Skip to main content

Notice: this Wiki will be going read only early in 2024 and edits will no longer be possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.

Jump to: navigation, search

Difference between pages "Polish3.2" and "JAR Signing"

(Difference between pages)
 
m
 
Line 1: Line 1:
<h1>3.2 Polish Items<br>
+
== Overview ==
</h1>
+
We are working towards signing Eclipse builds for the 3.2 Callisto release. The goal of signing is to allow users to verify that the content they obtain from eclipse.org and subsequently execute does indeed come from that source. Signing in a nutshell works as follows:
<p><small><i>Last update: March 15, 2006 (Changes since March 13, 2006 in <font
+
  color="#33cc00"><b>green</b></font>. New entries in Team and JDT UI)</i><br>
+
  </small></p>
+
<p><font color="#00FF00"><strong><em>New additions in green.</em></strong></font></p>
+
<p><strong><font color="#FF0000">Entries in RED have been fixed.</font></strong></p>
+
<p><strong><font color="#0000FF">Entries in BLUE are not in the plan for 3.2</font></strong></p>
+
<p><small><br>
+
  </small> So far, I have received input from the Search, Platform/JDT Text, JDT
+
  Core, JDT UI, and Debug teams. This document contains a summary of that feedback.
+
  The items are listed by component, but are otherwise in no particular order.
+
  <br>
+
</p>
+
<h2>General / All</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
 
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%"></td>
+
      <td>Do we need a new splash screen? <em><strong><font color="#0000FF">MVM asked designers to investigate in light of new welcome as well.  No significant changes planned here</font></strong></em></td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%"></td>
+
      <td>Update keywords for searching preference pages. I.e. verify that all the new preferences are covered.</td>
+
    </tr>
+
</table>
+
<br>
+
<h2>Platform Runtime</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=128178 128178]</td>
+
      <td>[Workbench] earlyStartup does not work in runtime eclipse with binary-imported plugins</td>
+
    </tr>
+
</table>
+
  
<h2>Platform Compare</h2>
+
# Eclipse builds produce content in various forms (zips, update JARS)
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
# The Eclipse Foundation produces a signature of the build content using its private key (signature = private key + content)
    <tr>
+
# User downloads build content and signatures from eclipse.org or from mirrors
      <th width="10%">Bugzilla</th>
+
# The Eclipse Foundation makes available a [http://en.wikipedia.org/wiki/Public_key_infrastructure public key] for verifying signatures
      <th>Description</th>
+
# User consults some trusted authority to verify that the public key does indeed belong to the Eclipse Foundation
    </tr>
+
# Verification is performed on the user's machine (signature + public key = hash of content)
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=78063 78063]</td>
+
      <td>Full Javadoc line selected even though only a character has been added to a word</td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=68758 68758]
+
      </td>
+
      <td>Structured Compare: selected added element not part of selection</td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=128362 128362]</td>
+
      <td>[Patch] Creating patch from compare in between versions/revisions</td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=118021 118021]</td>
+
      <td>Structured compare not available with additions or deletions</td>
+
    </tr>
+
    <tr>
+
      <td><p> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=112661 <font color="#00FF00">112661</font>]
+
          (bugs logged by mvm previously)</p>
+
        <p><font color="#00FF00"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=132693 132693]</font></p></td>
+
      <td>Cleanup UI of Create/Apply Patch wizards (follow Eclipse UI guidelines):<br>
+
      <ul>
+
        <li>button sizes</li>
+
        <li>caption</li>
+
        <li>margins</li>
+
        <li>mnemonics (missing)</li>
+
        <li>polish all descriptions and messages</li>
+
        <li>Match Project... button launches dialog called Retarget
+
        Patch (inconsistent)</li>
+
      </ul>
+
      </td>
+
    </tr>
+
 
+
</table>
+
<br>
+
<ul></ul>
+
<h2>Platform CVS</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%"><strong><font color="#FF0000">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=112927 112927]</font></strong></td>
+
      <td><strong><font color="#FF0000">[performance] Update CVS workspace job takes too long</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td>See also " [#too_may_password">too many passwords]" in the Platform UI section below.</td>
+
    </tr>
+
</table>
+
<br>
+
<h2>Platform Help</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%"></td>
+
      <td>New help support should be improved (2 votes):<br>
+
      <ul>
+
        <li>Help button should be on the side where the help shows up. Should stay pushed, and a release should close the help view again</li>
+
        <li>dialogs without help should better not get the help button</li>
+
        <li>clicking on a link should directly open the help browser as the space next to the dialog is always too small</li>
+
      </ul>
+
      </td>
+
    </tr>
+
 
