how to add our own update site url to the P2 Install/Update-> Trust -> Authorities?

[jcompagner]

I am trying to find out how i can add our own url there when people install our product and then want to update our product from that url

our product does see the defaults now:

AuthorityChecker:

	public Set<URI> getPreferenceTrustedAuthorities() {
		var result = new LinkedHashSet<URI>();
		var preferences = getEnngineProfilePreferences();
		if (preferences != null) {
			String defaultValue = EngineActivator.getContext().getProperty("p2.trustedAuthorities");
			if (defaultValue == null) {
				defaultValue = "https://download.eclipse.org https://archive.eclipse.org";
			} else {
				defaultValue = defaultValue.replace(',', ' ');
			}
			for (var value : preferences.get(TRUSTED_AUTHORITIES_PROPERTY, defaultValue).split("\\s+")) {
				try {
					if (!value.isBlank()) {
						result.add(new URI(value));
					}
				} catch (URISyntaxException e) {
					//$FALL-THROUGH$
				}
			}
		}
		return result;
	}

but i am wondering what i need to configure somewhere to also add our update site url

Because i guess, after that i guess unsigned jars are not reported like that? because the https url with a valid certificate will be seen as trusted (everything that is downloaded from it?)

it seems there is a "p2.trustedAuthorities" property but that is just an environment variable or something?

[merks]

Yes, it's effectively just an environment variable fetched in a proper OSGi way. So in your *.product file you can specify the system property with a comma (or space) separated list of authorities like this

      <vmArgs>-Xms256M
-Xmx2048M
-Dp2.trustedAuthorities=https://my.org,https://download.eclipse.org
      </vmArgs>

This only affects the prompting of authorities, i.e., the source of content:

https://eclipse.dev/eclipse/news/4.28/platform.php#Security

This is entirely orthogonal to prompting about signed content. You should sign your content.

[merks]

Here's how we make sure that everything in the SimRel repository is PGP signed if it is not otherwise considered jar signed by an anchored certificate:

• https://github.com/eclipse-simrel/simrel.build/blob/28ffb677b6cf318afb83db071204058243174356/pom.xml#L100-L122
• https://github.com/eclipse-simrel/simrel.build/blob/28ffb677b6cf318afb83db071204058243174356/Jenkinsfile#L78-L92

[jcompagner]

thx but i if look at the mojo i see this:

https://tycho.eclipseprojects.io/doc/latest/tycho-gpg-plugin/sign-p2-artifacts-mojo.html#executable

thats all kind of native stuff right that needs to be installed?

[merks]

It's configured to use "bc" for signing so nothing native needs to be installed but rather it uses bouncycastle libraries directly from within the same process:

https://tycho.eclipseprojects.io/doc/latest/tycho-gpg-plugin/sign-p2-artifacts-mojo.html#signer

The documentation could be improved...

[jcompagner]

ah thx, that was not directly clear to me,

But still we need to make a private/public key that we use that is then registered at a key server?
(https://help.eclipse.org/latest/index.jsp?topic=%2Forg.eclipse.platform.doc.isv%2Fguide%2Fp2_pgp.html)

[merks]

Yes you definitely need to create the public/ private keys and for that you do need some tools. There is no requirement to register it with a key server but users will perhaps find it more trustworthy if that's the case. With the bc signer, you can "stuff" the private key and the password into system properties to be used in the Tycho build without special tools needing to be installed for the build server...