[SIS-181] Use Apache code signing service for SIS releases

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Won't Fix
• Component/s: Build process
• Assignee: Unassigned
• Reporter: Martin Desruisseaux
• Created: 07/Oct/14 01:46
• Updated: 29/Nov/22 15:39
• Resolved: 29/Nov/22 15:39

Description

The Apache Foundation now provide a code signing service. The Apache SIS project should consider using it for their releases. Instructions are there:

• Blog: Code signing service now available
• Requesting Access to the Code signing service
• Using the code signing service

However given that code signing cost money to the ASF, probably the Apache SIS project is not big enough for this cost. Cost signing is used by bigger projects like Apache Tomcat; maybe we should wait for more experience gained by those big projects.