8196415: Disable SHA-1 Signed JARs

Prajwal Kumaraswamy · coffeys · commit 4ea26b8918b1 · 2021-04-29T11:14:40.000Z
Backport-of: 278057756a1a79a4b030750c48b821ba9735a0f9
diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
@@ -633,7 +633,8 @@ sun.security.krb5.maxReferrals=5
 #
 #
 jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \
-    RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224
+    RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224, \
+    SHA1 jdkCA & usage SignedJAR & denyAfter 2019-01-01
 
 #
 # Legacy algorithms for certification path (CertPath) processing and
@@ -697,7 +698,7 @@ jdk.security.legacyAlgorithms=SHA1, \
 # See "jdk.certpath.disabledAlgorithms" for syntax descriptions.
 #
 jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \
-      DSA keySize < 1024
+      DSA keySize < 1024, SHA1 jdkCA & denyAfter 2019-01-01
 
 #
 # Algorithm restrictions for Secure Socket Layer/Transport Layer Security

Original file line number	Diff line number	Diff line change
`@@ -633,7 +633,8 @@ sun.security.krb5.maxReferrals=5`
`633`	`633`	`#`
`634`	`634`	`#`
`635`	`635`	`jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \`
`636`		`- RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224`
	`636`	`+ RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224, \`
	`637`	`+ SHA1 jdkCA & usage SignedJAR & denyAfter 2019-01-01`
`637`	`638`
`638`	`639`	`#`
`639`	`640`	`# Legacy algorithms for certification path (CertPath) processing and`
`@@ -697,7 +698,7 @@ jdk.security.legacyAlgorithms=SHA1, \`
`697`	`698`	`# See "jdk.certpath.disabledAlgorithms" for syntax descriptions.`
`698`	`699`	`#`
`699`	`700`	`jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \`
`700`		`- DSA keySize < 1024`
	`701`	`+ DSA keySize < 1024, SHA1 jdkCA & denyAfter 2019-01-01`
`701`	`702`
`702`	`703`	`#`
`703`	`704`	`# Algorithm restrictions for Secure Socket Layer/Transport Layer Security`