WAR files can be signed?

[muthu moorthy]

Hi

Ref to the question below.

I am not sure about this "WAR files can or cannot be signed", i dont understand the term "signed"

I found the answer description below. Anybody can explain, thank you

Option B is incorrect because WAR files may be signed. Option C is incorrect.


Which four are true about WAR files? (Choose four.)

A WAR stands for Web ARchive.
B WAR files cannot be signed.
C WAR files typically contain EAR files.
D Entire web applications can be packaged into a single WAR file.
E WAR files can be created using the standard Java jar command.
F WEB-INF and META-INF are common top-level directories within WAR files.

[Ulf Dittmer]

Signing files in the Java world is most often associated with applets, although any jar/war/ear/... file can be signed. Wikipedia has an extensive writeup, but this introduction is a bit more readable.

[petar banicevic]

muthu moorthy wrote:Hi
I am not sure about this "WAR files can or cannot be signed", i dont understand the term "signed"

Yes war and ear can be signed using e.g. jar signer. It shouldn't matter if app server support or not signed wars or ears. As long as you deploy ear it will work. If you alter ear in a way that it offends the signature, then java.security exception will happen and you ear (or war) won't be launched by application server due the plain java.security exception.

This was tested on WebLogic 12g, but due to nature of mechanism which relies on java (not J2EE container) I am convinced it applies to all app servers.