[jira] Commented: (FELIX-22) Implement support for digitally signed bundles

["Richard S. Hall (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FELIX-22?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12511415 ] 

Richard S. Hall commented on FELIX-22:
--------------------------------------

stephane frenot wrote:

The patch modifies
framework/src/main/java/org/apache/felix/framework/cache/BundleArchive.java

It gets a general property  "private static final String SFELIX_PROP="
fr.inria.ares.sfelix";" to know if we are in a secured environment.
If yes, we call a private function checkSecurity in BundleArchive. The call
is made at the end of each BundleArchive constructor.

The checkSecurity, mainly tries to build an
fr.inria.ares.sfelix.BundleSignatureChecker instance which verifies the
signature in its construction phase.

The framework/pom.xml is modified, since we need bundlesignaturechecker
artifact

To test the patch, just follow the README instructions

**************
We need to converge on two elements :
- The name of the property we should use to trigger the verification :
smthing like : org.osgi.sfelix ?
- Possibly the name and the way we access class we use to check signature.
We can use a property and something like a forName(property) and have a
generic call. 

> Implement support for digitally signed bundles
> ----------------------------------------------
>
>                 Key: FELIX-22
>                 URL: https://issues.apache.org/jira/browse/FELIX-22
>             Project: Felix
>          Issue Type: New Feature
>          Components: Framework, Specification compliance
>            Reporter: Richard S. Hall
>            Assignee: Karl Pauls
>         Attachments: patch.txt, sfelix.zip, sfelix.zip
>
>
> This issue relates to section 2 of the OSGi R4 specification. This issue is somewhat difficult in general, but even more difficult if we hope to create a solution that works easily on J2ME and constrained devices.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.