RFR: 8242068: Signed JAR support for RSASSA-PSS and EdDSA [v5]

Weijun Wang weijun at openjdk.java.net
Tue Oct 13 12:35:26 UTC 2020

> Major points in CSR at https://bugs.openjdk.java.net/browse/JDK-8245274:
> - new sigalg "RSASSA-PSS", "EdDSA", "Ed25519" and "Ed448" can be used in jarsigner
> - The ".RSA" and ".EC" block extension types (PKCS #7 SignedData inside a signed JAR) are reused for new signature
>   algorithms
> - A new JarSigner property "directsign"
> - Updating the jarsigner tool doc
> Major code changes:
> - Always use the signature algorithm directly as SignerInfo::signatureAlgorithm. We used to use the encryption algorithm
>   there like RSA, DSA, and EC. Now it's always SHA1withRSA or RSASSA-PSS.
> - Move signature related utilities methods from AlgorithmId.java to SignatureUtil.java
> - Add new SignatureUtil methods fromKey() and fromSignature() to simplify creating Signature and getting its AlgorithmId
> - Use the new methods in PKCS10, X509CertImpl, and X509CRLImpl signing
> - Add a new (and intuitive, IMHO) PKCS7::generateNewSignedData capable of all old and new signature algorithms
> - Mark all -altsign related code deprecated and they can be removed once ContentSigner is removed

Weijun Wang has updated the pull request incrementally with one additional commit since the last revision:

  support rfc5652 CMSAlgorithmProtection


  - all: https://git.openjdk.java.net/jdk/pull/322/files
  - new: https://git.openjdk.java.net/jdk/pull/322/files/fecf30d7..81513907

 - full: https://webrevs.openjdk.java.net/?repo=jdk&pr=322&range=04
 - incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=322&range=03-04

  Stats: 72 lines in 5 files changed: 65 ins; 0 del; 7 mod
  Patch: https://git.openjdk.java.net/jdk/pull/322.diff
  Fetch: git fetch https://git.openjdk.java.net/jdk pull/322/head:pull/322

PR: https://git.openjdk.java.net/jdk/pull/322

More information about the compiler-dev mailing list