uima-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Peter Kl├╝gl <peter.klu...@averbis.com>
Subject Re: signing Jars
Date Fri, 29 Jan 2016 10:18:59 GMT
Hi,

... an aggregate answer mail for the last three mails...

yes, I was meaning maven central.

If I have to guess, then I would say that the artifacts are normally
code-signing but here is no .asc ect. -  I have to check it.

The artifacts are not bundled, but are only required for compiling the
Eclipse plugins, especially the stuff that requires DLTK, or other stuff
that is not hosted in maven central, but only in p2 repositories.

@Richard:
There are plans to host the artifacts here at Averbis :-)
I really appreciate that your department does it, but I'd say that my
company should (at least) do it (too).
... and the artifacts also need some updates in order to get rid of some
annoying error problems in Eclipse.

Best,

Peter

Am 28.01.2016 um 21:46 schrieb Richard Eckart de Castilho:
> I have no clue. Assuming that Eclipse features/JARs are usually signed, they are likely
signed by their original authors.
>
> If I remember correctly, Peter had obtained them from a local Eclipse installation and
we needed them in a repo so I put them in ours - btw. we could consider to upload them to
Bintray (another JFrog product/service).
>
> Cheers,
>
> -- Richard
>
>> On 28.01.2016, at 21:39, Marshall Schor <msa@schor.com> wrote:
>>
>> That reminds me - are the artifacts in UKP Artifactory signed (either
>> code-signed or .asc etc. signed)?
>>
>> When we "sign" a jar it would be good to know there's a chain of signed and
>> verified components that went into what gets built.
>>
>> I don't remember if the artifact in the UKP Artifactory are actually bundled
>> with what Ruta builds, or if they're just needed to compile? 
>>
>> -Marshall
>>
>> On 1/28/2016 3:04 PM, Richard Eckart de Castilho wrote:
>>> On 28.01.2016, at 18:17, Marshall Schor <msa@schor.com> wrote:
>>>>> (Another question is: do we need code signing for the jars in the
>>>>> artifactory? I would say no.)
>>>> Not sure what the "artifactory" is?
>>> Artifactory is a repository server product from JFrog ;) But I 
>>> would also guess Peter talks about Maven Central - unless he
>>> talks about the UKP Lab Artifactory where we still host some
>>> Eclipse artifacts that I believe Ruta needs for building.
>>>
>>> -- Richard


Mime
View raw message