Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8057797

add a -quiet option for JarSigner

XMLWordPrintable

    • Icon: Enhancement Enhancement
    • Resolution: Not an Issue
    • Icon: P4 P4
    • None
    • 7u67, 9
    • security-libs

      A DESCRIPTION OF THE REQUEST :
      With jdk7u51-b02, JarSigner got enhanced to have improved verification output and nag the user to use timestamping. (http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/7f2fc6c7c6dd)

      Alongside got introduced that JarSigner unconditionally outputs "jar signed." in the end.
      This is not so nice for quiet builds, as you cannot distinguish between info logging and warning / error logging and the log level is not configurable, except by -verbose.

      Please add a -quiet option for JarSigner that suppresses the final "jar signed." output, so that only warnings and errors are output.

      JUSTIFICATION :
      If you e. g. use the JarSigner from a Gradle build, you cannot tell the Gradle build to be quiet and only output errors or warnings. You can make the JarSigner output only appear on INFO level, but then warnings and errors are also only visible on INFO level. And capturing its output and deciding on parsing whether there are warnings or errors is not really nice, besides that we call JarSigner in-process to save time and resources.

      Any workflow that involves some automatic building that should not output any messages except if there are erorrs or warnings is affected by this, not only Gradle in-process workflows.

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      No output during normal successfull operation if "-quiet" is used.
      ACTUAL -
      No "-quiet" available

            weijun Weijun Wang
            webbuggrp Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: