private boolean verifySection ( Attributes sfAttr , String name , ManifestDigester md , BASE64Decoder decoder ) throws IOException { boolean oneDigestVerified = false ; ManifestDigester . Entry mde = md . get ( name , block . isOldStyle ( ) ) ; if ( mde == null ) { throw new SecurityException ( "no manifiest section for signature file entry " + name ) ; } if ( sfAttr != null ) { //sun.misc.HexDumpEncoder hex = new sun.misc.HexDumpEncoder(); //hex.encodeBuffer(data, System.out); // go through all the attributes and process *-Digest entries for ( Map . Entry < Object , Object > se : sfAttr . entrySet ( ) ) { String key = se . getKey ( ) . toString ( ) ; if ( key . toUpperCase ( Locale . ENGLISH ) . endsWith ( "-DIGEST" ) ) { // 7 is length of "-Digest" String algorithm = key . substring ( 0 , key . length ( ) - 7 ) ; MessageDigest digest = getDigest ( algorithm ) ; if ( digest != null ) { boolean ok = false ; byte [ ] expected = decoder . decodeBuffer ( ( String ) se . getValue ( ) ) ; byte [ ] computed ; if ( workaround ) { computed = mde . digestWorkaround ( digest ) ; } else { computed = mde . digest ( digest ) ; } if ( debug != null ) { debug . println ( "Signature Block File: " + name + " digest=" + digest . getAlgorithm ( ) ) ; debug . println ( " expected " + toHex ( expected ) ) ; debug . println ( " computed " + toHex ( computed ) ) ; debug . println ( ) ; } if ( MessageDigest . isEqual ( computed , expected ) ) { oneDigestVerified = true ; ok = true ; } else { // attempt to fallback to the workaround if ( ! workaround ) { computed = mde . digestWorkaround ( digest ) ; if ( MessageDigest . isEqual ( computed , expected ) ) { if ( debug != null ) { debug . println ( " re-computed " + toHex ( computed ) ) ; debug . println ( ) ; } workaround = true ; oneDigestVerified = true ; ok = true ; } } } if ( ! ok ) { throw new SecurityException ( "invalid " + digest . getAlgorithm ( ) + " signature file digest for " + name ) ; } } } } } return oneDigestVerified ; }
given the . SF digest header and the data from the section in the manifest see if the hashes match . if not throw a SecurityException .