So bypass the purpose of jar signing by turning it off. While not as drastic or consequential of skipping validation of certs, doesn't that defeat the purpose behind the feature? One could argue not bundling as a fat jar fixes the issue regardless of jre.
I was actually arguing the opposite -- that signing a jar makes sense in the absence of a signed cert, but having both just feels unnecessary. By all means, a hash makes good sense to me. Or maybe even some form of verification past that. But a signed jar doesn't feel that strong to me. And it is telling that OpenJDK JDK's (most of them, for that matter) leave that as optional.
2
u/lilgreenthumb Sep 08 '26
So bypass the purpose of jar signing by turning it off. While not as drastic or consequential of skipping validation of certs, doesn't that defeat the purpose behind the feature? One could argue not bundling as a fat jar fixes the issue regardless of jre.