Community
Participate
Working Groups
There seems to be a problem related to pack200 and jar signing in 3.5 RC1 Steps to reproduce: 1. Download http://download.eclipse.org/eclipse/updates/3.5milestones/S-3.5RC1-200905151143/plugins/org.eclipse.jdt.apt.pluggable.core_1.0.200.v20090429-1720.jar.pack.gz 2. unpack200 ./org.eclipse.jdt.apt.pluggable.core_1.0.200.v20090429-1720.jar.pack.gz org.eclipse.jdt.apt.pluggable.core_1.0.200.v20090429-1720.jar 3. jarsigner -verify org.eclipse.jdt.apt.pluggable.core_1.0.200.v20090429-1720.jar Results in: jarsigner: java.lang.SecurityException: SHA1 digest error for org/eclipse/jdt/internal/apt/pluggable/core/Apt6CompilationParticipant.class bug 232008 seems to be related May this be a problem with jar normalization? See http://java.sun.com/j2se/1.5.0/docs/guide/deployment/deployment-guide/pack200.html "3. Signing the JAR files. Pack200 rearranges the contents of the resultant JAR file. The jarsigner hashes the contents of the class file and stores the hash in an encrypted digest in the manifest. When the unpacker runs on a packed packed, the contents of the classes will be rearranged and thus invalidate the signature. Therefore, the JAR file must be normalized first using pack200 and unpack200, and thereafter signed."
Assigning to releng
Walter, can you retag the org.eclipse.jdt.apt.pluggable.core bundle and submit it to the build. I think the problem may be that in the build, we are reusing the bundle from 429 and the fix identified in bug 232008 for update core was released into the builder after this date. Thus this bundle still has the same issue. The bundle needs to be rebuilt with the new builder and submitting a new version to the build will force this to happen.
retagged
Forgot to mention, we had the same problem with: http://download.eclipse.org/eclipse/updates/3.5milestones/S-3.5RC1-200905151143/plugins/org.eclipse.jdt.compiler.apt_1.0.200.v20090429-1720.jar.pack.gz and http://download.eclipse.org/eclipse/updates/3.5milestones/S-3.5RC1-200905151143/plugins/org.eclipse.jdt.compiler.tool_1.0.100.v_959a.jar.pack.gz
Kim, I wonder if there is a way to scan all plug-ins? I will retag compiler.apt, but compiler.tool belongs to JDT Core.
I've also retagged all the other APT plugins that were 4/29 or older.
I can run a script against the entire repo.
RC3 is past. Can this be marked fixed?
Looked at this issue again today. There was a bug in our bootstrap script that caused pack200 files to be created in by a 1.6 vm instead of a 1.5 vm. (There are pack200 compatibility issues). This has been fixed for tonight's build. I'll run the script against the repo again tomorrow to verify the pack200 files.
Ran the jar verifier script against the packed jars and verified the packed jars in I20090602-2000 don't have any checksum errors. java -cp plugins/org.eclipse.equinox.p2.jarprocessor_1.0.100.v20090520-1905.jar org.eclipse.equinox.internal.p2.jarprocessor.verifier.Verifier -dir <tempWorkingDir> <inputfolder>
