java - 类在签名 Jar 文件之前找到，但不在签名之后找到

Question

我已经构建了一个 jar 文件:

[mdwilkie@cobalt ~/codesigning]$ jar tvf beforesign.jar
     0 Tue Mar 04 14:47:10 PST 2014 META-INF/
    89 Tue Mar 04 14:47:10 PST 2014 META-INF/MANIFEST.MF
   560 Tue Sep 08 08:35:48 PDT 2009 ControlPoint.class
  1190 Tue Sep 08 08:35:48 PDT 2009 Curve.class
  2367 Tue Sep 08 08:35:48 PDT 2009 CurveControls.class
  2417 Tue Sep 08 08:35:48 PDT 2009 CurveControls2.class
  4815 Tue Sep 08 08:35:48 PDT 2009 CurvePanel.class
  1186 Tue Sep 08 08:35:48 PDT 2009 Demo.class
  4108 Tue Sep 08 08:35:48 PDT 2009 DemoPanel.class
  5155 Tue Sep 08 08:35:48 PDT 2009 DisplayPanel.class
  1311 Tue Sep 08 08:35:48 PDT 2009 karst.class
  5411 Tue Sep 08 08:35:48 PDT 2009 Matrix.class

jar 文件的构造如下:

C:\Users\projects>dir curvefitting_demo
 Volume in drive C has no label.
 Volume Serial Number is 0AED-DBEF

 Directory of C:\Users\projects\curvefitting_demo

08/04/2014  01:19 PM    <DIR>          .
08/04/2014  01:19 PM    <DIR>          ..
08/09/2009  08:35 AM               560 ControlPoint.class
08/09/2009  08:35 AM             1,190 Curve.class
08/09/2009  08:35 AM             2,367 CurveControls.class
08/09/2009  08:35 AM             2,417 CurveControls2.class
08/09/2009  08:35 AM             4,815 CurvePanel.class
08/09/2009  08:35 AM             1,186 Demo.class
08/09/2009  08:35 AM             4,108 DemoPanel.class
08/09/2009  08:35 AM             5,155 DisplayPanel.class
08/09/2009  08:35 AM             1,311 karst.class
08/09/2009  08:35 AM             5,411 Matrix.class
              10 File(s)         28,520 bytes
               2 Dir(s)  160,337,125,376 bytes free

C:\Users\projects>jar cvf beforesign.jar -C curvefitting_demo/ .
added manifest
adding: ControlPoint.class(in = 560) (out= 396)(deflated 29%)
adding: Curve.class(in = 1190) (out= 732)(deflated 38%)
adding: CurveControls.class(in = 2367) (out= 1353)(deflated 42%)
adding: CurveControls2.class(in = 2417) (out= 1408)(deflated 41%)
adding: CurvePanel.class(in = 4815) (out= 2725)(deflated 43%)
adding: Demo.class(in = 1186) (out= 736)(deflated 37%)
adding: DemoPanel.class(in = 4108) (out= 2391)(deflated 41%)
adding: DisplayPanel.class(in = 5155) (out= 3170)(deflated 38%)
adding: karst.class(in = 1311) (out= 981)(deflated 25%)
adding: Matrix.class(in = 5411) (out= 3129)(deflated 42%)

C:\Users\projects>

我可以毫无错误地执行jar文件

java -jar beforesign.jar

然后，我使用从 GoDaddy 购买的证书，按照 http://support.godaddy.com/help/article/4780/signing-java-code 中的说明对 jar 文件进行签名，如下所示: (“方法 1”)。

jarsigner -verbose -keystore codesignstore -storepass password -keypass password -tsa http://tsa.starfieldtech.com/ -signedjar aftersign.jar beforesign.jar codesigncert

现在，当我尝试验证签名的 jar 文件时，我得到:

$ jarsigner -verify -verbose -certs aftersign.jar
jarsigner: java.lang.NullPointerException
$ 

