builtin class loaders and security manager

[Alan Bateman]

On 13/10/2018 19:55, Michał Zegan wrote:
> Hello,
> I seem to be asking many questions lately, although I am actually
> interested in some motivations. I was reading code of builtin class
> loaders, and from what I understand from that, it seems that classes
> loaded by builtin class loader including app class loader, if loaded
> from a signed jar, are properly verified, however signers are not
> retained in CodeSource. Is this intentional/why?
The support for signed modules is very limited at this time. The 
signatures are checked but the code source in the protection domain 
doesn't have the signers - this is tracked as JDK-8194930. To do that 
right may require adding a codeSigners method to ModuleReference or 
ModuleReader. There is further work needed at link time and in the 
runtime image to support linking of signed modules into a run-time 
image. Just hasn't been a priority to date and would need someone 
willing to put in significant time to work on the various pieces.

-Alan