How can I validate JARs from pure Java?

"jarsigner" is just a small wrapper for a Java program that checks the jar. Inside your JDK there is "tools.jar" (usually "C: \ programs \ Java \ jdk1.6.0_13 \ lib \ tools.jar" or something like that). Within this library there is a "JarSigner" class that provides the desired capability. Just put "tools.jar" in your classpath!

Here is a sample program that demonstrates the behavior

import sun.security.tools.JarSigner;

public class TestJarSigner {

 public static void main(String[] args) {
  JarSigner signer = new JarSigner();
  signer.run(new String[] { "-verify", "tools.jar" });
 }

}

      

        
        
        
      

    

Exit:

jar is unsigned. (signatures missing or not parsable)

      

        
        
        
      

    

Sources are available if you need a deeper understanding of the signing process.