On Thu, 25 Sep 2025 09:10:40 GMT, Matthias Baesken <[email protected]> wrote:
> When using boot JDK 25 we end up with bad content in
> lib/security/blocked.certs because cds related warning output shows up
> there.
>
> The problem is with extra lines in the generated `blocked.certs` file, at the
> start of the file there is something like this
>
>
>> [0.010s][error][cds] An error has occurred while processing the shared
>> archive file. Run with -Xlog:aot,cds for details.
>> [0.010s][error][cds] Mismatched values for property jdk.module.addexports:
>> java.base/sun.security.util=ALL-UNNAMED specified during runtime but not
>> during dump time
>> [0.010s][error][cds] Disabling optimized module handling
Marked as reviewed by iklam (Reviewer).
The fix looks OK to me.
Background: when using the default CDS archive, such warnings are disabled. The
reason is -- we assume the default archive is general purpose and can be used
for different sets of command-lines. We don't print warnings as it's not
"wrong" for the app to specify ` --add-exports`.
$ ${JAVA_HOME}/bin/java --add-exports=java.base/sun.security.util=ALL-UNNAMED
--version
java 26-internal 2026-03-17
Java(TM) SE Runtime Environment (build 26-internal-adhoc.iklam.rum)
JavaHotSpot(TM) 64-Bit Server VM (build 26-internal-adhoc.iklam.rum, mixed
mode, sharing)
But when you are using `-XX:SharedArchiveFile` to specify a CDS archive, we
assume that the archive has been tailored to the specific application that
you're using, so the warnings are printed more eagerly, as you might have
unintentionally given an incompatible VM option:
$ cp ${JAVA_HOME}/lib/server/classes.jsa foo.jsa
$ ${JAVA_HOME}/bin/java -XX:SharedArchiveFile=foo.jsa
--add-exports=java.base/sun.security.util=ALL-UNNAMED --version
[0.026s][error][cds] An error has occurred while processing the shared archive
file. Run with -Xlog:aot,cds for details.
[0.026s][error][cds] Mismatched values for property jdk.module.addexports:
java.base/sun.security.util=ALL-UNNAMED specified during runtime but not during
dump time
[0.026s][error][cds] Disabling optimized module handling
java 26-internal 2026-03-17
Java(TM) SE Runtime Environment (build 26-internal-adhoc.iklam.rum)
JavaHotSpot(TM) 64-Bit Server VM (build 26-internal-adhoc.iklam.rum, mixed
mode, sharing)
In this case, I think the JDK build system creates its own CDS archive with the
BOOT JDK, so it falls under the second scenario. Using `-Xlog:cds=off` is
appropriate.
-------------
PR Review: https://git.openjdk.org/jdk/pull/27485#pullrequestreview-3269822895
PR Comment: https://git.openjdk.org/jdk/pull/27485#issuecomment-3336409510
