csportal is not available for me, but these are two different things of signing. The gpg creates extra signature file, but webstart as typical webstart jar I know needs DSA or RSA signature inside jar file which can be accomplished by maven-jarsigner-plugin https://maven.apache.org/plugins/maven-jarsigner-plugin/usage.html You could open discussion in Users group.
On Mon, Oct 19, 2015 at 1:14 PM, Maxim Solodovnik [via Maven] < ml-node+s40175n5849695...@n5.nabble.com> wrote: > Now I'm a little bit scared :) > Our release process is documented here [1] > part "Step3 - Sign web start application" describes the current process of > signing jar files. (all current stable releases uses ant, dev releases are > using maven) > > > [1] http://openmeetings.apache.org/ReleaseGuide.html > > On Mon, Oct 19, 2015 at 4:58 PM, Tibor Digana <[hidden email] > <http:///user/SendEmail.jtp?type=node&node=5849695&i=0>> > wrote: > > > As I am reading your discussion, I am a little bit scared. > > Maxim you use your own ASK key? > > > > On Mon, Oct 19, 2015 at 8:02 AM, Maxim Solodovnik <[hidden email] > <http:///user/SendEmail.jtp?type=node&node=5849695&i=1>> > > wrote: > > > > > Hello Hervé, > > > > > > We are using "ASF key" to sign our webstart application, this way it > is > > > started without error in modern Java > > > Currently we are using lots of manual steps to sign necessary jars > using > > > ASF service > > > I thought maybe Maven can do it on my behalf :) > > > > > > On Sun, Oct 18, 2015 at 12:14 PM, Hervé BOUTEMY <[hidden email] > <http:///user/SendEmail.jtp?type=node&node=5849695&i=2>> > > > wrote: > > > > > > > Hi, > > > > > > > > Perhaps the "code signing" feature for jars should be explained, > since > > we > > > > already have maven-gpg-plugin [1] to sign code, that is used for > years > > > with > > > > great success. > > > > > > > > From what I read on ASF signing, it adds a feature for Windows > > > executables, > > > > that is checked by the OS at runtime and displayed to end-users. > > > > > > > > For jars, I don't see what we get better than gpg. > > > > What I suppose is that if a plugin is done, it will be an > > Apache-specific > > > > plugin: not same interest than doing a plugin for general public > use. > > > > > > > > What do you expect from this signing feature for jars? > > > > > > > > Regards, > > > > > > > > Hervé > > > > > > > > [1] http://maven.apache.org/plugins/maven-gpg-plugin/ > > > > > > > > Le jeudi 8 octobre 2015 12:26:57 Maxim Solodovnik a écrit : > > > > > Hello All, > > > > > > > > > > More than a year ago INFRA announce availability of code signing > at > > > > Apache: > > > > > > > > > https://blogs.apache.org/infra/entry/code_signing_service_now_available > > > > > > > > > > but still there is no maven plugin for doing that :( > > > > > I never wrote maven plugins and need more time to write "Hello > world" > > > > level > > > > > plugins before I can fix/create anything :) > > > > > > > > > > Maybe anyone is interested to write maven plugin so code can be > > signed > > > at > > > > > Apache? :) > > > > > > > > > > Thanks in advance! > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > To unsubscribe, e-mail: [hidden email] > <http:///user/SendEmail.jtp?type=node&node=5849695&i=3> > > > > For additional commands, e-mail: [hidden email] > <http:///user/SendEmail.jtp?type=node&node=5849695&i=4> > > > > > > > > > > > > > > > > > -- > > > WBR > > > Maxim aka solomax > > > > > > > > > > > -- > > Cheers > > Tibor > > > > > > -- > WBR > Maxim aka solomax > > > ------------------------------ > If you reply to this email, your message will be added to the discussion > below: > > http://maven.40175.n5.nabble.com/Maven-plugin-for-code-signing-Apache-tp5847816p5849695.html > To start a new topic under Maven Developers, email > ml-node+s40175n142166...@n5.nabble.com > To unsubscribe from Maven Developers, click here > <http://maven.40175.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=142166&code=dGlib3JkaWdhbmFAYXBhY2hlLm9yZ3wxNDIxNjZ8LTI4OTQ5MjEwMg==> > . > NAML > <http://maven.40175.n5.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml> > -- View this message in context: http://maven.40175.n5.nabble.com/Maven-plugin-for-code-signing-Apache-tp5847816p5849712.html Sent from the Maven Developers mailing list archive at Nabble.com.