+
</table>
+
<br>
+
<h2>Platform SWT</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=95634 95634]</td>
+
      <td>[Tree] TreeColumn does not show "..." on cut-off Text and misses tooltips</td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%"></td>
+
      <td>I know I'm dreaming, but: styled ranges inside a tree item (Font/colors etc for e.g. a word inside the full label) would be a boost</td>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=125702 125702]</td>
+
      <td><font color="#000000">If you collapse a tree on a recent version of GTK+, a big block of whitespace appears at the bottom. It's very irritating.</font></td>
+
    </tr>
+
    <tr>
+
      <td align="right"><p> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=123425 123425]</p>
+
        <p> [https://bugs.freedesktop.org/show_bug.cgi?id=5200 5200]</p></td>
+
      <td><font color="#000000">There's also the &quot;festival of carets&quot; bug. This is immediately noticeable to        anyone using a recent GTK+, and it makes us look bad. Unfortunately, it appears to be a bug somewhere in the Cairo/Pango/glib/GTK+ stack specific to the FPU mode (which the Java VM modifies on start-up). This bug is bad and will be hard to track down. We need to do work if we want to see this fixed; we can't just say &quot;It's their problem&quot;.</font></td>
+
    </tr>
+
    <tr>
+
      <td align="right"></td>
+
      <td>&nbsp;</td>
+
    </tr>
+
    <tr>
+
      <td align="right"></td>
+
      <td>&nbsp;</td>
+
    </tr>
+
 
+
</table>
+
<br>
+
<h2>Platform Team</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
 
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td>Need a general polish pass on new History view filtering and user interactions. The bugs below are examples...</td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=125860 125860]</td>
+
      <td><font color="#FF0000"><strong>New history view: filter is not persisted - no way to constantly ignore local history</strong></font></td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=129916 129916]</td>
+
      <td><font color="#FF0000"><strong>Per date sorting in History view forced on me upon ever input change</strong></font></td>
+
    </tr>
+
    <tr>
+
      <td align="right">&nbsp;</td>
+
      <td><p><font color="#00FF00"><strong>MOVED FROM UI</strong></font></p>
+
        <p>There are sometimes <a name="too_may_password">]too many password dialogs:<br>
+
        </p>
+
        <ul>
+
          <li>If I'm trying to work off-line but have CVS projects in workspace, it can happen that you get lots of dialogs to ask for the password as the CVS decorators each need that password. Clicking cancel once should be enough to let them know that I'm not interested in entering the password now.</li>
+
          <li>It would be nice to have a less intrusive way of asking for passwords. Idea is e.g. a status line icon similar to the progress view that blinks when a passwords are pending. Clicking on this icon brings a 'authentication view' that shows that status of all passwords: passed, failed, canceled, and lets me trying to connect again.</li>
+
        </ul></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=130408 130408]</td>
+
      <td><font color="#FF0000"><strong>Should be able to export psfs to the workspace
+
        (2 votes)</strong></font></td>
+
    </tr>
+
 
+
</table>
+
<br>
+
<h2>Platform Text</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
 
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=11624 11624]</td>
+
      <td><strong><font color="#0000FF">Text Drag and Drop (has many bug votes)</font></strong><br>
+
      <ul>
+
        <li>depends on StyledText support ([https://bugs.eclipse.org/bugs/show_bug.cgi?id=106372 NEW - Provide DND support for the StyledText widget 106372]),
+
        which is now marked as FIXED.</li>
+
      </ul>
+
      <p>In order to resolve this we first need to put the grounds for drag and drop contributions
+
      to editors, otherwise clients contributing some sort of DnD will get broken.
+
      This is covered in [https://bugs.eclipse.org/bugs/show_bug.cgi?id=125957 bug 125957] and won't make it into 3.2.</p></td>
+
    </tr>
+
</table>
+
<br>
+
  
