Verifying signed jar files from C
7 Message(s) by 2 Author(s) originally posted in java security
| From: pauljlucas.removethis |
Date: Sunday, January 07, 2007
|
I've a double-clickable
application (for both
Windows and Mac OS X) written
in JAVA (stored in
jar files) that uses a native launcher written in C to
start a
JVM and
run a particular class's main() contained in one of the jar
files.
I want to sign the jar files at build-time and later verify them at run-time
to ensure they have not been altered. I want to do the
verification as part
of the launcher written in C because somebody could still modify the jar
files and either leave them unsigned or resign them with his own self-signed
certificate.
I have done a lot of
Google searches and I have not been able to find any
information on doing what I want. (I only find stuff on signing applets and
verifying jar files with the jarsigner command-line tool.)
Can I do what I want and, if so, how?
- Paul
| From: Tom Hawtin |
Date: Monday, January 08, 2007
|
wrote in message:
I want to sign the jar files at build-time and later verify them at run-time
to ensure they have not been altered. I want to do the verification as part
of the launcher written in C because somebody could still modify the jar
files and either leave them unsigned or resign them with his own self-signed
certificate.
I do not follow why you want to do this. If the jar files can be altered,
why not C
object code also? If the jar files are obtained from somewhere
else, why not have a local jar that does the
signature verification?
Tom Hawtin
| From: pauljlucas.removethis |
Date: Thursday, January 11, 2007
|
wrote in message:
wrote in message:
>
> I want to sign the jar files at build-time and later verify them at run-time
> to ensure they have not been altered. I want to do the verification as part
> of the launcher written in C because somebody could still modify the jar
> files and either leave them unsigned or resign them with his own self-signed
> certificate.
I do not follow why you want to do this. If the jar files can be altered,
why not C object code also?
It's much easier to obfuscate the object code produced by a C
compiler than
it is to obfuscate the JAVA code.
- Paul
| From: Tom Hawtin |
Date: Friday, January 12, 2007
|
wrote in message:
wrote in message:
wrote in message:
I want to sign the jar files at build-time and later verify them at run-time
to ensure they have not been altered. I want to do the verification as part
of the launcher written in C because somebody could still modify the jar
files and either leave them unsigned or resign them with his own self-signed
certificate.
I do not follow why you want to do this. If the jar files can be altered,
why not C object code also?
It's much easier to obfuscate the object code produced by a C compiler than
it is to obfuscate the JAVA code.
So I just modify rt.jar to intercept classes as they are loaded. Your
system cracked in a tiny fraction of the time it took to
write it.
Tom Hawtin
| From: pauljlucas.removethis |
Date: Sunday, January 14, 2007
|
wrote in message:
wrote in message:
> It's much easier to obfuscate the object code produced by a C compiler than
> it is to obfuscate the JAVA code.
So I just modify rt.jar to intercept classes as they are loaded. Your
system cracked in a tiny fraction of the time it took to write it.
I do not see how altering rt.jar helps you. The C launcher checks that the
application's jars have not been altered even before a JVM is constructed.
- Paul
| From: Tom Hawtin |
Date: Sunday, January 14, 2007
|
wrote in message:
I do not see how altering rt.jar helps you. The C launcher checks that the
application's jars have not been altered even before a JVM is constructed.
So a malicious
cracker is free to inspect and doctor them after that...
Tom Hawtin
| From: pauljlucas.removethis |
Date: Monday, January 15, 2007
|
wrote in message:
wrote in message:
> I do not see how altering rt.jar helps you. The C launcher checks that the
> application's jars have not been altered even before a JVM is constructed.
So a malicious cracker is free to inspect and doctor them after that...
While the application is running?
- Paul
Next Message: Applet printing exception
Blogs related to Verifying signed jar files from C
General :: RE: The FONnector (tired of logging in?)
Well, let's check why your Windows
Java version has problems
verifying the root certificate.
... Once you found those
files, try (add proper paths if required):
... .exe
file: Hmmm, .exe is for windows only. You can call the
java -
jar ...
J2EE FAQ | revision 2
A suite of compatibility tests for
verifying that a J2EE product complies
... What is
JAR Java archive. A platform-independent
file format that permits
... The certificate can be self-
signed or approved by a certificate authority (CA).
...
HTTP Transport (updated)
If the SSL certificate of the server is "CArtel"
signed (ie issued by Verisign, Thawte, etc.
... for earlier versions download the full commons-ssl
JAR like below.)
... setDoVerify(true); // Do
verify DN in Cert with Hostname Protocol
...
certificate
Before adding the certificate to the keystore, keytool tries to
verify it by
... Suppose you have used the jarsigner tool to
sign a
Java ARchive (
JAR)
file.
... Given that certificate, and the
signed JAR file, a client can use the
...
Trip and Tick 2: JooJ up your project page with a Web Start demo
For this to work we gotta
sign the
jar as detailed in Web Start Developer's Guide,
... I found that the weblogs.
java.net webserver transforms XML
files somehow,
... jarsigner -certs -verbose -
verify /projects/aptframework/lib/derby.
jar ...
Monitoring and Managing JMX Instrumented Java Web Start ...
Compile the source
files above and create the InstrumentedJWS.
jar jar file.
... As I used a self-
signed certificate to
sign the application's
jar file it is
... Look at the
Java Cache Viewer and
verify that your application has been
...