Verifying jar files programmatically

Question

I need to determine at run time if a jar has been signed with our certificate. All the classes I've looked at are Sun classes, or are inaccessable (JarVerifier). Does someone have some code that does this, preferrably without the sun classes? I'll take code with these classes, however.

Answer 1

I got the same problem. And I have done some experiment. The code below it works. Note: in order to use the code direcctly, the last entry has to be class that has a certificate. You might try with a signed jar that have only one class inside. I am lazy to write for other cases.
   try {
      File file = new File(jarFilename);
      FileInputStream fileIs = new FileInputStream(file);
      boolean verify = true;
      JarInputStream jarIs =
            new java.util.jar.JarInputStream(fileIs, verify);
      JarEntry entry = null;
      JarEntry Entry = null;
      while ((entry = jarIs.getNextJarEntry()) != null ) {
         if (!entry.isDirectory()) {
            Entry = entry;
      Certificate[] certs = Entry.getCertificates();
      if(certs == null)
         System.out.println("The entry has no certificate.");
      else {
         System.out.println(Array.getLength(certs));
         for(int i = 0; i < Array.getLength(certs); i++)
            System.out.println(certs.toString());
} catch (Exception e) {
System.out.println("Something went wrong.");
System.out.println(e.toString());
The problem is that we need to read the jarIs until you reach the last entry before you getCertificates. I sounds stupid, isn't it.
Enjoy your work.
Nawa