JAR files: Netscape signtool.exe vs Sun jarsigner.exe

Unfortunately, the JAR archives produced by signtool and jarsigner are somewhat different, which causes some compatibility problems, mainly arising from the JAR file parser and signature verification routine used by signtool.exe and jarsigner.exe. jarsigner.exe for J2SE v1.3 supports recognition of JARs signed by either jarsigner.exe or Netscape's signtool1.3, as discussed in the J2SE Security enhancements and changes. This is reflected in the fact that RSA-signed applets using either signtool or jarsigner will work with Sun's JavaPlugin1.2.2 technology. However, JAR archives produced by Sun's jarsigner are not properly verified by Netscape's signtool, due to the signtool expecting a specific order of the manifest file in the JAR archive. This is reflected in the fact that applets signed with Sun's jarsigner will NOT be properly recognized and verified by Netscape's signtool or Netscape's native security manager within the Netscape browser (for Netscape 4.76 and lower; Netscape 6+ uses Sun's JavaPlugin so there is no issue with Netscape 6). Further, Netscape states that their signature file (.RSA) within the JAR archive is different than the .RSA file generated by jarsigner.exe.

To illustrate these differences, a single class file was JAR'd and signed with

• a code-signing certificate imported in Netscape key/cert files, and signtool.1.3 classpathNN.jar
• a code-signing certificate generated in Sun .keystore and using jar.exe and jarsigner.exe J2SE v1.3 classpathsun.jar

Comparing the order of items in the Netscape JAR with the Sun JAR shows the different location of the manifest entry. The contents of the manifest files are somewhat different. Note that the SHA1-Digest values are identical, for the same j2classpath.class file: