Hacker News Reader

Another difference is that In a jar file, all file names are utf-8 encoded. Where as in a zip file the encoding is not specified.

Most of the old school archive formats allow adding the same path twice. It's to avoid having to rewrite a huge archive just to change a file.

You don't need the same path twice in the central directory record for that though.

That sounds like a recipe for a good time with ClassLoaders.

It's been the source of at least two Android vulns that I can recall, since code-path A uses the top manifest for signature verification but code-path B uses the bottom manifest for reading out "the file" and poof!

How did you find out?

The usual way to find out is using JarOutputStream without thinking about content name uniqueness. I suspect that of those who do know many have learned it this way.