We are working towards signing Eclipse builds for the 3.2 Callisto release. The goal of signing is to allow users to verify that the content they obtain from eclipse.org and subsequently execute does indeed come from that source. Signing in a nutshell works as follows:
- Eclipse builds produce content in various forms (zips, update JARS)
- The Eclipse Foundation produces a signature of the build content using its private key (signature = private key + content)
- User downloads build content and signatures from eclipse.org or from mirrors
- The Eclipse Foundation makes available a public key for verifying signatures
- User consults some trusted authority to verify that the public key does indeed belong to the Eclipse Foundation
- Verification is performed on the user's machine (signature + public key = hash of content)
What gets signed?
The two principal outputs from the build process are update site JARs and stand-alone zips.
Signing stand-alone zips
The problem with stand-alone zips is that there is no opportunity to perform verification at download time. The user would need to take a manual step to run verification on the zip before unzipping and using it. Note that signing only the JARs within the stand-alone zips is not sufficient verification. For example, the eclipse executable is not within a JAR, and a compromised executable would negate the value of any other signing. Possible approaches for signing stand-alone executables:
- Do nothing. If users want to obtain verifiable content, they must obtain it from an update site
- Sign only the JARs within the stand-alone zip. This has no authentication value in itself, but might be useful raw material for others in the community who want to tackle complete authentication of an Eclipse-based application
- Create a signature of the entire zip file, and make the signature available in a separate JAR file. The user would then have to perform verification manually
Signing update site content
Signing of content on Eclipse update sites is slightly easier. All executable content is contained in JAR files, so the traditional Java JAR signing mechanism can be used.
How is signing done?
There are several ways we could sign update JAR content:
- Traditional Java JAR signing. The JDK comes with a tool called jarsigner. This tool signs JARs by producing a separate signature for every file in the JAR. The signatures are put in the MANIFEST.MF file and in a separate signature file in the META-INF directory. For optimization purposes, the signature of the MANIFEST.MF with all embedded signatures is also computed and placed in the signature file. The pros of using this approach are that the jarsigner tool is already available, and the signed JAR can also be used for runtime verification. The cons are that producing signatures for every file adds bulk to the download (about 3MB for the Eclipse SDK), and it is very slow to run (about an hour for the Eclipse SDK).
- Compute a single signature per JAR file. This should be much faster and have negligible size, but would require a custom signing tool. The signature would be placed in a separate JAR signed using jarsigner (either one signature JAR per update JAR, or one signature JAR per update site).
- Nested JARs. A sneaky way to get a single signature per JAR is to put each JAR in a wrapper JAR, and sign the wrapper. This would allow using the jarsigner tool, but would require significant changes to the structure of update site content, and changes to the update code to remove the signed wrappers