Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8284101

Add JFR security event for signed JARs that are treated as unsigned

XMLWordPrintable

    • Icon: Enhancement Enhancement
    • Resolution: Unresolved
    • Icon: P3 P3
    • None
    • None
    • security-libs

      Signed JARs can be treated as unsigned for various reasons, such as parsing errors and use of disabled algorithms. It would be useful to add a security event to help alert users when this occurs and also add additional details such as the exception message and the name of the JAR, to help diagnose the issue.

      The events should be added in the following places:
      - https://github.com/openjdk/jdk/blob/61b8944327e3d12cf58dc3f6bc45ecbeba4ef611/src/java.base/share/classes/java/util/jar/JarVerifier.java#L332
      - ...

            coffeys Sean Coffey
            mullan Sean Mullan
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: