-
Enhancement
-
Resolution: Unresolved
-
P3
-
None
-
None
Signed JARs can be treated as unsigned for various reasons, such as parsing errors and use of disabled algorithms. It would be useful to add a security event to help alert users when this occurs and also add additional details such as the exception message and the name of the JAR, to help diagnose the issue.
The events should be added in the following places:
- https://github.com/openjdk/jdk/blob/61b8944327e3d12cf58dc3f6bc45ecbeba4ef611/src/java.base/share/classes/java/util/jar/JarVerifier.java#L332
- ...
The events should be added in the following places:
- https://github.com/openjdk/jdk/blob/61b8944327e3d12cf58dc3f6bc45ecbeba4ef611/src/java.base/share/classes/java/util/jar/JarVerifier.java#L332
- ...