Claudio Miranda wrote:
> On Mon, Jan 12, 2009 at 3:38 PM, Richard S. Hall <heavy_at_ungoverned.org> wrote:
>
>>> Due to my current Felix refactoring, the second approach has been
>>> eliminated, so I don't think we would see this error in the Felix trunk (I
>>> could actually test this I suppose).
>>>
>> FYI, I did test this on Felix' trunk and I didn't get the security exception
>> when creating the manifest, but it really doesn't help since we get it as
>> soon as we try to load a class, since the same signature check is done when
>> getting its associated input stream...makes sense.
>>
>
> Glassfish v3 is going to benefit for this fix ? because glassfish v3
> uses felix 1.2.1.
>
GlassFish actually uses 1.2.2, but I hope it will migrate to newer
versions of Felix when the time is right.
> For people looking this thread for an answer how to repackage and sign
> resources, take a look at the pom.xml
>
> https://certadmin.dev.java.net/source/browse/*checkout*/certadmin/trunk/certmanager-plugin/external/bouncycastle/pom.xml?content-type=text%2Fplain
>
Actually, I am debating whether this signature checking shouldn't just
be disabled altogether, since it is reasonably worthless without
security enabled and Felix' security mechanism handles this separately
anyway. So, it might be the case we can just turn of signature
verification when run without a security manager...who knows, it might
even result in a performance improvement. :-)
-> richard