Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [ease-dev] Script signing example
Hi Christian,

We should change that as we want to store the signature to the file directly from the context menu. As sometimes a file might be read-only it is a good idea to have alternative locations to store signatures.

Do we need to append signature directly to the file to which it is getting applied? If so, won't user be able to manipulate it even unintentionally?

What I propose is:
  1. We store only signature to 'state location' of plugin so that user cannot directly access it. See [1] on stack overflow regarding state location.
  2. We provide a context menu 'Extract Signature' which will be active only when signature is present.
  3. Later on, user can chose to extract signature using 'Extract Signature' context menu to his preferred location.
  4. We can also provide user with an option to remove signature using context menu.


I have updated bug related to "Unable to access state location". Signature will now go to caller of wizard using instance of GetInfo class, in our case to PerformSignature handler class. See updated patch at [2].

[1]: http://stackoverflow.com/questions/37361643/save-file-info-for-processing-not-seen-by-user-in-eclipse 

[2]: https://git.eclipse.org/r/#/c/76997/


Thanks,


On Wed, Aug 3, 2016 at 12:41 PM, Christian Pontesegger <christian.pontesegger@xxxxxx> wrote:

Hi Varun,


created a keystore:

keytool -genkey -alias christian -keystore keystore.ease

Then I tried to sign a script with the alias 'christian' from that store. I went with the defaults: provider=SUN, algorithm=SHA256.

When clicking 'Finish' I end up with an error message: "Unable to access state location" and the dialog would not close.

Digging in the code you are trying to store the signature to a dedicated folder. We should change that as we want to store the signature to the file directly from the context menu. As sometimes a file might be read-only it is a good idea to have alternative locations to store signatures.
What about changing the wizard to not directly write the signature. Instead it should return the signature data and the caller of the wizard should decide where the signature should go to afterwards. When the file is writable, this would be the preferred location. A context menu on a workspace file should not do anything else.

Christian


On 07/31/2016 06:49 AM, Varun Raval wrote:
Hi Christian,

I have updated the patch [1].

One reason you might not be able to perform signature maybe the algorithm of private key. Since specific providers provide implementation of algorithms for e.g. SHA1withDSA by SUN, SHA1withRSA by SunRsaSign. I solved this issue.

Previously, I was taking SUN as default one. Now, in the update, if not selected explicitly on advanced page, it will try to chose preferred provider. Hence, for private key created for any algorithm like DSA or RSA, if provider combo box is not selected, it will iterate over all algorithms and chose preferred one.

In this case, it would be helpful to user if we provide "preferred" as an option so that once user has selected an algorithm, user can still let system make the choice of algorithm. I am saying this because, we previously agreed on showing specific types to user like "SUN" and not "Preferred" as default option.

Other reason might be that there are no alias with private key in provided keystore. jre/lib/security/cacerts is a kind of trust store that contains list of trusted certificates. These aliases are just certificates that contain public key. There is no alias with private key there by default.
Thanks,

On Sun, Jul 31, 2016 at 8:17 AM Varun Raval <vraval48@xxxxxxxxx> wrote:
Hi Christian,

Wherever you want to create a new keystore file, try this from terminal to make a new private key with name MYALIAS and place it in a new keystore with name KEYSTORE_NAME
          keytool -genkey -alias MYALIAS -keystore KEYSTORE_NAME

To list the current aliases in keystore
          keytool -list -keystore KEYSTORE_NAME


Generate a self-signed certificate file

keytool -export -alias MYALIAS -file certfile.cer -keystore KEYSTORE_NAME

To make a Certificate Signing Request(CSR) from existing JAVA Keystore

keytool -certreq -alias MYALIAS -keystore KEYSTORE_NAME -file MYALIAS.csr



Thanks,

On Sun, Jul 31, 2016 at 12:06 AM Christian Pontesegger <christian.pontesegger@xxxxxx> wrote:
Hi Varun,


could you provide a short totuorail how to create a keystore with a self
signed certificate that works with your current patchset? I was trying
out some settings but none of them worked so far.


thanks

Christian

_______________________________________________
ease-dev mailing list
ease-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/ease-dev
--
Varun Raval
--
Varun Raval


_______________________________________________
ease-dev mailing list
ease-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/ease-dev


_______________________________________________
ease-dev mailing list
ease-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/ease-dev

Back to the top