Usage: jarsigner [options] jar-file alias
jarsigner -verify [options] jar-file [alias...]
[-keystore <url>] keystore location
[-storepass <password>] password for keystore integrity
[-storetype <type>] keystore type
[-keypass <password>] password for private key (if different)
[-certchain <file>] name of alternative certchain file
[-sigfile <file>] name of .SF/.DSA file
[-signedjar <file>] name of signed JAR file
[-digestalg <algorithm>] name of digest algorithm
[-sigalg <algorithm>] name of signature algorithm
[-verify] verify a signed JAR file
[-verbose[:suboptions]] verbose output when signing/verifying.
suboptions can be all, grouped or summary
[-certs] display certificates when verbose and verifying
[-tsa <url>] location of the Timestamping Authority
[-tsacert <alias>] public key certificate for Timestamping Authority
[-tsapolicyid <oid>] TSAPolicyID for Timestamping Authority
[-tsadigestalg <algorithm>] algorithm of digest data in timestamping request
[-altsigner <class>] class name of an alternative signing mechanism
(This option has been deprecated.)
[-altsignerpath <pathlist>] location of an alternative signing mechanism
(This option has been deprecated.)
[-internalsf] include the .SF file inside the signature block
[-sectionsonly] don't compute hash of entire manifest
[-protected] keystore has protected authentication path
[-providerName <name>] provider name
[-addprovider <name> add security provider by name (e.g. SunPKCS11)
[-providerArg <arg>]] ... configure argument for -addprovider
[-providerClass <class> add security provider by fully-qualified class name
[-providerArg <arg>]] ... configure argument for -providerClass
[-strict] treat warnings as errors
[-conf <url>] specify a pre-configured options file
[-? -h --help] Print this help message
Options (20)
| Option | Description | Source |
|---|---|---|
-keystore url | Specifies the URL that tells the keystore location. | man |
-storetype storetype | Specifies the type of keystore to be instantiated. | man |
-sigfile file | Specifies the base file name to be used for the generated .SF and .DSA files. | man |
-sigalg algorithm | Specifies the name of the signature algorithm to use to sign the JAR file. | man |
-digestalg algorithm | Specifies the name of the message digest algorithm to use when digesting the entries of a JAR file. | man |
-certs | If the -certs option appears on the command line with the -verify and -verbose options, then the output includes certificate information for each signer of the JAR file. | man |
-certchain file | Specifies the certificate chain to be used when the certificate chain associated with the private key of the keystore entry that is addressed by the alias specified on the command line is not… | man |
-verbose | When the -verbose option appears on the command line, it indicates verbose mode, which causes jarsigner to output extra information about the progress of the JAR signing or verification. | man |
-internalsf | In the past, the .DSA (signature block) file generated when a JAR file was signed included a complete encoded copy of the .SF file (signature file) also generated. | man |
-sectionsonly | If the -sectionsonly option appears on the command line, then the .SF file (signature file) generated when a JAR file is signed does not include a header that contains a hash of the whole manifest… | man |
-protected | Values can be either true or false. | man |
-providerClass provider-class-name | Used to specify the name of cryptographic service provider's master class file when the service provider is not listed in the java.security security properties file. | man |
-providerName providerName | If more than one provider was configured in the java.security security properties file, then you can use the -providerName option to target a specific provider instance. | man |
-Jjavaoption | Passes through the specified javaoption string directly to the Java interpreter. | man |
-tsa url | If -tsa http://example.tsa.url appears on the command line when signing a JAR file then a time stamp is generated for the signature. | man |
-tsacert alias | When -tsacert alias appears on the command line when signing a JAR file, a time stamp is generated for the signature. | man |
-tsapolicyid policyid | Specifies the object identifier (OID) that identifies the policy ID to be sent to the TSA server. | man |
-altsigner class | This option specifies an alternative signing mechanism. | man |
-altsignerpath classpathlist | Specifies the path to the class file and any JAR file it depends on. | man |
-strict | During the signing or verifying process, the command may issue warning messages. | man |
Examples (32) from the manual page, untested
jarsigner -keystore /working/mystore
Use the following command to sign bundle.jar with the private key of a user whose keystore alias is jane in a keystore named mystore in the working directory and name the signed JAR file sbundle.jar:-storepass <keystore password>-keypass <private key password>-signedjar sbundle.jar bundle.jar janejarsigner -keystore /working/mystore
If you want to be prompted for the store password and the private key password, then you could shorten the previous command to the following:-signedjar sbundle.jar bundle.jar janejarsigner -signedjar sbundle.jar bundle.jar jane
If the keystore is the default keystore (.keystore in your home directory), then you do not need to specify a keystore, as follows:jarsigner bundle.jar jane
If you want the signed JAR file to overwrite the input JAR file (bundle.jar), then you do not need to specify a -signedjar option, as follows:jarsigner -verify sbundle.jar
To verify a signed JAR file to ensure that the signature is valid and the JAR file was not been tampered with, use a command such as the following:jarsigner -verify -verbose sbundle.jar
When the verification is successful, jar verified is displayed.198 Fri Sep 26 16:14:06 PDT 1997 META-INF/MANIFEST.MF199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSAsmk 2752 Fri Sep 26 16:12:30 PDT 1997 AclEx.classsmk 849 Fri Sep 26 16:12:46 PDT 1997 test.classs = signature was verifiedm = entry is listed in manifestk = at least one certificate was found in keystorejar verified.jarsigner -keystore /working/mystore -verify -verbose -certs myTest.jar
If you specify the -certs option with the -verify and -verbose options, then the output includes certificate information for each signer of the JAR file.198 Fri Sep 26 16:14:06 PDT 1997 META-INF/MANIFEST.MF199 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.SF1013 Fri Sep 26 16:22:10 PDT 1997 META-INF/JANE.DSA208 Fri Sep 26 16:23:30 PDT 1997 META-INF/JAVATEST.SF1087 Fri Sep 26 16:23:30 PDT 1997 META-INF/JAVATEST.DSAsmk 2752 Fri Sep 26 16:12:30 PDT 1997 Tst.classX.509, CN=Test Group, OU=Java Software, O=Oracle, L=CUP, S=CA, C=US (javatest)X.509, CN=Jane Smith, OU=Java Software, O=Oracle, L=cup, S=ca, C=us (jane)s = signature was verifiedm = entry is listed in manifestk = at least one certificate was found in keystorejar verified.