Ovidiu Predescu's Weblog

Upgrading the XSLT-process package in XEmacs

Ville Skytt? contacted me few days ago regarding the status of the XSLT-process in XEmacs. I've been really lazy updating this package in the XEmacs distribution, it's version 1.2.1, more than a year old. The primary reason is that the 2.1 version of XSLT-process is about 6.5Mb, with all the Java jar files for doing Docbook translation to PDF and HTML. This is really bloated by XEmacs standards, whose total size of all packages is about 20Mb. I simply cannot imagine having a sumo distribution with more than a quarter of it being my package! I would probably be spammed by all the XEmacs users...

Steve Youngs suggested a while ago to add the ability to download the optional jar files off the Net, when the user actually needs them. Today he pointed out to Ecrypto, recently added to XEmacs packages, which adds cryptographic functions to Emacs. However these functions are low level functions for encryption only, and there's no provision for verifying signatures and all the goodies tools like PGP and GnuPG provide.

In a separate email, Ville Skytt? pointed out that I can use mailcrypt to sign the jar files that need to be downloaded on demand. I think this tool is what I need, although to make sure things are secure, the user must have gpg or pgp installed on their machine. Linux users might have it if they run a recent Linux distribution, but Windows and even MacOS X, don't come with GnuPG installed.

I need to look into what means to sign a jar file using Java tools only. I strongly suspect the out-of-the-box JVM installations recognize only Sun signed files, and there are little provisions to add third party public certificates. In which case this cannot be an option.