From e60b048eae78324a4943e1cbea738cfd91c0d84b Mon Sep 17 00:00:00 2001
From: Stefan Bodewig <bodewig@apache.org>
Date: Tue, 20 Mar 2018 15:42:06 +0100
Subject: [PATCH 1/3] and Java5 doesn't seem to support PKCS12 when signing

---
 src/tests/antunit/taskdefs/signjar-test.xml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/tests/antunit/taskdefs/signjar-test.xml b/src/tests/antunit/taskdefs/signjar-test.xml
index dd2722a66..0faa94bea 100644
--- a/src/tests/antunit/taskdefs/signjar-test.xml
+++ b/src/tests/antunit/taskdefs/signjar-test.xml
@@ -68,7 +68,7 @@
     <sign />
   </target>
 
-  <target name="basic-pkcs12" depends="jar" unless="jdk9+">
+  <target name="basic-pkcs12" depends="jar" unless="jdk9+" if="jdk1.6+">
     <sign keystore="${testkeystore.pkcs12}" storetype="pkcs12" strict="true"/>
   </target>
 
@@ -244,7 +244,8 @@
     <verify-base jar="${signtest.jar}" />
   </target>
 
-  <target name="testVerifyJarPKCS12" depends="basic-pkcs12" unless="jdk9+">
+  <target name="testVerifyJarPKCS12" depends="basic-pkcs12"
+          unless="jdk9+" if="jdk1.6+">
     <verify-base-pkcs12 jar="${signtest.jar}" />
   </target>
 

From 9399b03205ef3210ddb6b6070bcb9e32f34b97b6 Mon Sep 17 00:00:00 2001
From: Stefan Bodewig <bodewig@apache.org>
Date: Tue, 20 Mar 2018 17:10:49 +0100
Subject: [PATCH 2/3] signing with a PKCS12 keystore seems to fail on Java6 as
 well

---
 src/tests/antunit/taskdefs/signjar-test.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/tests/antunit/taskdefs/signjar-test.xml b/src/tests/antunit/taskdefs/signjar-test.xml
index 0faa94bea..8fff479db 100644
--- a/src/tests/antunit/taskdefs/signjar-test.xml
+++ b/src/tests/antunit/taskdefs/signjar-test.xml
@@ -68,7 +68,7 @@
     <sign />
   </target>
 
-  <target name="basic-pkcs12" depends="jar" unless="jdk9+" if="jdk1.6+">
+  <target name="basic-pkcs12" depends="jar" unless="jdk9+" if="jdk1.7+">
     <sign keystore="${testkeystore.pkcs12}" storetype="pkcs12" strict="true"/>
   </target>
 
@@ -245,7 +245,7 @@
   </target>
 
   <target name="testVerifyJarPKCS12" depends="basic-pkcs12"
-          unless="jdk9+" if="jdk1.6+">
+          unless="jdk9+" if="jdk1.7+">
     <verify-base-pkcs12 jar="${signtest.jar}" />
   </target>
 

From 360acf53d0b88d9e51200e3c2374fc397854876e Mon Sep 17 00:00:00 2001
From: Stefan Bodewig <bodewig@apache.org>
Date: Tue, 20 Mar 2018 17:11:37 +0100
Subject: [PATCH 3/3] looks as if -storepass might be required on Java7 even
 without -strict

---
 src/main/org/apache/tools/ant/taskdefs/VerifyJar.java | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/main/org/apache/tools/ant/taskdefs/VerifyJar.java b/src/main/org/apache/tools/ant/taskdefs/VerifyJar.java
index 4cbbe2a31..187a02171 100644
--- a/src/main/org/apache/tools/ant/taskdefs/VerifyJar.java
+++ b/src/main/org/apache/tools/ant/taskdefs/VerifyJar.java
@@ -118,7 +118,7 @@ public class VerifyJar extends AbstractJarSignerTask {
         // So if strict is true then we hide storepass from the base
         // implementation and instead add the -storepass command line
         // argument
-        if (mustHideStorePass()) {
+        if (storepass != null) {
             savedStorePass = storepass;
             setStorepass(null);
         }
@@ -193,10 +193,6 @@ public class VerifyJar extends AbstractJarSignerTask {
         }
     }
 
-    private boolean mustHideStorePass() {
-        return strict && storepass != null;
-    }
-
     /**
      * we are not thread safe here. Do not use on multiple threads at the same time.
      */