<h2>Platform UI</h2>
+
== Signing ==
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
 
+
    <tr>
+
      <th width="12%">Bugzilla</th>
+
      <th width="88%">Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=119890 119890]</td>
+
      <td> <p><strong><font color="#0000FF">[ViewMgmt] Allow control of view tab compression
+
          </font></strong></p>
+
        <p><font color="#000000">- this was changed in 3.2 and need to decide if we like it</font></p></td>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=100993 100993]</td>
+
      <td><font color="#000000">[EditorMgmt][Presentations] Regression: Editor tabs do not remember order or active tab after restarting Eclipse</font>
+
      <p><strong><font color="#00FF00">Investigating</font></strong></p></td>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=128455 128455]</td>
+
      <td> <strong><font color="#FF0000">[Presentation] [ViewBar] Outline view toolbar is visible above a maximized editor</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=131559 131559]</td>
+
      <td> <font color="#FF0000"><strong>[Markers] Layout of marker filters dialog</strong></font></td>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=129936 129936]</td>
+
      <td><strong><font color="#0000FF">[ViewMgmt] View part description label should wrap</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=125691 125691]</td>
+
      <td> <font color="#0000FF">[ViewMgmt] Can't read view titles</font></td>
+
    </tr>
+
    <tr>
+
      <td height="38" align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=68684 68684]</td>
+
      <td><strong><font color="#0000FF"><strong>Remove MRU Ordering from the editors.</strong></font></td>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=113455 113455]</td>
+
      <td><strong><font color="#FF0000">Some errors do not appear in the Problems view. This happens very frequently for me (multi-processor box, GTK+) if I have grouping turned on.</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=130818 130818]</td>
+
      <td><strong><font color="#FF0000">Filters do not seem to apply when grouping by Java type (Problems view).<br>
+
        </font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">&nbsp;</td>
+
      <td>&nbsp;</td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="12%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=126155 126155]</td>
+
      <td><font color="#FF0000"><strong>[Markers] Issues of multi quick fix dialog</strong></font></td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="12%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=122639 122639]</td>
+
      <td>[WorkbenchParts] PageBookView's toolbar doesn't properly re-layout after page switching
+
          <p><strong><font color="#00FF00">Will investigate if time permits.</font></strong></p></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=128670 128670]</td>
+
      <td><font color="#FF0000"><strong>[Dialogs] StatusDialog adds 2 horizontal margins around button bar</strong></font></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=127629 127629]</td>
+
      <td><font color="#FF0000"><strong>[Markers] problems view: keep selection stable</strong></font></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=128381 128381], [https://bugs.eclipse.org/bugs/show_bug.cgi?id=128381 128381]</td>
+
      <td><strong><font color="#FF0000">[Markers] group should only show (10 of 10 items) if beyond the limit</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=129812 129812]</td>
+
      <td><strong><font color="#FF0000">[Markers] Enabling problem categorization per default</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=129184 129184]</td>
+
      <td><strong><font color="#FF0000">Progress view should be made more prominent</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=127289 127289]</td>
+
      <td><strong><font color="#FF0000">[Markers] SystemFilter and group selection
+
        state not preserved</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right"><strong><font color="#0000FF">see suggestions in bug [https://bugs.eclipse.org/bugs/show_bug.cgi?id=109998 109998]</font></strong></td>
+
      <td><strong><font color="#0000FF">Experimental (?) Keys preference page (3 votes):<br> <ul>
+
          <li>what do we do with the two pages?</li>
+
          <li>sorting by keys, by commands and by scope [https://bugs.eclipse.org/bugs/show_bug.cgi?id=109998 109998]</li>
+
          <li>see which keys are free and which commands are not used</li>
+
          <li>Platform UI team is investigating what can/can not be done about this without Doug around</li>
+
        </ul></font></strong></td>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td>Finish the preferences clean up effort from 3.0:<br>
+
        <ul>
+
          <li><strong><font color="#FF0000">decorator preference pages should offer a link to decorators</li>
+
          <li>font / color preferences should use shared settings so it is also possible to configure the color and font decoration for CVS on the CVS page</font></strong></li>
+
          <li><strong><font color="#00FF00">UI - please provide a bug for this so we can track polish</font></strong></li>
+
        </ul></td>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td><strong><font color="#0000FF">Improve the look of the filter control (preferences, other dialogs):<br>
+
        <ul>
+
          <li>the text field seems unaligned as long as there is no 'clear' button</li>
+
          <li>either dump the 'clear' button, or add it as a lay-over over the text field:</li>
+
          <ul>
+
            <li>For example,&nbsp;in Thunderbird (mozilla mail client), they added a magnifying glass inside the text field (Good visual indication what this field is about) and the clear button ('x', is IMO a better icon than what we have) is inside the text field when applicable. Even better is the help text&nbsp;in light gray.</li>
+
            <li><strong><font color="#00FF00">UI - please provide a bug for this so we
+
              can track polish</font></strong></li>
+
          </ul>
+
        </ul></font></strong></td>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td><p>The fast view icon looks like a bug, as the lower right corner is missing. For all the icons on the fast view bar, it isn't obvious what they do. They should be more "inviting" to click on. Maybe some extra adornment in the icon like an arrow that points in the direction they will open. The tooltip should also show the keyboard shortcut.</p>
+
        <p><strong><font color="#FF0000">New icon is being requested, no other
+
          work decided at this point</font></strong></p>
+
        <p><strong><font color="#00FF00">UI - please provide a bug for this so we can
+
          track polish</font></strong></p></td>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td>&nbsp;</td>
+
    </tr>
+
</table>
+
  
