OpenJDK 27 · sun.security.tools.jarsigner.Main · APIdia, the JavaDoc alternative

Modifier and Type	Class and Description
private static class	Main.ExitException

Field Summary

Modifier and Type	Field and Description
pack-priv String	alias
private boolean	aliasNotInStore
private boolean	allAliasesFound
pack-priv String	altCertChain
private boolean	badExtendedKeyUsage
private boolean	badKeyUsage
private boolean	badNetscapeCertType
private Map<CodeSigner, Integer>	cacheForInKS
pack-priv Map<CodeSigner, String>	cacheForSignerInfo
pack-priv X509Certificate[]	certChain
private static final DisabledAlgorithmConstraints	CERTPATH_DISABLED_CHECK
private boolean	chainNotValidated
private Throwable	chainNotValidatedReason
pack-priv List<String>	ckaliases
private static final Collator	collator
private List<String>	crossChkWarnings
pack-priv boolean	debug
private static final Set<CryptoPrimitive>	DIGEST_PRIMITIVE_SET
pack-priv String	digestalg
private int	disabledAlg
private boolean	disabledAlgFound
private Date	expireDate
private static MessageFormat	expiredTimeForm
private static MessageFormat	expiringTimeForm
private static boolean	externalFileAttributesDetected
pack-priv boolean	externalSF
private boolean	hasExpiredCert
private boolean	hasExpiredTsaCert
private boolean	hasExpiringCert
private boolean	hasExpiringTsaCert
private boolean	hasMultipleManifests
private boolean	hasNonexistentEntries
pack-priv boolean	hasTimestampBlock
private boolean	hasUnsignedEntry
pack-priv static final int	IN_KEYSTORE
private static final DisabledAlgorithmConstraints	JAR_DISABLED_CHECK
pack-priv String	jarfile
pack-priv static final JavaUtilZipFileAccess	JUZFA
pack-priv char[]	keypass
pack-priv String	keystore
private static final DisabledAlgorithmConstraints	LEGACY_CHECK
private int	legacyAlg
private String	legacyDigestAlg
private String	legacySigAlg
private String	legacyTsaDigestAlg
private static final String	NONE
pack-priv static final int	NOT_ALIAS
private boolean	noTimestamp
private boolean	notSignedByAlias
private static MessageFormat	notYetTimeForm
private boolean	notYetValidCert
pack-priv boolean	nullStream
private static final long	ONE_YEAR
private static final String	P11KEYSTORE
pack-priv String	pathlist
pack-priv PKIXBuilderParameters	pkixParameters
pack-priv PrivateKey	privateKey
pack-priv boolean	protectedPath
pack-priv HashMap<String, String>	providerArgs
pack-priv List<String>	providerClasses
pack-priv String	providerName
pack-priv List<String>	providers
private static final ResourceBundle	rb
pack-priv String	realStoreType
pack-priv boolean	revocationCheck
pack-priv boolean	showcerts
private static final Set<CryptoPrimitive>	SIG_PRIMITIVE_SET
pack-priv String	sigalg
pack-priv String	sigfile
pack-priv static final int	SIGNED_BY_ALIAS
pack-priv String	signedjar
private boolean	signerSelfSigned
pack-priv boolean	signManifest
private static MessageFormat	signTimeForm
private static final long	SIX_MONTHS
pack-priv static final int	SOME_ALIASES_NOT_FOUND
pack-priv KeyStore	store
pack-priv Hashtable<Certificate, String>	storeHash Maps certificates (as keys) to alias names associated in the keystore `keystore` (as values).
pack-priv char[]	storepass
pack-priv String	storetype
pack-priv boolean	strict
pack-priv boolean	token
pack-priv Set<X509Certificate>	trustedCerts
pack-priv String	tsaAlias
private boolean	tsaChainNotValidated
private Throwable	tsaChainNotValidatedReason
pack-priv String	tSADigestAlg
private Date	tsaExpireDate
pack-priv String	tSAPolicyID
pack-priv String	tsaUrl
private static MessageFormat	validityTimeForm
pack-priv String	verbose
pack-priv boolean	verify
pack-priv static final String	VERSION
pack-priv boolean	version
private boolean	weakKeyStore
private PublicKey	weakPublicKey
private ZipFile	zipFile

