On 4/13/07, David Corbin <[EMAIL PROTECTED]> wrote:
On Friday 13 April 2007 09:35, Jerome Lacoste wrote:>
> Yes but there are two different problems:
>
> - the fact that the skip sign incorrectly skips unsigned plugins after a
> mistake
>
> - the fact that you want to avoid resigning jars. I know some people
> moved the signing out of the webstart process, probably to solve that
> issue. You can do so with the jar-signer mojo. Maybe that's what you
> should look at. Then we will need a way to say: sign those jars, not
> the others.
If we were to use jar:sign, I think we could create and install artifacts
(possibly with a classifier attached). ButI think it would still be
necessary to tell the webstart plugin that "here are some signed jar files
that you can use."
Yes.
> One way to do it would be to use a small signing application that sits
> in front of a maven repository.
The problem with this (if I understand it correctly) is that we don't want
signed jars unless they're going into the webstart app. It actually creates
problems with some tools.
by "in front ot a maven repository" I meant that the application signs
the jars by picking them from a repository and returns the jars to the
client code that can then do something with them. So you only create
them when you need them and you don't put them in your repository when
you don't need them. The signing application can provide the caching.
Look at the URLs I provided for more info.
Hope that helps :)
J
---------------------------------------------------------------------
To unsubscribe from this list please visit:
http://xircles.codehaus.org/manage_email