<h2>JDT Core</h2>
+
=== What gets signed? ===
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
 
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=108087 108087]</td>
+
      <td><strong><font color="#FF0000">Java conventions default formatter settings
+
        confused</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=118217 118217]</td>
+
      <td><p>Change 'unused parameters' warning to only work on private or final methods to avoid false positives.</p></td>
+
    </tr>
+
 
+
</table>
+
  
 +
By default, every JAR pushed to an update site will be signed.  This includes JARs nested at arbitrary depth within other JARs. Some JARs may be excluded if there are technical or legal reasons why they cannot be signed.  In standalone zip distribtions, all JARed plugins will be signed, and un-JARed plugins will not be signed.
  
 +
=== How is signing done? ===
  
<h2>JDT Debug</h2>
+
Signing is performed using the JDK's [http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html jarsigner]. This tool signs JARs by producing a separate signature for every file in the JAR.  The signatures are put in the MANIFEST.MF file and in a separate signature file in the META-INF directory. For optimization purposes, the signature of the MANIFEST.MF with all embedded signatures is also computed and placed in the signature file.
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
 
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%"><strong><font color="#0000FF"> [https://bugs.eclipse.org/bugs/show_bug.cgi?id=128074 128074]</font></strong></td>
+
      <td><strong><font color="#0000FF">Cannot format stack trace</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=123589 123589]</td>
+
      <td>Unexpected switch to empty editor when using scrapbook</td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=123588 123588]</td>
+
      <td>Loosing key binding in scrapbook page</td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=130534 130534]</td>
+
      <td><strong><font color="#FF0000">add a "collapse all" to the tree's toolbar</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=128558 128558]</td>
+
      <td>support variables in port and host fields of Remote Java Applications</td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=77125 77125]</td>
+
      <td><strong><font color="#FF0000">preference for determing how Java breakpoints
+
        are created - to suspend thread or entire VM</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=125768 125768]</td>
+
      <td>Support to display breakpoints in rulers of external edtiors:<br> <ul>
+
          <li>ideally, there would be support for markers in external files from text/platform, but we might be able to do something here <i><b>(not sure how much work this is)</b></i></li>
+
          <li>since we support breakpoints in external files, and the editor now supports a ruler in external files, we really should make the two work together</li>
+
        </ul></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=80746 80746]</td>
+
      <td><font color="#0000FF"><strong>filter exceptions in anonymous classes of X when filtered on X</strong></font></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=89474 89474]</td>
+
      <td><strong><font color="#FF0000">support to edit attributes of multiple archives at once</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=110837 110837]</td>
+
      <td><strong><font color="#FF0000">properly specify bootpath when launching to avoid problems with crypto applications</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td>Columns in Variables/Registers view:<br>
+
        <ul>
+
          <li>We've added support to the debug platform for columns in debug views</li>
+
          <li>We want to add support for columns in the java debugger as an optional presentation (we've started this already)</li>
+
          <li><font color="#00FF00">DEBUG - please provide a bug for this so we can track polish</font></li>
+
        </ul></td>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td>Undo/Redo:<br>
+
        <ul>
+
          <li>We don't currently support undo/redo in the Scrapbook or Display view, which has made a few users angry</li>
+
          <li><font color="#00FF00">DEBUG - please provide a bug for this so we can track polish</font></li>
+
        </ul></td>
+
    </tr>
+
</table>
+
<br>
+
<h2>JDT Text</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
 
