Repository navigation
KeychainStore Ignored Exception on macOS #53
Description
Activity
Hi Philippe,
It is a bit sad that the developers of the jdk have decided tot print this message to the console. But I think it is more a design decision as they don't want to rely on external libraries such as slf4j. But they still could have used the java.util.logging instead of printing it in the console, so I am not sure why they decided to do it like this. Maybe you can raise a bug/issue on their jira page and suggest that they use java util logging, see here: https://bugs.openjdk.java.net/secure/Dashboard.jspa Or you can even create a pull request on their github page: https://github.com/openjdk/jdk
Your workaround looks fine to me, you extend the PrintStream with some custom logic. And for a specific use case you delegate the print statement to the logger 👍🏼
Thanks.
The problem is not as big as I first thought.
The messages are printed on the error stream, not the output stream.
So, it is annoying but it doesn't prevent the command line tool to do its job.Aha great to hear, I also don't think it would harm but indeed it can be a bit annoying.
Good luck, please let me know if you have any other questions
Describe the bug
On macOS, a KeychainStore exception is printed on the error stream instead of being logged or thrown. This exception happens when a certificate provided by the system has multiple "X509v3 Extended Key Usage" sections.
To Reproduce
KeychainStore Ignored Exception: java.security.cert.CertificateParsingException: java.io.IOException: Duplicate extensions not allowedExpected behavior
The system should not print the error instead of logging it, expecially for command line apps.
Environmental Data:
Additional context
The faulty code is available on openjdk repository at
https://github.com/openjdk/jdk16/blob/020ec8485251698d1187204ac13321f4726e45ea/src/java.base/macosx/classes/apple/security/KeychainStore.java#L810
https://github.com/openjdk/jdk16/blob/37043b05576c8b81b43ac41a8f06de0d0bbb3f5b/src/java.base/share/classes/sun/security/x509/CertificateExtensions.java#L105
I've written a quick and dirty workaround that decorate the err stream to log the exception instead of printing it.
My question is: is there a better solution?