[dsdp-tm-dev] Re: TM 2.0.1 milestone update site is not yet signed

[Martin Oberhuber <martin.oberhuber@xxxxxxxxxxxxx>]

Hi Xuan,

Eclipse foundation has a digital certificate which we can use to
digitally sign our Jars. This is done for the jars on the update
site specifically, such that users can trust they get the original
jars.

Not all Eclipse projects sign their Jars; EMF signs none, for
instance, and Platform signs both their Downloads and their
update site. You can check in Help : About : Plug-in details,
the leftmost column shows if a plugin is signed. We currently
sign the update site only, but not our downloads, since it is
not part of our build process yet; but I do want to sign downloads
as well in the future.

Unfortunately, although a signed plugin should work exactly
the same as an unsigned one, signed plugins have led to
problems in the past, especially when they were also compressed
with pack200 for update manager to use less bandwidth. UM
would think that the Jar were corrupted even if it was not.
So it's not a total no-brainer, and once our update site is
signed I need to test whether it works properly, before I
declare the release.

To answer your specific question, downloads are not going
to be affected, though I might prepare a SECOND download
location which holds signed variants of our downloads.

If there are any more questions just let me know...

Xuan Chen schrieb:
> Sorry, I am not familar with this process.
>
> What does it mean that "milestone update site is not yet signed"?  Is 
> it only for the case where people want to download it using update 
> manager?  
>
> Thanks,
>
> Xuan Chen,  Problem Determination Tools for iSeries
> (905) 413-3769 T/L 969-3769
> xuanchen@xxxxxxxxxx
>
>
>
>
> *"Oberhuber, Martin" <Martin.Oberhuber@xxxxxxxxxxxxx>*
>
> 09/27/2007 12:53 PM
>
> 	
> To
> 	"Target Management developer discussions" <dsdp-tm-dev@xxxxxxxxxxx>, 
> David McKnight/Toronto/IBM@IBMCA, "David Dykstal" 
> <david_dykstal@xxxxxxxxxx>, Xuan Chen/Toronto/IBM@IBMCA
> cc
> 	
> Subject
> 	TM 2.0.1 milestone update site is not yet signed
>
>
>
> 	
>
>
>
>
>
> Hi all,
>
> I just noticed that due to a missing directory
> on build.eclipse.org, the TM 2.0.1 milestone
> update site is not yet signed.
>
> I hope to fix this in the next hours.
>
> Cheers,
> --
> Martin Oberhuber
> Wind River Systems, Inc.
> Target Management Project Lead, DSDP PMC Member
> http://www.eclipse.org/dsdp/tm


--
Martin Oberhuber
Wind River Systems, Inc.
Target Management Project Lead, DSDP PMC Member
http://www.eclipse.org/dsdp/tm