[VFS] VFSClassLoader and JAR Files with no Manifest

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[VFS] VFSClassLoader and JAR Files with no Manifest

Bernd Eckenfels
When I use the VFSClassLoader on a URL which points to a JAR file which
has no Manifest, then loading classes will create a

This seems to be caused by the Fact that the JarFileSystem is caching
attributes but not certificates of the entries. When the certificates
for an entry are queried, it will go back to the underlying JarFile.
This is however closes (closeCommunicationLink) in this situation and
will therefore throw a IllegalStateException.

When the JAR file has a Manifest entry, the problem does not exist,
because the underlying JarFile will be in verified state. At least this
is what I think it looks like.

There are a few possible solutions:

a) ignore the IllegalStateException in getCertificates - I guess it
only happens one anyway. I am not sure if this could hide other

b) eagerly enforce the verification when attaching to a (replicated)
JAR file. This can for example be done in the ZipFileSystem#init()
method by opening the first (or better last) Zip Entries InputStream.

c) cache the certificates similiar to the attributes (not sure if this
is ok from a performance and memory perspective)

d) a general workaround would be to allow the Jar Filesystem to use the
verify=false constructor of JarFiles. This might be desirable as an
additional optimization anyway, but it does not fix the actual problem.

e) some variants of a) where some other state is queries (for example
"has no manifest")

f) a variant of d) is to use the ZipFileSystem with the .jar extension.
This removes the verification, but it will also remove the Manifest
access, so it is not always useable.

What do you think?

You find a test program (Junit), the error-output and a proposed patch
in this gist: the test requires 2 ZIP files, one without and one with
an empty Manifest (and the well known code/ClassToLoad.class file from
the VFS testsuite).


I intend to file a Issue once the problem is a bit clearer to me.

BTW: for the "VFS-with-manifest" case the resulting class
has Certificates[0], in the URLClassLoader case it is (expected) null.

To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]