Release Note: "Not Signed by Alias in This Keystore" No Longer a Severe Warning

XMLWordPrintable

    • Type: Sub-task
    • Resolution: Unresolved
    • Priority: P4
    • tbd
    • Affects Version/s: None
    • Component/s: security-libs

      The "not signed by alias in this keystore" warning, originally treated as a severe warning that triggered a non-zero exit code if `-strict` was used, has been reclassified. In practice, a signed JAR file is typically verified by someone other than the signer, so it's unrealistic to expect the verifier to have the signer's key or certificate in their local keystore. This warning is now considered informational and does not result in a non-zero exit code. Additionally, the warning's implementation has been updated to only check the signer's end-entity certificate, without considering whether any Certificate Authorities (CAs) associated with it are in the keystore.

            Assignee:
            Weijun Wang
            Reporter:
            Weijun Wang
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: