jarsigner(1) jarsigner(1) (NAME) jarsigner-openjdk8 - JAR OpenJDK 8 (SYNOPSIS) jarsigner [ options ] jar-file alias jarsigner -verify [ options ] jar-file [alias ...] options . . -verify -verify (keystore alias) JAR . -verify jarsigner JAR . -keystore . -strict jarsigner "jar verified, with signer errors" . jar-file JAR . -strict jarsigner "jar signed, with signer errors" . alias -keystore . (DESCRIPTION) jarsigner : o (JAR). o JAR . JAR . jar JAR . ( zip JAR jar jarsigner JAR META-INF/MANIFEST.MF .) ( ) ( ) . : o . o . o . o . . / . . jarsigner (keystore) JAR . X.509 . keytool . jarsigner . JAR . jarsigner JAR ( ) . jarsigner (timestamp) ( Java Plug-in) JAR . (API) . jarsigner JAR jar zip . JAR zip META-INF/MANIFEST.MF . jarsigner zip META-INF/MANIFEST.MF . jarsigner JAR zip . -verify JAR . jarsigner . . -strict . . (KEYSTORE ALIASES) (aliases) . jarsigner JAR . JAR MyJARFile.jar duke mystore working . MyJARFile.jar JAR . jarsigner -keystore /working/mystore -storepass -keypass MyJARFile.jar duke . . . (KEYSTORE LOCATION) jarsigner -keystore URL . .keystore user.home . Oracle Solaris user.home . -keystore KeyStore.load . NONE URL (null) KeyStore.load . NONE KeyStore . (KEYSTORE IMPLEMENTATION) KeyStore java.security . . ( keytool jarsigner) Policy Tool. KeyStore JDK . Oracle JKS . ( ) . (provider- based) KeyStore Service Provider Interface (SPI) . KeystoreSpi java.security SPI . Java Security API . KeystoreSpi : getInstance KeyStore . . . jarsigner policytool URL . MSCAPI PKCS11 . jarsigner keytool -storetype . Policy Tool Edit KeyStore . keystore.type . java.security JDK java.home/lib/security java.home ( jre JDK JRE) . keystore.type . . KeyStore getDefaultType keystore.type . keystore.type : KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); jks ( Oracle). : keystore.type=jks . JKS jks . . pkcs12 : keystore.type=pkcs12 : PKCS 11 "KeyTool" "JarSigner" Java PKCS #11 : (SUPPORTED ALGORITHMS) jarsigner JAR : o (DSA) SHA1 o RSA SHA256 o (EC) SHA256 (ECDSA). DSA jarsigner JAR SHA1withDSA . RSA jarsigner JAR SHA256withRSA . EC jarsigner JAR SHA256withECDSA . -sigalg . JAR (THE SIGNED JAR FILE) jarsigner JAR JAR JAR META- INF : o .SF o .DSA .RSA .EC -sigfile . -sigfile MKSIGN MKSIGN.SF MKSIGN.DSA . -sigfile .SF .DSA ( ) . . (_) . . (Signature File) ( .SF) jarsigner JAR . JAR .SF : o o (SHA) o SHA SHA . .SF . . . . JAR . (Signature Block File) .SF . . .DSA .RSA .EC . (SIGNATURE TIME STAMP) jarsigner JAR (signature time stamp) . jarsigner . . . -tsa url -tsacert alias -altsigner class -altsignerpath classpathlist -tsapolicyid policyid JAR (JAR FILE VERIFICATION) JAR JAR . JAR : 1. .SF . (.DSA) ( ) .DSA . (.SF) .SF . 2. .SF . .SF . . . .SF . . .SF .SF jar JAR . jar .SF . JAR . .SF . 3. JAR .SF . . . (security exception) . jarsigner . : ( -strict) ( -verbose -certs) . JAR (MULTIPLE SIGNATURES FOR A JAR FILE) JAR jarsigner : jarsigner myBundle.jar susan jarsigner myBundle.jar kevin JAR .SF .DSA JAR . JAR : SUSAN.SF SUSAN.DSA KEVIN.SF KEVIN.DSA (OPTIONS) jarsigner . : o (-) . o . o ( ) . o -storepass -keypass -sigfile -sigalg -digestalg -signedjar TSA JAR JAR . -keystore JAR . JAR . -keystore url URL . .keystore user.home . . . -verbose JAR . -keystore URL URL :file : -keystore filePathAndName -keystore file:filePathAndName Sun PKCS #11 java.security ( $JAVA_HOME/lib/security JRE) keytool jarsigner PKCS #11 : -keystore NONE -storetype PKCS11 PKCS#11 : keytool -keystore NONE -storetype PKCS11 -list -storetype storetype . keystore.type getDefaultType java.security.KeyStore . PIN PKCS #11 -storepass . keytool jarsigner PIN . ( PIN ) -protected . -storepass[:env | :file] argument . ( ) JAR . -storepass . env file argument . : o env: argument . o file: argument . : . -keypass [:env | :file] argument . jarsigner JAR . . env file argument . : o env: argument . o file: argument . : . -sigfile file .SF .DSA . DUKESIGN .SF .DSA DUKESIGN.SF DUKESIGN.DSA META-INF JAR . a-zA-Z0-9_- . . .SF .DSA . -sigfile .SF .DSA ( ) . . (_) . -sigalg algorithm JAR . "Appendix A: Standard Names" Java Cryptography Architecture (JCA) : JAR . SHA1withDSA SHA256withRSA SHA256withECDSA . -providerClass . -digestalg algorithm JAR . "Appendix A: Standard Names" Java Cryptography Architecture (JCA) : SHA256 . -providerClass . -certs -certs -verify -verbose JAR . ( .DSA) X.509 ( java.security.cert.X509Certificate) (distinguished name) . . ( ) . . -certchain file . . X.509 PKCS#7 (Base64) RFC 1421 . RFC 1421 : -verbose -verbose jarsigner JAR . -internalsf .DSA ( ) JAR .SF ( ) . . JAR .DSA .SF . -internalsf . . -internalsf . -sectionsonly -sectionsonly .SF ( ) JAR . JAR . . . JAR . . .SF . JAR . -sectionsonly . . -protected true false . PIN true . -providerClass provider-class-name java.security . -providerArg ConfigFilePath keytool jarsigner ConfigFilePath . PKCS #11 Oracle PKCS #11 : jarsigner -keystore NONE -storetype PKCS11 \ -providerClass sun.security.pkcs11.SunPKCS11 \ -providerArg /mydir1/mydir2/token.config \ -list -providerName providerName java.security -providerName . . Oracle PKCS #11 providerName SunPKCS11-TokenName TokenName . PKCS #11 SmartCard : jarsigner -keystore NONE -storetype PKCS11 \ -providerName SunPKCS11-SmartCard \ -list -Jjavaoption javaoption . jarsigner . . . java -h java -X . -tsa url -tsa http://example.tsa.url JAR . URL http://example.tsa.url (TSA) URL -tsacert . -tsa TSA . jarsigner (TSP) RFC 3161 TSA . TSA . -tsacert alias -tsacert alias JAR . TSA . Subject Information Access URL TSA . -tsacert TSA . -tsapolicyid policyid (OID) TSA . TSA . X.696 ITU (ITU-T) . 1.2.3.4. -altsigner class . (fully qualified) com.sun.jarsigner.ContentSigner . -altsignerpath . -altsigner jarsigner . jarsigner . com.sun.sun.jarsigner.AuthSigner -altsigner com.sun.jarsigner.AuthSigner . -altsignerpath classpathlist JAR . -altsigner . JAR JAR . . classpathlist JAR Oracle Solaris (:) (;) . . JAR . JAR : -altsignerpath /home/user/lib/authsigner.jar JAR JAR : -altsignerpath /home/user/classes/com/sun/tools/jarsigner/ -strict . . . -verbose suboptions -verbose . -certs ( all) JAR . -certs -verbose:grouped . -certs -verbose:summary one entry (and more) . . (ERRORS AND WARNINGS) jarsigner . jarsigner . jarsigner -strict -strict OR . . KeyUsage jarsigner -strict (=+) . : . jarsigner . (FAILURE) jarsigner ( ) JAR JAR . failure . . (SEVERE WARNINGS) : -strict . jarsigner JAR JAR . hasExpiredCert . JAR . notYetValidCert . JAR . chainNotValidated . JAR . badKeyUsage . JAR KeyUsage . badExtendedKeyUsage . JAR ExtendedKeyUsage . badNetscapeCertType . JAR NetscapeCertType . hasUnsignedEntry . JAR . notSignedByAlias . JAR () . aliasNotInStore . JAR . (INFORMATIONAL WARNINGS) (bad practice) . . hasExpiringCert JAR . internalInconsistenciesDetected JAR JarFile JarInputStream . noTimestamp JAR . JAR (YYYY-MM-DD) . (EXAMPLES) JAR (SIGN A JAR FILE) bundle.jar jane mystore working JAR sbundle.jar : jarsigner -keystore /working/mystore -storepass -keypass -signedjar sbundle.jar bundle.jar jane -sigfile .SF .DSA JAR . JANE.SF JANE.DSA . : jarsigner -keystore /working/mystore -signedjar sbundle.jar bundle.jar jane ( keystore. ) : jarsigner -signedjar sbundle.jar bundle.jar jane JAR JAR (bundle.jar) -signedjar : jarsigner bundle.jar jane JAR (VERIFY A SIGNED JAR FILE) JAR JAR : jarsigner -verify sbundle.jar jar verified . . -verbose . jarsigner -verbose : jarsigner -verify -verbose sbundle.jar 198 Fri Sep 26 16:14:06 PDT 1997 META-INF/MANIFEST.MF 199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF 1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSA smk 2752 Fri Sep 26 16:12:30 PDT 1997 AclEx.class smk 849 Fri Sep 26 16:12:46 PDT 1997 test.class s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore jar verified. (VERIFICATION WITH CERTIFICATE INFORMATION) -certs -verify -verbose JAR . ( X.509 ) JAR : jarsigner -keystore /working/mystore -verify -verbose -certs myTest.jar 198 Fri Sep 26 16:14:06 PDT 1997 META-INF/MANIFEST.MF 199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF 1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSA 208 Fri Sep 26 16:23:30 PDT 1997 META-INF/JAVATEST.SF 1087 Fri Sep 26 16:23:30 PDT 1997 META-INF/JAVATEST.DSA smk 2752 Fri Sep 26 16:12:30 PDT 1997 Tst.class X.509, CN=Test Group, OU=Java Software, O=Oracle, L=CUP, S=CA, C=US (javatest) X.509, CN=Jane Smith, OU=Java Software, O=Oracle, L=cup, S=ca, C=us (jane) s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore jar verified. X.509 . . PGP bob : PGP, (bob). (SEE ALSO) o jar(1) o keytool(1) o : Java SE : JDK 8 21 November 2013 jarsigner(1)