If a jar is correctly signed, the verifier (often but not necessarily a network client) needs only the root, and if you use a public CA that root will usually already be there.
Specifically, a KeyStore privateKeyEntry is supposed to contain the full cert chain (although if the cert is self-signed the chain is only that one cert). When
jarsigner signs using that privatekey (by alias) it creates a PKCS#7 SignedData detached signature, which includes the cert chain. For the case where the keystore can't provide the chain,
jarsigner since Java7 has
-certchain option to add them, see http://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html .
To verify a jar signature (or any signature containing a cert chain) Java actually can use any cert in the chain found in the local truststore. Since roots exist for the purpose of concentrating trust for all chains under them, it's conventional and easiest to have only roots in the local truststore. And JRE includes a default
cacerts containing nearly 100 roots for "well-known" public CAs like Verisign and GoDaddy.
jarsigner -verify -verbose -certs [-keystore if_not_default] test.jar will show you the cert chain used, and mark the cert(s?) found in the truststore with its alias in parentheses at the right.