Bug 440430

Description Joost van Pinxten 2014-07-25 07:29:19 EDT

Created attachment 245380 [details]
CodeandMe example; runs with Maven 3.0.5 (change tycho version to 0.18+ to run with Maven 3.1.1+)

We have a self-signed certificate as per [1]. We tried to run this under Windows 7 (Oracle JDK7) and Linux Ubuntu 14.04 (OpenJDK-7) all 64-bits versions. We have no problem generating and signing the Eclipse p2 update site, and the certificate is shown. 

However, the user is always presented with the screen to indicate whether or not they trust our certificate; even when they already indicated that they trust it the previous time. We have tried to find ways to circumvent this, but Google does not provide insights, nor does the Jarsigning wiki-page [2]. It would be very nice if this process would be documented somewhere, and the requirements of the certificate explicit (such as the emailaddress necessity indicated in [3], which did not help us).

See the self-signed project attachment (adapted from [1] to updated jarsigner-plugin); it runs on Windows and on Linux.

To reproduce (with Maven 3.0.5);

$ mvn verify

point Eclipse (Luna, Kepler or Juno, we've tried them all) to the {...}.releng/target/{...}-SNAPSHOT.zip and install the feature.

Accept the certificate, when it asks you to trust it (by checking the checkbox).

Create an update site with a later timestamp by running again:

$ mvn verify 

Reinstall as before, and see that the "do you trust these certificates"-dialog prevails...

[1] http://codeandme.blogspot.nl/2013/07/tycho-10-signing-plugins-and-executables.html
[2] http://wiki.eclipse.org/JAR_Signing
[3] http://stackoverflow.com/questions/12035479/eclipse-trust-certificate-window-on-verisign-cert