The class description for JarFile currently has the following text:

"Please note that the verification process does not include validating the signer's certificate. A caller should inspect the return value of JarEntry.getCodeSigners() to further determine if the signature can be trusted."

The class description of JarInputStream also has a similar warning.

A similar warning should be added to the getCertificates and getCodeSigners methods of JarEntry and the getCertificates method of JarURLConnection since these are the methods that return the code signer's certificate chain. We should state that these methods do not validate or establish trust in the code signer and instead it is the caller's responsibility to do that.