This task is for tracking purposes, more details (and maybe sub-tasks) will be added once this area has been explored further.

In summary, Project Jigsaw will need a solution that ensures that only JDK modules from the same JDK build are linked together. A possible approach is that each JDK module has an extended module descriptor that includes a hash of all of its transitive dependencies and that this hash be checked by jlink. This approach might also help with the concern that 3rd party crypto providers might be linked into the runtime image on the assumption that they are Oracle crypto..