[tycho-user] Block unsigned jar in eclipse RCP

[Guillaume Dufour <guillaume.duff@xxxxxxxxx>]

Hello,

I want to block overwrite of some classes in an Eclipse RCP (OSGI) application. I sign all my jars but when i modify the SHA-256 in the manifest, the application start without problem.

As i see it's normal because OSGI don't check signature by default here : wiki.eclipse.org/JAR_Signing

Is it possible to force signature check on class loading in an Eclipse RCP on all jars or on some specific jars ?

If not, how could I protect on code overwrite in java eclipse RCP world ?

For information all my code is already obfuscated and jars are signed.

I already post this on stackoverflow but without any reply :

https://stackoverflow.com/questions/64459897/block-unsigned-jar-in-eclipse-rcp

Regards,

Guillaume