<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="ltr">
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;">Many apps used signed jars "accidentally". When signed jars were fashionable, some lib developers signed their jars. Many of these libraries become orphaned and remain signed for
no particular reason.<span></span></b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><br>
</b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;">The reason that CDS doesn't archive signed clas<span>ses is because we aren't sure if we skip the whole signature checking process at run time, we can still ensure that all APIs
related to code signing (eg Class.getSigners) can return the expected value.<span></span></span></b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><span><br>
</span></b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><span>Cesar, could you confirm if the class signatures are actually used for something useful?</span></b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><span><br>
</span></b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><span>If not, I think maybe we can introduce a new execution mode, to simply ignore code signatures. <span></span></span></b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><br>
</b></div>
<div dir="ltr">Or drop support for signed jars as Alan mentioned below.<span></span><span></span></div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Thanks</div>
<div dir="ltr">Ioi</div>
<div dir="ltr"><br>
</div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><br>
</b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><br>
</b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;">-----------</b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><br>
</b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"> From:</b><span style="font-family: Calibri, sans-serif; font-size: inherit;"> leyden-dev <leyden-dev-retn@openjdk.org> on behalf of Alan Bateman <alan.bateman@oracle.com></span><br>
</div>
<div class="ms-outlook-mobile-reference-message">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif"><b>Sent:</b> Saturday, August 24, 2024 7:23 AM<br>
<b>To:</b> Cesar Soares Lucas <Divino.Cesar@microsoft.com>; Leyden-dev Maillist <leyden-dev@openjdk.org><br>
<b>Cc:</b> Brian Stafford <Brian.Stafford@microsoft.com>; Mat Carter <Matthew.Carter@microsoft.com><br>
<b>Subject:</b> Re: Some offhand questions
<div> </div>
</font></div>
<br>
<br>
<div class="moz-cite-prefix">On 23/08/2024 23:04, Cesar Soares Lucas wrote:<br>
</div>
<blockquote type="cite">
<pre class="moz-quote-pre">Hello!
I've a few questions that I'd like to ask your opinion about.
- Signed Jars: As far as I understand, we currently don't include classes from signed jars in the CDS archive. What is the reason for that? I had the impression that being able to archive such classes would be important given that many .jars are signed?!
</pre>
</blockquote>
As a general point, signed JARs on the class path or module path aren't all that useful. It's very different to a signed JAR loaded from a remote site where the JDK would need a lot more infrastructure to validation certificate chains. There has been consideration
on and off for many years about dropping the support for JAR files on the class path (and module path). The nice thing about dropping this (only from the class path and module path) is that it would avoid executing a lot of problematic security code when open
JAR files.<br>
<br>
</div>
<div id="mail-editor-reference-message-container" class="ms-outlook-mobile-reference-message">
-Alan<br>
<div id="" class="" dir="ltr"><br>
</div>
<div id="" class="" dir="ltr"><br>
</div>
</div>
<div></div>
</div>
</body>
</html>