[jdk11u] RFR: 8280890: Cannot use '-Djava.system.class.loader' with class loader in signed JAR

Severin Gehwolf sgehwolf at openjdk.org
Thu Dec 22 11:07:01 UTC 2022


Please review this almost clean backport (modulo copyright header in `DisabledAlgorithmConstraints`) in the product code. The test needed some changes to make it work (removal of text block syntax, `ClassFileInstaller` import change).

It fixes a regression introduced with [JDK-8269039: Disable SHA-1 Signed JARs](https://bugs.openjdk.org/browse/JDK-8269039) which was included in `11.0.17` (note that `11.0.16` is not affected as  JDK-8269039 is not there). This should be low-risk as it mainly removes use of `java.util.Calendar` API usage in `DisabledAlgorithmConstraints` which can cause issues with applications that contain `CalendarDataProvider`s in signed jars. See [JDK-8297684](https://bugs.openjdk.org/browse/JDK-8297684) for details.

Proposing as critical fix so that we don't have another release with that regression.

Regression test fails prior and passes after the product fix.

-------------

Commit messages:
 - 8280890: Cannot use '-Djava.system.class.loader' with class loader in signed JAR

Changes: https://git.openjdk.org/jdk11u/pull/65/files
 Webrev: https://webrevs.openjdk.org/?repo=jdk11u&pr=65&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8280890
  Stats: 183 lines in 4 files changed: 139 ins; 28 del; 16 mod
  Patch: https://git.openjdk.org/jdk11u/pull/65.diff
  Fetch: git fetch https://git.openjdk.org/jdk11u pull/65/head:pull/65

PR: https://git.openjdk.org/jdk11u/pull/65


More information about the jdk-updates-dev mailing list