<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Thanks Thomas and Sean for your review comments.<div class=""><br class=""></div><div class="">KeyStoreDelegator matches the JDK 9 version. I’ve moved it to the sun.security.package and modified it as suggested.</div><div class="">I also made JavaKeyStore package-private but DualFormatJKS needs to remain public.</div><div class="">The cert in trusted.pem is an arbitrary X.509 cert and I’ve added a comment in the TestKeystoreCompat test.<br class=""><div class=""><br class=""></div><div class="">A new webrev is available at:<br class=""><div class=""> <a href="http://cr.openjdk.java.net/~vinnie/8062552/webrev.02/" class="">http://cr.openjdk.java.net/~vinnie/8062552/webrev.02/</a></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 22 May 2015, at 16:27, Sean Mullan <<a href="mailto:sean.mullan@oracle.com" class="">sean.mullan@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">Just a couple of other comments:<br class=""><br class="">- Both JavaKeyStore and JavaKeyStore$DualFormatJKS can be package-private since they are only referenced from SunEntries which is in the same package. I would also move KeyStoreDelegator into sun.security.provider and make it package-private.<br class=""><br class="">- Can you add a comment describing the contents of the trusted.pem cert in case we need to re-create it at some point in the future?<br class=""><br class="">- In KeyStoreDelegator, I think most/all of the fields can be made final.<br class=""><br class="">--Sean<br class=""><br class="">On 05/21/2015 11:44 AM, Vincent Ryan wrote:<br class=""><blockquote type="cite" class="">Please review this enhancement to JDK 8u that addresses a compatibility risk for certain applications that access<br class="">keystores across JDK 8 and JDK 9 releases. The issue arises because the default keystore type is now PKCS12 in<br class="">JDK 9 but is JKS in earlier releases. The problem can occur when a keystore is created on JDK 9 using the default<br class="">keystore type but accessed on JDK 8 also using the default keystore type. This keystore type mismatch results in<br class="">an error.<br class=""><br class="">The change introduces a keystore compatibility mode for JKS keystores where both JKS and PKCS12 file formats are<br class="">understood. Similar behaviour is already present in JDK 9 (JEP-229). The keystore.type.compat security property<br class="">controls whether the mode is enabled or not. By default it is enabled.<br class=""><br class="">This enhancement enables at risk applications to continue to function across JDK 8 and JDK 9 without requiring any<br class="">application code changes.<br class=""><br class="">Thanks.<br class=""><br class="">Bug: <a href="https://bugs.openjdk.java.net/browse/JDK-8062552" class="">https://bugs.openjdk.java.net/browse/JDK-8062552</a><br class="">Webrev: <a href="http://cr.openjdk.java.net/~vinnie/8062552/webrev.01/" class="">http://cr.openjdk.java.net/~vinnie/8062552/webrev.01/</a><br class=""><br class=""></blockquote></div></blockquote></div><br class=""></div></div></div></body></html>