Jar's CodeSigner null on Java 10, non-null on Java 8

[Weijun Wang]

> On Oct 8, 2018, at 1:26 AM, Alan Bateman <Alan.Bateman at oracle.com> wrote:
> 
> On 07/10/2018 18:08, Scott Palmer wrote:
>> Thanks Alan.  I think this is exactly the issue I was hitting.
>> 
>> Is it currently not possible to ensure modules have not been tampered with?
>> 
> The signature checking for signed JARs on the module path is the same as that done for signed JARs on the class path. So if your signed JARs has been tampered with you should get an exception at startup.

That said, if someone modifies the content of your signed JARs and then simply removes the signature-related files, the JARs will be loaded successfully. Of course, they are treated as unsigned, but as you have observed and reported, even a correctly signed JAR is treated as unsigned too.

--Max

> 
> -Alan