Every jar file contains a MANIFEST.MF file containing a hash for every file. With jarsigner -verify you can verify a jar file, but what are the steps taken to verify a signed .class file in a jar? I am looking for a description of how jarsigner works.

  • Every jar contains a manifest file, but that manifest only contains hashes of the entries if the jar has been signed (at least once). For the verification process see the documentation page – dave_thompson_085 May 24 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.