search

ritschwumm / commonist

A file upload tool for mediawiki using its api.php interface
14 stars 4 forks source link

Sign the code to allow easy installation #14

Closed tbertels closed 6 years ago

tbertels commented 6 years ago

Since Java blocks by default installation from HTTP websites, the user has to add an exception as explained on https://commons.wikimedia.org/wiki/Commons_talk:Commonist/Archive_2#Blocked_!!!

I suggest to use a free Let's Encrypt certificate to support HTTPS.

ritschwumm commented 6 years ago

i'll just move it back to https://djini.de/commonist/ where i already have ssl enabled.

ritschwumm commented 6 years ago

done - can you update the documentation page on commons for me, please?

tbertels commented 6 years ago

Unfortunately, it seems that the only thing that actually matters is for the code to be signed.

It looks like the cheaper code signing certificate recognized by Java is Certum Open Source at 25 € per year + 25 € one time fee for the electronic card or 69 € for both and a card reader.

I suggest that you request a grant. For you, it seems Software-Stipendien is the best choice.

ritschwumm commented 6 years ago

well, webstart is dying - java 11 is just around the corner and does not support it any more. apart from that, webstart has been deliberately broken on OSX for quite some time now (because there's no way to sign a JNLP file itself...). in this light, i don't think it makes much sense to invest time or money into code signing.

sadly, i don't see any real alternative except implementing my own webstart replacement - but at least on OSX this would again require a signing certificate (this time from apple) and what worse, require building this thing exclusively on OSX so i actually can sign it...

let me know if you have a better idea - for now, the easiest thing is probably getting the capsule jar.

tbertels commented 6 years ago

Indeed, knowing that it's not much worth it.

Anyway, it may not necessarily be such a bad thing for commonist, unlike JOSM - given their release cycle - which may make their users install OpenJDK in the future as an alternative to the installer. After all, the majority of users probably don't have the JRE installed anymore, so distributing an application with webstart instead of jlink may actually be more annoying for the majority of users.