Emmanuel Bourg

> Is the only task for this PR resolving merge conflicts? No I don't think I'll merge the PR, I'm working on another design that provides a detailed verification report.

I'm not aware of an issue with the replacement of MSIX signatures. This case is covered by a unit test in [APPXSignerTest](https://github.com/ebourg/jsign/blob/f7b24a1ac9c888c6d5596d4d795e44caeba674de/jsign-core/src/test/java/net/jsign/APPXSignerTest.java#L129). If you change the extension of the signed...

Could you send the two files, before and after replacing the signature, to [email protected] please? I'd like to inspect them.

I've been able to reproduce this behavior, the missing '_Digital Signatures_' tab happens when the primary signature of the package is made with a certificate whose CN doesn't match the...

@jasonvooo I think this is now fixed, please let me know how it works for you.

I'm not sure that's that easy. The net.jsign package is shared among different modules and that's not allowed, so supporting JPMS required some code reorganisation first. What would Jsign JPMS...

> assuming there isn't any package-private stuff That's the issue, many implementation details are hidden behind package private classes and methods. > I can see that modularization for the maven,...

Thank you for the suggestion, I see two ways this could be implemented: * either the `--replace` option accepts an optional parameter to select an existing certificate. It could be...

Oh ok, in this case we could add a `removeSignatures(Function filter)` method in the Signable interface.

Why would you want to replace a signature with the same certificate? Wouldn't that generate the exact same signature?