On Wed, 18 Jan 2023 09:47:29 GMT, Eirik Bjorsnos <d...@openjdk.org> wrote:
>> Some call sites of SignatureFileVerifier.isBlockOrSF fails to check that >> files reside in META-INF directly, and not in a subdirectory of META-INF. >> >> The mentioned call sites needs updates to check and ignore such files. >> >> A new test VerifyUnrelatedSignatureFiles is added which verifies that [*.SF, >> *.RSA] files in META-INF/ subdirectories are indeed ignored. > > Eirik Bjorsnos has updated the pull request incrementally with four > additional commits since the last revision: > > - Introduce SignatureFileVerifier.isInMetaInf as a common method to replace > duplicated logic in JarVerifier, JarSigner and > SignatureFileVerifier.isSigningRelated. > > This introduces two subtle behavioural changes: > > - JarSigner is relaxed to ignore case when checking isInMetaInf, meaning > "meta-inf/" files will now be moved to the beginning of the signed JAR > - JarVerifier is tightened to reject /META-INF/ as not in META-INF/. This > is believed to have little impact, since ZipFile.Source.isMetaName already > rejects such paths. > - jarsigner -verify should also ignore unrelated signature files > - Style: Added whitespace separators between keyword and left parenthesis > for try,while,if.Removed final accessors for some local variables. > - Replacing File.createTempFile with Path.of lets jtreg handle retention of > JARs created during the test I added a few style fixes to the test which primarily adds whitespace between try,for,while,if and their following left parenthesis. ------------- PR: https://git.openjdk.org/jdk/pull/11976
