Re: Plugins in Custom Update Center appear as "Signed but not Trusted"

--001a11457fbaef7f7905549f4680
Content-Type: text/plain; charset="UTF-8"

I have a patch that's almost a year old about tsaurl on this issue
https://netbeans.org/bugzilla/show_bug.cgi?id=243213

I should probably just push the patch myself and stop waiting for a review.

You might be running into the fact that only Oracle is hardcoded as
trusted:
https://github.com/emilianbold/incubator-netbeans/blob/3c8b489a1f71bc1bc9dab9f3ac33acaff361a175/autoupdate.services/src/org/netbeans/modules/autoupdate/services/Utilities.java#L231

if (certDNName.contains("CN=\"Oracle America, Inc.\"")
> && (certDNName.contains("OU=Software Engineering") ||
> certDNName.contains("OU=Code Signing Bureau"))) {
> res = 2;
>
> ...
> switch (res) {
> case 2:
> return TRUSTED;
>

Also note this comment:

// signed by trusted certificate stored in user's keystore od ide.ks
> return TRUSTED;


PS: Please start using the Apache dev@ mailing list dev@
netbeans.incubator.apache.org . I've also cross-posted to the new mailing
list which I recommend you join.



--emi

On Tue, Jul 18, 2017 at 10:49 PM, sonideft <[email protected]> wrote:

> I recently acquired a Code Signing Certificate from Comodo for use with my
> NetBeans RCP Application. Signing the installer app.exe was fairly painless
> and incorporated into my Ant Build.xml script.
>
> I wasn't able to figure out how to get NetBeans to utilize a tsaurl while
> signing all the nmb's in my app; but I did get my nbm's signed using my
> code signing certificate. I verified this with jarsigner and also looked
> into the manifest of the nbm's and found the required *.RSA file there.
>
> When my users download the updates, they are presented with a Dialog
> listing all the nbm's and state that they are signed but not trusted. Is
> there another step I am missing or hints of what to check next? I'd like to
> have them trusted, as that is why I acquired the certificate.
>
> I did resign the nmb's manually using jarsigner again to force the tsurl
> to be applied. This had no effect on the results. FYI
>
>
>
>
>

--001a11457fbaef7f7905549f4680
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I have a patch that&#39;s almost a year old about tsaurl o=
n this issue <a href=3D"https://netbeans.org/bugzilla/show_bug.cgi?id=3D243=
213">https://netbeans.org/bugzilla/show_bug.cgi?id=3D243213</a><br><br>I sh=
ould probably just push the patch myself and stop waiting for a review.<br>=
<br>You might be running into the fact that only Oracle is hardcoded as tru=
sted: <a href=3D"https://github.com/emilianbold/incubator-netbeans/blob/3c8=
b489a1f71bc1bc9dab9f3ac33acaff361a175/autoupdate.services/src/org/netbeans/=
modules/autoupdate/services/Utilities.java#L231">https://github.com/emilian=
bold/incubator-netbeans/blob/3c8b489a1f71bc1bc9dab9f3ac33acaff361a175/autou=
pdate.services/src/org/netbeans/modules/autoupdate/services/Utilities.java#=
L231</a><br><br><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">if (certD=
NName.contains(&quot;CN=3D\&quot;Oracle America, Inc.\&quot;&quot;)<br>&amp=
;&amp; (certDNName.contains(&quot;OU=3DSoftware Engineering&quot;) || certD=
NName.contains(&quot;OU=3DCode Signing Bureau&quot;))) {<br>res =3D 2;<br><=
br>...<br>switch (res) {<br>case 2:<br>return TRUSTED;<br></blockquote><br>=
Also note this comment:<br><br><blockquote class=3D"gmail_quote" style=3D"m=
argin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left=
:1ex">// signed by trusted certificate stored in user&#39;s keystore od ide=
.ks<br>return TRUSTED;</blockquote><div><br></div><div>PS: Please start usi=
ng the Apache dev@ mailing list dev<wbr>@<a href=3D"http://netbeans.incubat=
or.apache.org">netbeans.incubator.apache.org</a> . I&#39;ve also cross-post=
ed to the new mailing list which I recommend you join.<br></div><div>=C2=A0=
</div></div><div class=3D"gmail_extra"><br clear=3D"all"><div><div class=3D=
"gmail_signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div>=
<br></div><div>--emi<br></div></div></div></div>
<br><div class=3D"gmail_quote">On Tue, Jul 18, 2017 at 10:49 PM, sonideft <=
span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]" target=3D"=
_blank">[email protected]</a>&gt;</span> wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex">I recently acquired a Code Signing Certificate from Comodo fo=
r use with my NetBeans RCP Application. Signing the installer app.exe was f=
airly painless and incorporated into my Ant Build.xml script.<br>
<br>
I wasn&#39;t able to figure out how to get NetBeans to utilize a tsaurl whi=
le signing all the nmb&#39;s in my app; but I did get my nbm&#39;s signed u=
sing my code signing certificate. I verified this with jarsigner and also l=
ooked into the manifest of the nbm&#39;s and found the required *.RSA file =
there.<br>
<br>
When my users download the updates, they are presented with a Dialog listin=
g all the nbm&#39;s and state that they are signed but not trusted. Is ther=
e another step I am missing or hints of what to check next? I&#39;d like to=
 have them trusted, as that is why I acquired the certificate.<br>
<br>
I did resign the nmb&#39;s manually using jarsigner again to force the tsur=
l to be applied. This had no effect on the results. FYI<br>
<br>
<br>
<br>
<br>
</blockquote></div><br></div>

--001a11457fbaef7f7905549f4680--