Constructor Summary

Access	Constructor and Description
public	Main()

Method Summary

Modifier and Type	Method and Description
private String	Returns: the info as a string certsAndTSInfo(String spaces before the ">>> Signer" line tab1, String spaces before the other lines tab2, List<? extends Certificate> the signer cert certs, Timestamp the timestamp, can be null ts) Fills info on certs and timestamp into a StringBuilder, sets warning flags (through printCert) and validates cert chains.
pack-priv void	checkCertUsage(X509Certificate the certificate to be examined userCert, boolean[] 3 booleans to show if the KeyUsage, ExtendedKeyUsage, NetscapeCertType has codeSigning flag turned on. If null, the class field badKeyUsage, badExtendedKeyUsage, badNetscapeCertType will be set. bad) Check if userCert is designed to be a code signer
private static String	checkWeakAlg(String alg, CertPathConstraintsParameters cpcp)
private static String	checkWeakKey(PublicKey key, CertPathConstraintsParameters cpcp)
private void	checkWeakSign(String alg, Set<CryptoPrimitive> primitiveSet, boolean tsa, JarConstraintsParameters jcp)
private void	checkWeakSign(PrivateKey key, JarConstraintsParameters jcp)
private void	compareManifest(Manifest cenManifest, Manifest locManifest)
private void	compareSigners(JarEntry cenEntry, JarEntry locEntry)
private void	crossCheckEntries(String jarName)
private void	displayCrossChkWarnings()
private void	displayMessagesAndResult(boolean isSigning)
pack-priv static void	doPrintVersion()
pack-priv void	error(String message)
pack-priv void	error(String message, Throwable e)
private TrustAnchor	findTrustAnchor(List<X509Certificate> chain)
private static String	Returns: the full name fullDisplayKeyName(Key the key object, cannot be null key) Returns the full display name of the given key object.
pack-priv static void	fullusage()
pack-priv void	getAliasInfo(String alias)
pack-priv static char[]	getPass(String modifier, String arg)
pack-priv char[]	getPass(String prompt)
pack-priv X509Certificate	getTsaCert(String alias)
pack-priv int	inKeyStore(CodeSigner[] signers)
private int	inKeyStoreForOneSigner(CodeSigner signer)
pack-priv void	loadKeyStore(String keyStoreName, boolean prompt)
public static void	main(String[] args)
pack-priv String[]	parseArgs(String[] args)
pack-priv String	printCert(boolean true if c is in the TSA cert chain, false otherwise. isTsCert, String tab, Certificate c, Date timestamp, boolean true to check code signer keyUsage checkUsage, CertPathConstraintsParameters cpcp) Returns a string about a certificate: [<tab>] <cert-type> [", " <subject-dn>] [" (" <keystore-entry-alias> ")"] [<validity-period> \| <expiry-warning>] [<key-usage-warning>] Note: no newline character at the end.
private String	printTimestamp(String tab, Timestamp timestamp)
private void	readEntry(InputStream is)
public int	run(String[] args)
private boolean	signatureRelated(String name) signature-related files include: .
private String	signerInfo(CodeSigner signer, String tab) Returns a string of signer info, with a newline at the end.
pack-priv void	signJar(String jarName, String alias)
pack-priv static void	usage()
pack-priv static void	usageNoArg()
pack-priv void	validateCertChain(String variant, List<? extends Certificate> certs, Timestamp this might be a timestamp parameter) Validates a cert chain.
pack-priv void	verifyJar(String jarName)
private String	verifyWithWeak(String alg, Set<CryptoPrimitive> primitiveSet, boolean tsa, JarConstraintsParameters jcp, AlgorithmParameters algParams)
private String	verifyWithWeak(PublicKey key, JarConstraintsParameters jcp)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

alias	back to summary
pack-priv String alias

aliasNotInStore	back to summary
private boolean aliasNotInStore

allAliasesFound	back to summary
private boolean allAliasesFound

altCertChain	back to summary
pack-priv String altCertChain

badExtendedKeyUsage	back to summary
private boolean badExtendedKeyUsage

badKeyUsage	back to summary
private boolean badKeyUsage

badNetscapeCertType	back to summary
private boolean badNetscapeCertType

cacheForInKS	back to summary
private Map<CodeSigner, Integer> cacheForInKS

cacheForSignerInfo	back to summary
pack-priv Map<CodeSigner, String> cacheForSignerInfo

