mirror of
https://github.com/spring-projects/spring-boot.git
synced 2024-08-29 03:06:45 +08:00
Update Gradle and Maven plugins to write an empty `META-INF/BOOT.SF` file whenever there is a nested signed jar. This update allows Oracle Java 17 to correctly verify the nested JARs. The file is required because `JarVerifier` has code roughly equivalent to: if (!jarManifestNameChecked && SharedSecrets .getJavaUtilZipFileAccess().getManifestName(jf, true) == null) { throw new JarException("The JCE Provider " + jarURL.toString() + " is not signed."); } The `SharedSecrets.getJavaUtilZipFileAccess().getManifestName(jf, true)` call ends up in `ZipFile.getManifestName(onlyIfSignatureRelatedFiles)` which is a private method that we cannot override in our `NestedJarFile` subclass. By writing an empty `.SF` file we ensure that the `Manifest` is always returned because there are always "signature related files". Fixes gh-28837 |
||
---|---|---|
.. | ||
src | ||
build.gradle |