Write signature files to uber jars to for Oracle Java 17 verification

Update Gradle and Maven plugins to write an empty `META-INF/BOOT.SF`
file whenever there is a nested signed jar.

This update allows Oracle Java 17 to correctly verify the nested JARs.
The file is required because `JarVerifier` has code roughly equivalent
to:

	if (!jarManifestNameChecked && SharedSecrets
			.getJavaUtilZipFileAccess().getManifestName(jf, true) == null) {
    	throw new JarException("The JCE Provider " + jarURL.toString() +
    		" is not signed.");
	}

The `SharedSecrets.getJavaUtilZipFileAccess().getManifestName(jf, true)`
call ends up in `ZipFile.getManifestName(onlyIfSignatureRelatedFiles)`
which is a private method that we cannot override in our `NestedJarFile`
subclass. By writing an empty `.SF` file we ensure that the `Manifest`
is always returned because there are always "signature related files".

Fixes gh-28837
This commit is contained in:
Phillip Webb
2023-10-09 18:37:10 -07:00
parent fe752dedef
commit 33c5e1269a
17 changed files with 266 additions and 17 deletions

View File

@@ -37,7 +37,6 @@ import org.springframework.boot.testsupport.testcontainers.DisabledIfDockerUnava
import org.springframework.util.Assert;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assumptions.assumeThat;
/**
* Integration tests loader that supports fat jars.
@@ -66,7 +65,6 @@ class LoaderIntegrationTests {
@ParameterizedTest
@MethodSource("javaRuntimes")
void runSignedJar(JavaRuntime javaRuntime) {
assumeThat(javaRuntime.toString()).isNotEqualTo("Oracle JDK 17"); // gh-28837
try (GenericContainer<?> container = createContainer(javaRuntime, "spring-boot-loader-tests-signed-jar",
null)) {
container.start();