RFR: 8277474: jarsigner does not check if algorithm parameters are disabled
Weijun Wang
weijun at openjdk.java.net
Wed Mar 2 16:31:05 UTC 2022
On Tue, 22 Feb 2022 22:00:05 GMT, Hai-May Chao <hchao at openjdk.org> wrote:
> This fixes jarsigner to enforce checking against algorithm constraint properties so when the signature algorithms parameters use disabled or legacy algorithms, it will emit warnings accordingly. If the algorithm used in parameters is disabled, jarsigner treats the jar as unsigned.
The return values of the 2 updated `verifyWithWeak` methods need to be fixed.
-------------
Changes requested by weijun (Reviewer).
PR: https://git.openjdk.java.net/jdk/pull/7582
More information about the security-dev
mailing list