docs: protected ClassLoader buildClassLoader(final List<URL> urlList, String verifyJarProperty) {
          if (libertyBoot) {
              // for liberty boot we just use the class loader that loaded this class
              return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() {
                  @Override
                  public ClassLoader run() {
                      return getClass().getClassLoader();
                  }
              });
          }
          final boolean verifyJar;
          if (System.getSecurityManager() == null) {
              // do not perform verification if SecurityManager is not installed
              // unless explicitly enabled.
              verifyJar = "true".equalsIgnoreCase(verifyJarProperty);
          } else {
              // always perform verification if SecurityManager is installed.
              verifyJar = true;
          }
  
          enableJava2SecurityIfSet(this.bootProps, urlList);
  
          ClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() {
  
              @Override
              public ClassLoader run() {
                  ClassLoader parent = getClass().getClassLoader();
                  URL[] urls = urlList.toArray(new URL[urlList.size()]);
                  if (verifyJar) {
                      return new BootstrapChildFirstURLClassloader(urls, parent);
                  } else {
                      try {
                          return new BootstrapChildFirstJarClassloader(urls, parent);
                      } catch (RuntimeException e) {
                          // fall back to URLClassLoader in case something went wrong
                          return new BootstrapChildFirstURLClassloader(urls, parent);
                      }
                  }
              }
  
          });
  
          return loader;
      }