JDK-8302819 : Remove JAR Index
  • Type: Enhancement
  • Component: core-libs
  • Sub-Component: java.util.jar
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2023-02-19
  • Updated: 2024-04-12
  • Resolved: 2023-04-10
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 21
21 b18Fixed
Related Reports
CSR :  
JDK-8305597 - Remove JAR Index
Duplicate :  
JDK-8263650 - Re-examine JAR index support
Relates :  
JDK-8273401 - Disable JarIndex Support In URLClassPath
Relates :  
JDK-8305758 - Update the JAR tool man page to indicate -i/--generate-file is deprecated
Relates :  
JDK-6957241 - ClassLoader.getResources() returns only 1 instance when using jar indexing
Sub Tasks
JDK-8305603 :  
Release Note: Remove the JAR Index Feature - Resolved
Description
JAR Index is a legacy optimization from early JDK releases to allow downloading of JAR files to be postponed when loading applets or other classes over the network. It is specified in the JAR file spec. JAR Index doesn't interact well with other features and has several long standing issues. Some examples:

- The JAR index file (META-INF/INDEX.LIST) is ignored in modular JARs. 

- The JAR index is not reliable when be used with Multi-Release JAR files, e.g. when the versioned section has classes/resources in "new packages".

- URLClassLoader::findResources does not locate resources in more than one JAR file when a JAR index is present.

- JarInputStream::getManifest can not return the Manifest because the index is stored as the first entry in the JAR file.

We had hoped to deprecate or remove JAR Index in Java 9 but didn't get to it. In JDK 18, the support at runtime to ignore JAR index files by default with a system property to re-enable if needed. There has been no feedback on this change.

It is time to remove the JAR Index feature. Removing this feature means:

- Removing the JAR Index section from the JAR file spec or changing it document it as a historical feature.

- The jar -i (--generate-index=FILE) option can continue to generate the JAR index or the option can be changed to just emit a warning.

- The system property jdk.net.URLClassPath.enableJarIndex can be removed.
Comments
Changeset: 0d45a524 Author: Eirik Bjorsnos <eirbjo@gmail.com> Committer: Lance Andersen <lancea@openjdk.org> Date: 2023-04-10 11:23:21 +0000 URL: https://git.openjdk.org/jdk/commit/0d45a524b3d29fd57a4d468d7b5af0f588db7409
10-04-2023
A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/13158 Date: 2023-03-23 12:05:50 +0000
28-03-2023
Thanks Alan, for your guidance. Let's agree to deal with 'jar -i' separately.
24-03-2023
There are several options for "jar -i". It can be left unchanged, augmented to print a warning, or changed to do nothing except print a warning. It's okay to do this with a separate PR.
24-03-2023
Further work on the PR is pending guidance from [~alanb] whether the deprecation warning of 'jar -i' should be included in the PR or handled by a seperate PR/CSR etc.
24-03-2023
Following some great feedback from Jaikiran, the PR now includes a cleanup of the moved JarIndex class such that only methods used by the implementation of 'jar -i' are left behind. https://github.com/openjdk/jdk/pull/13158
24-03-2023
Investigating the history of the current implementation of JarInputStream, I notice that 'doVerify' and 'tryManifest' were introduced by JDK-6544278. I was hoping to learn more by looking into this issue, however it is inaccessible to me, perhaps because the issue originally had some security implications?
23-03-2023
Thanks for that clarification. Seems JDK-8215788 added documentation for this in the ZipInputStream specification.
23-03-2023
The only API that depends on ordering is JarInputStream.
23-03-2023
An observation not necessarily relevant for this task/PR: The JAR File Specification does not seem to mandate any encounter-order of specified entries such as META-INF/, META-INF/MANIFEST.MF, META-INF/INDEX.LIST and signature-related files in META-INF. Several JAR-related implementation classes do however seem to assume or require that META-INF/MANIFEST.MF is either first of preceded only by META-INF/. Is this underspecification by design, an oversight, or something else?
23-03-2023
Looking at a first rough pass of this removal indicates that we would reduce the complexity significantly if the removal of jar -i / --generate-index could be handled in a separate PR. So I would prefer the option of just emitting a warning (or even not doing anything in this PR and handle it sepearately instead)
23-03-2023
No worries, Alan. (I was actually wondering were to find the sources since it didn't seem to be in the jdk repo)
23-03-2023
[~eirbjo] I can't do anything about that so we'll just need to agree the changes to the JAR file spec in the PR and coordinate the changes.
23-03-2023
[~alanb] Is the source code of the JAR File spec Oracle-internal?
23-03-2023
Here's a draft PR for the removal of the 'JAR index' feature: https://github.com/openjdk/jdk/pull/13158
23-03-2023