Skip to content

Preserve timestamps when stripping jar signatures - #67

Merged
jpenilla merged 1 commit into
mainfrom
fix/preserve-signature-stripping-timestamps
Nov 4, 2026
Merged

jpenilla merged 1 commit into
mainfrom
fix/preserve-signature-stripping-timestamps

Conversation

@jpenilla

@jpenilla jpenilla commented Nov 4, 2026

Copy link
Copy Markdown
Member

Switches StripSignaturesPage from zipfs to ZipFile and ZipOutputStream, so entries in the stripped jar keep their original timestamps and order.

Jars with duplicate entry names now fail with a ZipException instead of being collapsed by zipfs. This is intentional.

Testing

./gradlew check passes. No tests were added.

I also ran the CLI on Minecraft 26.1.2 and compared the signed server jar with the stripped one:

  • Only META-INF/MOJANGCS.RSA and META-INF/MOJANGCS.SF were removed.
  • Timestamps, entry order, extra fields and compression methods all match.
  • Only META-INF/MANIFEST.MF changed: its digest lines are gone and Main-Class is kept.

Every entry in that jar is DEFLATED, so the path that rewrites a STORED manifest has not been exercised.

Copy the jar with ZipFile and ZipOutputStream instead of zipfs, so entries keep their original timestamps and order.
@jpenilla
jpenilla merged commit 88e3515 into main Nov 4, 2026
2 checks passed
@jpenilla
jpenilla deleted the fix/preserve-signature-stripping-timestamps branch November 4, 2026 02:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant