From 37b04027c9e684e34a872ed2ca7bf49d0ab70988 Mon Sep 17 00:00:00 2001 From: Sean Mullan Date: Fri, 12 Jun 2026 14:59:31 -0400 Subject: [PATCH] Initial revision. --- .../share/classes/jdk/internal/loader/URLClassPath.java | 5 ++++- .../share/classes/jdk/internal/module/ModulePath.java | 2 +- .../share/classes/jdk/internal/module/ModuleReferences.java | 2 +- test/jdk/java/security/Security/signedfirst/DynStatic.java | 2 ++ 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/src/java.base/share/classes/jdk/internal/loader/URLClassPath.java b/src/java.base/share/classes/jdk/internal/loader/URLClassPath.java index 907715756575d..ed8b2db6f460d 100644 --- a/src/java.base/share/classes/jdk/internal/loader/URLClassPath.java +++ b/src/java.base/share/classes/jdk/internal/loader/URLClassPath.java @@ -77,6 +77,7 @@ public class URLClassPath { private static final boolean JAR_CHECKING_ENABLED; private static final boolean DISABLE_CP_URL_CHECK; private static final boolean DEBUG_CP_URL_CHECK; + private static final boolean VERIFY_SIGNED_JAR; static { Properties props = System.getProperties(); @@ -95,6 +96,8 @@ public class URLClassPath { // the check is not disabled). p = props.getProperty("jdk.net.URLClassPath.showIgnoredClassPathEntries"); DEBUG_CP_URL_CHECK = p != null ? p.equals("true") || p.isEmpty() : false; + p = props.getProperty("jdk.verifySignedJar"); + VERIFY_SIGNED_JAR = p != null ? p.equals("true") || p.isEmpty() : false; } /* Search path of URLs passed to the constructor or by calls to addURL. @@ -685,7 +688,7 @@ private JarFile getJarFile(URL url) throws IOException { if (!p.exists()) { throw new FileNotFoundException(p.getPath()); } - return checkJar(new JarFile(new File(p.getPath()), true, ZipFile.OPEN_READ, + return checkJar(new JarFile(new File(p.getPath()), VERIFY_SIGNED_JAR, ZipFile.OPEN_READ, JarFile.runtimeVersion())); } @SuppressWarnings("deprecation") diff --git a/src/java.base/share/classes/jdk/internal/module/ModulePath.java b/src/java.base/share/classes/jdk/internal/module/ModulePath.java index 2804079c5f9ea..e564d0383c1c1 100644 --- a/src/java.base/share/classes/jdk/internal/module/ModulePath.java +++ b/src/java.base/share/classes/jdk/internal/module/ModulePath.java @@ -631,7 +631,7 @@ private Set jarPackages(JarFile jf) { */ private ModuleReference readJar(Path file) throws IOException { try (JarFile jf = new JarFile(file.toFile(), - true, // verify + false, // verify ZipFile.OPEN_READ, releaseVersion)) { diff --git a/src/java.base/share/classes/jdk/internal/module/ModuleReferences.java b/src/java.base/share/classes/jdk/internal/module/ModuleReferences.java index c87c039c13348..0b9327930aeef 100644 --- a/src/java.base/share/classes/jdk/internal/module/ModuleReferences.java +++ b/src/java.base/share/classes/jdk/internal/module/ModuleReferences.java @@ -236,7 +236,7 @@ static class JarModuleReader extends SafeCloseModuleReader { static JarFile newJarFile(String path) { try { return new JarFile(new File(path), - true, // verify + false, // verify ZipFile.OPEN_READ, JarFile.runtimeVersion()); } catch (IOException ioe) { diff --git a/test/jdk/java/security/Security/signedfirst/DynStatic.java b/test/jdk/java/security/Security/signedfirst/DynStatic.java index 17fab4cac5bfa..61f8b6e7b5c22 100644 --- a/test/jdk/java/security/Security/signedfirst/DynStatic.java +++ b/test/jdk/java/security/Security/signedfirst/DynStatic.java @@ -78,6 +78,7 @@ public static void main(String[] args) throws Exception { // Run the DynSignedProvFirst test program ProcessTools.executeTestJava("-classpath", TEST_CLASSES.toString() + File.pathSeparator + "exp.jar", + "-Djdk.verifySignedJar=true", "DynSignedProvFirst") .shouldContain("test passed"); @@ -88,6 +89,7 @@ public static void main(String[] args) throws Exception { ProcessTools.executeTestJava("-classpath", TEST_CLASSES.toString() + File.pathSeparator + "exp.jar", "-Djava.security.properties=" + STATIC_PROPS.toUri(), + "-Djdk.verifySignedJar=true", "StaticSignedProvFirst") .shouldContain("test passed"); }