title: Verifying Jar Signature
body: <p>I'm trying to programmatically verify that a jar file has not been obviously tampered with. I have 2 use cases I want to prevent.
  1) Modifications of existing classes
  2) additions of new classes in the jar</p>
  
  <p>I signed the jar using jarsigner. When I verify either of the above cases with jarsigner it works like I would expect.</p>
  
  <p>When I try to do it programmatically using the samples in 
  <a href="https://stackoverflow.com/questions/1374170/how-to-verify-a-jar-signed-with-jarsigner-programmatically">How to verify a jar signed with jarsigner programmatically</a>
  or
  <a href="https://stackoverflow.com/questions/4970016/how-to-verify-signature-on-self-signed-jar">How to verify signature on self signed jar?</a>
  however, I don't get any SecurityExceptions...or any exceptions at all for that matter. </p>
  
  <p>Not sure what I am doing wrong since those snippets seemed to work for other people. Any ideas? This is JDK 1.6 BTW.</p>
  
  <p>Edit:
  As requested below, a sample of the code...supply your own modified jar :)
  <code></p>
  
  <pre><code>    JarFile myJar;
  
      try
      {
          //Insert the full path to the jar here      
          String libPath =  ""
          stature = new JarFile(libPath,true);
  
          //Don't really need this right now but was using it to inspect the SHA1 hashes
  
          InputStream is = myJar.getInputStream(myJar.getEntry("META-INF/MANIFEST.MF"));
          Manifest man = myJar.getManifest();            
          is.close();
  
          verifyJar(myJar);
  
      }
      catch (IOException ioe)
      {
          throw new Exception("Cannot load jar file", ioe);
      }
  
  
  private void verifyJar(JarFile jar) throws Exception
  {
      Enumeration&lt;java.util.jar.JarEntry&gt; entries = jar.entries();
      while (entries.hasMoreElements())
      {
          java.util.jar.JarEntry entry = entries.nextElement();
  
          try
          {
              jar.getInputStream(entry);
  
              //Also tried actually creating a variable from the stream in case it was discarding it before verification
              //InputStream is = jar.getInputStream(entry);
              //is.close();
          }
              catch (SecurityException se)
              {
                  /* Incorrect signature */                    
                  throw new Exception("Signature verification failed", se);
              }
              catch (IOException ioe)
              {
                  throw new Exception("Cannot load jar file entry", ioe);
              }
      }
  }
  </code></pre>
  
  <p></code></p>