[jdk8u-dev] Integrated: 8269039: Disable SHA-1 Signed JARs

[Alexey Bakhtin]

On Thu, 3 Nov 2022 15:34:01 GMT, Alexey Bakhtin <abakhtin at openjdk.org> wrote:

> I'd like to backport this enhancement for parity with Oracle and the security roadmap [1]
> 
> The patch is based on the OpenJDK11 backport [2]
> 
> The changes are the following:
> 
> 1. java.security.* files are changed on the base of java.security
> 2. jdk/src/share/classes/sun/security/tools/jarsigner/Main.java : signJar method is merged manually because of differences in the JDK-8172404 backport. 
> 3. jdk/test/java/security/Security/signedfirst/DynStatic.java : modules dependency removed, changed path to utility classes
> 4. jdk/test/sun/security/tools/jarsigner/Test4431684.java : changed library path. List.of() is not available in JDK8, so it is replaced with Arrays.asList()
> 5. jdk/test/lib/security/SecurityUtils.java is updated to make removeFromDisabledAlgs method public. It is required by newly added test Test4431684.java
> 6. jdk/test/sun/security/tools/jarsigner/DefaultOptions.java is skipped, it was introduced in JDK9 by JDK-8049834 as default_options.sh but never backported to JDK8
> 7. JDK8 has jdk/test/sun/security/tools/jarsigner/diffend.sh test instead of jdk/test/sun/security/tools/jarsigner/DiffEnd.java. diffend.sh was not renamed to DiffEnd.java because of JDK-8180573 is not backported to JDK8. JDK-8180573 is a big refactoring and out of scope for this issue. diffend.sh updated accordingly - SHA1 replaced to SHA-256
> 8. JDK8 has jdk/test/sun/security/tools/jarsigner/ec.sh test instead of jdk/test/sun/security/tools/jarsigner/EC.java. ec.sh was not renamed to EC.java because of JDK-8180573 is not backported to JDK8. JDK-8180573 is a big refactoring and out of scope for this issue. ec.sh has all required changes by JDK-8172404
> 9. JDK8 has jdk/test/sun/security/tools/jarsigner/nameclash.sh test instead of jdk/test/sun/security/tools/jarsigner/NameClash.java. nameclash.sh was not renamed to NameClash.java because of JDK-8180573 is not backported to JDK8. JDK-8180573 is a big refactoring and out of scope for this issue. nameclash.sh has all required changes by JDK-8172404
> 10. JDK8 has jdk/test/sun/security/tools/jarsigner/oldsig.sh test instead of  jdk/test/sun/security/tools/jarsigner/OldSig.java. oldsig.sh was not renamed to OldSig.java because of JDK-8180573 is not backported to JDK8. JDK-8180573 is a big refactoring and out of scope for this issue. The changes in the oldsig.sh are not required because of JDK-8217375 is not backported to JDK8.
> 11. jdk/test/sun/security/tools/jarsigner/OldSig.props is not backported as it is not used in the  jdk/test/sun/security/tools/jarsigner/oldsig.sh
> 
> All java/security/Security sun/security/tools regression tests passed
> 
> [1] - https://www.java.com/en/jre-jdk-cryptoroadmap.html
> [2] - https://github.com/openjdk/jdk11u-dev/commit/5a0824ba813ceda47847c9162c8a10bb0b8898e8

This pull request has now been integrated.

Changeset: c501bfaa
Author:    Alexey Bakhtin <abakhtin at openjdk.org>
URL:       https://git.openjdk.org/jdk8u-dev/commit/c501bfaa5fc2502942b228c907372dccd58c4a20
Stats:     657 lines in 29 files changed: 315 ins; 215 del; 127 mod

8269039: Disable SHA-1 Signed JARs

Reviewed-by: mbalao
Backport-of: 6d91a3eb7bd1e1403cfb67f7eb8ce06d7e08e7a7

-------------

PR: https://git.openjdk.org/jdk8u-dev/pull/154