8249906: Enhance opening JARs

Reviewed-by: weijun, rhalade, mschoene

src/java.base/share/classes/java/security/cert/CertPathHelperImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002, 2009, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -63,4 +63,8 @@ class CertPathHelperImpl extends CertPathHelper {
     protected void implSetDateAndTime(X509CRLSelector sel, Date date, long skew) {
         sel.setDateAndTime(date, skew);
     }
+
+    protected boolean implIsJdkCA(TrustAnchor anchor) {
+        return anchor.isJdkCA();
+    }
 }

src/java.base/share/classes/java/security/cert/TrustAnchor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2001, 2014, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2001, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,6 +30,7 @@ import java.security.PublicKey;
 
 import javax.security.auth.x500.X500Principal;
 
+import sun.security.util.AnchorCertificates;
 import sun.security.x509.NameConstraintsExtension;
 import sun.security.x509.X500Name;
 
@@ -68,6 +69,12 @@ public class TrustAnchor {
     private final X509Certificate trustedCert;
     private byte[] ncBytes;
     private NameConstraintsExtension nc;
+    private boolean jdkCA;
+    private boolean hasJdkCABeenChecked;
+
+    static {
+        CertPathHelperImpl.initialize();
+    }
 
     /**
      * Creates an instance of {@code TrustAnchor} with the specified
@@ -330,4 +337,18 @@ public class TrustAnchor {
             sb.append("  Name Constraints: " + nc.toString() + "\n");
         return sb.toString();
     }
+
+    /**
+     * Returns true if anchor is a JDK CA (a root CA that is included by
+     * default in the cacerts keystore).
+     */
+    synchronized boolean isJdkCA() {
+        if (!hasJdkCABeenChecked) {
+            if (trustedCert != null) {
+                jdkCA = AnchorCertificates.contains(trustedCert);
+            }
+            hasJdkCABeenChecked = true;
+        }
+        return jdkCA;
+    }
 }

src/java.base/share/classes/java/util/jar/JarFile.java

@@ -29,7 +29,6 @@ import jdk.internal.access.SharedSecrets;
 import jdk.internal.access.JavaUtilZipFileAccess;
 import sun.security.action.GetPropertyAction;
 import sun.security.util.ManifestEntryVerifier;
-import sun.security.util.SignatureFileVerifier;
 
 import java.io.ByteArrayInputStream;
 import java.io.EOFException;