certChain	back to summary
pack-priv X509Certificate[] certChain

CERTPATH_DISABLED_CHECK	back to summary
private static final DisabledAlgorithmConstraints CERTPATH_DISABLED_CHECK

chainNotValidated	back to summary
private boolean chainNotValidated

chainNotValidatedReason	back to summary
private Throwable chainNotValidatedReason

ckaliases	back to summary
pack-priv List<String> ckaliases

collator	back to summary
private static final Collator collator

crossChkWarnings	back to summary
private List<String> crossChkWarnings

debug	back to summary
pack-priv boolean debug

DIGEST_PRIMITIVE_SET	back to summary
private static final Set<CryptoPrimitive> DIGEST_PRIMITIVE_SET

digestalg	back to summary
pack-priv String digestalg

disabledAlg	back to summary
private int disabledAlg

disabledAlgFound	back to summary
private boolean disabledAlgFound

expireDate	back to summary
private Date expireDate

expiredTimeForm	back to summary
private static MessageFormat expiredTimeForm

expiringTimeForm	back to summary
private static MessageFormat expiringTimeForm

externalFileAttributesDetected	back to summary
private static boolean externalFileAttributesDetected

externalSF	back to summary
pack-priv boolean externalSF

hasExpiredCert	back to summary
private boolean hasExpiredCert

hasExpiredTsaCert	back to summary
private boolean hasExpiredTsaCert

hasExpiringCert	back to summary
private boolean hasExpiringCert

hasExpiringTsaCert	back to summary
private boolean hasExpiringTsaCert

hasMultipleManifests	back to summary
private boolean hasMultipleManifests

hasNonexistentEntries	back to summary
private boolean hasNonexistentEntries

hasTimestampBlock	back to summary
pack-priv boolean hasTimestampBlock

hasUnsignedEntry	back to summary
private boolean hasUnsignedEntry

IN_KEYSTORE	back to summary
pack-priv static final int IN_KEYSTORE

JAR_DISABLED_CHECK	back to summary
private static final DisabledAlgorithmConstraints JAR_DISABLED_CHECK

jarfile	back to summary
pack-priv String jarfile

JUZFA	back to summary
pack-priv static final JavaUtilZipFileAccess JUZFA

keypass	back to summary
pack-priv char[] keypass

keystore	back to summary
pack-priv String keystore

LEGACY_CHECK	back to summary
private static final DisabledAlgorithmConstraints LEGACY_CHECK

legacyAlg	back to summary
private int legacyAlg

legacyDigestAlg	back to summary
private String legacyDigestAlg

legacySigAlg	back to summary
private String legacySigAlg

legacyTsaDigestAlg	back to summary
private String legacyTsaDigestAlg

NONE	back to summary
private static final String NONE

NOT_ALIAS	back to summary
pack-priv static final int NOT_ALIAS

noTimestamp	back to summary
private boolean noTimestamp

notSignedByAlias	back to summary
private boolean notSignedByAlias

notYetTimeForm	back to summary
private static MessageFormat notYetTimeForm

notYetValidCert	back to summary
private boolean notYetValidCert

nullStream	back to summary
pack-priv boolean nullStream

ONE_YEAR	back to summary
private static final long ONE_YEAR

P11KEYSTORE	back to summary
private static final String P11KEYSTORE

pathlist	back to summary
pack-priv String pathlist

pkixParameters	back to summary
pack-priv PKIXBuilderParameters pkixParameters

privateKey	back to summary
pack-priv PrivateKey privateKey

protectedPath	back to summary
pack-priv boolean protectedPath

providerArgs	back to summary
pack-priv HashMap<String, String> providerArgs

providerClasses	back to summary
pack-priv List<String> providerClasses

providerName	back to summary
pack-priv String providerName

providers	back to summary
pack-priv List<String> providers

rb	back to summary
private static final ResourceBundle rb

realStoreType	back to summary
pack-priv String realStoreType

revocationCheck	back to summary
pack-priv boolean revocationCheck

showcerts	back to summary
pack-priv boolean showcerts

SIG_PRIMITIVE_SET	back to summary
private static final Set<CryptoPrimitive> SIG_PRIMITIVE_SET

