<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 23/08/2024 23:04, Cesar Soares Lucas
wrote:<br>
</div>
<blockquote type="cite" cite="mid:MN2PR21MB1520FB8265FD2801AD126EBB9A882@MN2PR21MB1520.namprd21.prod.outlook.com">
<pre class="moz-quote-pre" wrap="">Hello!
I've a few questions that I'd like to ask your opinion about.
- Signed Jars: As far as I understand, we currently don't include classes from signed jars in the CDS archive. What is the reason for that? I had the impression that being able to archive such classes would be important given that many .jars are signed?!
</pre>
</blockquote>
As a general point, signed JARs on the class path or module path
aren't all that useful. It's very different to a signed JAR loaded
from a remote site where the JDK would need a lot more
infrastructure to validation certificate chains. There has been
consideration on and off for many years about dropping the support
for JAR files on the class path (and module path). The nice thing
about dropping this (only from the class path and module path) is
that it would avoid executing a lot of problematic security code
when open JAR files.<br>
<br>
-Alan<br>
</body>
</html>