This week's book giveaway is in the Java 8 forum.
We're giving away four copies of Java 8 in Action and have Raoul-Gabriel Urma, Mario Fusco, and Alan Mycroft on-line!
See this thread for details.
The moose likes Beginning Java and the fly likes why jarsigner Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of Java 8 in Action this week in the Java 8 forum!
JavaRanch » Java Forums » Java » Beginning Java
Bookmark "why jarsigner" Watch "why jarsigner" New topic
Author

why jarsigner

Baskaran Ragav
Greenhorn

Joined: Apr 13, 2007
Posts: 14
Hi, Thanks for opening.

I have a basic question, like when do we need to sign a jar ? what is the purpose ?

Thanks
Ragav,
Henry Wong
author
Sheriff

Joined: Sep 28, 2004
Posts: 18138
    
  39

Originally posted by Raghven k b:
Hi, Thanks for opening.

I have a basic question, like when do we need to sign a jar ? what is the purpose ?

Thanks
Ragav,


Signing a jar is basically used to verify a trusted source. When you sign a jar with your digital signature (based on your private key), you place a mark into the jar file that could not have been done by anyone but you.

The signature is also a checksum of the Jar file, so if the jar get corrupted or modified in transit, the signature is invalid.

On the other side, your public key is placed into the keystore of the system that trust you. This will be used to verify your signature.

Currently, I believe this is mainly used for applets. Using signed jar files, and setting security properties on client browsers, applets can have access to disk, network, and other stuff that they don't normally have access to.

Henry


Books: Java Threads, 3rd Edition, Jini in a Nutshell, and Java Gems (contributor)
Baskaran Ragav
Greenhorn

Joined: Apr 13, 2007
Posts: 14
Thanks Henry for the response,

One more to add,

As per my understanding every private key will have some life time., i mean an expiry period.
So does this mean that if the key is expired the jar wont work.
Correct me if my understanding is wrong.

Thanks
Ragav,
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 39576
    
  27
In the case of an applet, the user will be alerted that the certificate has expired. He then has a choice whether or not to accept the expired certificate.


Ping & DNS - updated with new look and Ping home screen widget
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: why jarsigner
 
Similar Threads
air india or indian air
Please convince me about Certification
Can Ruby replace perl script?
Jython
variable conventions in ruby