[ https://issues.jboss.org/browse/SHRINKWRAP-406?page=com.atlassian.jira.pl... ] Andrew Rubinger commented on SHRINKWRAP-406: -------------------------------------------- Nice feature request. ZipExporter is just the client view which inherits its support from StreamExporter, so likely SignedZipExporter would also be: "public interface SignedZipExporter extends StreamExporter", a la: https://github.com/shrinkwrap/shrinkwrap/blob/master/api/src/main/java/or... Also we'd need a corresponding Importer. For the implementation, I wonder if it'd make sense to do this programatically, or take the output of a ZipExporter export and pipe that into jarsigner: http://docs.oracle.com/javase/tutorial/deployment/jar/signing.html ...which feels hacky, calling out to another process. Other ideas? -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/SHRINKWRAP-406?page=com.atlassian.jira.pl... ] Andrew Rubinger commented on SHRINKWRAP-406: -------------------------------------------- Thanks Carlo! Unfortunately GPL2 is more restrictive than our ASL2, so we cannot copy it directly in place. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/SHRINKWRAP-406?page=com.atlassian.jira.pl... ] Bartosz Baranowski commented on SHRINKWRAP-406: ----------------------------------------------- http://chess.eecs.berkeley.edu/ptexternal/src/ptII/doc/codeDoc/ptolemy/co... http://jce.iaik.tugraz.at/sic/Support/Technical-Articles/Signing_JAR_File... Out of better idea Ive started hacking something to make tests against, but... it doing the same thing all over again, since classes capable of this exist. I really wonder why JDKs hide this, parts of security stuff is publi api, part isnt, makes little sense. mvn/ant tasks invoke jarsigner directly so, unless there is specific need for some API which builds some layer over signed jar we could probably go down this path. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira