public final void verifySingleJarFile ( JarFile jf ) throws IOException , CertificateException , VerifierException { Vector entriesVec = new Vector ( ) ; // Ensure there is a manifest file Manifest man = jf . getManifest ( ) ; if ( man == null ) { throw new VerifierException ( "The JAR is not signed" ) ; } // Ensure all the entries' signatures verify correctly byte [ ] buffer = new byte [ 8192 ] ; Enumeration entries = jf . entries ( ) ; while ( entries . hasMoreElements ( ) ) { JarEntry je = ( JarEntry ) entries . nextElement ( ) ; entriesVec . addElement ( je ) ; InputStream is = jf . getInputStream ( je ) ; int n ; while ( ( n = is . read ( buffer , 0 , buffer . length ) ) != - 1 ) { // we just read. this will throw a SecurityException // if a signature/digest check fails. } is . close ( ) ; } jf . close ( ) ; // Get the list of signer certificates Enumeration e = entriesVec . elements ( ) ; while ( e . hasMoreElements ( ) ) { JarEntry je = ( JarEntry ) e . nextElement ( ) ; if ( je . isDirectory ( ) ) { continue ; } // Every file must be signed - except // files in META-INF Certificate [ ] certs = je . getCertificates ( ) ; if ( ( certs == null ) || ( certs . length == 0 ) ) { if ( ! je . getName ( ) . startsWith ( "META-INF" ) ) { throw new VerifierException ( "The JAR file has unsigned files." ) ; } } else { // Check whether the file // is signed as expected. // The framework may be signed by // multiple signers. At least one of // the signers must be a trusted signer. // First, determine the roots of the certificate chains Certificate [ ] chainRoots = getChainRoots ( certs ) ; boolean signedAsExpected = false ; for ( int i = 0 ; i < chainRoots . length ; i ++ ) { if ( isTrusted ( ( X509Certificate ) chainRoots [ i ] , trustedCaCerts ) ) { signedAsExpected = true ; break ; } } if ( ! signedAsExpected ) { throw new VerifierException ( "The JAR file is not signed by a trusted signer" ) ; } } } }
Verify the JAR file signatures with the trusted CA certificates .