sigalg	back to summary
pack-priv String sigalg

sigfile	back to summary
pack-priv String sigfile

SIGNED_BY_ALIAS	back to summary
pack-priv static final int SIGNED_BY_ALIAS

signedjar	back to summary
pack-priv String signedjar

signerSelfSigned	back to summary
private boolean signerSelfSigned

signManifest	back to summary
pack-priv boolean signManifest

signTimeForm	back to summary
private static MessageFormat signTimeForm

SIX_MONTHS	back to summary
private static final long SIX_MONTHS

SOME_ALIASES_NOT_FOUND	back to summary
pack-priv static final int SOME_ALIASES_NOT_FOUND

store	back to summary
pack-priv KeyStore store

storeHash	back to summary
pack-priv Hashtable<Certificate, String> storeHash Maps certificates (as keys) to alias names associated in the keystore `keystore` (as values).

storepass	back to summary
pack-priv char[] storepass

storetype	back to summary
pack-priv String storetype

strict	back to summary
pack-priv boolean strict

token	back to summary
pack-priv boolean token

trustedCerts	back to summary
pack-priv Set<X509Certificate> trustedCerts

tsaAlias	back to summary
pack-priv String tsaAlias

tsaChainNotValidated	back to summary
private boolean tsaChainNotValidated

tsaChainNotValidatedReason	back to summary
private Throwable tsaChainNotValidatedReason

tSADigestAlg	back to summary
pack-priv String tSADigestAlg

tsaExpireDate	back to summary
private Date tsaExpireDate

tSAPolicyID	back to summary
pack-priv String tSAPolicyID

tsaUrl	back to summary
pack-priv String tsaUrl

validityTimeForm	back to summary
private static MessageFormat validityTimeForm

verbose	back to summary
pack-priv String verbose

verify	back to summary
pack-priv boolean verify

VERSION	back to summary
pack-priv static final String VERSION

version	back to summary
pack-priv boolean version

weakKeyStore	back to summary
private boolean weakKeyStore

weakPublicKey	back to summary
private PublicKey weakPublicKey

zipFile	back to summary
private ZipFile zipFile

Method Detail

certsAndTSInfo

back to summary

private String certsAndTSInfo(String tab1, String tab2, List<? extends Certificate> certs, Timestamp ts) throws Exception

Fills info on certs and timestamp into a StringBuilder, sets warning flags (through printCert) and validates cert chains.

Parameters

tab1:String: spaces before the ">>> Signer" line
tab2:String: spaces before the other lines
certs:List<? extends Certificate>: the signer cert
ts:Timestamp: the timestamp, can be null

Returns:String

the info as a string

checkCertUsage

back to summary

pack-priv void checkCertUsage(X509Certificate userCert, boolean[] bad)

Check if userCert is designed to be a code signer

Parameters

userCert:X509Certificate: the certificate to be examined
bad:boolean[]: 3 booleans to show if the KeyUsage, ExtendedKeyUsage, NetscapeCertType has codeSigning flag turned on. If null, the class field badKeyUsage, badExtendedKeyUsage, badNetscapeCertType will be set.

checkWeakAlg	back to summary
private static String checkWeakAlg(String alg, CertPathConstraintsParameters cpcp)

checkWeakKey	back to summary
private static String checkWeakKey(PublicKey key, CertPathConstraintsParameters cpcp)

checkWeakSign	back to summary
private void checkWeakSign(String alg, Set<CryptoPrimitive> primitiveSet, boolean tsa, JarConstraintsParameters jcp)

checkWeakSign	back to summary
private void checkWeakSign(PrivateKey key, JarConstraintsParameters jcp)

compareManifest	back to summary
private void compareManifest(Manifest cenManifest, Manifest locManifest)

compareSigners	back to summary
private void compareSigners(JarEntry cenEntry, JarEntry locEntry)

crossCheckEntries	back to summary
private void crossCheckEntries(String jarName) throws Exception

displayCrossChkWarnings	back to summary
private void displayCrossChkWarnings()

displayMessagesAndResult	back to summary
private void displayMessagesAndResult(boolean isSigning)

doPrintVersion	back to summary
pack-priv static void doPrintVersion()

error	back to summary
pack-priv void error(String message)

error	back to summary
pack-priv void error(String message, Throwable e)

findTrustAnchor	back to summary
private TrustAnchor findTrustAnchor(List<X509Certificate> chain)

fullDisplayKeyName

back to summary

private static String fullDisplayKeyName(Key key)

