Download the JDK
Search the Tutorials
Hide the TOC
Trail: Deployment
Lesson: Packaging Programs in JAR Files
Section: Signing and Verifying JAR Files
Packaging Programs in JAR Files
Using JAR Files: The Basics
Creating a JAR File
Viewing the Contents of a JAR File
Extracting the Contents of a JAR File
Updating a JAR File
Running JAR-Packaged Software
Working with Manifest Files: The Basics
Understanding the Default Manifest
Modifying a Manifest File
Setting an Application's Entry Point
Adding Classes to the JAR File's Classpath
Setting Package Version Information
Sealing Packages within a JAR File
Signing and Verifying JAR Files
Understanding Signing and Verification
Signing JAR Files
Verifying Signed JAR Files
Using JAR-related APIs
The JarClassLoader Class
The JarRunner Class
Home Page > Deployment > Packaging Programs in JAR Files
Verifying Signed JAR Files

> Typically, verification of signed JAR files will be the responsibility of your JavaTM Runtime Environment. Your browser will verify signed applets that it downloads. Signed applications invoked with the `-jar` option of the interpreter will be verified by the runtime environment.

> However, you can verify signed JAR files yourself by using the Jarsigner tool. You might want to do this, for example, to test a signed JAR file that you've prepared.

> The basic command to use for verifying a signed JAR file is:

> >     jarsigner -verify jar-file

> This command will verify the JAR file's signature and ensure that the files in the archive haven't changed since it was signed. You'll see the following message if the verification is successful:

> >     jar verified.

> If you try to verify an unsigned JAR file, the following message results:

> >     jar is unsigned. (signatures missing or not parsable)

> If the verification fails, an appropriate message is displayed. For example, if the contents of a JAR file have changed since the JAR file was signed, a message similar to the following will result if you try to verify the file:

> >     jarsigner: java.lang.SecurityException: invalid SHA1
> >     signature file digest for test/classes/Manifest.class

Previous page: Signing JAR Files
Next page: Using JAR-related APIs