title: Is it possible to have SHA1-Digest in java Manifest file without actually using a key
body: <p>Currently we use jarsigner to sign our jar. We then display some SHA1-Digest values for some specific classes to prove to an external auditor that the code has not changed between releases.</p>
  
  <p>We only rely on the <code>META-INF/xxx.SF</code> file to get the digest information and we never use the <code>META-INF/xxx.DSA</code> signature block file.</p>
  
  <p>As we only need the digest calculation in our code, I was wondering if this is possible to have the <code>.SF</code> file generated with some java tool without actually using a key.</p>
  
  <p>I read <a href="http://docs.oracle.com/javase/6/docs/technotes/tools/windows/jarsigner.html" rel="nofollow">http://docs.oracle.com/javase/6/docs/technotes/tools/windows/jarsigner.html</a> but it looks like the key is mandatory.</p>