和

$ java -jar aftersign.jar

[mdwilkie@cobalt ~/codesigning]$ java -jar aftersign.jar
Exception in thread "main" java.lang.NullPointerException
        at sun.security.util.SignatureFileVerifier.getTimestamp(SignatureFileVerifier.java:538)
        at sun.security.util.SignatureFileVerifier.getSigners(SignatureFileVerifier.java:481)
        at sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:225)
        at sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:193)
        at java.util.jar.JarVerifier.processEntry(JarVerifier.java:294)
        at java.util.jar.JarVerifier.update(JarVerifier.java:205)
        at java.util.jar.JarFile.initializeVerifier(JarFile.java:338)
        at java.util.jar.JarFile.getInputStream(JarFile.java:403)
        at sun.misc.URLClassPath$JarLoader$2.getInputStream(URLClassPath.java:706)
        at sun.misc.Resource.cachedInputStream(Resource.java:77)
        at sun.misc.Resource.getByteBuffer(Resource.java:160)
        at java.net.URLClassLoader.defineClass(URLClassLoader.java:266)
        at java.net.URLClassLoader.access$000(URLClassLoader.java:73)
        at java.net.URLClassLoader$1.run(URLClassLoader.java:212)
        at java.security.AccessController.doPrivileged(Native Method)
        at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:321)
        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:266)
Could not find the main class: Demo. Program will exit.

但是 Demo.class 在那里(在两个 jar 文件中):

$ jar tvf beforesign.jar
     0 Tue Mar 04 14:47:10 PST 2014 META-INF/
    89 Tue Mar 04 14:47:10 PST 2014 META-INF/MANIFEST.MF
   560 Tue Sep 08 08:35:48 PDT 2009 ControlPoint.class
  1190 Tue Sep 08 08:35:48 PDT 2009 Curve.class
  2367 Tue Sep 08 08:35:48 PDT 2009 CurveControls.class
  2417 Tue Sep 08 08:35:48 PDT 2009 CurveControls2.class
  4815 Tue Sep 08 08:35:48 PDT 2009 CurvePanel.class
  1186 Tue Sep 08 08:35:48 PDT 2009 Demo.class
  4108 Tue Sep 08 08:35:48 PDT 2009 DemoPanel.class
  5155 Tue Sep 08 08:35:48 PDT 2009 DisplayPanel.class
  1311 Tue Sep 08 08:35:48 PDT 2009 karst.class
  5411 Tue Sep 08 08:35:48 PDT 2009 Matrix.class
$ jar tfv aftersign.jar
   769 Tue Apr 08 13:31:46 PDT 2014 META-INF/MANIFEST.MF
   872 Tue Apr 08 13:32:02 PDT 2014 META-INF/CODESIGN.SF
  7304 Tue Apr 08 13:32:02 PDT 2014 META-INF/CODESIGN.RSA
     0 Tue Mar 04 14:47:10 PST 2014 META-INF/
   560 Tue Sep 08 08:35:48 PDT 2009 ControlPoint.class
  1190 Tue Sep 08 08:35:48 PDT 2009 Curve.class
  2367 Tue Sep 08 08:35:48 PDT 2009 CurveControls.class
  2417 Tue Sep 08 08:35:48 PDT 2009 CurveControls2.class
  4815 Tue Sep 08 08:35:48 PDT 2009 CurvePanel.class
  1186 Tue Sep 08 08:35:48 PDT 2009 Demo.class
  4108 Tue Sep 08 08:35:48 PDT 2009 DemoPanel.class
  5155 Tue Sep 08 08:35:48 PDT 2009 DisplayPanel.class
  1311 Tue Sep 08 08:35:48 PDT 2009 karst.class
  5411 Tue Sep 08 08:35:48 PDT 2009 Matrix.class

我使用的是java版本1.6

Answer 1

从昨天开始我也遇到了同样的问题。看起来问题出在时间戳上。尝试使用另一个时间戳服务器而不是 tsa.starfieldtech.com您可以尝试https://timestamp.geotrust.com/tsa/或http://adobe-timestamp.geotrust.com/tsa/