How to verify a jar signed with jarsigner programmatically

code-signing, jarsigner, java, signature

Solution

The security Provider implementation guide outlines the process of verifying JARs. Although these instructions are for a JCA cryptographic service provider to verify itself, they should be applicable to your problem.

Specifically, check out the `verify(X509Certificate targetCert)` method in the sample code, "MyJCE.java".

Problem

I'm wanting to sign a jar using jarsigner, then verify it using a Java application which does not have the signed jar as part of it's classpath (i.e. just using a filesystem location of the jar) Now my problem is getting the signature file out of the jar, is there a simple way to do this? I've had a play with the Inflater and Jar InputStreams with no luck. Or is this something that can be accomplished in a better way? Thanks

Original source

Related problems