RFR: 8339280: jarsigner -verify performs cross-checking between CEN and LOC [v7]

[Hai-May Chao]

On Wed, 19 Mar 2025 13:34:10 GMT, Weijun Wang <weijun at openjdk.org> wrote:

>> Hai-May Chao has updated the pull request incrementally with one additional commit since the last revision:
>> 
>>   Add testcase for entry name integrity check
>
> src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java line 1147:
> 
>> 1145:             Manifest locManifest = jis.getManifest();
>> 1146:             if (!compareManifest(cenManifest, locManifest)) {
>> 1147:                 return;
> 
> Here and within `compareManifest`, there are multiple early returns. Have you considered avoiding early returns and accumulating more warnings instead?

Good idea. Updated the code. Thanks.

> src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java line 1184:
> 
>> 1182:     }
>> 1183: 
>> 1184:     private void readEntry(InputStream is) throws IOException {
> 
> This can be rewritten as `is.transferTo(OutputStream.nullOutputStream())`.

Done.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/23532#discussion_r2004125794
PR Review Comment: https://git.openjdk.org/jdk/pull/23532#discussion_r2004126337