revert the re-sign change, add one more warning

src/jdk.jartool/share/classes/jdk/security/jarsigner/JarSigner.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2023, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -699,7 +699,6 @@ private void sign0(ZipFile zipFile, OutputStream os)
         Vector<ZipEntry> mfFiles = new Vector<>();
 
         boolean wasSigned = false;
-        Set<String> signedEntries = new HashSet<>();
 
         for (Enumeration<? extends ZipEntry> enum_ = zipFile.entries();
              enum_.hasMoreElements(); ) {
@@ -729,12 +728,10 @@ private void sign0(ZipFile zipFile, OutputStream os)
                 // jar entry is contained in manifest, check and
                 // possibly update its digest attributes
                 updateDigests(ze, zipFile, digests, manifest);
-                signedEntries.add(ze.getName());;
             } else if (!ze.isDirectory()) {
                 // Add entry to manifest
                 Attributes attrs = getDigestAttributes(ze, zipFile, digests);
                 manifest.getEntries().put(ze.getName(), attrs);
-                signedEntries.add(ze.getName());
             }
         }
 
@@ -820,7 +817,7 @@ private void sign0(ZipFile zipFile, OutputStream os)
 
         // Calculate SignatureFile (".SF") and SignatureBlockFile
         ManifestDigester manDig = new ManifestDigester(mfRawBytes);
-        SignatureFile sf = new SignatureFile(digests, signedEntries, manDig,
+        SignatureFile sf = new SignatureFile(digests, manifest, manDig,
                 signerName, sectionsonly);
 
         byte[] block;
@@ -1070,7 +1067,7 @@ static class SignatureFile {
         String baseName;
 
         public SignatureFile(MessageDigest digests[],
-                             Set<String> signedEntries,
+                             Manifest mf,
                              ManifestDigester md,
                              String baseName,
                              boolean sectionsonly) {
@@ -1108,9 +1105,9 @@ public SignatureFile(MessageDigest digests[],
                                 "Manifest-Main-Attribute entry");
             }
 
-            // go through signed entries and create the digests
+            // go through the manifest entries and create the digests
             Map<String, Attributes> entries = sf.getEntries();
-            for (String name: signedEntries) {
+            for (String name: mf.getEntries().keySet()) {
                 mde = md.get(name, false);
                 if (mde != null) {
                     Attributes attr = new Attributes();

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

@@ -197,6 +197,7 @@ public ExitException(int errorCode) {
     private boolean hasExpiringCert = false;
     private boolean hasExpiringTsaCert = false;
     private boolean noTimestamp = true;
+    private boolean removedEntriesFound = false;
 
     // Expiration date. The value could be null if signed by a trusted cert.
     private Date expireDate = null;
@@ -1080,11 +1081,13 @@ void verifyJar(String jarName)
                         }
                         if (verbose != null) {
                             System.out.println(history);
-                            var signed = entriesInSF.get(s);
-                            if (!signed.isEmpty()) {
+                        }
+                        var signed = entriesInSF.get(s);
+                        if (!signed.isEmpty()) {
+                            if (verbose != null) {
                                 System.out.println(rb.getString("history.removed.entries") + signed);
                             }
-
+                            removedEntriesFound = true;
                         }
                     } else {
                         unparsableSignatures.putIfAbsent(s, String.format(
@@ -1321,6 +1324,9 @@ private void displayMessagesAndResult(boolean isSigning) {
             }
         }
 
+        if (removedEntriesFound) {
+            warnings.add(rb.getString("removed.entries.found"));
+        }
         if (extraAttrsDetected) {
             warnings.add(rb.getString("extra.attributes.detected"));
         }

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Resources.java

@@ -164,7 +164,7 @@ public class Resources extends java.util.ListResourceBundle {
 
         {"history.with.ts", "- Signed by \"%1$s\"\n    Digest algorithm: %2$s\n    Signature algorithm: %3$s, %4$s\n  Timestamped by \"%6$s\" on %5$tc\n    Timestamp digest algorithm: %7$s\n    Timestamp signature algorithm: %8$s, %9$s"},
         {"history.without.ts", "- Signed by \"%1$s\"\n    Digest algorithm: %2$s\n    Signature algorithm: %3$s, %4$s"},
-        {"history.removed.entries", "    Warning: nonexistent signed entries detected: "},
+        {"history.removed.entries", "    Warning: nonexistent signed entries: "},
         {"history.unparsable", "- Unparsable signature-related file %s"},
         {"history.nosf", "- Missing signature-related file META-INF/%s.SF"},
         {"history.nobk", "- Missing block file for signature-related file META-INF/%s.SF"},
@@ -179,6 +179,7 @@ public class Resources extends java.util.ListResourceBundle {
         {"key.bit.disabled", "%d-bit key (disabled)"},
         {"key.bit.eccurve.disabled", "%1$d-bit %2$s key (disabled)"},
         {"unknown.size", "unknown size"},
+        {"removed.entries.found", "Nonexistent signed entries detected. See details in -verbose output."},
         {"extra.attributes.detected", "POSIX file permission and/or symlink attributes detected. These attributes are ignored when signing and are not protected by the signature."},
 
         {"jarsigner.", "jarsigner: "},

test/jdk/sun/security/tools/jarsigner/RemovedFiles.java

@@ -44,14 +44,21 @@ public static void main(String[] args) throws Exception {
         SecurityTools.keytool("-genkeypair -storepass changeit -keystore ks -alias x -dname CN=x -keyalg ed25519");
         SecurityTools.jarsigner("-storepass changeit -keystore ks a.jar x");
 
+        // All is fine at the beginning.
+        SecurityTools.jarsigner("-verify a.jar")
+                .shouldNotContain("Nonexistent signed entries detected. See details in -verbose output.");
+
         // Remove an entry after signing. There will be a warning.
         JarUtils.deleteEntries(Path.of("a.jar"), "a");
+        SecurityTools.jarsigner("-verify a.jar")
+                .shouldContain("Nonexistent signed entries detected. See details in -verbose output.");
         SecurityTools.jarsigner("-verify -verbose a.jar")
-                .shouldContain("Warning: nonexistent signed entries detected: [a]");
+                .shouldContain("Nonexistent signed entries detected. See details in -verbose output.")
+                .shouldContain("Warning: nonexistent signed entries: [a]");
 
-        // Re-sign will clean up the SF file.
+        // Re-sign will not clear the warning.
         SecurityTools.jarsigner("-storepass changeit -keystore ks a.jar x");
-        SecurityTools.jarsigner("-verify -verbose a.jar")
-                .shouldNotContain("Warning: nonexistent signed entries detected: [a]");
+        SecurityTools.jarsigner("-verify a.jar")
+                .shouldContain("Nonexistent signed entries detected. See details in -verbose output.");
     }
 }