Verify unsigned plugins for Eclipse

Question

When I am installing a plug-in by the Eclipse marketplace there is always a warning shown. Is there a way to validate the plugin? Besides downloading it and verify it with a possible supplied (MD5/SHA-1) checksum

Answer 1

This validation error is not about the plugin content, but only about the identity of who created it. Similar like your browser verifies your banking website using certificates, Eclipse verifies the plugin author using certificates. But most plugin developers don't sign their plugins.

You can get rid of the warning by adding an additional parameter to your eclipse.ini.

Answer 2

There's nothing you can do to verify the plugin. That's something the plugin provider has to do. I've not heard of any problems with unsigned plugins, although hypothetically I'd want a verified/signed plugin if I were going to access my bank accounts with it.