/usr/lib/jvm/java-21-openjdk-openj9/bin/jarsigner --help

From openjdk-21-openj9 0.63.0-r0 (enterprise-packages), captured 2026-11-08 by running jarsigner --help (exit 0). permalink

Usage: jarsigner [options] jar-file alias
       jarsigner -verify [options] jar-file [alias...]
       jarsigner -version

[-keystore <url>]           keystore location

[-storepass <password>]     password for keystore integrity

[-storetype <type>]         keystore type

[-keypass <password>]       password for private key (if different)

[-certchain <file>]         name of alternative certchain file

[-sigfile <file>]           name of .SF/.DSA file

[-signedjar <file>]         name of signed JAR file

[-digestalg <algorithm>]    name of digest algorithm

[-sigalg <algorithm>]       name of signature algorithm

[-verify]                   verify a signed JAR file

[-version]                  print the program version

[-verbose[:suboptions]]     verbose output when signing/verifying.
                            suboptions can be all, grouped or summary

[-certs]                    display certificates when verbose and verifying

[-revCheck]                 Enable certificate revocation check

[-tsa <url>]                location of the Timestamping Authority

[-tsacert <alias>]          public key certificate for Timestamping Authority

[-tsapolicyid <oid>]        TSAPolicyID for Timestamping Authority

[-tsadigestalg <algorithm>] algorithm of digest data in timestamping request

[-internalsf]               include the .SF file inside the signature block

[-sectionsonly]             don't compute hash of entire manifest

[-protected]                keystore has protected authentication path

[-providerName <name>]      provider name

[-addprovider <name>        add security provider by name (e.g. SunPKCS11)
  [-providerArg <arg>]] ... configure argument for -addprovider

[-providerClass <class>     add security provider by fully-qualified class name
  [-providerArg <arg>]] ... configure argument for -providerClass

[-providerPath <list>]      provider classpath

[-strict]                   treat warnings as errors

[-conf <url>]               specify a pre-configured options file

[-? -h --help]              Print this help message

Options (28)

Option	Description	Source
`-keystore` url	Specifies the URL that tells the keystore location.	man
`-storepass` :env	Specifies the password that is required to access the keystore.	man
`-storetype` storetype	Specifies the type of keystore to be instantiated.	man
`-keypass` :env	Specifies the password used to protect the private key of the keystore entry addressed by the alias specified on the command line.	man
`-certchain` file	Specifies the certificate chain to be used when the certificate chain associated with the private key of the keystore entry that is addressed by the alias specified on the command line isn't complete.	man
`-sigfile` file	Specifies the base file name to be used for the generated .SF and signature block files.	man
`-signedjar` file	Specifies the name of signed JAR file.	man
`-digestalg` algorithm	Specifies the name of the message digest algorithm to use when digesting the entries of a JAR file.	man
`-sigalg` algorithm	Specifies the name of the signature algorithm to use to sign the JAR file.	man
`-verify`	Verifies a signed JAR file.	man
`-verbose` :suboptions	When the -verbose option appears on the command line, it indicates that the jarsigner use the verbose mode when signing or verifying with the suboptions determining how much information is shown.	man
`-certs`	If the -certs option appears on the command line with the -verify and -verbose options, then the output includes certificate information for each signer of the JAR file.	man
`-revCheck`	This option enables revocation checking of certificates when signing or verifying a JAR file.	man
`-tsa` url	If -tsa http://example.tsa.url appears on the command line when signing a JAR file then a time stamp is generated for the signature.	man
`-tsacert` alias	When -tsacert alias appears on the command line when signing a JAR file, a time stamp is generated for the signature.	man
`-tsapolicyid` policyid	Specifies the object identifier (OID) that identifies the policy ID to be sent to the TSA server.	man
`-tsadigestalg` algorithm	Specifies the message digest algorithm that is used to generate the message imprint to be sent to the TSA server.	man
`-internalsf`	In the past, the signature block file generated when a JAR file was signed included a complete encoded copy of the .SF file (signature file) also generated.	man
`-sectionsonly`	If the -sectionsonly option appears on the command line, then the .SF file (signature file) generated when a JAR file is signed doesn't include a header that contains a hash of the whole manifest…	man
`-protected`	Values can be either true or false.	man
`-providerName` providerName	If more than one provider was configured in the java.security security properties file, then you can use the -providerName option to target a specific provider instance.	man
`-addprovider` name	Adds a security provider by name (such as SunPKCS11) and an optional configure argument.	man
`-providerClass` provider-class-name	Used to specify the name of cryptographic service provider's master class file when the service provider isn't listed in the java.security security properties file.	man
`-providerPath` classpath	Used to specify the classpath for providers specified by the -providerClass option.	man
`-Jjavaoption`	Passes through the specified javaoption string directly to the Java interpreter.	man
`-strict`	During the signing or verifying process, the command may issue warning messages.	man
`-conf` url	Specifies a pre-configured options file.	man
`-version`	Prints the program version.	man

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.