8357691: File blocked.certs contains bad content when boot jdk 25 is used, sun/security/lib/CheckBlockedCerts.java failing

[MBaesken]

When using boot JDK 25 we end up with bad content in lib/security/blocked.certs because cds related warning output shows up there.

The problem is with extra lines in the generated blocked.certs file, at the start of the file there is something like this

> [0.010s][error][cds] An error has occurred while processing the shared archive file. Run with -Xlog:aot,cds for details.
> [0.010s][error][cds] Mismatched values for property jdk.module.addexports: java.base/sun.security.util=ALL-UNNAMED specified during runtime but not during dump time
> [0.010s][error][cds] Disabling optimized module handling

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8357691: File blocked.certs contains bad content when boot jdk 25 is used, sun/security/lib/CheckBlockedCerts.java failing (Bug - P4)

Reviewers

• Erik Joelsson (@erikj79 - Reviewer)
• Ioi Lam (@iklam - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/27485/head:pull/27485
$ git checkout pull/27485

Update a local copy of the PR:
$ git checkout pull/27485
$ git pull https://git.openjdk.org/jdk.git pull/27485/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 27485

View PR using the GUI difftool:
$ git pr show -t 27485

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/27485.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back mbaesken! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@MBaesken This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8357691: File blocked.certs contains bad content when boot jdk 25 is used, sun/security/lib/CheckBlockedCerts.java failing

Reviewed-by: erikj, iklam

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 24 new commits pushed to the master branch:

• ca03080: 8368030: Make package bundlers stateless
• 648582a: 8368714: [BACKOUT] JDK-8368468 Split out everything but configure results from spec.gmk
• 52e7778: 8367910: Reduce warnings about unsupported classes in AOT cache creation
• ... and 21 more: https://git.openjdk.org/jdk/compare/ba44656b97b7103d96718452e300df8a6bd59c87...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[openjdk]

@MBaesken The following label will be automatically applied to this pull request:

• build

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 00: Full (706ce165)

[rhalade]

/label security

[openjdk]

@rhalade
The security label was successfully added.

[iklam]

The fix looks OK to me.

Background: when using the default CDS archive, such warnings are disabled. The reason is -- we assume the default archive is general purpose and can be used for different sets of command-lines. We don't print warnings as it's not "wrong" for the app to specify --add-exports.

$ ${JAVA_HOME}/bin/java --add-exports=java.base/sun.security.util=ALL-UNNAMED --version
java 26-internal 2026-03-17
Java(TM) SE Runtime Environment (build 26-internal-adhoc.iklam.rum)
JavaHotSpot(TM) 64-Bit Server VM (build 26-internal-adhoc.iklam.rum, mixed mode, sharing)

But when you are using -XX:SharedArchiveFile to specify a CDS archive, we assume that the archive has been tailored to the specific application that you're using, so the warnings are printed more eagerly, as you might have unintentionally given an incompatible VM option:

$ cp ${JAVA_HOME}/lib/server/classes.jsa foo.jsa
$ ${JAVA_HOME}/bin/java -XX:SharedArchiveFile=foo.jsa --add-exports=java.base/sun.security.util=ALL-UNNAMED --version
[0.026s][error][cds] An error has occurred while processing the shared archive file. Run with -Xlog:aot,cds for details.
[0.026s][error][cds] Mismatched values for property jdk.module.addexports: java.base/sun.security.util=ALL-UNNAMED specified during runtime but not during dump time
[0.026s][error][cds] Disabling optimized module handling
java 26-internal 2026-03-17
Java(TM) SE Runtime Environment (build 26-internal-adhoc.iklam.rum)
JavaHotSpot(TM) 64-Bit Server VM (build 26-internal-adhoc.iklam.rum, mixed mode, sharing)

In this case, I think the JDK build system creates its own CDS archive with the BOOT JDK, so it falls under the second scenario. Using -Xlog:cds=off is appropriate.

[MBaesken]

Hi Ioi , thanks for the detailed explanation, why this happens.

And thanks for the reviews !

/integrate

[openjdk]

Going to push as commit a80ba62.
Since your change was applied there have been 27 commits pushed to the master branch:

• b90799c: 8368616: runtime/cds/appcds/aotCache/JavaAgent.java#dynamic fails on non CDS platforms/builds after JDK-8362561
• 8730780: 8368006: Parallel: Skip full regions in dense prefix during Full GC
• a663812: 8368124: Show useful thread names in ASAN reports
• ... and 24 more: https://git.openjdk.org/jdk/compare/ba44656b97b7103d96718452e300df8a6bd59c87...master

Your commit was automatically rebased without conflicts.

[openjdk]

@MBaesken Pushed as commit a80ba62.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.