While handling bug 2051963, I see that `jarsigner` (which is used to validate AABs) now complains about SHA1: ``` jarsigner -verify -verbose fenix-automotive-2051963-dep-signed.aab [...] m ? 801 Thu Jan 01 01:00:00 CET 1970 base/assets.pb m ? 68 Thu Jan 01 01:00:00 CET 1970 base/native.pb m ? 18803266 Thu Jan 01 01:00:00 CET 1970 base/resources.pb 360704 Tue Jan 01 00:00:00 CET 1980 META-INF/APK2_FEN.SF 1468 Tue Jan 01 00:00:00 CET 1980 META-INF/APK2_FEN.RSA 360599 Tue Jan 01 00:00:00 CET 1980 META-INF/MANIFEST.MF s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore ? = unsigned entry - Signed by "CN=Throwaway Key, OU=Release Engineering, O=Mozilla Corporation, L=Mountain View, ST=California, C=US" Digest algorithm: SHA1 (disabled) Signature algorithm: SHA1withRSA (disabled), 2048-bit RSA key WARNING: The jar will be treated as unsigned, because it is signed with a weak algorithm that is now disabled by the security property: jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024, SHA1 denyAfter 2019-01-01 ``` ``` jarsigner -version jarsigner 26.0.1 ``` Per [JDK-8264362](https://bugs.openjdk.org/browse/JDK-8264362), this new behavior was added to all supported versions of OpenJDK in 2022. It's not a blocker but it makes verifying AAB signatures trickier.
Bug 1838680 Comment 6 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
While handling bug 2051963, I see that `jarsigner` (which is used to validate AABs) now complains about SHA1: ``` jarsigner -verify -verbose fenix.aab [...] m ? 801 Thu Jan 01 01:00:00 CET 1970 base/assets.pb m ? 68 Thu Jan 01 01:00:00 CET 1970 base/native.pb m ? 18803266 Thu Jan 01 01:00:00 CET 1970 base/resources.pb 360704 Tue Jan 01 00:00:00 CET 1980 META-INF/APK2_FEN.SF 1468 Tue Jan 01 00:00:00 CET 1980 META-INF/APK2_FEN.RSA 360599 Tue Jan 01 00:00:00 CET 1980 META-INF/MANIFEST.MF s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore ? = unsigned entry - Signed by "CN=Throwaway Key, OU=Release Engineering, O=Mozilla Corporation, L=Mountain View, ST=California, C=US" Digest algorithm: SHA1 (disabled) Signature algorithm: SHA1withRSA (disabled), 2048-bit RSA key WARNING: The jar will be treated as unsigned, because it is signed with a weak algorithm that is now disabled by the security property: jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024, SHA1 denyAfter 2019-01-01 ``` ``` jarsigner -version jarsigner 26.0.1 ``` Per [JDK-8264362](https://bugs.openjdk.org/browse/JDK-8264362), this new behavior was added to all supported versions of OpenJDK in 2022. It's not a blocker but it makes verifying AAB signatures trickier.
While handling bug 2051963, I see that `jarsigner` (which is used to validate AABs) now complains about SHA1: ``` jarsigner -verify -verbose fenix.aab [...] m ? 165374008 Thu Jan 01 01:00:00 CET 1970 base/lib/x86_64/libxul.so m ? 135368 Thu Jan 01 01:00:00 CET 1970 base/manifest/AndroidManifest.xml m ? 833 Thu Jan 01 01:00:00 CET 1970 base/assets.pb m ? 68 Thu Jan 01 01:00:00 CET 1970 base/native.pb m ? 18064008 Thu Jan 01 01:00:00 CET 1970 base/resources.pb 338159 Tue Jan 01 00:00:00 CET 1980 META-INF/APK2_FEN.SF 1451 Tue Jan 01 00:00:00 CET 1980 META-INF/APK2_FEN.RSA 338054 Tue Jan 01 00:00:00 CET 1980 META-INF/MANIFEST.MF s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore ? = unsigned entry - Signed by "CN=Release Engineering, OU=Release Engineering, O=Mozilla Corporation, L=Mountain View, ST=California, C=US" Digest algorithm: SHA1 (disabled) Signature algorithm: SHA1withRSA (disabled), 2048-bit RSA key WARNING: The jar will be treated as unsigned, because it is signed with a weak algorithm that is now disabled by the security property: jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024, SHA1 denyAfter 2019-01-01 ``` ``` jarsigner -version jarsigner 26.0.1 ``` Per [JDK-8264362](https://bugs.openjdk.org/browse/JDK-8264362), this new behavior was added to all supported versions of OpenJDK in 2022. It's not a blocker but it makes verifying AAB signatures trickier.