| trusted bundles [message #102052] |
Thu, 29 November 2007 09:14  |
Eclipse User |
|
|
|
Originally posted by: dieter.schulten.d-velop.de
Hello *,
how to prevent unsigned bundles to be installed?
Any got a little code snippet?
best regards, dieter
|
|
|
| Re: trusted bundles [message #103357 is a reply to message #102052] |
Fri, 04 January 2008 19:07  |
 Christopher Butler
Messages: 1
Registered: July 2009 |
Junior Member |
|
|
Dieter,
I'm trying to do the same thing and have been gradually trying to step through
the concepts myself (coming at it from kind of an outsider perspective myself).
A couple things I've found in my research:
The Equinox Security project lists bundle signature checks as one of its
stated goals.
http://www.eclipse.org/equinox/incubator/security
http://wiki.eclipse.org/Trusted_Bundles
That said, I don't think this task has been formally started (I may be wrong,
if people are actively working on this, I would like to know what they are
up to and perhaps help).
I've found a very coarse means of keeping a bundle from loading is to write
an Adaptor Hook in an extension bundle with a Fragment-Host: org.eclipse.osgi.
You can create a HookConfigurator implementation, adding a BundleFileFactoryHook
to the hook registry. Within createBundleFile() in your hook, you can throw
an exception when some criteria isn't met (say, you find the bundle isn't
signed or verification fails)...I find this prevents a bundle from installing.
Of course, this is my n00b effort here and not without side-effects. I don't
know that BundleFileFactoryHook is actually the appropriate interface to
implement. And I find that while the bundle doesn't load, the plugin will
still try to contribute to the ExtensionRegistry (which will cause ClassNotFoundExceptions
since the bundle never actually installed successfully and its contributing
classes are unavailable).
There is also org.eclipse.osgi.internal.verifier.SignedBundleHook. It appears
to do some work with a trust engine and certificates, though to be honest
I would love to find more information on how to use this class myself. At
the very least, I can tell the property "osgi.support.signature.verify" needs
to be set to some valid value for this class to actually do much of anything...see
the following:
http://help.eclipse.org/stable/index.jsp?topic=/org.eclipse. platform.doc.isv/reference/misc/runtime-options.html
Finally, in conjunction with Equinox Security's trusted bundle goals, I find
the following in bugzilla:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=201420
The bug is currently assigned...I'm wondering myself if adaptor hooks are
the proper place for me to be looking on this issue (if anyone can point
me in the right direction, I would be happy to dig around more on this).
-chris
Hello Dieter,
> Hello *,
>
> how to prevent unsigned bundles to be installed?
> Any got a little code snippet?
> best regards, dieter
>
|
|
|
Powered by
FUDForum. Page generated in 0.03054 seconds
] 
Search
Help
Register
Login
Home
