Java 数字签名相关文件(MANIFEST.MF、*.SF、*.DSA)及其内容？

Question

我试图了解 jar 和 jarsigner 在 jarring up 和 sign up java code 时经历的步骤是什么，以编程方式复制这些步骤的一部分。

明确地说，我想知道 .SF 文件中到底包含什么，因为我读过许多文档，每篇文档都略有不同，一些示例:

• http://www.ntu.edu.sg/home/ehchua/programming/java/J9d_Jar.html

The digest (or hash) is computed for every file in the JAR and included inside the manifest, e.g.,

Name: Hello.class SHA1-Digest: (a 160-bit hash value for the file)

When the JAR file is signed, a signature file with extension ".SF" is created in the directory META-INF. The digest value of each file is signed (or encrypted) using the signer's private key. e.g.,

Name: Hello.class SHA1-Digest: (digest value encrypted using signer's private key)

• http://docs.oracle.com/javase/tutorial/deployment/jar/intro.html

The signature file contains digest entries for the archive's files that look similar to the digest-value entries in the manifest. However, while the digest values in the manifest are computed from the files themselves, the digest values in the signature file are computed from the corresponding entries in the manifest. Signature files also contain a digest value for the entire manifest

• 以模糊和非描述性方式处理论点的其他来源

那么嗯.. .SF 文件到底包含什么？它的条目是如何计算的？

请在发布答案之前，使用哈希计算器对其进行检查 like this如果需要的话!

Answer 1

另一方面，在 .SF 文件中，给定源文件的摘要值是源文件 list 文件中三行的哈希值。

更多信息，请看 http://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html