APIdia Launch Partner
Top Fields Constructors Methods
sun.security.util

public Class SignatureFileVerifier

extends Object
Class Inheritance
Imports
java.io.ByteArrayInputStream, .IOException, java.security.*, java.security.cert.CertPath, .CertificateException, .CertificateFactory, .X509Certificate, java.util.*, java.util.jar.Attributes, .Manifest, jdk.internal.util.ArraysSupport, sun.security.jca.Providers, sun.security.pkcs.PKCS7, .SignerInfo

Field Summary

Modifier and TypeField and Description
private static final String
ATTR_DIGEST

private final PKCS7
block

the PKCS7 block for this .DSA/.RSA/.EC file

private final CertificateFactory
certificateFactory

private HashMap<String, MessageDigest>
createdDigests

cache of created MessageDigest objects

private static final Debug
debug

private static final int
MAX_ARRAY_SIZE

public static final int
MAX_SIG_FILE_SIZE

private final ManifestDigester
md

the ManifestDigester

private static final String
META_INF

private final String
name

the name of the signature block file, uppercase and without the extension (.DSA/.RSA/.EC)

private JarConstraintsParameters
params

ConstraintsParameters for checking disabled algorithms

private final Map<String, Boolean>
permittedAlgs

Algorithms that have been previously checked against disabled constraints.

private byte[]
sfBytes

the raw bytes of the .SF file

private static int
SIGNER_CACHE_SIZE

private final List<CodeSigner[]>
signerCache

private boolean
workaround

Constructor Summary

AccessConstructor and Description
public
SignatureFileVerifier(List<CodeSigner[]> signerCache, ManifestDigester md, String
the name of the signature block file (.DSA/.RSA/.EC)
name, byte[]
the raw bytes of the signature block file
rawBytes)

Create the named SignatureFileVerifier.

Method Summary

Modifier and TypeMethod and Description
pack-priv static boolean
contains(CodeSigner[] set, CodeSigner signer)

public static String

Returns:

the extension
getBlockExtension(PrivateKey
the key used to sign the JAR file
key)

Returns the signed JAR block file extension for a key.

private MessageDigest
getDigest(String algorithm)

get digest from cache

private CodeSigner[]
getSigners(SignerInfo[] infos, PKCS7 block)

Given the PKCS7 block and SignerInfo[], create an array of CodeSigner objects.

pack-priv String
getWeakAlgorithms(String header)

With a given header (*-DIGEST*), return a string that lists all the algorithms associated with the header.

private static int
initializeMaxSigFileSize()

public static boolean

Returns:

true if the input file name is a supported Signature File or PKCS7 block file name
isBlockOrSF(String
file name
s)

Utility method used by JarVerifier and JarSigner to determine the signature file names and PKCS7 block files names that are supported

public static boolean

Returns:

true if the path resides in META-INF directly, ignoring case
isInMetaInf(String
the path name to check
name)

Utility method used by JarVerifier and JarSigner to determine if a path is located directly in the META-INF/ directory

public static boolean

Returns:

true if the input file name is signature related
isSigningRelated(String
file name
name)

Yet another utility method used by JarVerifier and JarSigner to determine what files are signature related, which includes the MANIFEST, SF files, known signature block files, and other unknown signature related files (those starting with SIG- with an optional [A-Z0-9]{1,3} extension right inside META-INF).

pack-priv static boolean
isSubSet(CodeSigner[] subset, CodeSigner[] set)

pack-priv static boolean
matches(CodeSigner[] signers, CodeSigner[] oldSigners, CodeSigner[] newSigners)

returns true if signer contains exactly the same code signers as oldSigner and newSigner, false otherwise.

public boolean
needSignatureFile(String
the name of the .SF file without the extension
name)

returns true if we need this .SF file.

public boolean
needSignatureFileBytes()

returns true if we need the .SF file

private boolean
permittedCheck(String key, String algorithm)

Check if algorithm is permitted using the permittedAlgs Map.

public void
process(Hashtable<String, CodeSigner[]> signers, List<Object> manifestDigests, String manifestName)

process the signature block file.

private void
processImpl(Hashtable<String, CodeSigner[]> signers, List<Object> manifestDigests, String manifestName)

public void
setSignatureFile(byte[] sfBytes)

used to set the raw bytes of the .SF file when it is external to the signature block file.

pack-priv void
updateSigners(CodeSigner[] newSigners, Hashtable<String, CodeSigner[]> signers, String name)

private boolean
verifyManifestHash(Manifest sf, ManifestDigester md, List<Object> manifestDigests)

See if the whole manifest was signed.

private boolean
verifyManifestMainAttrs(Manifest sf, ManifestDigester md)

private boolean

Returns:

true if all the -Digest headers verified
verifySection(Attributes sfAttr, String name, ManifestDigester md)

given the .SF digest header, and the data from the section in the manifest, see if the hashes match.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ATTR_DIGESTback to summary
private static final String ATTR_DIGEST
blockback to summary
private final PKCS7 block

the PKCS7 block for this .DSA/.RSA/.EC file

certificateFactoryback to summary
private final CertificateFactory certificateFactory
createdDigestsback to summary
private HashMap<String, MessageDigest> createdDigests

cache of created MessageDigest objects

debugback to summary
private static final Debug debug
MAX_ARRAY_SIZEback to summary
private static final int MAX_ARRAY_SIZE
MAX_SIG_FILE_SIZEback to summary
public static final int MAX_SIG_FILE_SIZE
mdback to summary
private final ManifestDigester md

the ManifestDigester

META_INFback to summary
private static final String META_INF
nameback to summary
private final String name

the name of the signature block file, uppercase and without the extension (.DSA/.RSA/.EC)

paramsback to summary
private JarConstraintsParameters params

ConstraintsParameters for checking disabled algorithms

permittedAlgsback to summary
private final Map<String, Boolean> permittedAlgs

Algorithms that have been previously checked against disabled constraints.

sfBytesback to summary
private byte[] sfBytes

the raw bytes of the .SF file

SIGNER_CACHE_SIZEback to summary
private static int SIGNER_CACHE_SIZE
signerCacheback to summary
private final List<CodeSigner[]> signerCache
workaroundback to summary
private boolean workaround

Constructor Detail

SignatureFileVerifierback to summary
public SignatureFileVerifier(List<CodeSigner[]> signerCache, ManifestDigester md, String name, byte[] rawBytes) throws IOException, CertificateException

Create the named SignatureFileVerifier.

