Purpose of signer about update4j

[mordechaim]

Very simple. Whenever you push a new release and post the new config, you can sign the artifacts and their respective signatures are added to the configuration. It is used on the development machine, not the server. You then need to use the update overload that takes a public key; it will verify the downloads. Note: on the next release the signer will also sign the config file itself to ensure properties/URIs/paths were not tempered.

[persal]

We plan to have the config distributed together with our software (same package on the server side) so in this case the config would have to be generated and signed already when performing the release on the build server, right?

For the next release, when the config will be signed as well, will there still be room for some properties to be changed?
Let say we wan't to push out a new vm parameter such as Xmx will this not be possible once the config is signed?

Thanks

[mordechaim]

Update4j properties are not the same as vm properties. If you want to add properties you just add it in the config builder and the signing will automatically be taken care of. If you want to add properties after signing and adding in builder is not an option, use the Configuration::sync method with the public key parameter.

[persal]

I do understand vm parameters are different, that was just an example of something that might be interesting getting up to the client after a package has been deployed. I have to do some more testing to get a better understanding of all mechanism in update4j.

[persal]

Just done a first prototype and everything seem to run very smooth.

We do however generate the config dynamically on our deployed server currently, which is working fine functionality wise. However going forward having signatures in place would be nice.

Is there a maven plugin or way of working to generate a config when performing a maven build?

[mordechaim]

I myself hadn't worked on a plugin, but other contributors did (check out the open pull request). Non of them can do everything that could be done with the builder. You can however use the maven-exec-plugin that calls your method that does your custom configured builder in Java code.

[persal]

Thanks will try that.

Btw: In the "Providers" chapter on https://github.com/update4j/update4j/wiki/Documentation there is a typo, META-INF/services/org.update4j.UpdateHandler should probably be META-INF/services/org.update4j.services.UpdateHandler