Write signature files to uber jars to for Oracle Java 17 verification

Update Gradle and Maven plugins to write an empty `META-INF/BOOT.SF`
file whenever there is a nested signed jar.

This update allows Oracle Java 17 to correctly verify the nested JARs.
The file is required because `JarVerifier` has code roughly equivalent
to:

	if (!jarManifestNameChecked && SharedSecrets
			.getJavaUtilZipFileAccess().getManifestName(jf, true) == null) {
    	throw new JarException("The JCE Provider " + jarURL.toString() +
    		" is not signed.");
	}

The `SharedSecrets.getJavaUtilZipFileAccess().getManifestName(jf, true)`
call ends up in `ZipFile.getManifestName(onlyIfSignatureRelatedFiles)`
which is a private method that we cannot override in our `NestedJarFile`
subclass. By writing an empty `.SF` file we ensure that the `Manifest`
is always returned because there are always "signature related files".

Fixes gh-28837

spring-boot-project/spring-boot-tools/spring-boot-loader-tools/src/test/java/org/springframework/boot/loader/tools/AbstractPackagerTests.java

@@ -660,7 +660,7 @@ abstract class AbstractPackagerTests<P extends Packager> {
 		return library.getFile();
 	}
 
-	private Library newLibrary(File file, LibraryScope scope, boolean unpackRequired) {
+	protected Library newLibrary(File file, LibraryScope scope, boolean unpackRequired) {
 		return new Library(null, file, scope, null, unpackRequired, false, true);
 	}
 
@@ -687,7 +687,7 @@ abstract class AbstractPackagerTests<P extends Packager> {
 				&& hasPackagedEntry("org/springframework/boot/loader/launch/JarLauncher.class");
 	}
 
-	private boolean hasPackagedEntry(String name) throws IOException {
+	protected boolean hasPackagedEntry(String name) throws IOException {
 		return getPackagedEntry(name) != null;
 	}
 

spring-boot-project/spring-boot-tools/spring-boot-loader-tools/src/test/java/org/springframework/boot/loader/tools/FileUtilsTests.java

@@ -17,9 +17,13 @@
 package org.springframework.boot.loader.tools;
 
 import java.io.File;
+import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.util.jar.JarOutputStream;
+import java.util.jar.Manifest;
+import java.util.zip.ZipEntry;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -99,4 +103,28 @@ class FileUtilsTests {
 		assertThat(FileUtils.sha1Hash(file)).isEqualTo("7037807198c22a7d2b0807371d763779a84fdfcf");
 	}
 
+	@Test
+	void isSignedJarFileWhenSignedReturnsTrue() throws IOException {
+		Manifest manifest = new Manifest(getClass().getResourceAsStream("signed-manifest.mf"));
+		File jarFile = new File(this.tempDir, "test.jar");
+		writeTestJar(manifest, jarFile);
+		assertThat(FileUtils.isSignedJarFile(jarFile)).isTrue();
+	}
+
+	@Test
+	void isSignedJarFileWhenNotSignedReturnsFalse() throws IOException {
+		Manifest manifest = new Manifest();
+		File jarFile = new File(this.tempDir, "test.jar");
+		writeTestJar(manifest, jarFile);
+		assertThat(FileUtils.isSignedJarFile(jarFile)).isFalse();
+	}
+
+	private void writeTestJar(Manifest manifest, File jarFile) throws IOException, FileNotFoundException {
+		try (JarOutputStream out = new JarOutputStream(new FileOutputStream(jarFile))) {
+			out.putNextEntry(new ZipEntry("META-INF/MANIFEST.MF"));
+			manifest.write(out);
+			out.closeEntry();
+		}
+	}
+
 }

spring-boot-project/spring-boot-tools/spring-boot-loader-tools/src/test/java/org/springframework/boot/loader/tools/RepackagerTests.java

@@ -28,6 +28,7 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Enumeration;
 import java.util.List;
+import java.util.jar.Attributes;
 import java.util.jar.JarEntry;
 import java.util.jar.JarFile;
 import java.util.jar.Manifest;
@@ -218,6 +219,20 @@ class RepackagerTests extends AbstractPackagerTests<Repackager> {
 		assertThat(stopWatch.getTotalTimeMillis()).isLessThan(5000);
 	}
 
+	@Test
+	void signedJar() throws Exception {
+		Repackager packager = createPackager();
+		packager.setMainClass("a.b.C");
+		Manifest manifest = new Manifest();
+		Attributes attributes = new Attributes();
+		attributes.putValue("SHA1-Digest", "0000");
+		manifest.getEntries().put("a/b/C.class", attributes);
+		TestJarFile libJar = new TestJarFile(this.tempDir);
+		libJar.addManifest(manifest);
+		execute(packager, (callback) -> callback.library(newLibrary(libJar.getFile(), LibraryScope.COMPILE, false)));
+		assertThat(hasPackagedEntry("META-INF/BOOT.SF")).isTrue();
+	}
+
 	private boolean hasLauncherClasses(File file) throws IOException {
 		return hasEntry(file, "org/springframework/boot/")
 				&& hasEntry(file, "org/springframework/boot/loader/launch/JarLauncher.class");

spring-boot-project/spring-boot-tools/spring-boot-loader-tools/src/test/resources/org/springframework/boot/loader/tools/signed-manifest.mf

@@ -0,0 +1,9 @@
+Manifest-Version: 1.0
+Created-By: 1.5.0_08 (Sun Microsystems Inc.)
+Specification-Version: 1.1
+
+Name: org/bouncycastle/pqc/legacy/math/linearalgebra/GoppaCode.class
+SHA-256-Digest: wNhEfeTvNG9ggqKfLjQDDoFoDqeWwGUc47JiL7VqxqU=
+
+Name: org/bouncycastle/crypto/modes/gcm/Tables8kGCMMultiplier.class
+SHA-256-Digest: nqljr9DNx4nNie4sbkZajVenvd3LdMF3X5s5dmSMToM=