• DSA (Digital Signature Algorithm) with the SHA-1 digest algorithm. Needed for JDK 1.2/1.3 compatibility.
• In JDK 1.4+, RSA algorithm with the SHA-1 digest algorithm, or MD-5 in previous versions.

• a signature file, with a .SF extension. These are the hashes of the elements of the jar encrypted with your private key. They can be verified by decrypting with your public key.
• a signature block file, with a .DSA or .RSA extension. This is your binary public key and certificate.

jarsigner.exe theapp.jar phony

Mitch Gallant has written an essay on the differences between signtool.exe and jarsigner.exe. In java 1.2+, you use jar.exe to create the jar and jarsigner.exe to sign it. You will need to use keytool.exe either to help purchase or fake a digital code-signing certificate before you can use jarsigner.exe. Many of the parameters that jarsigner uses are the same as keytool.exe, so you may find that my keytool.exe docs are helpful.

Don’t sign jars just for the heck of it. It slows down loading because all the hashes need to be computed, every time the classes in the jar are loaded, even if you are not using the security features.

jarsigner.exe includes your code signing certificate in the jar with its public key and the digital signature vouching for it, if any from the certificate authority. Of course it does not include your private key.

When you use ant to sign jars, the command to invoke jarsigner.exe is called <signjar not <jarsigner.

Make sure you back up your .keystore files especially when upgrading your OS or Java. Otherwise you will lose your code signing certificates.

Verifying

rem verify a jar is properly signed
jarsigner.exe -verify -verbose somejar.jar

You can get hold of the public key included in a signed jar with:

Learning More