Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have a question :

  • Why do I need to sign a .JAR using jarsigner?
  • is there a specific reason or use of that ?
  • Same question when I tag a version on github ?
share|improve this question
    
What are you doing with the jar? –  MichaelT Nov 30 '12 at 18:48
3  
You have three questions. –  David Cowden Nov 30 '12 at 19:09
    
no it is the same question. –  Alji Nov 30 '12 at 20:53
    
@ALJIMohamed You have one question about signing a jar. You have another question about tagging a version on github. A given answer will not be applicable to both of them. The answer you have accepted does not mention github - that should be an indication it is a different question. –  MichaelT Nov 30 '12 at 21:09
    
trust me, signingis signing either it is a tag or a jar. –  Alji Nov 30 '12 at 22:22
add comment

1 Answer 1

up vote 3 down vote accepted

If you sign a JAR with your private key, you can guarantee that it comes form you -- same with a commit tag. The way this works is that you have a pair of keys: public and private. These keys decrypt each other. If you sign your jar with your private keys, others can decrypt it with your public key and since, presumably, no one has your private key, they can be pretty sure it comes from you.

Now, there is an ever cooler layer which you may or may not be interested in. Say you want to guarantee that your jar can only be used by the person you intend it for. You can first sign the jar with your private key, so that they know it's from you, then encrypt (different form signing) the jar (or message -- the more common use case for this is an email) with their public key. Now, only the person you intend the message for can decrypt it since only they have access to their private key.

This is how public/private key encryption works.

Why is this important? Some services, take the Android Play Store for example, require you to sign your jar (apk) before submitting it to add a layer of security. In the case of jars and commit messages, the code you are signing is not actually encrypted as would be the case if you're trying to send a private email. You are simply adding a virtual signature to your work generated by hashing the input jar or commit message/digest and encrypting that with your private key. Thus, no one else can generate the same signature as you (save in the extremely unlikely event of a collision).

By attaching your signature to the code, you are saying that you are responsible for it. If I somehow got a hold of the Facebook developer account for the Play Store, I can't just upload a new Facebook app update that sends me 100s of millions of users' information because I would be unable forge Facebook's signature without their heavily protected private key. It's the same idea for commit messages. You are keeping a record of who does what. You can hold people responsible and on top of that prevent unauthorized people from committing code.

share|improve this answer
    
Signing a jar has significant implications in some circumstances (the security manager behaves very different with a signed webstart and an unsigned webstart). –  MichaelT Nov 30 '12 at 19:21
    
I guess it should be added that in some cases it's required to sign your jar and register your key with some party who may be responsible for security. –  David Cowden Nov 30 '12 at 19:23
    
Personally, I would feel more confident running an unsigned webstart than a signed one. The unsigned one cannot access my files. On the other hand, I have worked with webstart applications (means of deployment for internal - one server rather than every pc) where it must be signed. –  MichaelT Nov 30 '12 at 19:32
    
True but that's a result of the security policy employed by the Java Webstart engine. You must always be aware of what assumptions others may be making simply because your code is signed. If Webstart does nothing to verify the signature such as requiring you to register with a database that Webstart consults before granting more privileges, then there isn't much point the the perceived extra layer of security. –  David Cowden Nov 30 '12 at 19:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.