You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@karaf.apache.org by Bernd <ec...@zusammenkunft.net> on 2024/11/27 10:07:08 UTC
Signing for delivery
Hello,
Quick question is there a karaf or OSGi component to have a
installation/feature.xml integrity protected (signed) without using jar
signing? It should be possible to fix a whole product configuration, like for
example signing a boot feature.xml which then contains only fixed versions and
checksums. Or is there a method in/for the obr?
Gruss
Bernd
\--
http://bernd.eckenfels.net
Re: Signing for delivery
Posted by Matt Pavlovich <ma...@gmail.com>.
Hi Bernd-
Karaf is highly extensible— have you looked into implementing a feature deployer that performed the various integrity checks to your requirement?
-Matt
> On Nov 27, 2024, at 4:07 AM, Bernd <ec...@zusammenkunft.net> wrote:
>
> Hello,
>
> Quick question is there a karaf or OSGi component to have a installation/feature.xml integrity protected (signed) without using jar signing? It should be possible to fix a whole product configuration, like for example signing a boot feature.xml which then contains only fixed versions and checksums. Or is there a method in/for the obr?
>
> Gruss
> Bernd
>
>
> --
> http://bernd.eckenfels.net
Re: Signing for delivery
Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
Hi Bernd,
In one of my former companies, I implemented a custom features service
doing something similar to what you describe.
So, it's not implemented in Karaf "out of the box", but pretty easy to
do (you can create your own features service verify signature nested
in the feature repository for instance).
Regards
JB
On Wed, Nov 27, 2024 at 11:07 AM Bernd <ec...@zusammenkunft.net> wrote:
>
> Hello,
>
> Quick question is there a karaf or OSGi component to have a installation/feature.xml integrity protected (signed) without using jar signing? It should be possible to fix a whole product configuration, like for example signing a boot feature.xml which then contains only fixed versions and checksums. Or is there a method in/for the obr?
>
> Gruss
> Bernd
>
>
> --
> http://bernd.eckenfels.net
Re: Signing for delivery
Posted by Matt Pavlovich <ma...@gmail.com>.
Hi Bernd-
Karaf is highly extensible— have you looked into implementing a feature deployer that performed the various integrity checks to your requirement?
-Matt
> On Nov 27, 2024, at 4:07 AM, Bernd <ec...@zusammenkunft.net> wrote:
>
> Hello,
>
> Quick question is there a karaf or OSGi component to have a installation/feature.xml integrity protected (signed) without using jar signing? It should be possible to fix a whole product configuration, like for example signing a boot feature.xml which then contains only fixed versions and checksums. Or is there a method in/for the obr?
>
> Gruss
> Bernd
>
>
> --
> http://bernd.eckenfels.net