Fix jarsigner PKIX error for non-exportable AKV certificates via AIA chain completion#47977

Open

rujche with Copilot wants to merge 45 commits into

mainfrom

copilot/fix-jarsigner-certificate-chain-issue

Commits on Jul 8, 2026

Merge branch 'main' into copilot/fix-jarsigner-certificate-chain-issue
rujche
committed
Complete certificate chain via AIA extension for non-exportable certificates
rujche
committed
Update CHANGELOG for AIA certificate chain fix
rujche
committed
Add INFO/WARNING logs for AIA chain completion cases
rujche
committed
Address code review feedback
rujche
committed
fix: Apply code review feedback on certificate chain completion
rujche
committed
fix: Rename test methods to follow camelCase naming convention
rujche
committed
refactor: Change AIA chain completion logs to DEBUG level
rujche
committed
feat: Add debug logging for certificate chains
rujche
committed
fix: Address security and accuracy issues in certificate chain completion
rujche
committed
fix: Handle cross-signed certificates and improve exception handling
rujche
committed
fix: Address remaining Checkstyle and design issues in certificate chain code
rujche
committed
fix: Properly handle extra certificates in AIA chain completion
rujche
committed
fix: Correct duplicate certificate detection in AIA chain completion
rujche
committed
fix: Improve leaf certificate selection to avoid order-dependency
rujche
committed
fix: Add system property to disable AIA chain completion for security
rujche
committed
docs: Update CHANGELOG and README with AIA disable option
rujche
committed
style: Rename system property to use hyphens for consistency
rujche
committed
test: Add unit test for disable-aia-download system property
rujche
committed
fix: Address review comments - heading hierarchy and improved JavaDoc
rujche
committed
fix: Wrap long JavaDoc line to comply with 120-char line limit
rujche
committed
fix: Improve error handling and eliminate property name duplication
rujche
committed
fix: Improve duplicate detection and DN comparison in logging
rujche
committed
fix: Use signature-based issuer check instead of subject-DN-only duplicate detection
rujche
committed
fix: Add GoodLoggingCheck suppression for CertificateUtil.java
rujche
committed
fix: Remove string concatenation from LOGGER.log calls; restore suppression
rujche
committed
fix: Log caught exception in getBytes() to aid AIA failure diagnosis
rujche
committed
fix: Improve orderCertificateChain to handle incomplete [root, leaf] chains
rujche
committed
fix: Add @AfterEach cleanup for system property in AiaCertificateChainTest
rujche
committed
fix: Improve leaf selection and chain ordering with signature-based validation
rujche
committed
fix: Address Copilot review comments on maxDownloads logic and logging
rujche
committed
fix: Force sequential execution in AiaCertificateChainTest to prevent system property pollution
rujche
committed
fix: Address Copilot review comments - remove unused variables, log exception, fix comments
rujche
committed
fix: Address Copilot review comments - remove unused variables, log exception, fix comments
rujche
committed

Commits on Jul 14, 2026

Merge branch 'main' into copilot/fix-jarsigner-certificate-chain-issue
rujche
authored