public CodeSigner [ ] verify ( Hashtable < String , CodeSigner [ ] > verifiedSigners , Hashtable < String , CodeSigner [ ] > sigFileSigners ) throws JarException { if ( skip ) { return null ; } if ( signers != null ) return signers ; for ( int i = 0 ; i < digests . size ( ) ; i ++ ) { MessageDigest digest = digests . get ( i ) ; byte [ ] manHash = manifestHashes . get ( i ) ; byte [ ] theHash = digest . digest ( ) ; if ( debug != null ) { debug . println ( "Manifest Entry: " + name + " digest=" + digest . getAlgorithm ( ) ) ; debug . println ( " manifest " + toHex ( manHash ) ) ; debug . println ( " computed " + toHex ( theHash ) ) ; debug . println ( ) ; } if ( ! MessageDigest . isEqual ( theHash , manHash ) ) throw new SecurityException ( digest . getAlgorithm ( ) + " digest error for " + name ) ; } // take it out of sigFileSigners and put it in verifiedSigners... signers = sigFileSigners . remove ( name ) ; if ( signers != null ) { verifiedSigners . put ( name , signers ) ; } return signers ; }
go through all the digests calculating the final digest and comparing it to the one in the manifest . If this is the first time we have verified this object remove its code signers from sigFileSigners and place in verifiedSigners .