Is it possible to verify a signed jar-file from a program?

Is it possible to verify a signed jar-file from a program
(using some API) likewise jarsigner does?

Is it possible to verify a signed jar-file from a
program
(using some API) likewise jarsigner does?Hi,
You would have to open the jarfile, read each jar entry and for each of them do a getCertificates() and then in turn verify each certificate with the public key of the enclosed certificates in the jar file.
An easier solution would be to use the verify flag of the JarFile or JarInputStream.
Hope it helps..
Cheers,
Vijay

Similar Messages

  • Is it possible to download a comma delimited file from ABAP to a Portal

    directory or Web Dev URL on the Portal?
    We currently have a comma delimited file being emailed nightly using standard SAP FMs to a distribution list.
    We want to move these files to the Portal instead.
    Speaking with our Portal guys, they say the easiest way for them to receive the file is if I can download directly to a Web Dev URL.
    Does SAP provide a way to communicate from our app server to the portal?
    thanks alot,
    rp.

    Is it possible to verify a signed jar-file from a
    program
    (using some API) likewise jarsigner does?Hi,
    You would have to open the jarfile, read each jar entry and for each of them do a getCertificates() and then in turn verify each certificate with the public key of the enclosed certificates in the jar file.
    An easier solution would be to use the verify flag of the JarFile or JarInputStream.
    Hope it helps..
    Cheers,
    Vijay

  • Turning off jar cache causes classnotfound with signed jar files

    Hi,
    I have a problem with applet signed jars when the java cache is turned off.
    With the cache turned off, I get a class not found for the first class it attempts to use from the signed jar file from an applet.
    If I turn the jar caching on, all works perfectly with no other changes.
    Anyone have any ideas? This is java 6u16.
    Thanks

    jkc532 wrote:
    .. Is the fact that the CachedJarFile class doesn't attempt to reload the resource when it can't retrieve it from MemoryCache a bug? From your comprehensive investigation and report, it seems so to me.
    ..I've dug as deep as I can on this and I'm at wits end, does anybody have any ideas?Just after read the summary I was tired, so I have some understanding of the effort you have already invested in this (the 'wits' you have already spent). I think you should raise a bug report and seek Oracle's response.

  • NullPointerException thrown in PKCS12KeyStore when verifying a signed JAR

    Hi,
    java -versionjava version "1.6.0_07"
    Java(TM) SE Runtime Environment (build 1.6.0_07-b06)
    Java HotSpot(TM) Client VM (build 10.0-b23, mixed mode, sharing)
    (WinXP)
    I've signed a JAR with a new pkcs12 certificate using:
    jarsigner -keystore mystore.p12 -storetype pkcs12 -verbose my.jar myaliasNo errors or warnings were generated and each class file was listed as it was signed. When I attempt to verify the JAR, I get a NullPointerException from jarsigner, as it attempts to read the first signed entry (.class):
    jarsigner -keystore mystore.p12 -storetype pkcs12 -verbose -verify -debug my.jar5450 Sun Oct 05 07:53:06 EST 2008 META-INF/MANIFEST.MF
    0 Sun Oct 05 07:52:22 EST 2008 com/my/package/subpackage1
    0 Sun Oct 05 07:52:22 EST 2008 com/my/package/subpackage2
    jarsigner: java.lang.NullPointerException
    java.lang.NullPointerException
    at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.engineGetCertificateAl
    ias(PKCS12KeyStore.java:721)
    at java.security.KeyStore.getCertificateAlias(KeyStore.java:1092)
    at sun.security.tools.JarSigner.inKeyStore(JarSigner.java:791)
    at sun.security.tools.JarSigner.verifyJar(JarSigner.java:491)
    at sun.security.tools.JarSigner.run(JarSigner.java:193)
    at sun.security.tools.JarSigner.main(JarSigner.java:74)
    Anyone seen anything like this before or can suggest what might cause it? Is there something wrong with my new certificate?
    Thanks
    Brett

    The jarsigner -verify command only verfies the authenticity of the signed JAR file using the certificate inside the .DSA file in the JAR.That's not true. See the Javadoc for the 'jarsigner' tool, in 'verify' mode, 'keystore' option.

  • Three questions about signed jar file and applet

    I use three signed jar file. Each of them signed by different certificate. First of JARs contain applet class. When I start applet from html page I see message “This applet was signed by…… but Java cannot verify it… Do you trust…?”. All times I press “Yes I trust” and after this questions applet stop to work end exit. If I use only one certificate for signing of three JARs then applet continue to work after question. 1) What should I do to fix this bug? 2) Is it any method to check from applet that user press Trust button? Is it any method to emulate work of SecurityManager to check that Certificate object is trusted (I want do call some method check(Certificate) and if certificate is not trusted I want to see message with question: “Do you want to trust this certificate” and so on)?