Parameters
name:String

the name of the signature block file (.DSA/.RSA/.EC)

rawBytes:byte[]

the raw bytes of the signature block file

Method Detail

containsback to summary
pack-priv static boolean contains(CodeSigner[] set, CodeSigner signer)
getBlockExtensionback to summary
public static String getBlockExtension(PrivateKey key)

Returns the signed JAR block file extension for a key. Returns "DSA" for unknown algorithms. This is safe because the signature verification process does not require the extension to match the key algorithm as long as it is "RSA", "DSA", or "EC."

Parameters
key:PrivateKey

the key used to sign the JAR file

Returns:String

the extension

See Also
isBlockOrSF(String)
getDigestback to summary
private MessageDigest getDigest(String algorithm)

get digest from cache

getSignersback to summary
private CodeSigner[] getSigners(SignerInfo[] infos, PKCS7 block) throws IOException, NoSuchAlgorithmException, SignatureException, CertificateException

Given the PKCS7 block and SignerInfo[], create an array of CodeSigner objects. We do this only *once* for a given signature block file.

getWeakAlgorithmsback to summary
pack-priv String getWeakAlgorithms(String header)

With a given header (*-DIGEST*), return a string that lists all the algorithms associated with the header. If there are none, return "Unknown Algorithm".

initializeMaxSigFileSizeback to summary
private static int initializeMaxSigFileSize()
isBlockOrSFback to summary
public static boolean isBlockOrSF(String s)

Utility method used by JarVerifier and JarSigner to determine the signature file names and PKCS7 block files names that are supported

Parameters
s:String

file name

Returns:boolean

true if the input file name is a supported Signature File or PKCS7 block file name

See Also
getBlockExtension(PrivateKey)
isInMetaInfback to summary
public static boolean isInMetaInf(String name)

Utility method used by JarVerifier and JarSigner to determine if a path is located directly in the META-INF/ directory

Parameters
name:String

the path name to check

Returns:boolean

true if the path resides in META-INF directly, ignoring case

isSigningRelatedback to summary
public static boolean isSigningRelated(String name)

Yet another utility method used by JarVerifier and JarSigner to determine what files are signature related, which includes the MANIFEST, SF files, known signature block files, and other unknown signature related files (those starting with SIG- with an optional [A-Z0-9]{1,3} extension right inside META-INF).

Parameters
name:String

file name

Returns:boolean

true if the input file name is signature related

isSubSetback to summary
pack-priv static boolean isSubSet(CodeSigner[] subset, CodeSigner[] set)
matchesback to summary
pack-priv static boolean matches(CodeSigner[] signers, CodeSigner[] oldSigners, CodeSigner[] newSigners)

returns true if signer contains exactly the same code signers as oldSigner and newSigner, false otherwise. oldSigner is allowed to be null.

needSignatureFileback to summary
public boolean needSignatureFile(String name)

returns true if we need this .SF file.

Parameters
name:String

the name of the .SF file without the extension

needSignatureFileBytesback to summary
public boolean needSignatureFileBytes()

returns true if we need the .SF file

permittedCheckback to summary
private boolean permittedCheck(String key, String algorithm)

Check if algorithm is permitted using the permittedAlgs Map. If the algorithm is not in the map, check against disabled algorithms and store the result. If the algorithm is in the map use that result. False is returned for weak algorithm, true for good algorithms.

processback to summary
public void process(Hashtable<String, CodeSigner[]> signers, List<Object> manifestDigests, String manifestName) throws IOException, SignatureException, NoSuchAlgorithmException, CertificateException

process the signature block file. Goes through the .SF file and adds code signers for each section where the .SF section hash was verified against the Manifest section.

processImplback to summary
private void processImpl(Hashtable<String, CodeSigner[]> signers, List<Object> manifestDigests, String manifestName) throws IOException, SignatureException, NoSuchAlgorithmException, CertificateException
setSignatureFileback to summary
public void setSignatureFile(byte[] sfBytes)

used to set the raw bytes of the .SF file when it is external to the signature block file.

updateSignersback to summary
pack-priv void updateSigners(CodeSigner[] newSigners, Hashtable<String, CodeSigner[]> signers, String name)
verifyManifestHashback to summary
private boolean verifyManifestHash(Manifest sf, ManifestDigester md, List<Object> manifestDigests) throws SignatureException

See if the whole manifest was signed.

verifyManifestMainAttrsback to summary
private boolean verifyManifestMainAttrs(Manifest sf, ManifestDigester md) throws SignatureException
verifySectionback to summary
private boolean verifySection(Attributes sfAttr, String name, ManifestDigester md) throws SignatureException

given the .SF digest header, and the data from the section in the manifest, see if the hashes match. if not, throw a SecurityException.

Returns:boolean

true if all the -Digest headers verified

Exceptions
SecurityException:
if the hash was not equal