RFR: 8309841: Jarsigner should print a warning if an entry is removed [v2]
Hai-May Chao
hchao at openjdk.org
Thu Sep 12 21:44:09 UTC 2024
On Thu, 12 Sep 2024 15:32:44 GMT, Weijun Wang <weijun at openjdk.org> wrote:
>> There ~are two~ is one change~s~:
>>
>> 1. In `jarsigner -verify`, check a .SF file contains un-existing entries and print them out as
>>
>> Warning: nonexistent signed entries detected: [a]
>>
>> ~2. In `JarSigner::sign0`, when creating a new .SF file, only include signed file entries.~
>>
>> *Update*: Even when the JAR file is re-signed, the hash entry for the missing file will be in the new .SF file. There is no way to tell if this is for a file entry or a user-defined entry.
>
> Weijun Wang has updated the pull request incrementally with one additional commit since the last revision:
>
> test enhancements
Suggest to add testcases to remove more than one entry or file ending with "*" in RemovedFiles.
-------------
PR Comment: https://git.openjdk.org/jdk/pull/19599#issuecomment-2347297843
More information about the security-dev
mailing list