Interesting Jar Signing Issue

Question

I started out creating my key with:
keytool -genkey -keystore myKeystore -alias newKey
keytool -genkey -selfcert -alias newKey -keystore myKeystoreI then proceeded to successfully sign and verify 8 jar files using:
jarsigner -keystore myKeystore MyClass.jar newKey
jarsigner -verify MyClass.jarOn the 9th and 10th jar files the verify came back with this error:
jarsigner: java.io.IOException: invalid manifest formatOn the 9th jar file I un-jarred it and then re-jarred it again. I then signed it and verified it properly.
It is the 10th jar file that I cannot verify the signature for the life of me. I have gone though all of the above processes multiple times and have accomplished nothing besides losing a bit of hair! I do not understand this error because I am not modifying the manifest file whatsoever. It is just the plain jane vanilla manifest file that the jar command creates for you.
Basically I will sign the jar file and everything appears to be ok. When I verify I get the invalid manifest format error. If I try to sign the jar file again even with a different key I also get the invalid manifest error. It is almost as if jarsigner is trashing my manifest file. What should I do?!?
Help would be appreciated!
Phil

Answer 1

I was getting the IOException as you have mentioned above. I took the manifest from the signed jar and found that it didn't like the blank lines between some of the class and hash digital signature entries. These blank lines are not supposed to be there but it was jarsigner putting them there. The way I found out about these lines was by using my own modified Java VM and print out line numbers from the manifest file. Anyway, I couldn't put the corrected file back into the Jar as it would mean I wouldn't be able to verify the jar as it would now be deemed tampered with.
I solved my problem by using a different developer's machine and jdk. I was using JDK 1.3.0 c and the other developer's version was JDK 1.3.1. His environment made it all work first time. I suggest you try a different environment (ideally JDK 1.3.1 properly installed and without any other JDKs installed) just as a check.
I hope this helps.