You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cordova.apache.org by kirkshoop <gi...@git.apache.org> on 2015/01/20 21:27:56 UTC
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
GitHub user kirkshoop opened a pull request:
https://github.com/apache/cordova-windows/pull/55
CB-8307 - new 10yr cert and tools to generate as needed
This change introduces a new certificate valid for 10 years.
The certificate will be updated for another 10 years on each 'npm install' (with no arguments)
The idea is to ensure that each published release contains a certificate that will be valid for 10 years from the release.
The keys are included because generating new keys is slow. Generating a new cert is fast.
The keys can be regenerated, and used to make a new certificate, with 'npm run-script generatekey'
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/MSOpenTech/cordova-windows CB-8307
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/cordova-windows/pull/55.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #55
----
commit 7261deb6cf194f2c8118b4f35ccf4edcfb3b4386
Author: Kirk Shoop (MS OPEN TECH) <ki...@microsoft.com>
Date: 2015-01-14T18:51:12Z
CB-8307 - new 10yr cert and tools to generate as needed
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by sgrebnov <gi...@git.apache.org>.
Github user sgrebnov commented on the pull request:
https://github.com/apache/cordova-windows/pull/55#issuecomment-70806039
:+1:
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by sgrebnov <gi...@git.apache.org>.
Github user sgrebnov commented on the pull request:
https://github.com/apache/cordova-windows/pull/55#issuecomment-71706426
looks great!
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by kirkshoop <gi...@git.apache.org>.
Github user kirkshoop commented on the pull request:
https://github.com/apache/cordova-windows/pull/55#issuecomment-71703538
@sgrebnov I changed the code to only use node-forge if it is installed. I tried `npm install --production` and the console reported that the certificate was not updated.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by purplecabbage <gi...@git.apache.org>.
Github user purplecabbage commented on the pull request:
https://github.com/apache/cordova-windows/pull/55#issuecomment-71725852
I believe this still makes node-forge a dependency.
Running `npm install` will install all 'dependencies' and all 'devDependencies' and the only way to prevent it is to run `npm install --production`
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by purplecabbage <gi...@git.apache.org>.
Github user purplecabbage commented on the pull request:
https://github.com/apache/cordova-windows/pull/55#issuecomment-71734265
This may be better served living in cordova-coho which is the tool that we use to package a release.
Or possibly have the generate_certificate.js call `npm install node-forge` so only people who call `npm generatekey` will ever need it.
I am not completely sure what the impact is of having node-forge as a dependency, it may not be that big of a deal, but we will be looking at some point to remove npm_modules folder and have platform installs actually use npm install directly. ie No bundling of the dependencies.
Not sure what is the best approach here.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/cordova-windows/pull/55
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by kirkshoop <gi...@git.apache.org>.
Github user kirkshoop commented on the pull request:
https://github.com/apache/cordova-windows/pull/55#issuecomment-71731795
@purplecabbage Yes, this does add a dependency on node-forge, but only for publishing the platform, not when using it. Thus the node-forge package has not been committed and the cert is only generated if node-forge is installed.
Is there a better way to accomplish this?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by sgrebnov <gi...@git.apache.org>.
Github user sgrebnov commented on a diff in the pull request:
https://github.com/apache/cordova-windows/pull/55#discussion_r23286596
--- Diff: package.json ---
@@ -26,7 +28,8 @@
},
"devDependencies": {
"jasmine-node": "1.14.5",
- "rewire": ">=2.1.3"
+ "rewire": ">=2.1.3",
+ "node-forge": "~0.6.18"
--- End diff --
I believe `prepublish` is run during `install` so all required deps must be in `dependencies` (not in `devDependencies`), otherwise `npm install --production` will fail.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
[GitHub] cordova-windows pull request: CB-8307 - new 10yr cert and tools to...
Posted by kirkshoop <gi...@git.apache.org>.
Github user kirkshoop commented on a diff in the pull request:
https://github.com/apache/cordova-windows/pull/55#discussion_r23389897
--- Diff: package.json ---
@@ -26,7 +28,8 @@
},
"devDependencies": {
"jasmine-node": "1.14.5",
- "rewire": ">=2.1.3"
+ "rewire": ">=2.1.3",
+ "node-forge": "~0.6.18"
--- End diff --
That is unfortunate. The goal is to only run before publishing a new release. installing from npm is not intended to run this. We really do not want to impose node-forge as a dependency.
Do you have a recommendation? Is there any scenario where --production is required to work? If so, perhaps I can check to see if node-forge is installed from the script and skip the certificate creation.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org