Return-Path: Mailing-List: contact security-dev-help@xml.apache.org; run by ezmlm Delivered-To: mailing list security-dev@xml.apache.org Delivered-To: moderator for security-dev@xml.apache.org Received: (qmail 75833 invoked from network); 18 Feb 2003 11:58:24 -0000 Received: from a17-250-248-88.apple.com (HELO smtpout.mac.com) (17.250.248.88) by daedalus.apache.org with SMTP; 18 Feb 2003 11:58:24 -0000 Received: from asmtp02.mac.com (asmtp02-qfe3 [10.13.10.66]) by smtpout.mac.com (Xserve/MantshX 2.0) with ESMTP id h1IBwO3X010043 for ; Tue, 18 Feb 2003 03:58:24 -0800 (PST) Received: from [192.168.123.114] ([24.242.237.78]) by asmtp02.mac.com (Netscape Messaging Server 4.15) with ESMTP id HAI6LB00.PK4 for ; Tue, 18 Feb 2003 03:58:23 -0800 Mime-Version: 1.0 X-Sender: paul_roebuck@mail.mac.com Message-Id: Date: Tue, 18 Feb 2003 05:58:19 -0600 To: security-dev@xml.apache.org From: Paul Roebuck Subject: [RFC/Q] XML Security 1.0.4 Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N Since there was mention of desiring comments, here are my thoughts after downloading the binary 1.0.4 release... [COMMENTS] - Only dot-zip archive available. Grrr. Zip archives don't preserve file permissions. Make compressed TAR archive available as well. - Zip archive didn't have a root directory. GRRRRRRRRRRR. Normally, I check first but for some reason didn't early this morning. I hate extracting something that scribbles in a common directory. Most packages extract with a single root-level directory named -. Much preferred. - ANT build file could be improved by using 'location' attribute instead of 'value' for build directories. - There is a ANT task. Use it on the documentation. Some of us don't use Windows and the '^M' on every line makes reading the documentation too harsh. Yes, I can [and did] change it myself but would prefer to make minimal [or better, none] changes to any distribution of someone else's software. - Run spellcheck on documentation as well. Update version mismatches; although it probably hasn't changed itself, the INSTALL file is still pushing version 1.0.0. - Color me silly but after tracing down open source configuration errors in several setups, I really prefer it when JAR files are named -.jar since it's much easier to determine when the problem is just that something's out-of-date. [PEDANTIC] - Could drop the '-bin' portion of the binary distribution file. If it's not the source distribution, it must be... [HELP] Unfortunately, the reason I downloaded it in the first place, I still can't get it to work with Axis. I downloaded the JCE implementation as well. I made symlinks from xml-security subdirectories for 'xmlsec.jar' and 'jce-jdk13-118.jar' in /path/to/tomcat/common/lib/ with no luck. Yes, I restarted Tomcat (over and over) with each change. Never noticed any request to set an XMLSEC_HOME or something of that nature. Code need anything else from its installation directory? I get the following error message testing the setup: >Warning: could not find a dependency of class >org.apache.xml.security.Init from file xmlsec.jar [Q] What steps are required to get Axis to use it? -- ---------------------------------------------------------- Out of the 10Base-T, through the router, down the T1, over the leased line, off the bridge, past the firewall... nothing but Net.