Just the code in java/gadgets... upload.py is a bit aggressive.
shindig.signing.key-file should not include your user's file
LGTM. http://codereview.appspot.com/33053/diff/1/5 File java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java (right): http://codereview.appspot.com/33053/diff/1/5#newcode90 Line 90: protected static final String OPENSOCIAL_PROXIED_CONTENT = "opensocial_proxied_content"; This should go in http://svn.apache.org/viewvc/incubator/shindig/trunk/java/common/src/main/jav... http://codereview.appspot.com/33053/diff/1/5#newcode410 Line 410: params.add(new Parameter(OPENSOCIAL_PROXIED_CONTENT, "1")); Might make sense to put trustedParams in OAuthArguments, and add opensocial_proxied_content=1 to this. I originally made trustedParams a constructor parameter, but that doesn't seem to be as useful as having it on OAuthArguments. What you've done is fine too, just something to think about.
http://codereview.appspot.com/33053/diff/1/5 File java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java (right): http://codereview.appspot.com/33053/diff/1/5#newcode90 Line 90: protected static final String OPENSOCIAL_PROXIED_CONTENT = "opensocial_proxied_content"; On 2009/04/02 22:42:22, beaton wrote: > This should go in > http://svn.apache.org/viewvc/incubator/shindig/trunk/java/common/src/main/jav... Seems more consistent to keep it here. Its not an OAuth param.