    Hello Jarman,
    1. If I have a signed jar file, then as long as the
    certificate is recognised as trusted that applet can
    run as a fully trusted application on the client
    machine. So I should not have to add lines such as
    permission java.lang.RuntimePermission
    "readFileDescriptor", "read" ;
    permission java.lang.RuntimePermission
    "writeFileDescriptor", "write" ;
    to my java.policy file. true/false ?true
    2. If I am running a signed jar file in the Java
    plugin then I do not need to have a verisign or thawte
    certificate (however to allow my certificate to be
    accepted I do have to import it into the cacerts file
    on the client machine). True/false?true
    3. Following on from question 2, if I want to be able
    to run an applet on a client machine, without messing
    around with ANY files on those machines, I need a
    verisign or thawte certificate. True/false?true
    4. (And finally) Apart from a security exception
    saying that I need to add one of the lines like those
    of question 1, is there any way I can get other debug
    information as to why the signed jar file is not being
    recognised as signed?No. This could be a problem of importing your certifcate into the wrong place.
    The information on the following link is a little bit dated but it helped me to successfully install a testcertificate and sign an applet with it.
    http://www.suitable.com/Doc_CodeSigning.shtml

  • URLClassLoader + dynamically loading signed jar files

    I have an applet that does not know all of the jar files it will need to load at startup.
    I would like to dynamically load these signed jar files using the URLClassLoader, however it does not recognize these jar files as being signed and I get java.security.AccessControlException: access denied errors.
    Any suggestions?
    Thanks!

    Try this classloader for loading the jars, it should to the trick:
    import java.net.URL;
    import java.net.URLClassLoader;
    import java.net.URLStreamHandlerFactory;
    import java.security.AllPermission;
    import java.security.CodeSource;
    import java.security.PermissionCollection;
    import java.security.Permissions;
    public class AllPermissionsClassLoader extends URLClassLoader {
        public AllPermissionsClassLoader (URL[] urls) {
            super(urls);
        public AllPermissionsClassLoader (URL[] urls, ClassLoader parent) {
            super(urls, parent);
            System.out.println(parent);
        public AllPermissionsClassLoader (URL[] urls, ClassLoader parent, URLStreamHandlerFactory factory) {
            super(urls, parent, factory);
        protected PermissionCollection getPermissions (CodeSource codesource) {
            Permissions permissions = new Permissions();
            permissions.add(new AllPermission());
            return permissions;
    }

  • Is it possible to call a class in a jar file from JNI environment?

    Hi
    Is it possible to call a class in a jar file from JNI environment?
    Thanks in advance.

    Could you explain a bit more what you are trying to do? (In other words, your question is vague.)
    o If your main program is written in C, you can use JNI to start a JVM, load classes from the jar of your choice, and call constructors and methods of the objects defined in the jar.
    o If your main program is java, and has been laoded from a jar, a JNI routine can call back into java to use the constructors and methods of classes defined in the jar(s).

  • How can i add update signed jar file

    I am developing an applet which requires signing to run in a browser.
    I am developing supporting classes. But these class files have to be added
    to the jar. Isnt it??
    But to test the applet i need to load it in the browser each time i modify the class files. So the jar file need to be updated every time. But an
    IOError
    is being displayed when i try to update the signed jar file.
    How can i update signed jar file?? Or is there any othe way to test the signed applet during development??

    How can i update signed jar file?You can't, the signature is there to make sure the content of the jare hasn't been messed
    with.
    Either recreate the jar and re sign it or set up a policy during testing.

  • Is it possible to run a jar file in another program???

    Hello members,
    i am sanketh. is it possible to run a jar file in another program.
    if possible plz reply with an example or good links to go thru.

    What do you mean "run a jar file in another program"? It's not very clear.

