Integrated: 8309841: Jarsigner should print a warning if an entry is removed

Weijun Wang weijun at openjdk.org
Wed Oct 2 22:58:41 UTC 2024


On Fri, 7 Jun 2024 15:11:29 GMT, Weijun Wang <weijun at openjdk.org> wrote:

> There ~are two~ is one change~s~:
> 
> 1. In `jarsigner -verify`, check a .SF file contains un-existing entries and print them out as
> 
> Warning: nonexistent signed entries detected: [a]
> 
> ~2. In `JarSigner::sign0`, when creating a new .SF file, only include signed file entries.~
> 
> *Update*: Even when the JAR file is re-signed, the hash entry for the missing file will be in the new .SF file. There is no way to tell if this is for a file entry or a user-defined entry.

This pull request has now been integrated.

Changeset: bdfb41f9
Author:    Weijun Wang <weijun at openjdk.org>
URL:       https://git.openjdk.org/jdk/commit/bdfb41f977258831e4b0ceaef5d016d095ab6e7f
Stats:     241 lines in 5 files changed: 240 ins; 0 del; 1 mod

8309841: Jarsigner should print a warning if an entry is removed

Reviewed-by: mullan, hchao

-------------

PR: https://git.openjdk.org/jdk/pull/19599


More information about the security-dev mailing list