Re: Plugins in Custom Update Center appear as "Signed but not Trusted"

There's probably no solution if you submit an IDE plugin.

But, for your own RCP app, you could look into
org.netbeans.spi.autoupdate.KeyStoreProvider and how
org.netbeans.modules.updatecenters.resources.NetBeansKeyStoreProvider
uses the included core/ide.ks and replicate that.

> I paid for a code signing certificate so that all trust concerns should b=
e minimized.

Well, they have been minimized, but not reduced to zero. Even bad guys
could get a certificate for $84 from ksoftware.net

Perhaps the wording should be a bit better, but explaining security to
users is hard as Google Chrome and every other major app discovered.
Would you prefer a text "You have no other plugins from this
publisher" and "You already installed plugins from this publisher"?
Even that might confuse users.

PS: Start using the Apache dev@ mailing list [email protected].=
org

--emi


On Thu, Jul 20, 2017 at 5:07 AM, sonideft <[email protected]> wrote:
> To be more specific, I am using NetBeans 8.02 still and the clients are u=
sing Java 8.0.74 that is bundled with the RCP app, built through Ant.
>
> As an experiment I published another update through my update center. Thi=
s time the Dialog stating all my nbms were signed but not trusted did not a=
ppear. I followed the NetBeans sourcecode and it appears that Java/NetBeans=
 may treat all certificates as untrusted until they are accepted at least o=
nce by the end user.
>
> If this is true, I still don't want my users to see this Dialog even the =
first time. It will confuse them and they may not trust my app. I paid for =
a code signing certificate so that all trust concerns should be minimized.
>
> Any ideas how I can suppress this Dialog from appearing the first time?
>
>
>
>