JAR files: Netscape signtool.exe vs Sun jarsigner.exe

M. Gallant 01/29/2001

Netscape provides the tool signtool.exe to archive and sign java applets and applications for web-deployment. Sun offers similar functionality in its J2SE v1.3, but the archiving (with jar.exe ) and signing (with jarsigner.exe ) are performed in two separate steps.

Unfortunately, the JAR archives produced by signtool and jarsigner are somewhat different, which causes some compatibility problems, mainly arising from the JAR file parser and signature verification routine used by signtool.exe and jarsigner.exe. jarsigner.exe for J2SE v1.3 supports recognition of JARs signed by either jarsigner.exe or Netscape's signtool1.3, as discussed in the J2SE Security enhancements and changes. This is reflected in the fact that RSA-signed applets using either signtool or jarsigner will work with Sun's JavaPlugin1.2.2 technology. However, JAR archives produced by Sun's jarsigner are not properly verified by Netscape's signtool, due to the signtool expecting a specific order of the manifest file in the JAR archive. This is reflected in the fact that applets signed with Sun's jarsigner will NOT be properly recognized and verified by Netscape's signtool or Netscape's native security manager within the Netscape browser (for Netscape 4.76 and lower; Netscape 6+ uses Sun's JavaPlugin so there is no issue with Netscape 6). Further, Netscape states that their signature file (.RSA) within the JAR archive is different than the .RSA file generated by jarsigner.exe.

To illustrate these differences, a single class file was JAR'd and signed with

[Note that two different code-signing certificates were used, since it is not currently possible to port private keys (via PKCS#12) out of Sun's .keystore to Netscape or Microsoft cryptoAPI key databases. Therefore the exact size of of the RSA files are expected to be different, reflecting the certificate details therein.]

Comparing the order of items in the Netscape JAR with the Sun JAR shows the different location of the manifest entry. The contents of the manifest files are somewhat different. Note that the SHA1-Digest values are identical, for the same j2classpath.class file:


Manifest-Version: 1.0 Created-By: Signtool (signtool 1.3) Comments: PLEASE DO NOT EDIT THIS FILE. YOU WILL BREAK IT. Name: j22classpath.class Digest-Algorithms: MD5 SHA1 MD5-Digest: 2uS+aWIjoPfNcJVjcyoNKQ== SHA1-Digest: FCu/IyG4goEMvGIyPowtnpANIJM= Manifest-Version: 1.0 Created-By: 1.3.0 (Sun Microsystems Inc.) Name: j22classpath.class SHA1-Digest: FCu/IyG4goEMvGIyPowtnpANIJM=



Attempting to verify the signatures in the JAR archives using Sun's jarsigner shows that both are valid:

C:\Windows\DESKTOP>jarsigner -verify -verbose classpathsun.jar 139 Fri Jan 26 19:29:12 EST 2001 META-INF/MANIFEST.MF 192 Fri Jan 26 19:29:12 EST 2001 META-INF/MIGRSA.SF 3537 Fri Jan 26 19:29:12 EST 2001 META-INF/MIGRSA.RSA 0 Fri Jan 26 19:26:54 EST 2001 META-INF/ sm 1479 Thu Sep 23 01:00:00 EDT 1999 j22classpath.class s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore i = at least one certificate was found in identity scope jar verified. C:\Windows\DESKTOP>jarsigner -verify -verbose classpathnn.jar smk 1479 Sun Jan 28 11:47:44 EST 2001 j22classpath.class 250 Sun Jan 28 11:47:44 EST 2001 META-INF/manifest.mf 358 Sun Jan 28 11:47:44 EST 2001 META-INF/zigbert.sf 1207 Sun Jan 28 11:47:44 EST 2001 META-INF/zigbert.rsa s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore i = at least one certificate was found in identity scope jar verified. C:\Windows\DESKTOP>



however, verifying the signed archives with Netscape's signtool v1.3 fails to properly verify the Sun archive:

C:\Windows\DESKTOP\Signing\signtool13WIN95>signtool -d cacertdb -v classpathNN.jar using certificate directory: cacertdb archive "classpathNN.jar" has passed crypto verification. status path ------------ ------------------- verified j22classpath.class C:\Windows\DESKTOP\Signing\signtool13WIN95>signtool -d cacertdb -v classpathsun.jar using certificate directory: cacertdb NOTE -- "classpathsun.jar" archive DID NOT PASS crypto verification. (reported reason: Corrupt JAR file) C:\Windows\DESKTOP\Signing\signtool13WIN95>