Verifying signed Jar using Java code

Question

Hi,
I have been looking for a way to verify signed or unsigned jar from java code.
I have to use the jar name and from here, I have to verify the digital signature. For this goal I have found some Java classes which can be useful for me. These classes would be JarEntry class, from which I could get the certificates. Signature class, whose methods let me verify the digital signatures, and Certificate class. I also found a class called SignedObject from I could get the signature data which the method getSignature (), but the problem here it is that I need a private key in the SignedObject constructor, which is not possible since I want to verify a signed jar which I am not able to know the private key, just public key. So, could anybody tell me how I could solve this problem?
My code would be some as shown below:
jar = new JarEntry (location);
          jarcertificates = jar.getCertificates();
          /* We should check all the certificates
          if (jarcertificates != null){
               for (int i=0;i<jarcertificates.length;i++){
                    sig.initVerify(jarcertificates);
                    sig.update(jar.getExtra());
                    sig.verify( DIGITAL SIGNATURE FROM JAR SHOULD BE HERE);
I guess that I have to use jar.getExtra () in order to get the data to put in Signature.update() method but I am not sure, am I wrong?
Thanks in advance

Answer 1

Here is some sample code to verify a jar file:
        JarFile jf = new JarFile(args[0], true);
        byte[] buffer = new byte[8192];
        Enumeration e = jf.entries();
        ArrayList entries = new ArrayList();
        while (e.hasMoreElements()) {
            JarEntry je = (JarEntry) e.nextElement();
            entries.add(je);
            InputStream is = jf.getInputStream(je);
            while (is.read(buffer, 0, buffer.length) != -1) {
                // we just read. this will throw a SecurityException
                // if  a signature/digest check fails.
            is.close();
        }To validate the certificate chain, you can call JarEntry.getCertificates(), create a CertPath from the array of Certificates (using a CertificateFactory), and then use the CertPathValidator APIs. For more information, see the PKI Programmer's guide: http://java.sun.com/javase/6/docs/technotes/guides/security/certpath/CertPathProgGuide.html