Notice: this Wiki will be going read only early in 2024 and edits will no longer be possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.
Difference between pages "Equinox" and "JAR Signing"
(Difference between pages)
| Line 1: | Line 1: | ||
| − | + | == Overview == | |
| + | We are working towards signing Eclipse builds for the 3.2 Callisto release. The goal of signing is to allow users to verify that the content they obtain from eclipse.org and subsequently execute does indeed come from that source. Signing in a nutshell works as follows: | ||
| − | [ | + | # Eclipse builds produce content in various forms (zips, update JARS) |
| + | # The Eclipse Foundation produces a signature of the build content using its private key (signature = private key + content) | ||
| + | # User downloads build content and signatures from eclipse.org or from mirrors | ||
| + | # The Eclipse Foundation makes available a [http://en.wikipedia.org/wiki/Public_key_infrastructure public key] for verifying signatures | ||
| + | # User consults some trusted authority to verify that the public key does indeed belong to the Eclipse Foundation | ||
| + | # Verification is performed on the user's machine (signature + public key = hash of content) | ||
| − | + | == Open problems == | |
| − | + | === What gets signed? === | |
| + | |||
| + | The two principal outputs from the build process are update site JARs and stand-alone zips. | ||
| + | |||
| + | ==== Signing stand-alone zips ==== | ||
| + | |||
| + | The problem with stand-alone zips is that there is no opportunity to perform verification at download time. The user would need to take a manual step to run verification on the zip before unzipping and using it. Note that signing only the JARs within the stand-alone zips is not sufficient verification. For example, the eclipse executable is not within a JAR, and a compromised executable would negate the value of any other signing. Possible approaches for signing stand-alone executables: | ||
| + | |||
| + | * Do nothing. If users want to obtain verifiable content, they must obtain it from an update site | ||
| + | * Sign only the JARs within the stand-alone zip. This has no authentication value in itself, but might be useful raw material for others in the community who want to tackle complete authentication of an Eclipse-based application | ||
| + | * Create a signature of the entire zip file, and make the signature available in a separate JAR file. The user would then have to perform verification manually | ||
| + | |||
| + | ==== Signing update site content ==== | ||
| + | |||
| + | Signing of content on Eclipse update sites is slightly easier. All executable content is contained in JAR files, so the traditional Java JAR signing mechanism can be used. | ||
| + | |||
| + | === How is signing done? === | ||
| + | |||
| + | === What public key (certificate) do we use? === | ||
| + | |||
| + | === Where are the signatures stored? === | ||
| + | |||
| + | === When does verification happen? === | ||
| + | |||
| + | |||
| + | == Miscellaneous links == | ||
| + | |||
| + | * [https://bugs.eclipse.org/bugs/show_bug.cgi?id=43889 Bundle signing bug report] | ||
| + | * [https://www.verisign.com/products-services/security-services/code-signing/digital-ids-code-signing/index.html Verisign code signing products] | ||
Revision as of 18:31, 27 February 2006
Contents
Overview
We are working towards signing Eclipse builds for the 3.2 Callisto release. The goal of signing is to allow users to verify that the content they obtain from eclipse.org and subsequently execute does indeed come from that source. Signing in a nutshell works as follows:
- Eclipse builds produce content in various forms (zips, update JARS)
- The Eclipse Foundation produces a signature of the build content using its private key (signature = private key + content)
- User downloads build content and signatures from eclipse.org or from mirrors
- The Eclipse Foundation makes available a public key for verifying signatures
- User consults some trusted authority to verify that the public key does indeed belong to the Eclipse Foundation
- Verification is performed on the user's machine (signature + public key = hash of content)
Open problems
What gets signed?
The two principal outputs from the build process are update site JARs and stand-alone zips.
Signing stand-alone zips
The problem with stand-alone zips is that there is no opportunity to perform verification at download time. The user would need to take a manual step to run verification on the zip before unzipping and using it. Note that signing only the JARs within the stand-alone zips is not sufficient verification. For example, the eclipse executable is not within a JAR, and a compromised executable would negate the value of any other signing. Possible approaches for signing stand-alone executables:
- Do nothing. If users want to obtain verifiable content, they must obtain it from an update site
- Sign only the JARs within the stand-alone zip. This has no authentication value in itself, but might be useful raw material for others in the community who want to tackle complete authentication of an Eclipse-based application
- Create a signature of the entire zip file, and make the signature available in a separate JAR file. The user would then have to perform verification manually
Signing update site content
Signing of content on Eclipse update sites is slightly easier. All executable content is contained in JAR files, so the traditional Java JAR signing mechanism can be used.