JAR files: Netscape signtool.exe vs Sun jarsigner.exe
M. Gallant 01/29/2001
Netscape provides the tool
signtool.exe
to archive and sign java applets and applications for web-deployment.
Sun offers similar functionality in its J2SE v1.3, but the archiving (with
jar.exe
) and signing (with
jarsigner.exe
) are performed in two separate steps.
Unfortunately, the JAR archives produced by signtool and jarsigner are somewhat different,
which causes some compatibility problems, mainly arising from the JAR file parser and
signature verification routine used by signtool.exe and jarsigner.exe.
jarsigner.exe for J2SE v1.3 supports recognition of JARs signed by
either jarsigner.exe or Netscape's signtool1.3, as discussed in the
J2SE Security enhancements and changes.
This is reflected in the fact that RSA-signed applets using either signtool
or jarsigner will work with Sun's JavaPlugin1.2.2 technology.
However, JAR archives produced by Sun's
jarsigner are not properly verified by Netscape's signtool, due to the signtool expecting a
specific order
of the manifest file in the JAR archive. This is reflected in the fact that applets signed
with Sun's jarsigner will NOT be properly recognized and verified by Netscape's signtool or
Netscape's native security manager within the Netscape browser (for Netscape 4.76 and lower;
Netscape 6+ uses Sun's JavaPlugin so there is no issue with Netscape 6).
Further,
Netscape states
that their signature file (.RSA) within the JAR archive is different
than the .RSA file generated by jarsigner.exe.
To illustrate these differences, a single class file was JAR'd and signed with
- a code-signing certificate imported in Netscape key/cert files, and signtool.1.3
classpathNN.jar
- a code-signing certificate generated in Sun .keystore and using jar.exe and jarsigner.exe J2SE v1.3
classpathsun.jar
[Note that two different code-signing certificates were used, since it is not
currently possible to port private keys (via PKCS#12) out of Sun's .keystore to Netscape or
Microsoft cryptoAPI key databases. Therefore the exact size of
of the RSA files are expected to be different, reflecting the certificate details therein.]
Comparing the order of items in the Netscape JAR with
the Sun JAR shows the different location of the manifest entry.
The contents of the manifest files are somewhat different. Note that the SHA1-Digest values
are identical, for the same j2classpath.class file:
Manifest-Version: 1.0
Created-By: Signtool (signtool 1.3)
Comments: PLEASE DO NOT EDIT THIS FILE. YOU WILL BREAK IT.
Name: j22classpath.class
Digest-Algorithms: MD5 SHA1
MD5-Digest: 2uS+aWIjoPfNcJVjcyoNKQ==
SHA1-Digest: FCu/IyG4goEMvGIyPowtnpANIJM=
Manifest-Version: 1.0
Created-By: 1.3.0 (Sun Microsystems Inc.)
Name: j22classpath.class
SHA1-Digest: FCu/IyG4goEMvGIyPowtnpANIJM=
Attempting to verify the signatures in the JAR archives using Sun's jarsigner shows
that both are valid:
C:\Windows\DESKTOP>jarsigner -verify -verbose classpathsun.jar
139 Fri Jan 26 19:29:12 EST 2001 META-INF/MANIFEST.MF
192 Fri Jan 26 19:29:12 EST 2001 META-INF/MIGRSA.SF
3537 Fri Jan 26 19:29:12 EST 2001 META-INF/MIGRSA.RSA
0 Fri Jan 26 19:26:54 EST 2001 META-INF/
sm 1479 Thu Sep 23 01:00:00 EDT 1999 j22classpath.class
s = signature was verified
m = entry is listed in manifest
k = at least one certificate was found in keystore
i = at least one certificate was found in identity scope
jar verified.
C:\Windows\DESKTOP>jarsigner -verify -verbose classpathnn.jar
smk 1479 Sun Jan 28 11:47:44 EST 2001 j22classpath.class
250 Sun Jan 28 11:47:44 EST 2001 META-INF/manifest.mf
358 Sun Jan 28 11:47:44 EST 2001 META-INF/zigbert.sf
1207 Sun Jan 28 11:47:44 EST 2001 META-INF/zigbert.rsa
s = signature was verified
m = entry is listed in manifest
k = at least one certificate was found in keystore
i = at least one certificate was found in identity scope
jar verified.
C:\Windows\DESKTOP>
however, verifying the signed archives with Netscape's signtool v1.3
fails to properly verify the Sun archive:
C:\Windows\DESKTOP\Signing\signtool13WIN95>signtool -d cacertdb -v classpathNN.jar
using certificate directory: cacertdb
archive "classpathNN.jar" has passed crypto verification.
status path
------------ -------------------
verified j22classpath.class
C:\Windows\DESKTOP\Signing\signtool13WIN95>signtool -d cacertdb -v classpathsun.jar
using certificate directory: cacertdb
NOTE -- "classpathsun.jar" archive DID NOT PASS crypto verification.
(reported reason: Corrupt JAR file)
C:\Windows\DESKTOP\Signing\signtool13WIN95>