Re: store reference detection (was Re: JARs and reference scanning)

[Ricardo Wurmus]

Chris Marusich <address@hidden> writes:

> There are probably many ways to accomplish that.  For example, in Java,
> perhaps we could implement a custom classloader.  Or maybe we could
> patch the built-in class loading mechanism [1].  Similarly, in Python
> there are also ways to customize the import mechanism [2].  Perhaps Perl
> also has a similar mechanism?

Jar files can be told to import classes from another Jar by adding it to
the “Class-Path” field of the Jar’s manifest.

Here’s an example:
https://docs.oracle.com/javase/tutorial/deployment/jar/downman.html

I don’t know if this mechanism permits the use of absolute paths, but
it’s worth a try.  I should note that this doesn’t help with store
reference detection, because the manifest will be part of the compressed
Jar.  But if this works we could avoid propagation for Java packages.

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net