On Tue, 18 Aug 2026 13:03:41 GMT, Alan Bateman <[email protected]> wrote:
>> Alternate implementation - this version only contains one argument - the >> name of the properties file. If an include statement is needed, it should be >> inserted in the properties file and it will always be added as the last line >> of the the conf/security/java.security configuration file.. >> >> See https://github.com/openjdk/jdk/pull/30635 for the other implementation. >> >> This is a new jlink plugin which allows the user to specify values of >> security properties it wants to override in the conf/security/java.security >> configuration file in a custom runtime image. This enhancement, along with >> https://github.com/openjdk/jdk/pull/29700 allow users to more easily create >> runtimes that address the specific security requirements of their >> applications. >> >> The command-line syntax takes a file containing properties that the user >> wants to override. The file can also contain an include statement which will >> be added as the last line of the conf/security/java.security configuration >> file. >> >> For example: >> >> jlink --security-properties props.security >> >> where props.security is a file containing one more more properties in the >> java.security file syntax. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/SecurityPropertiesPlugin.java > line 117: > >> 115: // replacing values of overridden properties as we go >> 116: try (InputStreamReader isr = new InputStreamReader(content); >> 117: BufferedReader br = new BufferedReader(isr)) { > > SecPropLoader.loadFromPath uses Properties.load and so is using 8859-1. The > plugin is using UTF-8 (default charset) so not in sync. Good point! The JDK build actually assumes the `java.security` file is UTF-8 when it writes it out so maybe that is already a bug. It's all ASCII though so there hasn't been any issues. As long as it is all ASCII, there will never be a conflict using either. But I should probably assume 8859-1 just in case there are prop files out there with non-ASCII characters that are not escaped. Will try some experiments but let me know if you have any suggestions. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/31884#discussion_r3824318422
