RFR: 8215788: Clarify JarInputStream Manifest access [v7]
Lance Andersen
lancea at openjdk.org
Tue Sep 20 10:53:57 UTC 2022
On Tue, 20 Sep 2022 06:56:49 GMT, Alan Bateman <alanb at openjdk.org> wrote:
>>> I realise you've had a few iterations with Max on this section but I'm concerned that the text is telling the reader that they should use the 2-arg constructor to verify the signatures when a JAR is signed. The default is to verify and the main reason to use the 2-arg constructor is when you want to opt out, not opt-in.
>>>
>>> I think the intro to this section will need to start with a sentence to say that JAR files can be signed (link to specs/jar/jar.html#signed-jar-file) and that JarInputStream can read a signed JAR from the input stream. As per the description further up, the manifest must be at the start of the stream.
>>
>> OK, will make another pass at this today
>
>> OK, will make another pass at this today
>
> I looked at the latest draft (2bafc00c). I think it would help if the section "Verifying a JarInputStream" were renamed to "Signed JAR files". The link to getManifest makes the reader wonder if they have to call this method whereas I think what you want to say that the manifest must be at the start of the stream (as per the first section) and then followed by signature entries.
> > OK, will make another pass at this today
>
> I looked at the latest draft ([2bafc00](https://github.com/openjdk/jdk/commit/2bafc00cc462b7af3f724371ac1bef5fd99c989c)). I think it would help if the section "Verifying a JarInputStream" were renamed to "Signed JAR files".
OK, I will change as you suggest
The link to getManifest makes the reader wonder if they have to call this method whereas I think what you want to say that the manifest must be at the start of the stream (as per the first section) and then followed by signature entries.
The reason I used the getManifest wording is I felt it was easier and less redundant than copying the wording about the Manifest needing to be either the first or second entry (assuming META-INF/ is the first in the stream). However if you prefer that, I will make that change.
-------------
PR: https://git.openjdk.org/jdk/pull/10045
More information about the core-libs-dev
mailing list