless you know exactly how it was conditioned. 

This case might be easier to solve if
you had the "original binary" from the "original project"
instead of getting the "processed" version deployed to maven
central. It would be a fair request to the original project to provide
that, if they do not. 

While it would not apply in this case,
in the old (current) PDE system, we had a "prebuilt" flag specially
for cases where we took the jar "as is" and did not do anything
to it, except sign it with Eclipse certificate. [We didn't do that much,
for the same complications as listed above]. But, it would be nice to have
 similar "flag" (profile, I assume?) in the new system.
Though, as stated, a well documented way on how to customize the pom would
work too. 

Good luck! 




From:      
 Gunnar Wagenknecht
<gunnar@xxxxxxxxxxxxxxx>
To:      
 Orbit Developer discussion
<orbit-dev@xxxxxxxxxxx>, 
Date:      
 02/29/2016 12:46 AM
Subject:    
   Re: [orbit-dev]
[Hudson] Build failed in Hudson: orbit-recipes #35
Sent by:    
   orbit-dev-bounces@xxxxxxxxxxx

---

Hi Matthias,

Thanks for the explanations. They were very helpful.

> Am 29.02.2016 um 00:05 schrieb Matthias Sohn <matthias.sohn@xxxxxxxxx>:
> 
> How could I skip eclipse-jarsigner for these artifacts ?


It looks like the pom would have to override the signing profile to not
execute signing. I'm not sure if that would work.

-Gunnar 

-- 
Gunnar Wagenknecht
gunnar@xxxxxxxxxxxxxxx, http://guw.io/
_______________________________________________
orbit-dev mailing list
orbit-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe
from this list, visit
https://dev.eclipse.org/mailman/listinfo/orbit-dev