[jdk8u-dev] RFR: 8339280: jarsigner -verify performs cross-checking between CEN and LOC [v2]

[Andrew John Hughes]

On Fri, 19 Sep 2025 18:51:57 GMT, Francisco Ferrari Bihurriet <fferrari at openjdk.org> wrote:

>> Hi, this is a backport of openjdk/jdk11u-dev#3098. The backport isn't clean, because of the following:
>> 
>> * File paths that require adjustment for 8u
>> * In `Main.java`, trivial context differences and code that needs adjustment from 11u to 8u:
>>     * `java.nio.file.Path.of()` ⟶ `java.nio.file.Paths.get()`
>>     * `InputStream::transferTo(OutputStream.nullOutputStream())` ⟶ [original code before a review suggestion](https://github.com/openjdk/jdk/pull/23532/commits/ef546f4b778e8a1f43dbedc56a79bb53d169a1e7#diff-7083af3b8473a092987afa0bbb4d1694664649534bac716f6b9cd3c3b9833219L1185-L1186)
>> * In the test (`VerifyJarEntryName.java`), code that needs adjustment from 11u to 8u:
>>     * `@library /test/lib` ⟶ `@library /lib/testlibrary`
>>     * JUnit 5 ⟶ JUnit 4
>>         * `org.junit.jupiter.api.BeforeAll` ⟶ `org.junit.BeforeClass`
>>         * `org.junit.jupiter.api.BeforeEach` ⟶ `org.junit.Before`
>>         * `org.junit.jupiter.api.Test` ⟶ `org.junit.Test`
>>         * `java.nio.file.Path.of()` ⟶ `java.nio.file.Paths.get()`
>>         * `@BeforeClass`, `@Before` and `@Test` methods must be public
>>     * Can't use `var`
>>     * `Arrays.equals(a, start, end, b, 0, b.length)` ⟶ `Arrays.equals(Arrays.copyOfRange(a, start, end), b)` (`Arrays::equals` with offsets not present in 8u)
>> * ~~NOTE: for the Japanese manpages translation approach, please refer to openjdk/jdk11u-dev#3098~~
>>     * ~~I updated `jdk/src/linux/doc/man/ja/jarsigner.1` and `jdk/src/solaris/doc/sun/man/man1/ja/jarsigner.1` (identical), and left `dk/src/bsd/doc/man/ja/jarsigner.1` untouched (doesn't have any content besides the headers)~~
>>     * $\mbox{\color{red}UPDATE}$ (28348b29f892b685d9098c4560128a8bfb206afd): all the internationalized messages have been removed, as they aren't typically included in backports (thanks @jerboaa for letting me know).
>> 
>> #### Related issues ("relates to" Jira issue links)
>> 
>> [JDK-8353299](https://bugs.openjdk.org/browse/JDK-8353299 "VerifyJarEntryName.java test fails") (openjdk/jdk at acd4da49a01760599ec4c325ff6c56f53ba5cc9c) and [JDK-8367782](https://bugs.openjdk.org/browse/JDK-8367782 "VerifyJarEntryName.java: Fix modifyJarEntryName to operate on bytes and re-introduce verifySignatureEntryName") (openjdk/jdk at 1b9a11682d5f73885213822423bfce8dfc17febd) were also included as part of this backport. They are test-only changes that improve the reliability and coverage of `VerifyJarEntryName.java`.
>> 
>> Since `test/hotspot/jtreg/runtime/appcds/SignedJar.java` is ...
>
> Francisco Ferrari Bihurriet has updated the pull request incrementally with one additional commit since the last revision:
> 
>   Remove internationalized messages

Patch looks good.

Thanks for the extra information. I thought you were saying the translations shouldn't be updated at all, but it seems it was more that they shouldn't be mixed into a backport of another change they weren't part of. I do question that they will ever get updated in bulk though, so that is something we should probably look into under another PR.

This one should be good to go though. Thanks for clarifying.

-------------

Marked as reviewed by andrew (Reviewer).

PR Review: https://git.openjdk.org/jdk8u-dev/pull/699#pullrequestreview-3513286049
PR Comment: https://git.openjdk.org/jdk8u-dev/pull/699#issuecomment-3583898505