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=95619 95619]</td>
+
      <td><strong><font color="#FF0000">[5.0][content assist] Function parameter assist does not work with some parameterized types</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=92371 92371]</td>
+
      <td><strong><font color="#FF0000">[content assist] Parameter guessing could also propose
+
      expressions for parameters of array types</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=41189 41189]</td>
+
      <td><strong><font color="#FF0000">[hovering] Editor tooltip size too small
+
        for title text (3 votes)</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=125677 125677]</td>
+
      <td><strong><font color="#FF0000">[navigation] @category not standing out enough in Java Outline view</font></strong></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=91500 91500]</td>
+
      <td><strong><font color="#FF0000">Improve the NLS tooling, especially existing hover and linking features to Eclipse string externalization support (2 votes)</font></strong></td>
+
    </tr>
+
 
+
</table>
+
<h2>JDT UI</h2>
+
<table border="1" cellpadding="2" cellspacing="2" width="100%">
+
    <tr>
+
      <th width="10%">Bugzilla</th>
+
      <th>Description</th>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=129929 129929]</td>
+
      <td>IDE no longer responsive when JUnit tests are running</td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=129925 129925]</td>
+
      <td>[JUnit view] Hierarchical+failures should not show more than just failures</td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=130106 130106]</td>
+
      <td><font color="#FF0000">[junit] Hierarchical mode sometimes show testcase in progress
+
      and sometimes not</font></td>
+
    </tr>
+
    <tr>
+
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=130107 130107]</td>
+
      <td><font color="#FF0000">[junit view] Hierarchical mode not properly rebuilding the
+
      tree</font></td>
+
    </tr>
+
    <tr>
+
      <td align="right" width="10%">
+
        <p>[https://bugs.eclipse.org/bugs/show_bug.cgi?id=136572 136572]</p>
+
        <p>[https://bugs.eclipse.org/bugs/show_bug.cgi?id=134078 134078]</p>
+
        <p>[https://bugs.eclipse.org/bugs/show_bug.cgi?id=134305 134305]</p>
+
      </td>
+
      <td>Polish the Clean Up support (2 votes):<br>
+
        <ul>
+
          <li><font color="#FF0000">Clean Up with focus on current file forces me to save other resources? This is particularly annoying when the resource is a text scratch file.</font></li>
+
          <li><font color="#0000FF">Clean Up should also offer to format the code.</font></li>
+
          <li><font color="#FF0000">The wizard needs polish.</font></li>
+
        </ul>
+
      </td>
+
    </tr>
+
    <tr>
+
      <td></td>
+
      <td><p><font color="#0000FF">New Java Perspective (old one becomes the 'Classic Java Perspective')</font></p>
+
        </td>
+
    </tr>
+
    <tr>
+
  
      <td align="right" width="10%">
+
=== Where is signing done? ===
        <p>[https://bugs.eclipse.org/bugs/show_bug.cgi?id=119259 119259]</p>
+
 
      </td>
+
A critical part of the security behind signing is that the private keys used to produce the signatures are held in a secure location and never transmitted or accessible via a network. To accomplish this, the signing must be done on a secure machine that has access to the private key.  The Eclipse Foundation has set up a machine with a signing script.  The build will upload content to be signed to this machine, and a script is run to perform the signing.  Access to this machine will be given to trusted parties that want to perform signing.
      <td><font color="#FF0000">provide a way to get fully qualified class name into clipboard
+
 
