mirror of
https://github.com/spring-projects/spring-boot.git
synced 2024-08-29 03:06:45 +08:00
33c5e1269a
Update Gradle and Maven plugins to write an empty `META-INF/BOOT.SF`
file whenever there is a nested signed jar.
This update allows Oracle Java 17 to correctly verify the nested JARs.
The file is required because `JarVerifier` has code roughly equivalent
to:
if (!jarManifestNameChecked && SharedSecrets
.getJavaUtilZipFileAccess().getManifestName(jf, true) == null) {
throw new JarException("The JCE Provider " + jarURL.toString() +
" is not signed.");
}
The `SharedSecrets.getJavaUtilZipFileAccess().getManifestName(jf, true)`
call ends up in `ZipFile.getManifestName(onlyIfSignatureRelatedFiles)`
which is a private method that we cannot override in our `NestedJarFile`
subclass. By writing an empty `.SF` file we ensure that the `Manifest`
is always returned because there are always "signature related files".
Fixes gh-28837
|
||
|---|---|---|
| .. | ||
| spring-boot | ||
| spring-boot-actuator | ||
| spring-boot-actuator-autoconfigure | ||
| spring-boot-autoconfigure | ||
| spring-boot-dependencies | ||
| spring-boot-devtools | ||
| spring-boot-docker-compose | ||
| spring-boot-docs | ||
| spring-boot-parent | ||
| spring-boot-starters | ||
| spring-boot-test | ||
| spring-boot-test-autoconfigure | ||
| spring-boot-testcontainers | ||
| spring-boot-tools | ||