Loading ...
Sorry, an error occurred while loading the content.
 

Re: [rng-users] signed jar for jing?

Expand Messages
  • George Cristian Bina
    Hi Tara, We signed Jing (as well as other libraries) when we included it in the Java Web Start distribution of oXygen and also in the sample oXygen Author
    Message 1 of 3 , Oct 3, 2011
      Hi Tara,

      We signed Jing (as well as other libraries) when we included it in the
      Java Web Start distribution of oXygen and also in the sample oXygen
      Author Component Applet.

      Best Regards,
      George
      --
      George Cristian Bina
      <oXygen/> XML Editor, Schema Editor and XSLT Editor/Debugger
      http://www.oxygenxml.com

      On 10/1/11 4:41 AM, tara_athan wrote:
      > I am trying to implement Jing with Java Webstart, so we can publish a web service with full access to the command line options of Jing.
      >
      > When Jing resolves uris it looks up the path on the local machine, (even if the uri is an absolute URI and doesn't need that information). This action triggers Java Webstart to require a signature - and the Jing jar is not signed.
      >
      > Before I file an issue, I thought I would ask if anyone has already re-built the jar including signature?
      >
      > Of course, ideally the person building the official jar would be the one to sign it, certifying that it doesn't contain hidden evil features.
      >
      >
      > Thanks, Tara
      >
      >
      >
      > ------------------------------------
      >
      > Yahoo! Groups Links
      >
      >
      >
    • Tara Athan
      George - I checked in the Java Web Start distribution - the signed jar that contains jing, oxygen_lib.zip.jar, does as you say contain quite a few other
      Message 2 of 3 , Oct 3, 2011
        George - I checked in the Java Web Start distribution - the signed jar
        that contains jing, oxygen_lib.zip.jar, does as you say contain quite a
        few other libraries, accumulating to 53MB. This is not really going to
        meet our needs for a light-weight JAWS for Jing alone (maybe a separate
        JAWS for Trang as well). But I see that you have put your signature on a
        lot of opensource jars from other sources, so maybe it is not outside
        the realm of best practice if we do what you did - bundle the Jing jar
        into another jar and sign it ourselves.

        Tara


        George Cristian Bina wrote:
        > Hi Tara,
        >
        > We signed Jing (as well as other libraries) when we included it in the
        > Java Web Start distribution of oXygen and also in the sample oXygen
        > Author Component Applet.
        >
        > Best Regards,
        > George
        > --
        > George Cristian Bina
        > <oXygen/> XML Editor, Schema Editor and XSLT Editor/Debugger
        > http://www.oxygenxml.com
        >
        > On 10/1/11 4:41 AM, tara_athan wrote:
        >> I am trying to implement Jing with Java Webstart, so we can publish a
        >> web service with full access to the command line options of Jing.
        >>
        >> When Jing resolves uris it looks up the path on the local machine,
        >> (even if the uri is an absolute URI and doesn't need that
        >> information). This action triggers Java Webstart to require a
        >> signature - and the Jing jar is not signed.
        >>
        >> Before I file an issue, I thought I would ask if anyone has already
        >> re-built the jar including signature?
        >>
        >> Of course, ideally the person building the official jar would be the
        >> one to sign it, certifying that it doesn't contain hidden evil features.
        >>
        >>
        >> Thanks, Tara
        >>
        >>
        >>
        >> ------------------------------------
        >>
        >> Yahoo! Groups Links
        >>
        >>
        >>
        >
      Your message has been successfully submitted and would be delivered to recipients shortly.