> Some call sites of SignatureFileVerifier.isBlockOrSF fails to check that > files reside in META-INF directly, and not in a subdirectory of META-INF. > > The mentioned call sites needs updates to check and ignore such files. > > A new test VerifyUnrelatedSignatureFiles is added which verifies that [*.SF, > *.RSA] files in META-INF/ subdirectories are indeed ignored.
Eirik Bjorsnos has updated the pull request incrementally with two additional commits since the last revision: - The accidental regression where MANIFEST.MF was incorrecly not matched by SignatureFileVerifier.isSigningRelated revealed was not caught by any test. Adding a sanity check to IgnoreUnrelatedSignatureFiles which verifies that a basic signed JAR has the expected manifest sections. - The update of SignatureFileVerifier.isSigningRelated to call isInMetaInf accidentally removed "META-INF/" prefix stripping. This broke some checks in the remainder of this method. I chose to restore current behaviour by comparing MANIFEST.MF and "SIG-" files using the full path. This saves the allocation caused by substring and also makes sure isBlockOrSF now always called with the full path. ------------- Changes: - all: https://git.openjdk.org/jdk/pull/11976/files - new: https://git.openjdk.org/jdk/pull/11976/files/c3a19971..34873625 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=11976&range=10 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=11976&range=09-10 Stats: 21 lines in 2 files changed: 17 ins; 0 del; 4 mod Patch: https://git.openjdk.org/jdk/pull/11976.diff Fetch: git fetch https://git.openjdk.org/jdk pull/11976/head:pull/11976 PR: https://git.openjdk.org/jdk/pull/11976
