Verifying signed jar files programmatically

Question

Hi,
We need to verify the signatures of jar files without using system commands ( e.g. jarsigner.exe ).
The code below is how I tried to extract the certificates associated with the jar entries:
FileInputStream fileIs = new FileInputStream( somefile );
boolean verify = true;
JarInputStream jarIs = new java.util.jar.JarInputStream( fileIs, verify );
JarEntry entry = null;
while ( ( entry = jarIs.getNextJarEntry() ) != null ) {
if ( !entry.isDirectory() && ! isManifest( entry ) ) {
... read entire the byte stream associated with the entry
Certificate[] certs = entry.getCertificates();
// certs always returns null
I am not able to extract certificates associated with the jarentries this way, because the entry.getCertificates always return null.
What is it that I do not understand? Is there a way to do this?
regards,
jorrit

Answer 1

I got the same problem. And I have done some experiment. The code below it works. Note: in order to use the code direcctly, the last entry has to be class that has a certificate. You might try with a signed jar that have only one class inside. I am lazy to write for other cases.
   try {
      File file = new File(jarFilename);
      FileInputStream fileIs = new FileInputStream(file);
      boolean verify = true;
      JarInputStream jarIs =
            new java.util.jar.JarInputStream(fileIs, verify);
      JarEntry entry = null;
      JarEntry Entry = null;
      while ((entry = jarIs.getNextJarEntry()) != null ) {
         if (!entry.isDirectory()) {
            Entry = entry;
      Certificate[] certs = Entry.getCertificates();
      if(certs == null)
         System.out.println("The entry has no certificate.");
      else {
         System.out.println(Array.getLength(certs));
         for(int i = 0; i < Array.getLength(certs); i++)
            System.out.println(certs.toString());
} catch (Exception e) {
System.out.println("Something went wrong.");
System.out.println(e.toString());
The problem is that we need to read the jarIs until you reach the last entry before you getCertificates. I sounds stupid, isn't it.
Enjoy your work.
Nawa