      </font></td>
+
=== When is signing done? ===
    </tr>
+
 
    <tr>
+
Signing will be done as part of the build process.  Because this adds a significant amount of time to the build process, the releng team is investigating streamlining the build process.  The process of producing a signed build is:
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=108256 108256]</td>
+
 
      <td><font color="#FF0000">[refactoring] [ltk] Refactoring preview does not correctly highlight 5.0 code [refactoring]</font></td>
+
# Checkout source from eclipse.org CVS repositories to build machine
    </tr>
+
# Run build and produce a single ZIP of all plugins in update site form (all plugins in JARs)
    <tr>
+
# Send build output to eclipse.org for signing
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=122527 122527]</td>
+
# Send signed build to update site
      <td><font color="#0000FF">[build path] Offer a SWT container in JDT</font></td>
+
# Copy zip of signed JARs back to the build machine, and package standalone zips
    </tr>
+
# Copy standalone zips to test machines for automated testing
    <tr>
+
 
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=135279 135279]</td>
+
Currently the Eclipse project build machine is located remote from the Eclipse Foundation servers.  This means the Eclipse source has to be transferred across the Internet, and the build output needs to be transferred back to Foundation machines for signing.  These two major network bottlenecks could be removed by also using Eclipse Foundation machines for building.
      <td><font color="#FF0000">[refactoring] improve order of refactoring actions</font></td>
+
 
    </tr>
+
=== What public key (certificate) do we use? ===
    <tr>
+
 
      <td align="right">[https://bugs.eclipse.org/bugs/show_bug.cgi?id=135285 135285]</td>
+
The Eclipse Foundation [https://bugs.eclipse.org/bugs/show_bug.cgi?id=130943 has purchased] a signing certificate from Verisign.  Content made available on Eclipse.org will be signed with the foundation certificate.  Note this doesn't preclude other parties from later signing the JARs with their own certificates.
      <td><font color="#FF0000">[source actions] improve order of source actions</font></td>
+
 
    </tr>
+
=== Where are the signatures stored? ===
</table>
+
 
 +
The signatures are stored in the JAR file, both in the MANIFEST.MF, and in a separate signature file (currently Eclipse_.sf).
 +
 
 +
== Verification ==
 +
 
 +
=== When does verification happen? ===
 +
 
 +
Verification can happen any time.  The common times to perform verification are:
 +
* During update.  Minimally, verification happens at the time the client obtains the signed content.  The Eclipse update mechanism will perform verification of any update JARs that are signed, and will prompt the user for confirmation if the certificate used for signing is not trusted. 
 +
* At load-time.  It is sometimes desirable to perform verification at load time when classes are loaded from a JAR.  The default Java class loader performs this verification automatically for any signed JAR on the classpath.  The Eclipse class loader can also be configured to perform load-time verification, but it is optional.
 +
* Manual user verification.  The Eclipse about dialog will be augmented to show what plugins are signed.  From this dialog the user should be able to manually perform verification of signed content if desired.
 +
 
 +
== Miscellaneous links ==
 +
 
 +
=== Eclipse Bugzilla reports ===
 +
 
 +
{|
 +
|-
 +
! Done || Description
 +
|-
 +
|
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=43889 OSGi Bundle signing bug report]
 +
|-
 +
|
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=78208 Runtime signing support]
 +
|-
 +
|
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=94461 Signing indicator in About dialog]
 +
|-
 +
| [[Image:check.gif]]
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=130943 Purchasing signing certificates]
 +
|-
 +
|
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=132046 Signing script to signal completion]
 +
|-
 +
|
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=132048 Starting signing immediately after signing script is called]
 +
|-
 +
| [[Image:check.gif]]
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=134264 Bug for installing Java 1.5 on signing server]
 +
|-
 +
|
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=135044 Bug for installing Improved signing/packing application on signing server]
 +
|-
 +
|
 +
| [https://bugs.eclipse.org/bugs/show_bug.cgi?id=130383 Bug for using OSGi verification during update]
 +
|}
 +
 
 +
=== Other signing links ===
 +
 
 +
* [https://www.verisign.com/products-services/security-services/code-signing/digital-ids-code-signing/index.html Verisign code signing products]  
 +
* [http://java.sun.com/j2se/1.5.0/docs/guide/security/time-of-signing.html Sun docs on timestamps in signatures]
 +
* [http://opentsa.org/ Web site of open source time stamp protocol implementation]
 +
* [http://www.digistamp.com/ Time stamping service]

