[NETBEANS-2331] Make signing of plugins mandatory or remove it completely

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: Next
• Component/s: platform - Module System, updatecenters - Pluginportal
• Assignee: Unassigned
• Reporter: Christian Lenz
• Created: 01/Apr/19 11:38
• Updated: 05/Feb/21 21:41
• Resolved: 26/Jun/20 21:11

Description

Atm the moment, the process is you can create and upload a plugin on the plugin page. Everything is fine and you need to go to that page if you want to download this plugin which is not signed. So you will not find it on the plugin manager of NetBeans.

If you want to see it inside of the plugin manager inside NetBeans, you need to sign the plugin or you can add the catalg for unsigned plugins.

The thing is, some or maybe most of plugin developers doesn't know to generate the keystore file or it is to complicated and often a pain in the ass.

So my proposal is either we make it mandatory for Ant and Maven (Maybe Gradle too) to sign the plugin inside of the project settings where you can fill in the stuff, that is needed or we remove the signing stuff completely. Afaik VS Code or IntelliJ doesn't have such process. But only guessing.

When I had a look into the docu of IntelliJ to create a plugin, I couldn't find an info for sigining a plugin.

Another proposal, if we still want to have the sigining, should add the not signed plugins as default to NetBeans and show the user which plugins are signed and which not. That everyone can find the plugin inside of the NetBeans plugin manager and not on both, the page and manager. That is a pain in the ass.