Hi. It seems (as usual) that the discussion has died out, and nobody does anything (my apologies in advance I am wrong, I would very much like to be wrong).
Digital signing was and is a major theme for AOO. In fact AOO and Tomcat was to be the 2 start/test applications for Apache. Infra has invested quite an amount of money into getting this to happen and a big amount of that expires relative soon (Apache has a slot of signings available for 12 month). Tomcat has now for a while signed releases, we (or more correctly the PMC) has received a signing certificate....so it is without doubt 100% upto us when we start (as far as I know we have not even done test signing, except for my experiments). I am sure the board of apache will heavely reduce the budget for digitial signing for the year to come, unless we put action behind the pressure we created. My suggestion is simple, lets rerun AOO 4.1 for windows, sign it digitally, and then release it as a patch version. I am happy to help, especially with the signing, but to help I need access to the certificate given to the PMC, and somebody who can make a release windows build. Steps are simple: 1) make a full build, pick all DLL, JAR and EXE from the object tree 2) Sign them, or let me help with that 3) Overwrite the object tree with the signed artifacts 4) run build but on postprocess (generate new setup package) 5) Sign the installer or let me help with that 6) Upload and start vote 7) Upload to dist and be happy. What is stopping us from doing something that simple ? If we want a 4.2 so much better, but lets do the simple things first. And please lets not cloud this simple step, by missing buildbots etc. just my opinion. rgds jan i.
