-
Sub-task
-
Resolution: Delivered
-
P4
-
24
If an entry is removed from a signed JAR file, there is no mechanism to detect that it has been removed using the `JarFile` API, since the `getJarEntry` method returns `null` as if the entry had never existed. With this change, the `jarsigner -verify` command analyzes the signature files and if some sections do not have matching file entries, it prints out the following warning: "This JAR contains signed entries for files that do not exist". Users can further find out the names of these entries by adding the `-verbose` option to the command.