Akio Motoki 25.May.10 05:00 AM a Web browser Client for Desktop6.2.1Windows XP
I'm testing signed plugin with self certification that made by ikeyman.
I found 2 problems about the signed plugin.
(1) Signed plugin with self certification is not treated as UNTRUSTED but UNSIGNED.
(2) EXPIRED_SIGNATURE_POLICY can't work properly.
----------------------------------------------------------------
Environment : Expeditor for Desktop 6.2.1 FP1 on Windows XP SP3
Self certification "herohero" is made by ikeyman and stored in default "cacerts" file:
[Expeditor]\rcp\eclipse\plugins\com.ibm.rcp.j2se.win32.x86_1.6.0.20090820c-201001210330\jre\lib\security\cacerts)
Plugin is signed with "herohero" by following command:
jarsigner.exe -keystore [Expeditor]\rcp\eclipse\plugins\com.ibm.rcp.j2se.win32.x86_1.6.0.20090820c-201001210330\jre\lib\security\cacerts -storepass changeit D:\update\plugins\com.ibm.rcp.samples.richapp_6.1.2.jar herohero
Signature Policy is set by adding following settings to [Expeditor]\rcp\plugin_customization.ini:
Problem (1)
Signed plugin with self certification is not treated as UNTRUSTED but UNSIGNED.
Install the plugin is failed in the case of following settings:
com.ibm.rcp.security.update/EXPIRED_SIGNATURE_POLICY=ALLOW
com.ibm.rcp.security.update/UNSIGNED_PLUGIN_POLICY=DENY
com.ibm.rcp.security.update/UNTRUSTED_SIGNATURE_POLICY=ALLOW
Problem (2)
EXPIRED_SIGNATURE_POLICY can't work properly.
The plugin is installed even it is expired in the case of following settings:
com.ibm.rcp.security.update/EXPIRED_SIGNATURE_POLICY=DENY
com.ibm.rcp.security.update/UNSIGNED_PLUGIN_POLICY=ALLOW
com.ibm.rcp.security.update/UNTRUSTED_SIGNATURE_POLICY=ALLOW
I wonder if these are problem about verificationLister.
Return to top
Signed Plugin (Akio Motoki 25.May.10)
. . 
Print this page
