make jnlp build process runnable again

[ebarboni]

kind of the opposite of #9312

I do not remember if it was possible to generate a NetBeans jnlp back in the day.
ant build-jnlp build only the different modules

this seems to work to rebuild jnlp files. this is quite long (20minutes)

the sha1 is not working anymore so need a bump to sha256
jnlp.verify.exclusion updated to match what ant warns about.

Some late verification like this one are failling (jarsigner also say so):

<testcase classname="org.netbeans.nbbuild.VerifyJNLP" name="/home/barboni/fork/netbeans/netbeans/nbbootstrap/netbeans/nbbuild/build/jnlp/org-eclipse-core-contenttype.jnlp/testSignatures" time="0.0">
<failure message="error examining signatures in /home/barboni/fork/netbeans/netbeans/nbbootstrap/netbeans/nbbuild/build/jnlp/org-eclipse-core-contenttype/org-eclipse-core-contenttype.jar: java.lang.SecurityException: invalid SHA1 signature file digest for org/eclipse/core/internal/content/XMLRootHandler$StopParsingException.class" type="junit.framework.AssertionFailedError">error examining signatures in /home/barboni/fork/netbeans/netbeans/nbbootstrap/netbeans/nbbuild/build/jnlp/org-eclipse-core-contenttype/org-eclipse-core-contenttype.jar: java.lang.SecurityException: invalid SHA1 signature file digest for org/eclipse/core/internal/content/XMLRootHandler$StopParsingException.class</failure>
</testcase>

[ebarboni]

I have no clue, why I need to use classpath="${cp.extra}" to make it work

[mbien]

do we know if a minimal platform app would still start using webstart?

with the JDK removing SecurityManager (24) and AppContext (seems to happen now with 27), my guess is that the only LTS JDK where this still might work and we still support would be 21.

(I have nothing against fixing it if its not that much work and do a few releases with it fixed)

[matthiasblaesing]

The changes to the verify make sense to me. I read the code of the ant task as that the verification steps ensures, that all files found after build are actually used. This indeed would need someone with interest in the modules and JNLP interest to verify, but at least it gets the modules in a state of builability.

The signature and key algorithm changes makes sense to me.

The changes to the java/api.debugger.jpda and java.spi.debugger.jpda.ui modules make no sense right now as build-init is invoked on normal builds and so my question is: how can the problem be reproduced?