elharo opened a new issue, #149:
URL: https://github.com/apache/maven-jarsigner-plugin/issues/149
**Affected version:** HEAD
**File:**
`src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:290-292`
The validation of `tsapolicyid` length produces a misleading warning when
neither `tsa` nor `tsacert` are configured:
```java
if (tsapolicyid.length > tsa.length || tsapolicyid.length > tsacert.length) {
getLog().warn(getMessage("warnUsageTsapolicyidTooMany",
tsapolicyid.length, tsa.length, tsacert.length));
}
```
If both `tsa` and `tsacert` are length 0 (user didn't configure any TSA
servers), the condition `tsapolicyid.length > 0` is true whenever the user has
configured any policy IDs. The warning says "Too many OIDs" (implying the count
is excessive) but the actual problem is that zero TSA servers are configured,
so all OIDs will be silently ignored regardless.
The fix should first check if at least one TSA source is configured before
comparing counts, or adjust the warning message to reflect the actual problem.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
