What prevents someone from subverting qualified exports by pretending to be a module they are not?

Question

Given:

module A
{
  exports fuzzy.bunny to B;
}

What prevents a malicious player from pretending to be module B in order to gain access to module A 's secrets?

I know that Java has some sort of signing mechanism in META-INF that allows each module to ensure that its own class files have not been modified, but what mechanism ensures that one module can trust another module's class files?

Answer 1

Might not precisely be the answer you are looking for, but a part of JMOD file creation using jmod tool explains it briefly :

--hash-modules

With the --hash-modules option or the jmod hash command, you can, in each module's descriptor, record hashes of the content of the modules that are allowed to depend upon it, thus "tying" together these modules. This let's you to allow a package to be exported to one or more specifically-named modules and to no others through qualified exports . The runtime verifies if the recorded hash of a module matches the one resolved at run time; if not, the runtime returns an error.

further from the same documentation

These hashes are recorded in the JMOD archive file being created, or a JMOD archive or modular JAR on the module path specified by the jmod hash command.

Useful : There is a hashing example in the link shared above as well which depicts a use case to which your question quite relates.