About code signing for OpenJDK21

[bambooflower227]

When I asked the systems department to install "microsoft-jdk-21.0.9-windows-x64.zip", they told me, "There is a risk because it is not code signed. Ask the vendor to issue a code signature."
Is it possible to request that the following file, which is created during installation, be code signed?
C:\Users\Administrator\Desktop\openjdk-25.0.1_windows-x64_bin\jdk-25.0.1\lib\jrt-fs.jar

[brianjstafford]

Hi @bambooflower227 - this should be possible, although we'll need to review some potential consequences. We'll put this on our roadmap to investigate.

[karianna]

Hi @bambooflower227 - A couple of follow up questions:

1. Can you clarify the versions here? You mentioned both 21.0.9 and 25.0.1
2. You mention jrrt-fs.jar specifically, is that the only file which was flagged by your IT department's scanners?

[bambooflower227]

@karianna

Answers to followup questions.

1. I’m sorry. I provided incorrect information. Here is the correct information:
   C:\Program Files\Microsoft\jdk-21.0.9.10-hotspot\lib\jrt-fs.jar

2. Yes, this is the only file that was flagged by our IT department’s scanners.