Using signed jar files

Using signed jar files In a Java SE environment, can detect digital signatures on jar files. When attempting to load a class from a signed jar file stored in the database, will verify the validity of the signature. jar filesloading signed signed jar files The class loader only validates the integrity of the signed jar file and verifies that the certificate has not expired. cannot ascertain whether the validity or identity of declared signer is correct.

When loading classes from an application jar file in a Java SE environment, behaves as follows if the class is signed:

Verifies that the jar file was signed using a X.509 certificate (that is, it can be represented by the class java.security.cert.X509Certificate). If not, throws an exception.
Verifies that the digital signature matches the contents of the file. If not, throws an exception.
Checks that the set of signing certificates are all valid for the current date and time. If any certificate has expired or is not yet valid, throws an exception.
Passes the array of certificates to the setSigners() method of java.lang.ClassLoader. This allows security managers to obtain the list of signers for a class (using java.lang.Class.getSigners) and then validate the identity of the signers using the services of a Public Key Infrastructure (PKI).

For more information about signed jar files, see .