  • Error signing jar file

    I am using oracle Devsuite10g 10.1.2.1 on windows when I signed the webuitl.jar and jacob.jar it gives me the follwing error
    E:\dev10g\forms\webutil>sign_webutil.bat e:\dev10g\forms\java\frmwebutil.jar
    Generating a self signing certificate for key=webutil...
    keytool error: java.lang.Exception: Key pair not generated, alias <webutil> alre
    ady exists
    There were warnings or errors while generating a self signing certificate. Pleas
    e review them.
    Backing up e:\dev10g\forms\java\frmwebutil.jar as e:\dev10g\forms\java\frmwebuti l.jar.old...
    1 file(s) copied.
    Signing e:\dev10g\forms\java\frmwebutil.jar using key=webutil...
    The system cannot find the path specified.
    There were warnings or errors while signing the jar. Please review them.
    E:\dev10g\forms\webutil>sign_webutil.bat e:\dev10g\forms\java\jacob.jar
    Generating a self signing certificate for key=webutil...
    keytool error: java.lang.Exception: Key pair not generated, alias <webutil> alre
    ady exists
    There were warnings or errors while generating a self signing certificate. Please review them.
    and later check the formweb.cfg
    WebUtilArchive=frmwebutil.jar,jacob.jar
    WebUtilLogging=off
    WebUtilLoggingDetail=normal
    WebUtilErrorMode=Alert
    WebUtilDispatchMonitorInterval=5
    WebUtilTrustInternal=true
    WebUtilMaxTransferSize=16384
    baseHTMLjinitiator=webutiljini.htm
    baseHTMLjpi=webutiljpi.htm
    baseHTML=webutilbase.htm
    archive_jini=frmall_jinit.jar,frmwebutil.jar,jacob.jar
    archive=frmall.jar
    lookAndFeel=oracle
    and the webutil.cfg is as follows
    archive_jini=f90all_jinit.jar,frmwebutil.jar,jacob.jar
    WebUtilArchive=frmwebutil.jar,jacob.jar
    install.syslin.location=/webutil
    transfer.APPSRV.READ=C:\
    transfer.APPSRV.WRITE.1=C:\WORK\UPLOAD
    transfer.APPSRV.WRITE.2=C:\WORK\LOG
    transfer.appsrv.workAreaRoot=d:\temp
    transfer.appsrv.accessControl=true
    transfer.database.enabled=TRUE
    transfer.appsrv.enabled=TRUE
    plz help to come out from this error

    This occurs when you attempt to run the provided script (batch) more than once or the Key name is already in the keystore. If you are not familiar with how to sign JARs on your own, the easiest solution is likely to change the value of JAR_KEY in the script.
    The script is provided as a courtesy more than anything else. Oracle doesn't do any magic in the script. It is simply a scripted version of what is required by Sun in order to create a certificate and sign a JAR. You can get more info about how to sign a JAR file from Sun or by doing a Google search. You can also refer to an older Oracle white paper which offered step-by-step instructions for signing:
    http://www.oracle.com/technology/products/forms/pdf/SigningJint13.pdf

  • Possible to create a JAR file from within a java app?

    Is it possible to create a jar file from within a java application?
    Can it be done more elegantly than by spawning-off another
    process with the Runtime and exec() portions of the api?
    Thanks
    Scott

    Thanks! I was mislead by the API notes for java.util.jar:
    The JarOutputStream class is used to write the contents
    of a JAR file to any output stream.
    I was looking for a class or method to make jar files.
    Seems this is it ;)
    Thanks
    Scott

  • Access jar file from in-memory classes...

    I have some classes that I compile to memory and everything works fine until one class that must access some external jar files. I have been unable to access those jar files from disk after trying every suggestion using URLClassLoader. I even tried someone's example to hack the SystemClassLoader which properly adds the jar file paths, but still they can't be seen. The only way it works is if I put the files in the jdk/jre/lib/ext directory. Then everything works fine. There must be a way to load the jar files in memory as well as the class files so they can be accessible. Has anyone done anything like this? Is it possible? Even though the class files are in memory, why would the jar files not be seen even when they are added to the same URLClassLoader's URL's. Thanks.

    Sorry that wasn't clear. What I mean is that the classes are compiled to byte code directly to memory and no physical .class file is created. Yes, I'm using my own ClassLoader that extends URLClassLoader and I'm setting the parent to ClassLoader.getSystemClassLoader(). I also should mention that I'm doing this inside a Netbeans module that is part of a Netbeans Platform application. I don't know why that should matter though, since I'm trying to do everything in memory without creating the physical files. Thanks.

