signing: Write META-INF signing resources immediately after manifest by bjhargrave · Pull Request #5268 · bndtools/bnd (original) (raw)

JarInputStream requires the META-INF signing resources to come after the manifest and before any other resources. Otherwise, JarInputStream does not consider the jar to be properly signed.

Later versions of Equinox now use JarInputStream to verify the jar signing replacing Equinox's custom verification code. So Bnd needs to properly generate signed jars to work with JarInputStream.

We also define a standard pattern for the META-INF signing resources which is used by other classes that care.

Signed-off-by: BJ Hargrave bj@hargrave.dev