diff --git a/src/jarsigner b/src/jarsigner --- a/src/jarsigner +++ b/src/jarsigner @@ -14,7 +14,7 @@ SYNOPSIS jarsigner [ options ] jar-file alias - jarsigner -verify [ options ] jar-file + jarsigner -verify [ options ] jar-file [alias...] @@ -322,7 +322,7 @@ - That is, if the signer’s public and private keys are DSA keys, jar��‐ + That is, if the signer’s public and private keys are DSA keys, jar‐ signer will sign the JAR file using the "SHA1withDSA" algorithm. If the signer’s keys are RSA keys, jarsigner will attempt to sign the JAR file using the "MD5withRSA" algorithm. @@ -486,6 +486,12 @@ process, the process is stopped and a security exception is thrown. It is caught and displayed by jarsigner. + The jarsigner -verify command can take zero or more alias names + after the jar filename. When provided, for each signed entry in the + jar file, the tool would check if the certificate used to verify the + entry matches one of the aliases. The aliases are defined in the + keystore specified by -keystore, or the default keystore. + Multiple Signatures for a JAR File A JAR file can be signed by multiple people simply by running the @@ -548,10 +554,9 @@ other than the default). A keystore is not required when verifying, but if one is specified, - or the default exists, and the -verbose option was also specified, - additional information is output regarding whether or not any of the - certificates used to verify the JAR file are contained in that key‐ - store. + or the default exists, additional information is output regarding + whether or not any of the certificates used to verify the JAR file + are contained in that keystore. Note: the -keystore argument can actually be a file name (and path) specification rather than a URL, in which case it will be treated @@ -697,8 +702,8 @@ For further information on verification, see JAR File Verification. -certs - If this appears on the command line, along with the -verify and - -verbose options, the output includes certificate information for + If this appears on the command line, along with the -verify + option, the output includes certificate information for each signer of the JAR file. This information includes o the name of the type of certificate (stored in the .DSA file) @@ -721,7 +726,7 @@ -verbose If this appears on the command line, it indicates "verbose" mode, - which causes jarsigner to output extra information as to the + which causes jarsigner to output detailed information as to the progress of the JAR signing or verification. -internalsf @@ -839,6 +844,11 @@ The TSA’s public key certificate must be present in the keystore when using -tsacert. + -strict + During the verifying process, some warning messages will show. + If this appears on the command line, along with the -verify + option, the exit code of the tool will reflect what warning + messages are found. Read the "WARNINGS" section for details. -altsigner class Specifies that an alternative signing mechanism be used. The @@ -951,26 +961,11 @@ If the verification is successful, - jar verified. + - 1307 Tue Mar 03 16:15:34 CST 2009 META-INF/MANIFEST.MF (and 4 more) + (Not signed) - - - is displayed. Otherwise, an error message appears. - - - You can get more information if you use the -verbose option. A sam‐ - ple use of jarsigner with the -verbose option is shown below, along - with sample output: - - - jarsigner -verify -verbose sbundle.jar - - 198 Fri Sep 26 16:14:06 PDT 1997 META-INF/MANIFEST.MF - 199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF - 1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSA - smk 2752 Fri Sep 26 16:12:30 PDT 1997 AclEx.class - smk 849 Fri Sep 26 16:12:46 PDT 1997 test.class + smk 178 Tue Mar 03 16:15:34 CST 2009 A0.class (and 4 more) s = signature was verified m = entry is listed in manifest @@ -981,9 +976,39 @@ + is displayed. Otherwise, an error message appears. + + + You can get more information if you use the -verbose option. A sam‐ + ple use of jarsigner with the -verbose option is shown below, along + with sample output: + + + jarsigner -verify -verbose sbundle.jar + + - 1307 Tue Mar 03 16:15:34 CST 2009 META-INF/MANIFEST.MF + - 199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF + - 1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSA + - 199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JAVATEST.SF + - 1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JAVATEST.DSA + smk 178 Tue Mar 03 16:15:34 CST 2009 A0.class + smk 178 Tue Mar 03 16:15:34 CST 2009 A1.class + smk 178 Tue Mar 03 16:15:34 CST 2009 A2.class + smk 178 Tue Mar 03 16:15:34 CST 2009 A3.class + smk 178 Tue Mar 03 16:15:34 CST 2009 A4.class + + s = signature was verified + m = entry is listed in manifest + k = at least one certificate was found in keystore + + jar verified. + + + + Verification with Certificate Information If you specify the -certs option when verifying, along with the -verify - and -verbose options, the output includes certificate information for + option, the output includes certificate information for each signer of the JAR file, including the certificate type, the signer distinguished name information (iff it’s an X.509 certificate), and, in parentheses, the keystore alias for the signer if the public key cer‐ @@ -992,12 +1017,11 @@ jarsigner -keystore /working/mystore -verify -verbose -certs myTest.jar - 198 Fri Sep 26 16:14:06 PDT 1997 META-INF/MANIFEST.MF - 199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF - 1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSA - 208 Fri Sep 26 16:23:30 PDT 1997 META-INF/JAVATEST.SF - 1087 Fri Sep 26 16:23:30 PDT 1997 META-INF/JAVATEST.DSA - smk 2752 Fri Sep 26 16:12:30 PDT 1997 Tst.class + - 1307 Tue Mar 03 16:15:34 CST 2009 META-INF/MANIFEST.MF (and 2 more) + + (Not signed) + + smk 178 Tue Mar 03 16:15:34 CST 2009 A0.class (and 4 more) X.509, CN=Test Group, OU=Java Software, O=Sun Microsystems, L=CUP, S=CA, C=US (javatest) X.509, CN=Jane Smith, OU=Java Software, O=Sun, L=cup, S=ca, C=us (jane) @@ -1010,6 +1034,9 @@ + If both -certs and -verbose are provided along with the -verify option, + you can read all entry names as well as the certificate information in + the output. If the certificate for a signer is not an X.509 certificate, there is no distinguished name information. In that case, just the certificate @@ -1037,12 +1064,19 @@ jarsigner -keystore /working/mystore -verify -verbose -certs writeFile.jar - 198 Fri Sep 26 16:14:06 PDT 1997 META-INF/MANIFEST.MF - 199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF - 1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSA - 199 Fri Sep 27 12:22:30 PDT 1997 META-INF/DUKE.SF - 1013 Fri Sep 27 12:22:30 PDT 1997 META-INF/DUKE.DSA - smki 2752 Fri Sep 26 16:12:30 PDT 1997 writeFile.html + - 198 Fri Sep 26 16:14:06 PDT 1997 META-INF/MANIFEST.MF + - 199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF + - 1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSA + - 199 Fri Sep 27 12:22:30 PDT 1997 META-INF/DUKE.SF + - 1013 Fri Sep 27 12:22:30 PDT 1997 META-INF/DUKE.DSA + + (Not signed) + + smki 178 Tue Mar 03 16:15:34 CST 2009 A0.class + smki 178 Tue Mar 03 16:15:34 CST 2009 A1.class + smki 178 Tue Mar 03 16:15:34 CST 2009 A2.class + smki 178 Tue Mar 03 16:15:34 CST 2009 A3.class + smki 178 Tue Mar 03 16:15:34 CST 2009 A4.class X.509, CN=Jane Smith, OU=Java Software, O=Sun, L=cup, S=ca, C=us (jane) X.509, CN=Duke, OU=Java Software, O=Sun, L=cup, S=ca, C=us [duke] @@ -1060,6 +1094,34 @@ Note that the alias "duke" is in brackets to denote that it is an iden‐ tity database alias, not a keystore alias. +WARNINGS + + During the verifying process, some warnings may be printed to the output + for various common problems of the certificate or keystore used. + Currently, jarsigner defines these warning codes: + + hasExpiredCert 2 + chainNotEndedWithRootCA 4 + notYetValidCert 8 + notSignedByAlias 16 + aliasNotInStore 32 + badKeyUsage 64 + badExtendedKeyUsage 128 + badNetscapeCertType 256 + hasExpiringCert 512 + hasUnsignedEntry 1024 + + When the -strict option is provided along with the -verify option. An + OR-value of warnings detected would be returned as the exit code of the + tool. For example, if a certificate used to sign an entry is expired + and have a keyUsage extension that does not allows it to sign a file, + an exit code 66 (=64+2) will be returned. + + In any case, if the jar file fails to verify, the exit code + + verifyFailure 1 + + will be returned. SEE ALSO o jar tool documentation