code review request: 7081783: jarsigner error when no $HOME/.keystore

Xuelei Fan xuelei.fan at oracle.com
Thu Sep 1 04:37:43 UTC 2011


On 9/1/2011 12:31 PM, Weijun Wang wrote:
> 
> On 08/31/2011 09:17 PM, Xuelei Fan wrote:
>> I understand the code, fine to me. But the loadKeyStore() method looks
>> really ugly and lazy. :-)
> 
> It's ugly, but not very lazy.
> 
Lazy code is not a bad coding style. ;-)

> Anyway, I'm going to putback this version since you already said fine.
> 
Please go ahead. It's fine to me. I just want to talk about some of my
concerns.

Thanks,
Xuelei

>>
>> Just for your reference in the inline comments.
>>
> ...
> 
>>>
>>> Well, it looks more correct, but is complicated in 2 senses:
>>>
>>> 1. ~/.keystore and user-specified -keystore are not treated the same.
>>> You can ignore ~/.keystore, but if a user-specified -keystore does not
>>> exist, it's an error.
>>>
>> We can handle the logic simply at the following blok, right?
>> 1562 if (!nullStream&&  keyStoreName == null) {
>> 1563     keyStoreName = System.getProperty("user.home") + File.separator
>> 1564         + ".keystore";
>> +        // check file existence, ignore it if non-exist
>> 1565 }
>>
>>> 2. signing and verification have different behaviors on exception
>>> handling. See above.
>>>
>> We don't need to make more significant update in other blocks because of
>> we have ignore the non-exist keystore, right? If no required private
>> key, the following steps will throw the expected exception.
> 
> If you ignore non-existing ~/.keystore, there will be no exception, and
> store will be either null or uninitialized. Then when it's used, NPE or
> KeyStoreException will be thrown and the user is confused. So you still
> need to check it earlier.
> 
> Thanks
> Max
> 
>>
>> Or is there any other thing that I missed?
>>
>> Thanks,
>> Xuelei




More information about the security-dev mailing list