JDK-8242262 : Add forRemoval=true to already deprecated ContentSigner
  • Type: CSR
  • Component: security-libs
  • Sub-Component: jdk.security
  • Priority: P3
  • Status: Closed
  • Resolution: Approved
  • Fix Versions: 15
  • Submitted: 2020-04-07
  • Updated: 2020-04-16
  • Resolved: 2020-04-14
Related Reports
CSR :  
Description
Summary
------

Terminally deprecate (add  `forRemoval=true) the following JDK-specific APIs, these APIs have been deprecated since JDK 9.

```
com.sun.jarsigner.ContentSigner
ContentSignerParameters
```

Problem
------
The function was deprecated in JDK 9. Now it's time to mark them for removal.

Solution
------
Add the `forRemoval` argument to the related classes and update several `jarsigner` outputs.

Specification
------

    diff --git a/src/jdk.jartool/share/classes/com/sun/jarsigner/ContentSigner.java b/src/jdk.jartool/share/classes/com/sun/jarsigner/ContentSigner.java
    --- a/src/jdk.jartool/share/classes/com/sun/jarsigner/ContentSigner.java
    +++ b/src/jdk.jartool/share/classes/com/sun/jarsigner/ContentSigner.java
    @@ -38,7 +38,7 @@
      * @deprecated This class has been deprecated.
      */
    
    -@Deprecated(since="9")
    +@Deprecated(since="9", forRemoval=true)
     public abstract class ContentSigner {
    
         /**
    diff --git a/src/jdk.jartool/share/classes/com/sun/jarsigner/ContentSignerParameters.java b/src/jdk.jartool/share/classes/com/sun/jarsigner/ContentSignerParameters.java
    --- a/src/jdk.jartool/share/classes/com/sun/jarsigner/ContentSignerParameters.java
    +++ b/src/jdk.jartool/share/classes/com/sun/jarsigner/ContentSignerParameters.java
    @@ -36,7 +36,7 @@
      * @author Vincent Ryan
      * @deprecated This class has been deprecated.
      */
    -@Deprecated(since="9")
    +@Deprecated(since="9", forRemoval=true)
     public interface ContentSignerParameters {
    
         /**

    diff --git a/src/jdk.jartool/share/classes/com/sun/jarsigner/package-info.java b/src/jdk.jartool/share/classes/com/sun/jarsigner/package-info.java
    --- a/src/jdk.jartool/share/classes/com/sun/jarsigner/package-info.java
    +++ b/src/jdk.jartool/share/classes/com/sun/jarsigner/package-info.java
    @@ -30,9 +30,9 @@
      * tool by supplying an alternative implementation of
      * {@link com.sun.jarsigner.ContentSigner}.
      *
    - * The classes in this package have been deprecated. New classes should not be
    - * added to this package. Use the {@link jdk.security.jarsigner.JarSigner} API
    - * to sign JAR files.
    + * The classes in this package have been deprecated and will be removed in
    + * a future release. New classes should not be added to this package.
    + * Use the {@link jdk.security.jarsigner.JarSigner} API to sign JAR files.
      */
     
     package com.sun.jarsigner;

Also, update jarsigner to show the following messages on the help screen:

    $ jarsigner
    Usage: jarsigner [options] jar-file alias
           jarsigner -verify [options] jar-file [alias...]
    
    ....
    [-altsigner <class>]        class name of an alternative signing mechanism
                                (This option is deprecated and will be removed in a future release.)
    
    [-altsignerpath <pathlist>] location of an alternative signing mechanism
                                (This option is deprecated and will be removed in a future release.)
    ....

An updated warning will also be shown when an deprecated option is used:

    $ jarsigner -altsigner X
    This option is deprecated and will be removed in a future release: -altsigner


Comments
Updated the jarsigner help screen, s/has been deprecated/is deprecated/.
16-04-2020

Moving to Approved.
14-04-2020

We decide to only add a `forRemoval=true` argument this time.
14-04-2020

[~darcy] Is it acceptable if I keep the classes but do not use them anywhere? This means "jarsigner -altsigner" will report an unknown option error, and JarSigner$Builder.setProperty("altsigner") will throw an UOE, but at least any user provided ContentSigner implementation still compiles.
10-04-2020

Oh no. Sean noticed the classes in `com.sun.jarsigner` was not deprecated with a `forRemoval = true` argument. It needs to be done first before an actual removal. I'll update the CSR.
09-04-2020

Done. Thanks.
09-04-2020

Moving to Provisional. Please include the removed tooldoc text in the specification section when the request is re-Finalized.
08-04-2020