On Thu, 10 Nov 2022 01:02:00 GMT, pandaapo <duke at openjdk.org> wrote: > The cache named `signerToCodeSource` in `JarVerifier` is never used now. I'm not sure. You can probably ask on jdk8u-dev at openjdk.java.net. ------------- PR: https://git.openjdk.org/jdk/pull/11072