Revision as of 13:13, 20 April 2006

Overview

We are working towards signing Eclipse builds for the 3.2 Callisto release. The goal of signing is to allow users to verify that the content they obtain from eclipse.org and subsequently execute does indeed come from that source. Signing in a nutshell works as follows:

  1. Eclipse builds produce content in various forms (zips, update JARS)
  2. The Eclipse Foundation produces a signature of the build content using its private key (signature = private key + content)
  3. User downloads build content and signatures from eclipse.org or from mirrors
  4. The Eclipse Foundation makes available a public key for verifying signatures
  5. User consults some trusted authority to verify that the public key does indeed belong to the Eclipse Foundation
  6. Verification is performed on the user's machine (signature + public key = hash of content)

Signing

What gets signed?

By default, every JAR pushed to an update site will be signed. This includes JARs nested at arbitrary depth within other JARs. Some JARs may be excluded if there are technical or legal reasons why they cannot be signed. In standalone zip distribtions, all JARed plugins will be signed, and un-JARed plugins will not be signed.

How is signing done?

Signing is performed using the JDK's jarsigner. This tool signs JARs by producing a separate signature for every file in the JAR. The signatures are put in the MANIFEST.MF file and in a separate signature file in the META-INF directory. For optimization purposes, the signature of the MANIFEST.MF with all embedded signatures is also computed and placed in the signature file.

Where is signing done?

A critical part of the security behind signing is that the private keys used to produce the signatures are held in a secure location and never transmitted or accessible via a network. To accomplish this, the signing must be done on a secure machine that has access to the private key. The Eclipse Foundation has set up a machine with a signing script. The build will upload content to be signed to this machine, and a script is run to perform the signing. Access to this machine will be given to trusted parties that want to perform signing.

When is signing done?

Signing will be done as part of the build process. Because this adds a significant amount of time to the build process, the releng team is investigating streamlining the build process. The process of producing a signed build is:

  1. Checkout source from eclipse.org CVS repositories to build machine
  2. Run build and produce a single ZIP of all plugins in update site form (all plugins in JARs)
  3. Send build output to eclipse.org for signing
  4. Send signed build to update site
  5. Copy zip of signed JARs back to the build machine, and package standalone zips
  6. Copy standalone zips to test machines for automated testing

Currently the Eclipse project build machine is located remote from the Eclipse Foundation servers. This means the Eclipse source has to be transferred across the Internet, and the build output needs to be transferred back to Foundation machines for signing. These two major network bottlenecks could be removed by also using Eclipse Foundation machines for building.

What public key (certificate) do we use?

The Eclipse Foundation has purchased a signing certificate from Verisign. Content made available on Eclipse.org will be signed with the foundation certificate. Note this doesn't preclude other parties from later signing the JARs with their own certificates.

Where are the signatures stored?

The signatures are stored in the JAR file, both in the MANIFEST.MF, and in a separate signature file (currently Eclipse_.sf).

Verification

When does verification happen?

Verification can happen any time. The common times to perform verification are:

  • During update. Minimally, verification happens at the time the client obtains the signed content. The Eclipse update mechanism will perform verification of any update JARs that are signed, and will prompt the user for confirmation if the certificate used for signing is not trusted.
  • At load-time. It is sometimes desirable to perform verification at load time when classes are loaded from a JAR. The default Java class loader performs this verification automatically for any signed JAR on the classpath. The Eclipse class loader can also be configured to perform load-time verification, but it is optional.
  • Manual user verification. The Eclipse about dialog will be augmented to show what plugins are signed. From this dialog the user should be able to manually perform verification of signed content if desired.

Miscellaneous links

Eclipse Bugzilla reports

Done Description
OSGi Bundle signing bug report
Runtime signing support
Signing indicator in About dialog
Check.gif Purchasing signing certificates
Signing script to signal completion
Starting signing immediately after signing script is called
Check.gif Bug for installing Java 1.5 on signing server
Bug for installing Improved signing/packing application on signing server
Bug for using OSGi verification during update

Other signing links

Back to the top