tree d7923fe90dd2885cb07891b970c157ae53b5f1d1
parent 746f21f33b7327176a345a50a7b6fb629fbe8397
author Lázaro Clapp <lazaro@uber.com> 1565670114 -0700
committer GitHub <noreply@github.com> 1565670114 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJdUjriCRBK7hj4Ov3rIwAAdHIIAJwEhV5eq2yvswKdIhZ2Tn+Z
 4gDnCvr+yETO5XRkopJivuAFk9wOYZSNJ9fF5IxieHphL16xIjlFQPdPxgHsO05P
 YDZUk9tTKP65KrrajEjvYi05cy1kTAJAmMoEsSRrV7ssI9ppNXnjO3HSVXwW8BjB
 qpJvqo7t2BXJZuC3frhzsCzxX/aA2U60+MY48bQYR50roMnwb1tm1kUiFsEdvjgb
 iZnYfEgyfNNcF23M0yY56hgvUoCCEzio9O5cbJm2O/hTqpgDiT1fJbImb9ISo9Nv
 c28jcvLov4cmw/RTQF40BDs9mBPSRXKZVxtDDN8s7Ak7NDvAIxhLIHJYx2fAICI=
 =Y/2t
 -----END PGP SIGNATURE-----
 

Add option to JarInfer to deal with signed jars. (#345)

This makes two changes to the JarInfer CLI tool:

1) By default, the tool will error out when it encounters a signed jar 
(as per the `jarsigner` tool), since modifying a signed jar's bytecode 
and having it still verify is impossible. Users can then exclude such 
jars from the list of jars sent the tool runs on.
2) We add an optional flag `--strip-jar-signatures` for users who 
explicitly want to run JarInfer on such jars, removing the signature 
in the process.

This change includes a test, but it might be fragile outside of JDK8 
due to the fact that the `jarsigner` tool's programatic API is not 
stable. This instability does not affect the JarInfer tool, just the test.