  • Getting Exception in JWS while downloading jar files from server

    Hi All,
    I am running JWS on j2re1.4.2_10(build 03). while JWS is trying to download jar files from web server, I am getting the following Exception.
    All the jar files are signed. Any idea ?
    JNLPException[category: Download Error : Exception: null : LaunchDesc: null ]
         at com.sun.javaws.cache.DownloadProtocol.doDownload(Unknown Source)
         at com.sun.javaws.cache.DownloadProtocol.getDownloadSize(Unknown Source)
         at com.sun.javaws.LaunchDownload.downloadJarFiles(Unknown Source)
         at com.sun.javaws.LaunchDownload.downloadEagerorAll(Unknown Source)
         at com.sun.javaws.Launcher.downloadResources(Unknown Source)
         at com.sun.javaws.Launcher.handleApplicationDesc(Unknown Source)
         at com.sun.javaws.Launcher.handleLaunchFile(Unknown Source)
         at com.sun.javaws.Launcher.run(Unknown Source)
         at java.lang.Thread.run(Unknown Source)

    Are you able to download your *.jar files directly from server
    For example say,
    http://127.0.0.1:8080/test/testme.jarIf yes,
    Then problem should be with your *.jnlp file. Check all your *.jar with respect to context location of your url from where you are downloading *.jnlp file

  • Running .jar files from Java code

    Hi.
    I am designing a sort of platform to run some games which are saved in .jar files. Basically this platform is a menu from which the user can select the game which he/she wants to run. It also has the feature of adding new games.
    Is is possible to run the .jar file from within java code?
    Thanks for any help!
    Krt_malta

    Just list the jar in the classpath list and call the class in the jar.

  • Can't run JavaFX app as a jar file from command line

    I'm trying to build a JavaFX app from scratch (that is, by including the jar file from the JavaFX SDK rather than by using the special JavaFX project type from NetBeans). It runs fine in NetBeans. However, when I try to launch it as a jar file from the command line (using "java -jar dist\TestApp") I get the following. Has anybody seen this before, and if so how can I fix it?:
    *** Fallback to Prism SW pipeline
    Exception in thread "main" java.lang.RuntimeException: java.lang.UnsatisfiedLink
    Error: Can't load library: C:\dev\TestApp\dist\bin\mat.dll
    at com.sun.javafx.tk.quantum.QuantumToolkit.startup(QuantumToolkit.java:
    289)
    at com.sun.javafx.application.PlatformImpl.startup(PlatformImpl.java:68)
    at com.sun.javafx.application.LauncherImpl.launchApplication1(LauncherIm
    pl.java:145)
    at com.sun.javafx.application.LauncherImpl.access$000(LauncherImpl.java:
    27)
    at com.sun.javafx.application.LauncherImpl$1.run(LauncherImpl.java:97)
    at java.lang.Thread.run(Unknown Source)
    Caused by: java.lang.UnsatisfiedLinkError: Can't load library: C:\dev\RedactionT
    oolPrototype\RedactionToolPrototype.Core\dist\bin\mat.dll
    at java.lang.ClassLoader.loadLibrary(Unknown Source)
    at java.lang.Runtime.load0(Unknown Source)
    at java.lang.System.load(Unknown Source)
    at com.sun.glass.utils.NativeLibLoader.loadLibraryFullPath(NativeLibLoad
    er.java:155)
    at com.sun.glass.utils.NativeLibLoader.loadLibraryInternal(NativeLibLoad
    er.java:85)
    at com.sun.glass.utils.NativeLibLoader.loadLibrary(NativeLibLoader.java:
    30)
    at com.sun.glass.ui.Application$1.run(Application.java:28)
    at java.security.AccessController.doPrivileged(Native Method)
    at com.sun.glass.ui.Application.loadNativeLibrary(Application.java:26)
    at com.sun.glass.ui.win.WinApplication.<clinit>(WinApplication.java:33)
    at com.sun.glass.ui.win.WinPlatformFactory.createApplication(WinPlatform
    Factory.java:20)
    at com.sun.glass.ui.win.WinPlatformFactory.createApplication(WinPlatform
    Factory.java:17)
    at com.sun.glass.ui.Application.Run(Application.java:51)
    at com.sun.javafx.tk.quantum.QuantumToolkit.startup(QuantumToolkit.java:
    279)
    ... 5 more

    Unsatisfied link means that Java is trying to access a native library, but it cannot be found. As to why this error is being thrown, here is my guess:
    If you open up one of the sample jars with a zip viewer, you will see that the Manifest file has the following entries:
    >
    Manifest-Version: 1.0
    JavaFX-Version: 2.0
    implementation-vendor: Oracle
    implementation-title: BrickBreaker
    implementation-version: 1.0
    JavaFX-Application-Class: brickbreaker.Main
    Created-By: JavaFX Packager
    Main-Class: com/javafx/main/Main
    >
    In other words, a JavaFX project works a bit differently than a normal Java project. com/javafx/main/Main is used as the Main class and your "Main" class is called later.
    If you are trying to build this from a normal Java project, then com/javafx/main/Main will not be created and it will call your Main class right away. Thus, whatever setup is needed to run JavaFX will not occur.

Maybe you are looking for