<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
On 26/08/2024 22:01, Ioi Lam wrote:<br>
<blockquote type="cite" cite="mid:SA1PR10MB58853F8FAEAE325F060D4CF2828B2@SA1PR10MB5885.namprd10.prod.outlook.com">
<div dir="ltr">
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;">:<span></span></b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;"><br>
</b></div>
<div dir="ltr"><b style="font-family: Calibri, sans-serif; font-size: inherit;">The reason
that CDS doesn't archive signed clas<span>ses is because we
aren't sure if we skip the whole signature checking
process at run time, we can still ensure that all APIs
related to code signing (eg Class.getSigners) can return
the expected value.<span></span></span></b></div>
<br>
</div>
</blockquote>
Just to add add that this was an issue when jlink was introduced in
JDK 9 too. There was exploration into persisting the signer
information into the runtime image so that signer information is
available at runtime if needed. In the end, it didn't go too far and
jlink now errors if you attempt to link in a module that is signed,
need to use --ignore-signing-information to drop the signer
information at link time.<br>
<br>
Probably time to have another go as dropping signed JAR support from
the class path and module path as it's too troublesome and don't do
what people think.<br>
<br>
-Alan<br>
</body>
</html>