On 7/20/12 2 :34PM, "Om" <bigosma...@gmail.com> wrote:
>On Fri, Jul 20, 2012 at 7:50 AM, Nicholas Kwiatkowski ><nicho...@spoon.as>wrote: > >> It's not really apart of the release, so I don't think so, but we >>should be >> able to create another place for it to exist. >> >> BTW: Is the installer final? I'd like to post it on the website as well. >> >> -Nick >> >> >Here are the outstanding items for the installer. In the interest of >time, >it would be great if folks pick items from this list and get it done. > >1. Build auto-update mechanism (Om + Carol) release/version.xml is now being generated. You/someone needs to fix installer.url.win/installer.url.mac in build.properties. > >I would like help with these items: > >2. Use closer.cgi to automatically pick a download mirror. The app must >somehow get the preferred mirror url. The closer.cgi, ex: >http://www.apache.org/dyn/closer.cgi/incubator/flex/4.8.0-incubating/apach >e-flex-sdk-4.8.0-incubating-src.zipreturns >a html which contains a link to a preferred mirror. We should >probably parse the html in the app to grab the preferred url? Anyone >knows >of a better approach? The documentation is here: >http://www.apache.org/dev/mirrors.html > >3. Signing the binaries the Apache way. I was hoping to learn the >process, but if Carol can do it for this release, that would be great. In >any case, I dont have access to a Mac, and I dont think I should be >signing >artifacts that I personally did not generate. I can do this when it is time. > >4. The installer app needs to programatically verify the downloaded flex >binaries' signatures. I have very little experience with crypto >algorithms. Can someone take this up? Even if someone can explain the >steps to do this, I can get it done. Are you going to check the signature (.asc) or the checksum (.md5)? I'm sure the later is much easier. > >5. Signing the binaries the Adobe AIR way. This process will allow us to >have Apache Flex (or ASF) as the publisher ID in the installer. This >makes >the installer app look more reliable for end users. >I am engaged in a discussion about this process in the @infra-dev list. I >am not sure when this might be set up for us. I dont think we can afford >to delay the release of the app for this feature. Or should we wait? > >Thanks, >Om
