Please sign releases

[ben-willow]

Please sign each release, so we can know provenance of future releases, and help protect against malicious updates.

[paulvi]

@ben-willow Can you point to any case of malicious updates ?

[bekopharm]

It's common sense to install only signed packages. I may even be company policy and would increase acceptance. Don't wait for a malicious update to happen. Prevent it in the first place.

[paulvi]

For non Eclipse foundation plugins, I know only @jeeeyul Lee signing.

And that only creates additional questions asked to user (while for Eclipse signed binaries there's no question asked)

[ncjones]

I agree this is common sense but I am unsure how to implement it. I've read through https://wiki.eclipse.org/JAR_Signing but this does not provide any advice for 3rd-party plugin authors. Nor did I find any advice when quickly searching through "Mastering Eclipse Plug-in Development" and "Eclipse Plug-ins, Third Edition". Any advice on how this should work?

[paulvi]

@ncjones Nathan, you can ask @jeeeyul

but I would suggest not to spend time on this

[cniweb]

+1