[ecd-pmc] Questions regarding signing for Che

[Stevan Le Meur <stevan.lemeur@xxxxxxxxx>]

Dear PMC,

We had a discussion this morning with Mikael about the signing procedure we should follow for Che.

As you know Che is a bit different from other Eclipse projects, in the sense that we have bundle archives with a lot of JARs:
(1)- most of the JARs are ours and those JARs, should definitely be signed;
(2)- we are bundling other JARs from third-part, such as Tomcat for example, those have already valid IP Check and proper CQs.

The question we have is how far we should go in the process of signing the JARs that we have into our bundled archives?
Should we sign the third-part JARs (2) or only our own JARs (1) will be enough?

Thanks in advance,

Stévan