Returns the full display name of the given key object. Could be - "X25519", if its getParams() is NamedParameterSpec - "EC (secp256r1)", if it's an EC key - "1024-bit RSA", other known keys - plain algorithm name, otherwise Note: the same method appears in keytool and jarsigner which uses same resource string defined in their own Resources.java.

Parameters

key:Key: the key object, cannot be null

Returns:String

the full name

fullusage	back to summary
pack-priv static void fullusage()

getAliasInfo	back to summary
pack-priv void getAliasInfo(String alias) throws Exception

getPass	back to summary
pack-priv static char[] getPass(String modifier, String arg)

getPass	back to summary
pack-priv char[] getPass(String prompt)

getTsaCert	back to summary
pack-priv X509Certificate getTsaCert(String alias)

inKeyStore	back to summary
pack-priv int inKeyStore(CodeSigner[] signers)

inKeyStoreForOneSigner	back to summary
private int inKeyStoreForOneSigner(CodeSigner signer)

loadKeyStore	back to summary
pack-priv void loadKeyStore(String keyStoreName, boolean prompt)

main	back to summary
public static void main(String[] args) throws Exception

parseArgs	back to summary
pack-priv String[] parseArgs(String[] args) throws Exception

printCert

back to summary

pack-priv String printCert(boolean isTsCert, String tab, Certificate c, Date timestamp, boolean checkUsage, CertPathConstraintsParameters cpcp) throws Exception

Returns a string about a certificate: [] [", " ] [" (" ")"] [ | ] [] Note: no newline character at the end. This method sets global flags like hasExpiringCert, hasExpiredCert, notYetValidCert, badKeyUsage, badExtendedKeyUsage, badNetscapeCertType, hasExpiringTsaCert, hasExpiredTsaCert.

Parameters

isTsCert:boolean: true if c is in the TSA cert chain, false otherwise.
checkUsage:boolean: true to check code signer keyUsage

printTimestamp	back to summary
private String printTimestamp(String tab, Timestamp timestamp)

readEntry	back to summary
private void readEntry(InputStream is) throws IOException

run	back to summary
public int run(String[] args)

signatureRelated	back to summary
private boolean signatureRelated(String name) signature-related files include: . META-INF/MANIFEST.MF . META-INF/SIG-* . META-INF/.SF . META-INF/.DSA . META-INF/.RSA . META-INF/.EC

signerInfo	back to summary
private String signerInfo(CodeSigner signer, String tab) throws Exception Returns a string of signer info, with a newline at the end. Called by verifyJar().

signJar	back to summary
pack-priv void signJar(String jarName, String alias) throws Exception

usage	back to summary
pack-priv static void usage()

usageNoArg	back to summary
pack-priv static void usageNoArg()

validateCertChain

back to summary

pack-priv void validateCertChain(String variant, List<? extends Certificate> certs, Timestamp parameter) throws Exception

Validates a cert chain.

Parameters

parameter:Timestamp: this might be a timestamp

verifyJar	back to summary
pack-priv void verifyJar(String jarName) throws Exception

verifyWithWeak	back to summary
private String verifyWithWeak(String alg, Set<CryptoPrimitive> primitiveSet, boolean tsa, JarConstraintsParameters jcp, AlgorithmParameters algParams)

verifyWithWeak	back to summary
private String verifyWithWeak(PublicKey key, JarConstraintsParameters jcp)

Modifier and Type	Field and Description
private final int	errorCode
pack-priv static final long	serialVersionUID Hides java.lang.RuntimeException.serialVersionUID.

public Class Main

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class Main.ExitException

Field Summary

Constructor Summary

Field Detail

Constructor Detail