[9] request for review 8047353: Improve error message when a JAR with invalid signatures is loaded

Aaron Digulla digulla at hepe.com
Fri Jun 20 10:00:01 UTC 2014


Am Donnerstag, 19. Juni 2014 23:49 CEST, Joe Darcy <joe.darcy at oracle.com> schrieb: 
 
> I'd prefer to see the CheckJarSigError.sh as a Java program.

There original bug report contains a full self-contained test case in Java. Why was that split into several files?

I'm also a bit uneasy about the "just show the file name". I have thousands of JARs with the same name on my harddisk (several Maven repos, target folders, you name it). If you strip the path from the error message, then I have to somehow figure out the classpath which was used.

That might work when I run Java from the command line but when I use complex frameworks like OSGi or Maven which do all kinds of magic to determine which JARs they might want to load, then this doesn't help much.


At least add a command line option / system property which allows to see the full path.

Regards,
 
-- 
Aaron "Optimizer" Digulla a.k.a. Philmann Dark
"It's not the universe that's limited, it's our imagination.
Follow me and I'll show you something beyond the limits." 
http://blog.pdark.de/ 


More information about the security-dev mailing list