Win a copy of Design for the Mind this week in the Design forum!
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

why jarsigner

 
Baskaran Ragav
Greenhorn
Posts: 14
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi, Thanks for opening.

I have a basic question, like when do we need to sign a jar ? what is the purpose ?

Thanks
Ragav,
 
Henry Wong
author
Marshal
Pie
Posts: 20997
76
C++ Chrome Eclipse IDE Firefox Browser Java jQuery Linux VI Editor Windows
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Originally posted by Raghven k b:
Hi, Thanks for opening.

I have a basic question, like when do we need to sign a jar ? what is the purpose ?

Thanks
Ragav,


Signing a jar is basically used to verify a trusted source. When you sign a jar with your digital signature (based on your private key), you place a mark into the jar file that could not have been done by anyone but you.

The signature is also a checksum of the Jar file, so if the jar get corrupted or modified in transit, the signature is invalid.

On the other side, your public key is placed into the keystore of the system that trust you. This will be used to verify your signature.

Currently, I believe this is mainly used for applets. Using signed jar files, and setting security properties on client browsers, applets can have access to disk, network, and other stuff that they don't normally have access to.

Henry
 
Baskaran Ragav
Greenhorn
Posts: 14
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Thanks Henry for the response,

One more to add,

As per my understanding every private key will have some life time., i mean an expiry period.
So does this mean that if the key is expired the jar wont work.
Correct me if my understanding is wrong.

Thanks
Ragav,
 
Ulf Dittmer
Rancher
Posts: 42967
73
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
In the case of an applet, the user will be alerted that the certificate has expired. He then has a choice whether or not to accept the expired certificate.
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic