[Fedora-packaging] RFC: Signed JAR Packaging Policy

[Rex Dieter]

Per
RFC: Signed JAR Packaging Policy http://lwn.net/Articles/225981/
Review Request: jss - Java Security Services (JSS), 
http://bugzilla.redhat.com/230262

The "jar signing issue" is something we'll have to address somehow 
sooner or later.  Imo, it can/should be considered on the same level as 
Fedora's signed rpms.

<crazy_idea>
Maybe fedora could have some sort of fedora-ca-keys pkg containing java 
CA's that's *only* available to the buildsys (ie, private, similar to 
fedora's rpm keys).   We could also provide some sort of dummy 
fedora-ca-keys pkg in our public repos (or some other means for folks to 
generate/create their own ca-keys-containing pkg) to satisfy the 
reproducibility(*) issue.
</crazy_idea>

comments?

-- Rex

(*) reproducible in that you could build signed jars, but they wouldn't 
be identical, obviously.