[9] request for review 8047353: Improve error message when a JAR with invalid signatures is loaded
Vincent Ryan
vincent.x.ryan at oracle.com
Fri Jun 20 12:21:46 UTC 2014
Hello Aaron,
I considered using your testcase that manually generates the necessary malformed JAR
but as there was a suitable signed JAR already in the test suite I decided to re-use that.
I think it makes sense to re-work the test as a Java program. Unfortunately I’ll be on vacation
from today but I’ll return to this issue when I get back.
Thanks.
On 20 Jun 2014, at 11:00, Aaron Digulla <digulla at hepe.com> wrote:
> Am Donnerstag, 19. Juni 2014 23:49 CEST, Joe Darcy <joe.darcy at oracle.com> schrieb:
>
>> I'd prefer to see the CheckJarSigError.sh as a Java program.
>
> There original bug report contains a full self-contained test case in Java. Why was that split into several files?
>
> I'm also a bit uneasy about the "just show the file name". I have thousands of JARs with the same name on my harddisk (several Maven repos, target folders, you name it). If you strip the path from the error message, then I have to somehow figure out the classpath which was used.
>
> That might work when I run Java from the command line but when I use complex frameworks like OSGi or Maven which do all kinds of magic to determine which JARs they might want to load, then this doesn't help much.
>
>
> At least add a command line option / system property which allows to see the full path.
>
> Regards,
>
> --
> Aaron "Optimizer" Digulla a.k.a. Philmann Dark
> "It's not the universe that's limited, it's our imagination.
> Follow me and I'll show you something beyond the limits."
> http://blog.pdark.de/
More information about the security-dev
mailing list