On Aug 21, 2007, at 2:50 PM, Scott Deboy wrote:
The ability to run the latest version of Chainsaw via Web Start is a
service our users have come to expect and value.
Taking away this service due to deployment/infrastructure issues isn't
an answer. If we need to, let's talk to infra@ and figure out a
way to
deal with this.
I understand ASF officially signing Chainsaw is a complicated
issue, but
it would be a disservice to our users to take this away - let's do the
hard work of working through it.
(I know I'm making assumptions that our users take advantage of this
feature. I know I do.)
Scott Deboy
There was a jar signing thread on [EMAIL PROTECTED] (http://mail-
archives.apache.org/mod_mbox/incubator-general/200708.mbox/%
[EMAIL PROTECTED]) already in progress about digitally
signing jars. The initial post has linked to describe how the
Eclipse Foundation digitally signs their jars. To do it right, it
would appear to require a purchased code signing key from Thwate,
Verisign or similar which would cost several hundred dollars a year
and secured hardware and a process to ensure that the code signing
key is only applied to legitimate code. The thread didn't seem to
reach any conclusions, but just seemed to die out.
There were two different issues in my response, the first was trying
to understand the technical issue that was motivating splitting the
receivers companion and the second was the general concern with
WebStart not fitting in with the ASF release process. I still don't
have my mind around the technical problem that is motivating the split.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
